12 Simple Steps to Bulletproof WordPress Backups

I think you’ll agree with me when I say:

It’s very hard to have 100% confidence in your wordpress backups. To know absolutely that if anything goes wrong, at any time, that your safe.

But it doesn’t have to be that way.

This guide gives you 12 simple steps that you can complete today, to ensure that your website is safe should something go wrong. We are going to show you an easy process to avoid ever losing information again.

We promise to include links to any plugins you might need and any advice we think you can’t do without and, if for some reason you would like me to take care of your WordPress website maintenance for you thats fine too! Let’s get started!

1. STOP. Run a website backup. Then,  run another

If your thinking:

but I don’t know how to backup my website

Don’t worry.

Read this guide before doing anything else to your website and you will have a bulletproof system for keeping your website safe.

If you are a reader who already has some kind of backup system in place for their website but wants to learn a bit more, then great. Please go to your website now and ensure you run a full backup of your site, then, run another one. Keep one on your server and download one of them to your computer or a third party location like Dropbox.

Done? Great, let’s get to it

We have just learned the key and probably the most single important rule of backing up a website.

If you are altering any critical files, changing structure or doing anything time intensive or with far reaching repercussions if something goes wrong, run a backup first.

The rules change a little between when you are working on your own site and when you are working on a client’s site. Although it is good practice to backup any site before working on it, the repercussions are different when working on a client site. When I log into a client website before I literally do anything at all I run a backup, not only does this give me a savepoint it is also proof of the condition of the site when I first logged into it.

We are only human

Sometimes the best of us press the wrong key, clicks on the wrong button or simply has a moment of questionable sanity. The peace of mind that comes from having a backup you made 2 minutes before you accidentally deleted every post on a website is invaluable. Frequent backups will prevent loss of time, money and prevent getting shouted at by your client or colleagues. If in doubt back it up!

Recommended WordPress backup plugins:

Backup plugins provide an easy to use interface for those who are less ‘techy’ and don’t understand working server side. For those of us that are techy and do understand working on a server, backup plugins provide valuable insurance in terms of having scheduled multiple backups. Either way, having a reliable backup plugin on your WordPress website is a no-brainer.

Not sure what plugin to use?

There are loads of plugins out there and it can often be difficult to work out which one is reputable, reliable and provides the functions that you may want and need. Largely finding the right plugin is trial and error but there are some shortcuts you can use to find the right one.

Use these shortcuts to find a reputable WordPress backup plugin

Always look at the ‘number of installs’. A larger number is generally better. Look at when the plugin was last updated. More recent is better. Lastly look at if the plugin is reviewed highly and by a large number of people.

Use your intuition

Find what you think is a good balance between these statistics and that will be your plugin of choice. Click on ‘install now’, activate it and run a backup. The instructions for doing this will vary based on your chosen plugin and information will be available from that plugin provider by clicking on ‘more details’.

We use WP All in one migration on most of our client sites and have found it really useful for not only backing up to file and Dropbox ( a cloud storage service ) but also for scheduling and restoring backups as and when needed. Updraft plus is also really popular.

2. Keep your website software, plugins or modules updated

So, what can you do?

Quite simply you can either manually or automatically keep your WordPress core and your WordPress plugins updated. You can do this yourself or you can employ a third party to do this on your behalf.

Stick with us and we will show you exactly how to backup your site and what resources you may need.

Want some extra reading?

It is always useful to stay up to date with security practices and other relevant information. You can do that by keeping an eye on the WordPress news blog and also by looking at a leading company who operate WordPress security plugins, like the Wordfence blog.

3. Maintain backups of both the WordPress files and WordPress database

If you’re thinking…

This is going to be difficult, here comes the jargon. I won’t be able to do this…

You can do this!

We will walk through some really simple steps with pictures and notes so that in about ten minutes time you will know exactly how to do these things for yourself.

Some WordPress plugins such as WP All in one migration, for example, may run a complete all in one backup which includes both a copy of your website files and also a copy of the WordPress database. These backups are normally intended to be imported by the same plugin if everything goes wrong or if you simply want to roll back to a point before you made a mistake or deleted some content you wanted to keep.

What’s the catch?

Plugins do occasionally experience problems, errors, vulnerabilities etc. That is one of the reasons why I advise that you not only use a plugin to run a backup on some kind of schedule but that you also run server-side backups of both your files and your database manually.

If for some reason your plugin created backup fails or becomes corrupted you have an alternative method of recovery to attempt. It may just prevent you pulling all your hair out or throwing the computer out the window.

Let’s do this together

Firstly let’s take a backup of your database. My assumption here is that you are using the industry standard software on your server which is CPanel. CPanel, simply put is the web hosting industry’s most reliable, intuitive control panel and has been in use since the late 1990’s. It is the most likely bit of software you will find that gives you access to managing your server.

Now:

We are nearly done.

Next, we need to download a copy of the physical files on your server. Both the database backup you made a moment ago and the files are needed to be able to restore your site if something goes wrong.

Well done!

