WordPress Backup — UpdraftPlus, ManageWP and Offsite for Data Safety

Why a WordPress site without offsite backup is a real risk?

Imagine waking up to find your site offline. A failed update, an attack, or a hosting error. Without a recoverable backup stored outside your server, that day becomes a total loss. We see it every year on dozens of projects coming in: clients who have a backup — yes — but stored on the same server that went down. It's like locking your money in a safe inside a bank that's on fire. Local server backups don't exist: if the server dies, they die with it.

An offsite backup — on Google Drive, Dropbox, Amazon S3, or another cloud service — is your only real guarantee. And it's not enough to just have it: you must test it. A broken backup is worthless. At Meteora Web, we start from this principle: a backup is not optional, it's an insurance policy on your revenue. We come from accounting — we know the cost of a single day offline. That's why we focus on what actually works, not on what looks cool.

In this guide we'll show you how to use UpdraftPlus and ManageWP for automatic, offsite backups. Two tools we use daily on real projects. No abstract theory: concrete steps, working code examples, and a checklist you can execute today.

How does UpdraftPlus work for automatic WordPress backup?

UpdraftPlus is a WordPress plugin. Not the only one, but the one we rely on most because it's reliable, has a full-featured free version, and integrates with all major cloud services. It doesn't try to make you rich with a fancy UI — it just does its job. And when a plugin works without hiccups for years, that's gold to us.

Installation and basic setup

1. Go to Plugins > Add New. Search "UpdraftPlus". Install and activate.
2. Go to Settings > UpdraftPlus Backups.
3. In the "Backup Settings" section, choose your frequency: for sites that change daily, a daily backup of files and database. For brochure sites, weekly might be enough.
4. Choose how many backups to keep. We recommend at least 4: gives you both a recent and an older restore point.

Common mistake: setting hourly backups because "it doesn't cost anything". In reality, it fills storage and slows the server. Be realistic. If you post one article a week, a weekly backup is perfect.

Example of WP-CLI automation (for advanced users)

If you manage your site from the command line, you can automate backups without touching the UI. We do this for clients on VPS: a cron job that triggers UpdraftPlus from terminal.

# Run a full backup via WP-CLI using UpdraftPlus
wp updraftplus backup

# Check status
wp updraftplus status

# Integrate into a cron job
0 3 * * * /usr/local/bin/wp updraftplus backup --path=/var/www/yoursite --allow-root >/dev/null 2>&1

This runs a full backup every night at 3 AM. Then, if you've configured remote storage, UpdraftPlus moves it offsite automatically.

What's the difference between UpdraftPlus and ManageWP for multiple sites?

The choice depends on how many sites you manage. UpdraftPlus is perfect for a single site or a few. Install it on each domain, configure once, and it works. Its premium version adds incremental backups and storage on Google Drive, Dropbox, S3, OneDrive, SFTP. The free version already supports some of these, but premium unlocks everything.

ManageWP is different. It's a cloud platform that aggregates management of multiple WordPress sites from one dashboard. It doesn't replace UpdraftPlus — it integrates with it. With ManageWP, you can back up all your sites from one place, with offsite storage on Google Drive, Dropbox, Amazon S3. It also offers bulk updates, uptime monitoring, SEO reports. If you have 5, 10, or 50 sites, ManageWP saves you hours every month.

When to use what? If you run a single WooCommerce store, UpdraftPlus is enough. If you manage client sites, an agency, or a network, ManageWP is the right choice. We use ManageWP for subscription clients: automated backups, monthly reports, and a single access point. But note: ManageWP has a cost, though reasonable. The basic plan starts at a few euros per month per site, but for offsite backups you need to enable the add-on.

How to configure offsite backup on Google Drive, Dropbox, or S3?

This is the core of protection. Without offsite, a backup is useless. Here are the three most common methods, starting with the simplest.

Google Drive with UpdraftPlus Premium

1. Install and activate UpdraftPlus Premium.
2. Go to Settings > UpdraftPlus Backups > "Settings" tab.
3. Under "Choose your remote storage destination", select Google Drive.
4. Click "Connect to Google Drive". Authorize UpdraftPlus to access your account. Create a dedicated folder (e.g., "ClientX Site Backup").
5. Save settings and run a test backup: click "Backup Now" on the main tab.
6. Go to Google Drive and confirm the files are there.

