On This Page: [hide]
Kinsta’s backup documentation contains one sentence most of its customers have never read. “Each backup is stored on the same host machine as your site.” Kinsta is a well-regarded managed host, and that line is not a scandal. Same-machine snapshots are the industry norm, and they restore fast. But it means the copy you’re counting on lives on the machine you’re protecting yourself from.
Quick answer: Run two layers. Install UpdraftPlus or WPvivid free, then schedule a push to Google Drive, Dropbox or Amazon S3. That takes about ten minutes. Leave your host’s backups on as the fast rollback option. Running a store? Neither layer is enough alone, and you want real-time backups from Jetpack VaultPress at USD 119.40/year or BlogVault at USD 499/year.
Last reviewed: August 2026. Prices, install counts and plugin versions verified against official sources this month.
What a WordPress Backup Actually Contains
A WordPress site is two things stuck together. A backup that only grabs one of them is useless. There’s the file side and the database side.
The files sit in your web root. That means WordPress core, everything in wp-content, plus wp-config.php and .htaccess. Inside wp-content live your themes, your plugins, and the uploads folder holding every image you’ve ever added. The database holds your posts, pages, comments and users. It also holds every setting each plugin has ever saved.
Restore files without the database and you get a working WordPress install with no content. Restore the database without the files and your content points at themes and plugins that aren’t there.
Two files break restores more often than anything else. wp-config.php holds your database credentials and security salts, and it’s specific to the server it was written for. .htaccess holds your permalink rules and any redirects you’ve built up. Some backup tools skip both by default, on the theory that you’ll regenerate them.
One thing WordPress itself will not do for you: back up the site. Core has had a rollback feature since 6.3. It stashes a copy of a plugin or theme in wp-content/upgrade/temp-backup before updating. If the update fails, the old version goes back. That’s useful, and it saves sites from white screens. It is not a backup. It covers one plugin for the length of one update. It does nothing for your database, your uploads, or a site that got hacked. WordPress 7.0 shipped on 20 May 2026 and 7.1 followed on 19 August 2026. Neither added native site backups.
How We Picked and Verified These Tools
Every install count and rating here comes from the WordPress.org plugin API, queried on 31 August 2026. None of it comes from vendor marketing pages. Every price was read off the vendor’s own checkout the same day. Two of them, Duplicator and UpdraftPlus, were loaded in a real browser. Both inject prices with JavaScript and hand a plain fetch a blank page.
Our exclusion rules were blunt. We dropped any plugin whose last WordPress.org update predates the May 2026 release of WordPress 7.0. A backup tool untested against current core is a liability, not a safety net. We dropped anything you can no longer buy as a standalone product, which is how BackupBuddy left this list after fifteen years. And we ignored “unlimited storage” claims unless the vendor states retention in days. Storage you can’t recover from three weeks ago is marketing, not insurance.
Weighting reflects what actually goes wrong. Offsite storage counted most, because a backup on the same disk as the site fails the one scenario backups exist for. Restore capability came second, judged on what each vendor documents. Three questions there: is restore in the free tier, does it work from a dashboard outside the site, and how far back can you reach. Price counted third, measured at renewal instead of year one.
What we did not do: run restore tests on all five tools ourselves, or measure backup speed on a live site. No timing figure in this guide comes from our own stopwatch. Where we describe how a tool behaves under load, it comes from vendor documentation rather than our own testing, and it’s labelled as such.
UpdraftPlus: The Free Default, on One Condition
Free | Premium USD 70/year for 2 sites | 3M+ active installs | 96/100 from 8,633 ratings
Start with the uncomfortable part. In June 2026, UpdraftPlus shipped a fix for CVE-2026-10795. It was an unauthenticated authentication bypass rated CVSS 8.1, affecting every version up to and including 1.26.4. An attacker who never logged in could forge commands and run them as your administrator. In practice that means uploading a plugin of their choosing. TeamUpdraft published the patch on 5 June 2026 in versions 1.26.5 free and 2.26.5 premium. The CVE record went public on 11 June 2026.
Here’s why that matters more for a backup plugin than for most others. A backup plugin runs with full read access to your database and files. It also stores the credentials for wherever you send those files. Compromise it and you don’t just get the site. You get the archive of the site, plus a key to the Dropbox account holding it.
So treat backup plugins as the highest-value target on your install. Turn on automatic updates for this one specifically. Our guide to testing your WordPress site security covers how to check whether an older version left anything behind.
The current version is 1.26.7, released 21 August 2026 and tested against WordPress 7.1. Update and move on, because the free tier is still the sensible starting point for most sites. It runs scheduled automatic backups. It restores from inside the dashboard. And it ships free connectors for Google Drive, Dropbox, Amazon S3, Rackspace, FTP, DreamObjects, OpenStack Swift and email.
Where the free tier stops is worth knowing before you install it. OneDrive, SFTP, WebDAV, SCP, Google Cloud, Backblaze and pCloud are all Premium. So are incremental backups, automatic backups before updates, multisite support and database encryption. That last group is the real argument for the USD 70. Incremental backups are the one most people feel. A full nightly copy of a 4 GB site chews through your server’s CPU and your Drive quota.
Compare storage options directly and UpdraftPlus loses to a free competitor. WPvivid hands you Microsoft OneDrive, SFTP and DigitalOcean Spaces at no cost. UpdraftPlus puts all three behind a USD 70 paywall. That’s three destinations for zero against three destinations for seventy.
Pros
- Free tier includes scheduled backups and restore, not just export
- Largest user base of any backup plugin at 3 million installs
- Eight free remote storage destinations
- 14-day money-back guarantee on Premium
Cons
- Shipped a CVSS 8.1 auth bypass in June 2026
- Incremental backups are Premium only, so free users run full copies
- No published renewal price, so year-two cost is unconfirmed
Pricing: Free forever, with no feature timer. Premium Personal costs USD 70/year for 2 sites. TeamUpdraft’s checkout applies local VAT, so an Irish visitor sees USD 86.10 for that plan. A “Show prices without VAT” toggle sits on the pricing page. UpdraftPlus advertises a renewal discount but publishes no renewal figure, so budget the full USD 70 for year two.
Best for: Anyone who wants working offsite backups today without opening a wallet.
Skip if: You manage more than two sites and won’t pay, since Premium’s site limits bite fast.
Verdict: Install UpdraftPlus free, update to 1.26.7, and enable automatic updates for it. Pay the USD 70 only for incremental backups or automatic pre-update snapshots. If your reason for upgrading is OneDrive or SFTP support, don’t pay it. WPvivid gives you both for nothing.
WPvivid: The Free Tier That Out-Specs a Paid One
Free | Pro available | 900,000+ active installs | 98/100 from 1,536 ratings
Most people have never heard of WPvivid. Its free tier quietly does things its better-known rival charges for. Free WPvivid connects to Dropbox, Google Drive, Amazon S3, Microsoft OneDrive, DigitalOcean Spaces, FTP and SFTP. Scheduled backups are free. Restore is free. Migration to a different host is free, with no site-size ceiling.
Put that against UpdraftPlus and the gap is specific rather than vague. Both give you Dropbox, Drive, S3 and FTP at no cost. WPvivid adds OneDrive, SFTP and DigitalOcean Spaces on top. UpdraftPlus charges USD 70/year for those same three. For a developer backing up to SFTP on a box they already own, WPvivid free replaces a USD 70 subscription outright.
Its rating backs that up: 98 out of 100, two points above UpdraftPlus. That comes from 1,536 ratings rather than 8,633, though. Smaller sample, so read it as encouraging rather than conclusive. Version 0.9.133 landed on 27 August 2026 and tests against WordPress 7.1.
Pro exists and covers incremental backups, database encryption, multisite and white labelling. It adds four more storage providers: Wasabi, pCloud, Backblaze and WebDAV. The pattern will look familiar by now. Incremental backups are the paid feature in this category, across every tool here.
The honest weakness isn’t technical. It’s institutional. WPvivid is a small team with a fraction of TeamUpdraft’s support footprint. When a restore goes wrong at 2am, the size of the community answering questions matters. There’s also no version 1.0 after years of development, which bothers some buyers more than it should.
Pros
- Seven free storage destinations, including OneDrive and SFTP
- Free migration with no size limit
- Rated 98/100, above UpdraftPlus
- Staging built into the same plugin
Cons
- Much smaller support community than UpdraftPlus
- Incremental backups and encryption are Pro only
- Still on a pre-1.0 version number after years of releases
Pricing: The free tier covers everything described above, with no time limit and no site cap. Pro is annual, with a 30-day money-back guarantee:
- Blogger: USD 49/year, 2 domains
- Freelancer: USD 69/year, up to 10 domains
- Small Business: USD 99/year, up to 50 domains
- Ultimate: USD 149/year, unlimited domains
Two numbers there deserve a second look. Freelancer covers 10 sites for USD 69, undercutting UpdraftPlus Premium Business by roughly USD 26 for the same site count. And that 30-day refund window is more than double the 14 days offered by both UpdraftPlus and Duplicator. That matters for a product you can’t properly judge until you’ve restored from it once.
Best for: Anyone whose preferred storage is OneDrive, SFTP or DigitalOcean Spaces.
Skip if: You want the largest possible community to search when a restore fails.
Verdict: Choose WPvivid over UpdraftPlus free when your storage sits on the premium side of UpdraftPlus’s line. That saves USD 70 a year for the same job. On paid tiers it wins on raw value too: Small Business covers 50 domains for USD 99. Pick UpdraftPlus instead if a 3-million-install community and years of answered forum threads beat three extra connectors.
Duplicator: Excellent at Moving, Wrong Tool for Nightly Backups
Free | Pro from USD 69.30/year introductory, USD 99 at renewal | 1M+ installs | 98/100 from 4,929 ratings
Duplicator doesn’t actually compete with UpdraftPlus. Treating it as a backup plugin is the most common mistake people make with it. It’s a migration and cloning tool that happens to produce a file you can restore from. That distinction decides whether you should install it.
The free version makes the point clearly. It creates backups manually, stores them on your own server, and packages a site into an installer you drag to a new host. What it won’t do for free: run on a schedule, or send anything to cloud storage. Scheduled backups, cloud destinations, one-click recovery points, multisite and staging are all Pro. A free Duplicator backup sitting on the same server as your site fails the basic test this guide is built around.
Where it earns its place is a host move. Duplicator’s installer handles the search-and-replace of your old domain across the database. That’s the step people get wrong by hand. Our guide to free WordPress migration services covers hosts that will do this for you at no charge, which is often the better answer.
Now the pricing, because it needs saying plainly. Duplicator’s page carries this footnote in small type: “Special introductory pricing, all renewals are at full price.” Basic is advertised at USD 69.30 against a USD 99 list price, so you pay 1.43x in year two. Plus is worse. It runs USD 99.50 introductory against USD 199 list, a flat doubling. Pro runs USD 159.60 against USD 399, a 2.5x jump. Elite matches that multiplier at USD 239.60 against USD 599.
Set that against the alternatives at renewal and the case narrows. Duplicator Plus costs USD 199 in year two for 5 sites. BlogVault Personal is USD 99 flat for 1 site, with real offsite storage and 30-day retention. UpdraftPlus Premium is USD 70 for 2 sites. So Duplicator Basic’s USD 99 renewal buys 2 sites, matching UpdraftPlus at 41% more money. UpdraftPlus also includes incremental backups that Duplicator Basic does not.
Pros
- Best-in-class host-to-host migration with automatic URL rewriting
- Highest rating in this guide at 98/100 from 4,929 ratings
- Free tier handles a one-off move at no cost
- 14-day refund window
Cons
- Free version has no scheduling and no cloud storage
- Renewals run at full list price, up to 2.5x year one
- Users report renewal notices that omit the new price
Pricing: The free tier covers manual local backups. Pro is annual, with a 14-day money-back guarantee:
- Basic: USD 69.30 first year, then USD 99 (2 sites)
- Plus: USD 99.50 first year, then USD 199 (5 sites)
- Pro: USD 159.60 first year, then USD 399 (20 sites)
- Elite Bundle: USD 239.60 first year, then USD 599 (100 sites)
Best for: Moving a site between hosts, or cloning production to staging.
Skip if: You want scheduled offsite backups, which is what most people arrive here for.
Verdict: Buy Duplicator Pro if migrations are recurring work, where the 20-site tier spreads that USD 399 renewal across real client billing. For scheduled nightly backups on one site, don’t. UpdraftPlus Premium does that job for USD 70 against Duplicator Basic’s USD 99 renewal, and does it incrementally.
Jetpack VaultPress Backup: Real-Time, Priced by Storage
USD 119.40/year for 10 GB | USD 14.95 billed monthly | Built by Automattic
Every other tool in this guide takes a snapshot on a timer. Jetpack VaultPress Backup records changes as they happen. That sounds like marketing until you own a shop. Picture a nightly backup running at 3am and a database corruption at 8pm. You’ve lost seventeen hours of orders, and those orders are money customers already paid you. Real-time backup means the recovery point is seconds old, not hours.
Backups go to Automattic’s own cloud. Not to your server, and not to a Drive folder you manage. Restores run from a web dashboard that keeps working when your site does not. That’s the scenario that matters. A backup plugin living inside a site that won’t load is a plugin you can’t reach.
The base plan includes 10 GB of storage, and retention is yours to choose: 7 days, 30 days, 120 days or a year. There’s a trap in that choice worth understanding before you make it. Jetpack calculates storage as your latest daily backup multiplied by how many daily backups it holds. So a 1 GB site set to 120-day retention wants roughly 120 GB, and your 10 GB allowance is gone on day eleven. Pick the long retention and you’re buying a storage add-on too. Those run USD 2.95/month for 10 GB, USD 5.95 for 100 GB, or USD 9.95 for 1 TB.
Run the annual maths against the alternatives. The 10 GB tier costs USD 119.40 a year, which works out at USD 9.95 a month billed yearly. Paying month to month instead costs USD 14.95, a 50% penalty for the flexibility. BlogVault’s real-time WooCommerce tier is USD 499/year, so VaultPress delivers real-time backups at 76% less. Against UpdraftPlus Premium’s USD 70 for two sites, VaultPress costs 71% more for one. What that premium buys is the difference between nightly and continuous.
One more thing the pricing cards don’t advertise. Jetpack discounts the first year heavily, currently 45% off. Its own footnote reads: “Discount is for the first year only; all renewals are at full price.” That’s the same structure Duplicator uses. Budget year two at the full USD 119.40, not the introductory rate.
The awkward part is the plugin itself. The main Jetpack plugin carries 3 million installs but only a 74/100 rating, the lowest of anything here. Much of that reflects long-standing complaints about bundling and upsells rather than backup quality. The standalone Jetpack VaultPress Backup plugin rates 90/100, but from just 35 ratings across 20,000 installs. That’s too thin a sample to lean on.
Pros
- Real-time backups, not scheduled snapshots
- Restore dashboard works when your site is down
- Offsite by default, on Automattic infrastructure
- Retention configurable up to one year
Cons
- First-year discount, then renewals at full price
- 10 GB base storage is thin once retention goes past 30 days
- Parent Jetpack plugin rates just 74/100
Pricing: The 10 GB tier is USD 119.40/year, or USD 14.95 month to month. A 1 GB tier runs USD 35.88/year and a 1 TB tier USD 359.40/year. Storage add-ons cost USD 2.95/month for 10 GB, USD 5.95 for 100 GB and USD 9.95 for 1 TB.
Best for: WooCommerce stores and membership sites, where an hour of lost data means lost orders.
Skip if: You publish twice a month, since nothing changes between nightly backups anyway.
Verdict: Choose VaultPress if you take orders and can only afford to lose minutes of data. If the answer is measured in days, this is a USD 119.40 annual bill for a feature you’ll never use. UpdraftPlus free pushing to Google Drive covers you for nothing. If you need real-time plus 90-day retention, BlogVault Business is the closer fit.
BlogVault: Offsite by Design, Priced Per Site
Personal USD 99/year | Business USD 299/year | WooCommerce USD 499/year | Incremental, multi-cloud
BlogVault sells no free tier. That turns out to be the honest version of what it is. This is a hosted backup service with a WordPress plugin attached, rather than a plugin with storage bolted on. Backups run incrementally, transferring only what changed since the last one. They’re processed on BlogVault’s servers instead of yours. On a shared plan where a full nightly archive can trip your host’s resource limits, that architectural difference is the whole product.
Retention is where the tiers separate, and it’s the number to buy on. Personal at USD 99/year keeps 30 days with daily backups. Business at USD 299/year keeps 90 days and backs up twice daily. WooCommerce at USD 499/year keeps a full 365 days with real-time backups. All three cover one site. Five-site bundles run USD 299, USD 899 and USD 1,499.
Why does retention deserve that weight? Because the failures that end sites are the slow ones. Ransomware sits quiet for weeks. A bad plugin update corrupts a custom field type, and nobody notices until a client asks where the data went. Thirty days of history covers the disasters you spot immediately. Ninety days covers the ones you don’t.
