What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A dependable WordPress backup has two parts: a copy of the database and a copy of the files. Store both in a private object-storage bucket, keep several restore points, automate the job, and regularly prove that a backup can actually restore the site. A backup plugin such as UpdraftPlus can package the database, WordPress core, plugins, themes and uploads, send them to Amazon S3 or an S3-compatible service, schedule recurring backups and perform the restore.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What a complete WordPress backup must contain
Backing up only the uploads directory is not enough. The database contains posts, pages, users, settings, orders, form entries and plugin data; the files contain the code and media needed to run that database. If either half is missing, recovery may produce a blank, broken or incomplete site.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →| Backup component | What it contains | Why it matters during recovery |
|---|---|---|
| Database | WordPress content, users, options, metadata and data created by plugins | Restores the site’s content and configuration state |
| WordPress core | Core PHP files and the standard WordPress application | Provides the application code that interprets the database |
| Plugins | Plugin code and, for some plugins, files outside the database | Recreates site features and plugin-specific functionality |
| Themes | Active and inactive themes, templates and custom code | Restores the presentation layer and theme customizations |
| Uploads | Images, videos, documents and other files in the media library | Keeps media referenced by posts and pages available |
| Configuration | Settings such as database connection details and site-specific configuration | Allows the restored files to connect to the restored database; secrets must be handled separately and securely |
AWS guidance for WordPress similarly treats application code, themes, plugins, uploads and the database as separate protection concerns. Before choosing exclusions, identify whether your site stores media, generated files or application data outside the normal WordPress directories.
Start with an inventory of the site
Write down the current environment before configuring a backup. This record makes it possible to rebuild a compatible staging site and quickly identify changes after an incident.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
- Primary domain, alternate domains and any subdomains that host WordPress.
- WordPress version and PHP or other runtime version.
- Active and inactive plugins, themes and any must-use plugins.
- Whether the installation is a single site or a multisite network.
- Database engine and approximate database size.
- Upload volume, largest files and expected monthly growth.
- Media or assets already stored on a content-delivery or external-media service.
- Scheduled jobs, payment or checkout functions, forms, memberships and integrations that must be tested after restoration.
Record where the web root and wp-config.php reside, but do not place the file or its credentials in a public document. Note the PHP extensions and server settings required by important plugins. A restore that copies files and tables but uses an incompatible runtime can still fail.
Design the object-storage destination
Use a dedicated private bucket or container
Create a bucket dedicated to backups, or at least a dedicated prefix that cannot be confused with production media. Keep it private and disable anonymous listing and public object access. A separate destination limits the effect of a compromised WordPress account and makes retention rules easier to reason about.
Choose the region deliberately
Select a region that meets your data-residency, latency and disaster-recovery requirements. A nearby region can make routine uploads and restores faster; a different region can reduce the chance that a regional incident affects both the live site and its backups. Check whether moving data between regions incurs provider-specific transfer charges before committing.
Prefer S3 API compatibility when portability matters
Amazon S3 is the reference implementation, while many services expose an S3-compatible endpoint. Compatibility is useful only when the backup tool supports the provider’s authentication, endpoint, multipart-upload behavior and listing APIs. Test an upload and a download with the exact plugin and account you will use; a service can advertise compatibility yet differ in lifecycle, versioning or restore behavior.
| Decision axis | Questions to answer |
|---|---|
| API and plugin support | Does the tool support the provider directly or through an S3-compatible endpoint, and does its connection test pass? |
| Region and residency | Where will objects be stored, and are cross-region copies required? |
| Storage and request pricing | How are stored gigabytes, PUT and GET requests, retrieval and data transfer charged? |
| Durability controls | Are versioning, lifecycle rules, immutability or replication available? |
| Identity controls | Can you issue a dedicated least-privilege identity limited to the backup bucket? |
| Restore performance | Can the provider and network deliver the data quickly enough for your recovery objective? |
| Operational tooling | Can your plugin, WP-CLI process and monitoring tools list, upload and retrieve objects reliably? |
Enable versioning with a retention plan
Object versioning protects against accidental overwrites and some deletion mistakes, but it can multiply storage use. Decide how many historical versions you need and how long they remain before enabling automated expiration. Versioning is a safety net, not a substitute for separate restore testing or an independent copy.
Give the backup identity only the access it needs
Create a dedicated access key or role for the backup process rather than using an administrator credential. Restrict it to the target bucket and the object actions required by the tool: listing the bucket or prefix, creating objects, reading objects for restore and deleting objects only when your retention process requires deletion. Do not grant access to unrelated buckets.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Keep the bucket private, require encrypted transport, and enable encryption at rest using the provider’s managed or customer-controlled key option that fits your risk model. Store credentials in the hosting platform’s secret store or another protected mechanism. Never hard-code them in a theme, commit them to a repository or place them in a publicly readable file.
UpdraftPlus documents an option for storing remote-storage credentials outside the WordPress database through an mu-plugin configuration. That approach reduces the chance that a database export alone exposes the storage secret, but the configuration file still needs filesystem permissions and server-level protection.
