Backup plan

What a full backup contains

• The database: a complete dump of every table, e.g. wp db export or mysqldump.
• All of wp-content: uploads, themes, plugins and mu-plugins, not only uploads.
• wp-config.php and .htaccess (or the Nginx rules). Restores stall without them.
• A DNS zone export, with registrar and DNS logins kept in a password manager.
• Mailboxes, if email is hosted on the same server. Site backups often skip mail.
• A note of the PHP version, WordPress version and plugin list (wp plugin list).

Match frequency to change rate

• Shops, memberships, bookings: database at least daily, hourly if a lost day of orders hurts.
• Sites that change monthly: daily database and weekly files is a sensible default.
• Take an on-demand backup before every update, migration, theme change or bulk edit.
• Run backups outside peak hours and read the job log to confirm they finished.

Retention and storage

• Follow 3-2-1: three copies, on two kinds of storage, with one copy off-site.
• Keep one copy with a provider other than your host, in a separate account.
• Sensible default: daily copies for 14 to 30 days, weekly for 3 months, monthly for a year.
• Keep enough history to reach back before a quiet compromise. Some go unnoticed for weeks.
• Turn on versioning or object lock so a backup cannot be overwritten or deleted early.

Lock down the backups

• Use separate credentials for backup storage, write-only for the backup job where possible.
• Encrypt backups and keep the key somewhere other than the web server.
• Print the restore steps. You may need them while the site and its email are down.

Prove a restore works

• Restore to a staging copy at least quarterly, and after any change of backup tool.
• Confirm the SQL dump imports cleanly and the uploads folder is complete.
• On a different domain, run wp search-replace with --dry-run first, then for real.
• Test logins, forms, checkout and images, and record the time to restore.
• Alert on failed or missing backups, not only on success emails.