How to Backup Your WordPress Site in 2026 (plugin, Hosts and the Manual Way) - IT

Kinsta’s backup documentation contains one sentence most of its customers have never read. “Each backup is stored on the same host machine as your site.” Kinsta is a well-regarded managed host, and that line is not a scandal. Same-machine snapshots are the industry norm, and they restore fast. But it means the copy you’re counting on lives on the machine you’re protecting yourself from.

Risposta rapida: Run two layers. Install UpdraftPlus or WPvivid free, then schedule a push to Google Drive, Dropbox or Amazon S3. That takes about ten minutes. Leave your host’s backups on as the fast rollback option. Gestire un negozio? Neither layer is enough alone, and you want real-time backups from Jetpack VaultPress at USD 119.40/year or BlogVault at USD 499/year.

Ultima revisione: agosto 2026. Prezzi, install counts and plugin versions verified against official sources this month.

What a WordPress Backup Actually Contains

A WordPress site is two things stuck together. A backup that only grabs one of them is useless. There’s the file side and the database side.

The files sit in your web root. That means WordPress core, everything in wp-content, più wp-config.php e .htaccess. Dentro wp-content live your themes, your plugins, and the uploads folder holding every image you’ve ever added. The database holds your posts, pagine, comments and users. It also holds every setting each plugin has ever saved.

Restore files without the database and you get a working WordPress install with no content. Restore the database without the files and your content points at themes and plugins that aren’t there.

Two files break restores more often than anything else. wp-config.php holds your database credentials and security salts, and it’s specific to the server it was written for. .htaccess holds your permalink rules and any redirects you’ve built up. Some backup tools skip both by default, on the theory that you’ll regenerate them.

One thing WordPress itself will not do for you: back up the site. Core has had a rollback feature since 6.3. It stashes a copy of a plugin or theme in wp-content/upgrade/temp-backup prima dell'aggiornamento. If the update fails, the old version goes back. That’s useful, and it saves sites from white screens. It is not a backup. It covers one plugin for the length of one update. It does nothing for your database, your uploads, or a site that got hacked. WordPress 7.0 spedito il 20 Maggio 2026 e 7.1 seguito 19 agosto 2026. Neither added native site backups.

How We Picked and Verified These Tools

Every install count and rating here comes from the WordPress.org plugin API, queried on 31 agosto 2026. None of it comes from vendor marketing pages. Every price was read off the vendor’s own checkout the same day. Two of them, Duplicator and UpdraftPlus, were loaded in a real browser. Both inject prices with JavaScript and hand a plain fetch a blank page.

Our exclusion rules were blunt. We dropped any plugin whose last WordPress.org update predates the May 2026 release of WordPress 7.0. A backup tool untested against current core is a liability, non una rete di sicurezza. We dropped anything you can no longer buy as a standalone product, which is how BackupBuddy left this list after fifteen years. And we ignored “memoria illimitata” claims unless the vendor states retention in days. Storage you can’t recover from three weeks ago is marketing, not insurance.

Weighting reflects what actually goes wrong. Offsite storage counted most, because a backup on the same disk as the site fails the one scenario backups exist for. Restore capability came second, judged on what each vendor documents. Three questions there: is restore in the free tier, does it work from a dashboard outside the site, and how far back can you reach. Price counted third, measured at renewal instead of year one.

Cosa non abbiamo fatto: run restore tests on all five tools ourselves, or measure backup speed on a live site. No timing figure in this guide comes from our own stopwatch. Where we describe how a tool behaves under load, it comes from vendor documentation rather than our own testing, and it’s labelled as such.