Pro tip: use a dedicated Google account for backups, not your personal one. That way, if you change management, you don't lose access to the data.

Amazon S3 (or compatible services like DigitalOcean Spaces)

UpdraftPlus supports S3 natively. You need a bucket on AWS S3 (or DigitalOcean Spaces). You'll need Access Key and Secret Key.

1. In UpdraftPlus remote settings, select "Amazon S3".
2. Enter your IAM credentials with permissions limited to that specific bucket. Never use the root key.
3. Specify the bucket name and region (e.g., eu-west-1 for Ireland, low latency for Europe).
4. Save, run a test backup, and verify in the S3 Console that the files arrive.

Watch out for S3 costs: storage is cheap (pennies per GB/month), but API requests (PUT/GET) can add up if you back up frequently. For normal sites, the cost is negligible. For large volumes, consider storage classes like S3 Glacier Deep Archive for historical backups.

Dropbox: minimal and works

UpdraftPlus supports Dropbox natively. Same procedure: select Dropbox, authorize, create a folder for backups. Dropbox isn't built for heavy loads, but for small/medium sites it works great. We use it for clients who want a hands-on view of their backups.

How to test a WordPress backup without risking the live site?

This is the step almost everyone skips. An untested backup is a gamble. We have a rule: every backup must be restored at least once on a staging environment before you can sleep soundly.

Method with UpdraftPlus: restore on a subdomain

1. Prepare a test subdomain (e.g., test.yoursite.com). Install a fresh WordPress on that subdomain.
2. In UpdraftPlus, go to "Existing Backups". Find the backup you want to test. Click "Restore".
3. Select all components (plugins, themes, uploads, database).
4. UpdraftPlus will ask where to restore. Choose the database of the subdomain. Critical: make sure the wp-config.php of the subdomain points to a different database than the live one. Otherwise you'll overwrite it.
5. Once done, visit test.yoursite.com. Do pages load? Do logins work? Are WooCommerce products visible? Do images display? If yes, the backup is good.

WP-CLI automation script for staging test:

# Dump live DB to staging DB
wp db export /tmp/live.sql --path=/var/www/live
wp db import /tmp/live.sql --path=/var/www/staging

# Replace live URL with staging URL
wp search-replace "https://yoursite.com" "https://staging.yoursite.com" --path=/var/www/staging

# Now manually restore the UpdraftPlus backup on staging via plugin.

You don't need to become a bash ninja: a manual test on a subdomain already works and will save you when it really matters.

Backup and security: what everyone forgets

At Meteora Web, we work on cybersecurity every day. Backups are part of the defense, but be careful: a backup saved on a server that gets compromised can be infected too. Here are the rules we apply:

• Always offsite. Never on the same server.
• Encrypted storage. UpdraftPlus can encrypt the backup with a password. Enable it. If the cloud is breached, the file remains unreadable.
• Rotation. Don't keep every backup forever. Delete old ones. We recommend 4-8 rotating backups per site, plus one weekly snapshot kept monthly.
• Integrity check. UpdraftPlus has an option to test the backup after upload. Use it.
• Isolate credentials. The S3 API key or Google Drive token shouldn't be exposed in public files. UpdraftPlus stores them encrypted in the database, but if the site is hacked, an attacker might decrypt them. Use an hosting environment with a read-only wp-config.php or restrict file permissions.

For more on CMS security, check out our pillar guide on WordPress security.

What to do right now

Don't postpone. Backups are boring until you need them. Then they become the only thing that matters. Here are the steps to execute today:

1. Install UpdraftPlus (free) and configure it for daily file and database backups.
2. Connect an offsite service: Google Drive, Dropbox, or S3. The free version already supports some services.
3. Run a test backup and confirm files arrive at the destination.
4. Test a restore on a staging subdomain. Don't skip this step.
5. If you manage multiple sites, evaluate ManageWP to centralize backups, updates, and monitoring.
6. Enable encryption if the plugin supports it.

A backup isn't an expense. It's an investment in your business continuity. We know this because we live it every day with our clients — from small artisans to SMEs in Southern Italy who deserve top-tier technology.