Configure UpdraftPlus for Amazon S3 or compatible storage
UpdraftPlus is listed on WordPress.org as actively installed on more than 3 million websites. Its purpose is to back up, restore and migrate WordPress sites, and it supports scheduled jobs and remote destinations including Amazon S3. The following sequence keeps the backup complete and the destination private.
- Install and open the plugin. In WordPress, go to Plugins → Add New, install and activate UpdraftPlus, then open Settings → UpdraftPlus Backups.
- Open the remote-storage settings. Choose Amazon S3 when using S3, or the S3-compatible option and endpoint when using another provider. Enter the bucket name, region or endpoint details, and a path or prefix dedicated to this site.
- Run the connection check. Save the settings and use the plugin’s connection-test control. Confirm that it can authenticate, write a small object and read it back. Fix endpoint, region, policy or key errors before scheduling production backups.
- Select every required component. Enable the database, plugins, themes, uploads and WordPress core. Review any separate “other” or miscellaneous-files setting for custom directories used by your site.
- Choose sensible exclusions. Caches, debug logs, temporary exports and rebuildable files can often be excluded to reduce size, but only after confirming that no business data is stored there. Do not exclude a directory merely because its name looks temporary.
- Set local and remote retention. Keep enough complete restore points to cover the time between discovering an incident and the last known-good state. Ensure that remote deletion is not enabled until you understand how the plugin’s retention count interacts with bucket versioning.
- Run an on-demand backup. Start a manual backup, wait for each component to finish and verify that the resulting objects appear in the intended bucket and prefix. A green completion message is useful, but a test download is stronger evidence.
- Record the configuration. Document the bucket region, prefix, plugin version, schedule, retention count and the identity used. Keep the document free of secret values.
The plugin’s settings and connection-test labels can vary by version and by the selected storage provider. Treat a successful upload, listing and download as the acceptance test rather than relying on a saved settings screen.
Schedule recurring backups and automate with WP-CLI
Choose intervals by how quickly data changes
A brochure site that changes weekly may need daily database backups and less frequent full-file backups. A store, membership site or newsroom with continuous changes may need much more frequent database protection. Schedule uploads and code often enough that the maximum amount of lost work is acceptable, and run a full backup after major plugin, theme or configuration changes.
UpdraftPlus exposes scheduled backup intervals in its WordPress.org listing. Configure the schedule in the plugin first, then verify that the hosting environment actually runs WordPress cron or that a real system scheduler invokes it. A schedule displayed in WordPress does not help if cron is disabled or blocked.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Run a manual backup with WP-CLI
From the WordPress installation directory, the documented UpdraftPlus command is:
wp updraftplus backupThe UpdraftPlus WP-CLI guide documents database and file-selection flags and remote sending. With remote storage configured, it states: “By default, if set up, backups will be sent to remote storage.” Use the command’s help output on the installed version to see the exact flags available:
Free tools Windows power users keep installed
One-click scans. No signup required.
wp help updraftplus backupThat check matters because command options can differ between plugin releases. Run the command as the web-site owner or another account with the same filesystem access, and use the global --path option when invoking WP-CLI from outside the WordPress directory. Capture the exit status and log output so a scheduler can alert on failure.
Use a system scheduler carefully
A system cron entry or hosting scheduler can invoke the WP-CLI command at a fixed time, but avoid starting several full backups simultaneously. Stagger database-heavy and file-heavy jobs, set a timeout appropriate to the upload size and send failures to an alert channel. After changing credentials, the bucket policy or the plugin, run one foreground command and inspect its complete output before returning to unattended execution.
Retention, lifecycle rules and lower-cost storage
Retention should answer two different questions: how many recent restore points are needed for operational recovery, and how far back must the organization be able to investigate corruption or ransomware. Keep multiple complete restore points rather than one rolling copy. If a backup job succeeds with a corrupted database, a single-copy policy can preserve only the corruption.
Object-storage lifecycle rules can transition older objects to a lower-cost warm tier. AWS documents S3 backup tiering to lower-cost warm storage, and AWS Backup documents tiering controls. Tiering can reduce storage expense, but retrieval may take longer or cost more. Apply lifecycle transitions only after confirming the restore procedure can read that tier.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Never configure expiration solely by object age without considering versioned objects, multipart uploads and the date of the last usable restore point. Test lifecycle rules in a non-production prefix first. A rule that deletes the only copy before a weekly job has produced its replacement creates a predictable recovery gap.
Replication and geographic copies
Replication can protect against a regional outage or destructive access to the primary bucket, but it is not automatically an air-gapped backup. Deletions and encrypted or corrupted objects may replicate too. If you use replication, define which versions, prefixes and delete markers are copied, and set independent access controls and retention in the destination.
Do not confuse database retention with file retention
Some managed database services retain automated snapshots independently of your WordPress file backup. The AWS WordPress whitepaper says Aurora backup retention can be configured from 1 to 35 days for Aurora databases. That range applies to Aurora, not to every WordPress hosting stack, and it does not protect themes, plugins or uploads. Keep the database and file retention policies aligned so a database snapshot is not paired with an incompatible file set.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to restore a WordPress backup from object storage
Restore first in a staging environment whenever possible. Staging lets you discover version mismatches, broken serialized settings, missing PHP extensions and plugin conflicts without taking the public site offline.