If you have followed the steps above you now have a backup of your WordPress database and you have a backup of your website files. Already you are in a much better situation than you were when you started following this guide.

Whatever happens now, you have a way to restore your website.

Not only that

You have done the hardest part of backing up a website. From here on in everything gets much easier!

4. Maintain website backups at a frequency which reflects the value of your site

You’ve got a plugin and some backups. What now?

Set a backup schedule that is proportionate to the importance of either the data, or the function of your site. The higher the level of importance and or value, the more frequent your backups should be.

So, what does this mean for you?

This is quite subjective and your chosen backup frequency may be monthly, weekly, daily or even hourly. This is down to you and how much time/data you are willing to lose if everything goes badly wrong and your website blinks out of existence.

Backup frequency is set by how much data, reputation or income you are willing to lose

It isn’t a frequent occurrence for a website to just disappear but it can and does happen and you can rest assured that it will be when you least want it to happen.

Sometimes, despite the best care plan being in place if an individual is intent on breaking into your site and damaging it then they will achieve it.  Pretty much like house security, we can reduce the risks of burglary but if someone really wants to get in they are going to. The same goes for websites.

How can you actually use this?

To get a quick answer to how often you should backup and maintain your site you can use this useful infographic:

5. Maintain as many backups as you can. Going as far back as you can

Why does this matter?

What’s the real story?

It is not unheard of for a website to become defaced, deleted or damaged from a vulnerability that was present 6 months before. The hacker may have left malicious code sitting in your database for many months before exploiting it. There is no point restoring a backup that has this vulnerability or malicious code in it and as such you need to roll back to a date that predates that vulnerability.

You did keep those backups, right?

When backing up our client sites we keep multiple copies in multiple unconnected locations which stretch back between 6 months and a year. More in some cases depending upon what was agreed with that particular client and in line with the profile and value of that site.

6. Keep your backups in multiple physical and cloud locations

You might be wondering:

How do I keep my website backups safe from accident, disaster and failure?

If you are a business with buildings in multiple locations this is as straightforward as mirroring your data to multiple locations over the web and by supplementing with professional backup services/cloud services.

Here’s what we do:

When we back up our files or those of clients we ensure we keep multiple copies of those files.

Technology is flawed because it is built by humans. Sometimes a hard drive will fail. It may be a raid array with mirroring and both volumes may corrupt or fail at the same time. Often drives in raid arrays are purchased out of the same batch and bought and fitted at the same time. As the drives experience the same environment and stress it is not unknown for those drives to fail simultaneously.

7. Keep any backup drives physically secured

8. Keep data encrypted

If someone does steal your data what will they have access to? Your client data, accounts, security information? Make sure your backups are encrypted to a recognised standard. Many computers and network drives support this with built in software these days and it may be as simple as putting a tick in a box.

Don’t let anyone access your clients/customers data if they steal your drives. That goes for laptops and thumb drives etc. too.

9. Ensure your backups are secure physically and are scanned frequently

10. Keep at least one backup which is not network connected or mapped to any computers

In these days of ransomware, it is also advisable that you have a backup which is not mapped to any of your computers. When you map a network drive to a computer you put a log in and password into your computer that gives it access to that drive. Should you fall foul of ransomware that login and password can then be used by the ransomware to encrypt your mapped drives.

We have backup volumes which are on the network but not mapped to any computers for access. This helps give you some degree of protection if one of your PC’s is compromised and has logins and passwords for all the drives mapped to it. We also have backups which aren’t connected to our network at all and this kind of isolation is the holy grail of guarding against volume encryption by ransomware.

If the worst happens and your computers are attacked and encrypted you could in theory junk all those hard drives and restore all your information from your non-network connected backups.

11. Have a plan in place (which you have rehearsed) to recover your website

Literally, mirror your site to a subdomain or run a copy locally on your computer using WAMP (Windows) or MAMP (mac) and practice restoring a backup. See what works, what doesn’t and it will give you a good learning experience.

It is a good idea to document the process and produce a flowchart of tick list of items specific to that particular website just in case there are any unique issues or considerations to take into account that you may not worry about on other sites. If you’re ill then one of your colleagues can carry out the same process with the benefit of your learning.

12. Don’t ignore your systems

Put all these systems in place and periodically (as in putting it in your calendar as a recurring event) check that your backups are actually being saved, that they are actually being backed up to your alternate locations and that your backups actually work and are not corrupted. Try restoring one to a local copy of your website to ensure your backups are effective.

Many years ago before I maintained websites on behalf of other people I found out by pure chance that my backup NAS had turned off 6 months beforehand. It made me feel nauseous and as a result, I set up all manner or checks and notifications to ensure it never happened again. Always a good idea to have your NAS send you an email after a successful backup routine has run or on any errors or problems. You can get your website or server to do this for you using a plugin or a cron job on your server. You won’t regret it.

Thanks for reading this blog post about WordPress Backups. The above steps are easy to follow but if you don’t have the time, or you would rather someone else do this work for you then please give Paul a call on 01903 527927 and we can get your site backed up right now and keep your site updated and cared for moving forwards.

Thanks for your time.