Compare it against the field on price per retained day. BlogVault Personal costs USD 99 for 30 days of history on one site. SiteGround includes 30 daily copies inside a shared plan you’re already paying for, which makes BlogVault Personal hard to justify there. Kinsta’s smaller plans retain 14 days on the same machine as the site. Against those, BlogVault Personal buys double the history and real separation for USD 99. And the USD 499 WooCommerce tier is 4.2x the USD 119.40 Jetpack VaultPress charges for real-time. What that buys is 365-day retention and store-specific order logging.
Pros
- Incremental backups processed offsite, so no server load
- Retention up to 365 days on the top tier
- Multi-cloud redundant storage, encrypted
- Staging and migration bundled in
Cons
- No free tier at all, unlike every other plugin here
- Priced per site, which scales badly across a portfolio
- USD 499 WooCommerce tier is the priciest option here
Pricing: All plans are annual and cover one site:
- Personal: USD 99/year, daily backups, 30-day retention
- Business: USD 299/year, twice daily, 90-day retention
- WooCommerce: USD 499/year, real-time, 365-day retention
- Five-site bundles: USD 299, USD 899 and USD 1,499 respectively
Best for: Sites on cheap shared hosting, where local backups would trip resource limits.
Skip if: Your host already keeps 30 days of off-server copies, making Personal redundant.
Verdict: Buy BlogVault Business at USD 299 when 90-day retention is the requirement. Nothing else here retains that long without a per-site premium. If you just want offsite dailies on one site, don’t pay USD 99 for it. UpdraftPlus free pointed at Google Drive does the same job, and the money belongs in your hosting plan.
Where BackupBuddy Went
If you’ve read an older backup guide, including the previous version of this one, you were probably told to buy BackupBuddy. Don’t go looking. It doesn’t exist as a product you can purchase.
The trail runs like this. iThemes built BackupBuddy and sold it for roughly fifteen years. StellarWP acquired iThemes and renamed the plugin Solid Backups. Then on 12 May 2026, Liquid Web merged its brands into a single platform and retired four of them as standalone products, SolidWP among them. Solid Backups became Kadence Backups, available only inside a Kadence bundle. Security patches for the SolidWP line are scheduled to end in April 2027.
Two practical consequences follow. If you hold a Solid Backups licence, note that April 2027 cutoff and plan a move before then. An unpatched backup plugin is the exact risk the UpdraftPlus CVE demonstrated. Second, if a comparison article published this year still lists BackupBuddy at a standalone price, that page hasn’t been checked since May 2026. It’s a useful test for the rest of what’s on it.
Your Host’s Backups, and Exactly Where They Stop
Nearly every host takes backups, and most site owners treat that as the end of the conversation. It shouldn’t be. The reason is where those copies physically sit.
Kinsta states it plainly in its own documentation: “Each backup is stored on the same host machine as your site.” That isn’t a criticism of Kinsta, because same-machine snapshots are normal and they restore quickly. But the scenario backups exist for is the machine itself failing. A snapshot on that machine doesn’t survive it. Kinsta does sell genuine offsite backups to Amazon S3 or Google Cloud Storage as an add-on. It costs USD 2/month per site plus USD 1/GB of bandwidth. The cloud storage itself is billed separately by Google or AWS. Worth buying, and easy to miss.
Retention differs enough between hosts to change your plugin decision:
- Kinsta: daily backups retained 14 days on smaller plans, 30 on larger ones. Up to 5 manual backups kept a minimum of 14 days. One downloadable ZIP per week, available for 48 hours. Hourly backups cost USD 100/site/month, or USD 20 for six-hourly.
- SiteGround: up to 30 daily copies on shared plans, 7 on Cloud, with 5 free manual slots on GrowBig and above. SiteGround states backups may be stored in a data center in another city, state or country. That’s the geographic separation Kinsta charges extra for.
- Hostinger: weekly backups on all plans. Daily backups start at Web Business and are kept for 7 days only, though lower tiers can buy them. On VPS, the daily upgrade runs USD 6.00/month and keeps just 2 daily plus 2 weekly copies.
Read those three next to each other and the spread is stark. SiteGround’s shared plans retain 30 daily copies at no extra charge. Hostinger’s daily backups retain 7 days, and only from the Business tier up. That’s 4.3x more history included in the base price, and it never appears in a hosting comparison table. If you’re picking a host partly on this, our roundup of the best managed hosting providers goes deeper on what each one includes.
A second limit applies to all of them. Host backups are only as available as your relationship with that host. Miss an invoice, trip a terms-of-service rule, or watch the company get acquired and restructured, and the backups go with the account. An offsite copy in storage you control is the version nobody else can switch off.