- Prepare a clean target. Provision a server with compatible PHP, database engine, web-server settings and disk space. Install the same or a compatible WordPress version and restrict the site from public indexing.
- Install the backup tool. Install UpdraftPlus or the tool that created the archive. Configure the same object-storage endpoint and credentials, or use a separate restore identity with read access to the backup prefix.
- Locate the desired restore point. List the remote objects and select a complete set from the same backup run. Do not mix a database from one point with uploads or plugins from an unrelated point unless you understand the consequences.
- Download the archives. Retrieve the database, plugins, themes, uploads and core archives. Confirm that every archive finishes downloading and that available checksums or sizes match the remote objects.
- Restore the database. Import the selected database into the target database, preserving the table prefix and character settings expected by the configuration. If the site URL changes, perform a WordPress-aware search-and-replace that understands serialized data; never use a raw text replacement that can corrupt serialized values.
- Restore files and configuration. Extract core, plugins, themes and uploads into the target web root. Recreate
wp-config.phpwith the target database credentials and server-specific salts or settings, keeping secrets outside public paths. - Clear caches and rebuild generated data. Purge page, object and opcode caches, then regenerate thumbnails or other derived files only when required. Re-enable scheduled tasks after confirming that the restored site can run them safely.
- Test the application. Check permalinks, media, administrator and ordinary-user logins, forms, email delivery, scheduled jobs, search, integrations, checkout or other critical transactions. Review PHP and web-server logs for errors that a homepage check would miss.
- Promote or document the result. If staging passes, plan the production cutover, lower DNS or proxy caching where necessary, take a final pre-cutover backup and repeat the verification checklist. Record the exact restore point and any manual fixes.
Common failures and practical fixes
| Symptom | Likely cause | Action |
|---|---|---|
| Connection test fails | Wrong endpoint, region, key, bucket policy or clock skew | Recheck the endpoint and region, issue a dedicated key, verify bucket permissions and confirm the server clock is accurate. |
| Backup stops during uploads | Timeout, memory limit, network interruption or very large files | Increase execution limits within hosting policy, enable multipart or chunked transfer when supported, exclude only verified rebuildable files and retry from a stable network. |
| Database backup succeeds but files are absent | File components were not selected or a path was excluded | Review component selections and exclusion rules, then run a complete manual backup and inspect the remote object list. |
| Objects exist but cannot be restored | Wrong backup set, missing versions, lifecycle transition or incompatible archive | Choose a complete same-run set, retrieve the correct object version and test extraction on staging. |
| Restored site shows database errors | Incorrect credentials, table prefix, database engine or character settings | Compare the restored configuration with the database export, correct connection details and inspect the server error log. |
| Images return 404 errors | Uploads were not restored, permissions are wrong or the URL changed | Restore the uploads tree, fix ownership and permissions, clear caches and run a serialized-data-safe URL replacement if the domain changed. |
| Only the newest backup remains | Retention or lifecycle deleted older versions | Review plugin retention, object versioning and lifecycle expiration together; adjust them and create an additional verified restore point. |
Security and operational checklist
- Use a private, dedicated bucket or prefix.
- Use a least-privilege identity limited to the required bucket and object actions.
- Encrypt uploads in transit and objects at rest.
- Keep credentials out of themes, plugins, repositories and public files.
- Consider storing remote-storage credentials outside the WordPress database with a protected must-use plugin configuration.
- Enable versioning only with a documented cost and expiration policy.
- Keep more than one complete restore point and consider an independently controlled replica.
- Check that lifecycle transitions do not remove the only usable copy.
- Monitor scheduled jobs and alert on non-zero WP-CLI exit codes or failed uploads.
- Run a staging restore at a defined interval and record the observed recovery time.
- After every major WordPress, plugin, theme, PHP or hosting change, run and verify a new backup.
How to choose among object-storage implementations
Amazon S3 is a natural default when your existing operations, identity controls and monitoring already use AWS. Wasabi, Backblaze B2 and other S3-compatible services can be considered when their storage pricing, regions, lifecycle features and restore economics fit better. The correct choice is not the provider with the lowest advertised storage rate; it is the service that your backup tool can reliably write to and restore from under your retention and recovery requirements.
For each candidate, perform the same proof: create a private test bucket, issue a restricted identity, upload a representative backup, retrieve it to a clean staging site, observe the time and transfer cost, then test versioning and lifecycle behavior. Keep the implementation that meets your recovery objective without weakening access controls or making routine restores impractical.
Recommended operating pattern
For most WordPress sites, use a private, dedicated object-storage bucket in a deliberately chosen region; configure UpdraftPlus to include the database, core, plugins, themes and uploads; schedule backups at an interval matched to the site’s change rate; retain several complete restore points; and use WP-CLI or a monitored scheduler for repeatable jobs. Add versioning, lifecycle tiering or replication only after testing how each feature affects deletion, cost and restoration. The backup is complete only when a staged restore has verified the database, files and the site’s critical user journeys.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems
