Recommended Free Tools
The dependable way to automate a WordPress backup is to capture both the database and the site files, send copies away from the production server, keep enough historical versions for your recovery needs, and rehearse a restore. A database export alone cannot rebuild a site: it contains posts, pages, comments, users and settings, but not themes, plugins, uploads or wp-config.php.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
You can automate that process with a server cron job calling WP-CLI, a backup plugin with separate file and database schedules, a managed backup service, or a hosted WordPress plan that includes automated backups. The right choice depends on how quickly your content changes, how much server access you have, whether you run multisite or commerce, and how much restoration work you want to perform yourself.
As an Amazon Associate I earn from qualifying purchases.
What a complete WordPress backup must contain
WordPress recovery has two different parts. The database stores the structured content and configuration: posts, pages, comments, users, settings, menus and metadata. The filesystem stores the code and media that make that content usable, including themes, plugins, uploaded images and documents, and configuration files. The WordPress database handbook strongly recommends regular database backups and an additional backup before an upgrade.
A database-only dump can restore text and settings, but the site may still show a broken theme, missing images or disabled functionality. Conversely, a copy of wp-content without the database cannot restore recent orders, form submissions, edits or settings. Define the recovery set before choosing a tool.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
- Database: all WordPress tables, plus any application tables your plugins create.
- Uploads: normally the
wp-content/uploadsdirectory, including media and generated files you need to keep. - Themes and plugins: active and inactive code in
wp-content/themesandwp-content/plugins. - Must-use plugins: files in
wp-content/mu-pluginswhen your site uses them. - Configuration:
wp-config.php, server rules, custom deployment files and any environment-specific configuration required to connect to the database. - Custom root or content files: files your site or deployment process added outside the standard directories.
Also record the WordPress version, PHP version, active theme, critical plugin versions, domain name and any scheduled tasks. This inventory makes a restore reproducible even when the backup archive itself is intact.
Choose an automation method
| Method | Scheduling | What you control | Restore experience | Best fit |
|---|---|---|---|---|
| WP-CLI plus server cron | Any interval your server scheduler supports | Commands, encryption, storage, retention and alerts | Manual or scripted database and file restoration | Administrators who have shell access and want maximum control |
| UpdraftPlus | Free choices include every 2, 4 or 8 hours, daily, weekly, fortnightly or monthly; premium adds a chosen start time and incremental backups | Separate file and database schedules, remote destination and retention settings | Plugin-guided restoration, including individual components | Sites managed from the WordPress dashboard |
| Jetpack VaultPress Backup | At least daily, with additional captures after events such as publishing or theme or plugin changes; daily time can be set to an off-peak window | Service settings and restore selections rather than server scripts | One-click restoration, browsing and downloading of backup files | Owners who prefer a managed service and event-based capture |
| WordPress.com Business or Commerce | Real-time backup is included; backups are saved at least daily and can occur multiple times on high-change days | Hosted-plan settings and account access | One-click restore through the hosted service | Sites hosted on an eligible WordPress.com plan |
Confirm current features, storage destinations, multisite support and plan terms before deployment. Schedules and plan inclusions can change, and a feature advertised for one edition may not exist in another.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOption 1: automate backups with WP-CLI and cron
WP-CLI is designed to turn WordPress operations into scripts that can run from cron or a deployment pipeline. The essential database commands are wp db export and wp db dump. They read the connection details from wp-config.php; wp db dump can write to a file or standard output.
1. Prepare a protected backup location
Do not write your only copy into a publicly reachable directory under the web root. Create a directory outside the document root with permissions that allow the backup user to write but prevent ordinary web requests from reading it. Better still, transfer each completed archive to separate storage in another account or system. Keep encryption keys outside the archive directory and restrict access to the scheduler account.
2. Create a backup script
The following pattern illustrates the sequence; adapt paths, credentials and retention to your server. It exports the database, archives the files that matter, and leaves a single timestamped package for transfer.
#!/bin/sh
set -eu
SITE=/var/www/example
DEST=/var/backups/wordpress
STAMP=$(date -u +%Y-%m-%dT%H-%M-%SZ)
WORK="$DEST/$STAMP"
mkdir -p "$WORK"
cd "$SITE"
wp db export "$WORK/database.sql" --quiet
tar -czf "$WORK/files.tar.gz"
wp-content wp-config.php .htaccess
# Encrypt before leaving the server, then copy to separate storage.
# Apply your storage provider's upload command here.
find "$DEST" -mindepth 1 -maxdepth 1 -type d -mtime +30 -exec rm -rf {} ;The archive list is an example, not a universal rule. Include custom root files, server configuration and plugin-created directories that your inventory identified. If you use multisite, test the export and file set against every network site. A database command that succeeds while the file archive fails still produces an incomplete backup, so the script must exit on errors and report a non-zero status.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute3. Schedule it with cron
Edit the scheduler for the account that owns the WordPress files:
crontab -eFor a daily run at 02:15 UTC, add a line such as:
15 2 * * * /usr/local/sbin/wordpress-backup.sh >> /var/log/wordpress-backup.log 2>&1Choose a time that avoids your busiest workload, but do not assume a quiet hour is safe for every region or audience. Set the server timezone explicitly or use UTC so daylight-saving changes do not move the run unexpectedly.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
4. Transfer, retain and alert
After creating the package, copy it to storage that is independent of the live server. Apply retention there as well as locally; otherwise a compromised server can delete every generation. Encrypt in transit and at rest, rotate credentials, and avoid putting secrets in command-line arguments that may appear in process listings.
Send an alert only after the script verifies each stage: database export, file archive, encryption, transfer and an integrity check. A successful cron exit is not proof that a remote upload completed. Keep logs long enough to diagnose a missed run, but exclude database passwords and encryption keys.
Option 2: schedule backups with UpdraftPlus
UpdraftPlus exposes independent schedules for files and the database, which is useful when content changes faster than code. Its free schedule choices are every 2, 4 or 8 hours, daily, weekly, fortnightly or monthly. Premium adds a selected start time and incremental backups, so you can run a less frequent full backup while capturing changes more often.
Configure both schedules
- Install and activate the plugin from the WordPress administrator account.
- Open its settings and configure a file backup schedule and a separate database backup schedule. Do not leave either component disabled.
- Select an off-site destination and authenticate it with a dedicated account. Verify that the destination is not merely another folder on the same server.
- Set the number of retained database and file generations. Use a value that covers your expected rollback window rather than deleting every older copy after one successful run.
- Run a manual backup once, inspect the resulting components, and perform a test restoration on staging before trusting the schedule.
Incremental backups reduce repeated file transfer, but they depend on the base backup and every required increment remaining available. Treat the chain as one recovery set and test restoring from the oldest base plus its increments.
What to check before relying on the plugin
- Whether your chosen remote destination is supported by the current edition.
- Whether multisite and large media libraries are supported in your exact configuration.
- Whether the plugin can alert the right people when a scheduled job fails or storage authentication expires.
- Whether restoration can be limited to the database, plugins, themes or uploads when you need a partial rollback.
- Whether an update changes schedule behavior or retention defaults.
Option 3: use Jetpack VaultPress Backup
Jetpack VaultPress Backup automatically creates backups and provides one-click restoration, browsing and downloading of backup files. Its documented coverage includes the WordPress database, plugins, mu-plugins, themes and uploads directories, plus eligible files in the root and wp-content.
It does not copy core WordPress files, caches, logs, backup directories or some non-WordPress tables. Those exclusions matter when a site has custom application tables or server-generated files: identify those items and protect them with an additional method if they are required for recovery.
Backups run at least daily and can also be triggered by events such as publishing or theme and plugin changes. You can configure the daily backup time for an off-peak window. Before enabling the service, confirm that the event history shows successful captures and that the account can restore to the correct site.
Use the restore controls deliberately
- Open the backup activity for the site and select a timestamp before the incident.
- Review the files and database components included at that point.
- Restore to a staging location first when the site is still available, especially after a plugin or theme change.
- If production is down, record the current DNS, hosting and database state before starting a one-click restore.
- After restoration, test log-in, front-end pages, forms, media, scheduled jobs and any transaction workflow.
Option 4: WordPress.com managed plans
WordPress.com documentation updated October 1, 2025 states that Business and Commerce plans include Jetpack VaultPress Backup with real-time backup and one-click restore options. Backups are saved at least once per day and may occur multiple times in a day when many changes are made. Automated backups require Business or Commerce; other plans can export content and media manually rather than using the same automated service.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
This approach removes server-maintenance work, but it also ties backup controls to the hosted account and plan. Confirm the plan attached to the specific site, the retention and download options currently offered, and the procedure for restoring a custom domain or moving the site elsewhere.
Set frequency from your change rate and recovery target
There is no universal WordPress backup interval, retention period, recovery-point objective (RPO) or recovery-time objective (RTO). Choose them from the amount of work the business can afford to lose and the time it can tolerate being offline.
Free tools Windows power users keep installed
One-click scans. No signup required.
Estimate an RPO
RPO is the maximum acceptable age of the latest recoverable copy. A brochure site that changes once a week may accept a daily capture. A store, membership site or newsroom with continuous orders and submissions may need event-based or hourly capture so a failure does not erase a day of transactions.
Estimate an RTO
RTO is the time allowed to return to service. A one-click managed restore may meet a short RTO, while a manual database import and file transfer may require a documented maintenance window. Measure the procedure during a rehearsal instead of assuming the advertised restore control will meet your deadline.
Build a retention policy
- Keep recent copies densely enough to cover the RPO.
- Keep older daily or weekly points long enough to detect slow corruption, a compromised account or an accidental deletion discovered weeks later.
- Store at least one copy outside the production provider and protect it from deletion by the same administrator account.
- Document who can change retention and who receives failure alerts.
How to verify that an automated backup is usable
A green status message proves only that a job reported success. Verification must test the archive and the recovery process.
- Check completeness: confirm the backup contains a readable database dump and the expected themes, plugins, uploads, configuration and custom files.
- Check integrity: verify archive checksums or the storage service’s integrity report after transfer.
- Check isolation: confirm that the copy remains available if the web server, hosting account or local backup directory is deleted.
- Restore on staging: create a clean WordPress installation, import the database, restore files and apply the documented configuration.
- Validate behavior: test administrator login, permalinks, media, search, forms, scheduled events, email delivery and any commerce or membership workflow.
- Record timing: note how long each step takes and update the RTO documentation.
Perform a restore rehearsal after major hosting, domain, database or plugin changes, and at a cadence your team can sustain. Keep the rehearsal site private so restored personal or customer data is not exposed.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Restore order when a site breaks
Stop making changes to the damaged site and preserve its current state if you may need forensic information. Then follow the documented sequence:
- Provision a clean, compatible PHP and WordPress environment or a staging clone.
- Restore the required files, including
wp-config.php, themes, plugins, uploads and custom root files. If the host supplies core WordPress files, install the matching core version rather than restoring an old core directory from an incomplete archive. - Create an empty database and import the selected SQL dump. Confirm the database name, user, password and table prefix in
wp-config.php. - Update the site URL only when the domain or staging address changed. Use a WordPress-aware search-and-replace process so serialized data is handled safely; a raw text replacement can corrupt settings.
- Clear caches and rebuild generated assets only after the database and files are in place.
- Test the site privately, then switch traffic or DNS when the checks pass.
If only one component caused the incident, restore that component rather than overwriting healthy data. For example, a faulty plugin may require a plugin-file rollback while preserving newer orders in the database.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Common automation failures and fixes
The database export succeeds but files are missing
Separate database and file jobs can produce mismatched timestamps or a database-only archive. Make the workflow fail unless both artifacts exist, and include the file directories identified in your recovery inventory.
Cron runs manually but not on schedule
Use absolute paths for the PHP, WP-CLI and script binaries, set the correct working directory, and check the cron user’s permissions. Review the scheduler log and the script’s exit status. A different environment, PATH or PHP version is a common cause.
The backup fills local disk space
Compress before transfer, enforce local retention, and monitor free space. Keep enough local copies to survive a transient upload failure, but do not let old archives consume the volume needed for the next run.
Remote uploads fail after a password or token change
Alert on authentication errors, rotate credentials in a controlled window, and run a manual transfer test. Keep the previous valid copy until a new remote copy has been verified.
A restore loads pages but not images
The upload directory was omitted, placed at the wrong path, or blocked by permissions. Compare the restored file tree with the original inventory and check ownership and URL settings.
Restored pages show database or plugin errors
Check that the SQL dump and files came from compatible timestamps. Restore the matching plugin and theme versions, confirm PHP compatibility, and inspect the server error log. Do not overwrite the database repeatedly while diagnosing; make a fresh copy of the current state first.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →A multisite restore works for the network but not one site
Multisite data is shared across network tables and may also include site-specific uploads. Verify the complete network database, every uploads path, domain mapping and network configuration. Test an individual site restore only if the backup system explicitly supports that granularity.
Security and operational safeguards
- Use a dedicated backup account with the minimum permissions required to read files, export the database and write to the backup destination.
- Encrypt archives before they leave the server and protect keys separately. Treat backups as sensitive because they contain user data, configuration secrets and possibly customer records.
- Keep production and backup credentials separate. Multi-factor authentication should protect the dashboard or hosted account that can delete backup history.
- Store copies in a separate failure domain. A second directory on the same server does not protect against disk failure, ransomware or an administrator mistake.
- Document the restore owner, emergency contacts, DNS changes, database credentials, search-and-replace procedure and validation checklist.
- Review backup logs and storage usage routinely; automation without monitoring eventually becomes an unobserved failure.
A practical implementation checklist
- List every recoverable asset: database tables, uploads, themes, plugins, must-use plugins, configuration and custom files.
- Choose WP-CLI plus cron, a plugin scheduler, a managed service or an eligible hosted plan according to your access and RPO.
- Schedule database and file captures, and use event-based or more frequent capture for high-change sites.
- Send encrypted copies to storage outside the production server and set a documented retention policy.
- Configure failure alerts and verify that a real person receives them.
- Run a staging restore, time it, and record the exact order of operations.
- Repeat the rehearsal after major changes and whenever a backup system, host or domain changes.
The Bottom Line
Automated WordPress protection is complete only when it captures the database and files, keeps an independent copy, reports failures and proves that restoration works. Select the scheduler that matches your access and recovery target, then validate the result with a real restore rehearsal.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
