Your host probably takes backups. That's not enough on its own. Host-level backups are stored on the same infrastructure as your site, a billing dispute, account compromise, or catastrophic server failure could affect both simultaneously. You need your own backups, stored somewhere you independently control, with enough retention depth to recover from infections you didn't notice for weeks. Here's a comparison of the best plugins for the job.
Most shared hosting plans retain 7 to 30 days of rolling backups. The retention window matters more than most site owners realise. If your site was injected with malware two months ago, common with SEO spam injections that don't visibly break the site, your host's one-month retention window doesn't get you clean files. Plugin-managed backups with longer retention, stored to a cloud destination you control independently of your hosting account, close this gap.
The 3-2-1 backup rule is a useful framework: three copies of your data, on two different media types, with one copy offsite. For WordPress: host-level backups (copy 1, on hosting infrastructure), plugin backup to Google Drive or S3 (copy 2, independent cloud storage), and periodic local download to your computer (copy 3). A plugin-to-cloud backup satisfies the "one offsite" requirement most sites are missing.
UpdraftPlus is the most-installed WordPress backup plugin with over 3 million active installations. The free version is genuinely capable for most single-site use cases.
Configuration walkthrough for UpdraftPlus free: install the plugin, go to Settings > UpdraftPlus Backups > Settings tab. Set Files backup schedule to "Weekly" and database to "Daily." Under "Choose your remote storage," select Google Drive and follow the OAuth authorisation flow. Click "Save Changes," then "Backup Now" to run an immediate backup and verify it appears in Google Drive. Check Settings > UpdraftPlus Backups > Existing Backups the next day to confirm the scheduled backup ran automatically.
BackupBuddy from iThemes is premium-only (~£80/year for a single site) with a strong reputation for reliability on WooCommerce stores and complex multisite installations.
BackupBuddy's value is highest for agencies and developers who regularly need to migrate sites between hosts or staging environments. ImportBuddy alone can justify the subscription cost if you're moving sites frequently.
Duplicator has a split identity: it's marketed partly as a backup plugin but excels primarily as a migration and cloning tool. The free version creates a complete site package, a ZIP of all files plus a PHP installer, that can be deployed to any server.
Use Duplicator Free for one-off site migrations or staging deployments. Don't rely on it as your scheduled backup solution unless you're on Duplicator Pro. The free version doesn't automate anything, you have to remember to create packages manually.
WPvivid is a newer entrant that has earned a strong reputation for a well-organised interface and a capable free tier that competes directly with UpdraftPlus.
WPvivid is particularly well-suited to users who find UpdraftPlus's interface confusing. The dashboard is cleaner and the restore workflow is more intuitive. If you've had frustrations with UpdraftPlus, WPvivid is the natural alternative to try before investing in premium options.
A backup you've never restored is a backup of unknown value. Backup plugins can silently fail for various reasons: cloud storage authorisation tokens expire, file permission issues prevent archives from writing completely, or large sites time out mid-backup without reporting an error. The only way to know your backup is viable is to restore it and get a working site.
Set up a local or staging environment (Local by Flywheel is free, or use a staging subdomain). Restore your most recent backup to it. Navigate the restored site, check that content and settings look correct, and verify that the database content matches what you'd expect from that backup date. Do this once when you first configure your backup plugin. Repeat after any significant change to your backup configuration or cloud storage setup.
Also verify the backup process itself periodically. Go to your remote storage destination (Google Drive, Dropbox, S3) and confirm that new backup files are appearing on schedule with the dates you'd expect. A backup process that stopped working three months ago is useless today. Set a calendar reminder to check this monthly.
HostBible takes daily automated server-level backups stored offsite, a solid safety net to run alongside your own plugin-based backups for full redundancy.
View Hosting Plans