UpdraftPlus: The Free Default, on One Condition

Gratuito | Premio USD 70/anno per 2 siti | 3M+ installazioni attive | 96/100 a partire dal 8,633 giudizi

Inizia con la parte scomoda. Nel mese di giugno 2026, UpdraftPlus shipped a fix for CVE-2026-10795. It was an unauthenticated authentication bypass rated CVSS 8.1, che interessano ogni versione fino a quella inclusa 1.26.4. An attacker who never logged in could forge commands and run them as your administrator. In practice that means uploading a plugin of their choosing. TeamUpdraft published the patch on 5 giugno 2026 in versions 1.26.5 gratuito e 2.26.5 premio. The CVE record went public on 11 giugno 2026.

Here’s why that matters more for a backup plugin than for most others. A backup plugin runs with full read access to your database and files. It also stores the credentials for wherever you send those files. Compromise it and you don’t just get the site. You get the archive of the site, plus a key to the Dropbox account holding it.

So treat backup plugins as the highest-value target on your install. Turn on automatic updates for this one specifically. La nostra guida a testing your WordPress site security covers how to check whether an older version left anything behind.

The current version is 1.26.7, rilasciato 21 agosto 2026 and tested against WordPress 7.1. Update and move on, because the free tier is still the sensible starting point for most sites. It runs scheduled automatic backups. It restores from inside the dashboard. And it ships free connectors for Google Drive, Dropbox, Amazon S3, Rackspace, FTP, DreamObjects, OpenStack Swift and email.

Where the free tier stops is worth knowing before you install it. OneDrive, SFTP, WebDAV, SCP, Google Cloud, Backblaze and pCloud are all Premium. So are incremental backups, automatic backups before updates, multisite support and database encryption. That last group is the real argument for the USD 70. Incremental backups are the one most people feel. A full nightly copy of a 4 GB site chews through your server’s CPU and your Drive quota.

Compare storage options directly and UpdraftPlus loses to a free competitor. WPvivid hands you Microsoft OneDrive, SFTP and DigitalOcean Spaces at no cost. UpdraftPlus puts all three behind a USD 70 paywall. That’s three destinations for zero against three destinations for seventy.

Professionisti

• Il livello gratuito include scheduled backups and restore, not just export
• Largest user base of any backup plugin at 3 milioni di installazioni
• Eight free remote storage destinations
• 14-day money-back guarantee on Premium

Contro

• Spedito a CVSS 8.1 auth bypass nel mese di giugno 2026
• Incremental backups are Premium only, so free users run full copies
• No published renewal price, so year-two cost is unconfirmed

Prezzi: Libero per sempre, with no feature timer. Premium Personal costs USD 70/year for 2 siti. TeamUpdraft’s checkout applies local VAT, so an Irish visitor sees USD 86.10 for that plan. UN “Show prices without VAT” toggle sits on the pricing page. UpdraftPlus advertises a renewal discount but publishes no renewal figure, so budget the full USD 70 per il secondo anno.

Meglio per: Anyone who wants working offsite backups today without opening a wallet.

Salta se: You manage more than two sites and won’t pay, since Premium’s site limits bite fast.

Verdetto: Install UpdraftPlus free, update to 1.26.7, and enable automatic updates for it. Paga i dollari 70 only for incremental backups or automatic pre-update snapshots. If your reason for upgrading is OneDrive or SFTP support, don’t pay it. WPvivid gives you both for nothing.

WPvivid: The Free Tier That Out-Specs a Paid One

Gratuito | Pro available | 900,000+ installazioni attive | 98/100 a partire dal 1,536 giudizi

Most people have never heard of WPvivid. Its free tier quietly does things its better-known rival charges for. Free WPvivid connects to Dropbox, Google Drive, Amazon S3, Microsoft OneDrive, DigitalOcean Spaces, FTP and SFTP. Scheduled backups are free. Restore is free. Migration to a different host is free, with no site-size ceiling.

Put that against UpdraftPlus and the gap is specific rather than vague. Both give you Dropbox, Guidare, S3 and FTP at no cost. WPvivid adds OneDrive, SFTP and DigitalOcean Spaces on top. UpdraftPlus charges USD 70/year for those same three. For a developer backing up to SFTP on a box they already own, WPvivid free replaces a USD 70 subscription outright.

Its rating backs that up: 98 fuori da 100, two points above UpdraftPlus. That comes from 1,536 ratings rather than 8,633, anche se. Smaller sample, so read it as encouraging rather than conclusive. Versione 0.9.133 atterrato 27 agosto 2026 e test contro WordPress 7.1.

Pro exists and covers incremental backups, database encryption, multisite and white labelling. It adds four more storage providers: Wasabi, pCloud, Backblaze and WebDAV. The pattern will look familiar by now. Incremental backups are the paid feature in this category, across every tool here.

The honest weakness isn’t technical. It’s institutional. WPvivid is a small team with a fraction of TeamUpdraft’s support footprint. When a restore goes wrong at 2am, the size of the community answering questions matters. There’s also no version 1.0 after years of development, which bothers some buyers more than it should.

Professionisti

• Seven free storage destinations, including OneDrive and SFTP
• Free migration with no size limit
• Valutato 98/100, above UpdraftPlus
• Staging built into the same plugin

Contro

• Much smaller support community than UpdraftPlus
• Incremental backups and encryption are Pro only
• Still on a pre-1.0 version number after years of releases

Prezzi: The free tier covers everything described above, with no time limit and no site cap. Pro is annual, con un 30-garanzia di rimborso entro un giorno:

• blogger: 49 USD/anno, 2 domini
• Libero professionista: USD 69/year, fino a 10 domini
• Piccola impresa: 99 USD/anno, fino a 50 domini
• finale: 149 USD/anno, domini illimitati

Two numbers there deserve a second look. Freelancer covers 10 siti per USD 69, undercutting UpdraftPlus Premium Business by roughly USD 26 for the same site count. And that 30-day refund window is più del doppio il 14 days offered by both UpdraftPlus and Duplicator. That matters for a product you can’t properly judge until you’ve restored from it once.

Meglio per: Anyone whose preferred storage is OneDrive, SFTP or DigitalOcean Spaces.

Salta se: You want the largest possible community to search when a restore fails.

Verdetto: Choose WPvivid over UpdraftPlus free when your storage sits on the premium side of UpdraftPlus’s line. That saves USD 70 a year for the same job. On paid tiers it wins on raw value too: Small Business covers 50 domains for USD 99. Pick UpdraftPlus instead if a 3-million-install community and years of answered forum threads beat three extra connectors.

Duplicatore: Excellent at Moving, Wrong Tool for Nightly Backups

Gratuito | Pro from USD 69.30/year introductory, Dollaro statunitense 99 al rinnovo | 1M+ si installa | 98/100 a partire dal 4,929 giudizi

Duplicator doesn’t actually compete with UpdraftPlus. Treating it as a backup plugin is the most common mistake people make with it. It’s a migration and cloning tool that happens to produce a file you can restore from. That distinction decides whether you should install it.

The free version makes the point clearly. It creates backups manually, stores them on your own server, and packages a site into an installer you drag to a new host. What it won’t do for free: run on a schedule, or send anything to cloud storage. Scheduled backups, cloud destinations, one-click recovery points, multisite and staging are all Pro. A free Duplicator backup sitting on the same server as your site fails the basic test this guide is built around.

Where it earns its place is a host move. Duplicator’s installer handles the search-and-replace of your old domain across the database. That’s the step people get wrong by hand. La nostra guida a free WordPress migration services covers hosts that will do this for you at no charge, which is often the better answer.

Now the pricing, because it needs saying plainly. Duplicator’s page carries this footnote in small type: “Prezzo di lancio speciale, tutti i rinnovi sono a prezzo pieno.” Basic is advertised at USD 69.30 against a USD 99 prezzo di listino, so you pay 1.43x in year two. Plus is worse. It runs USD 99.50 introductory against USD 199 elenco, un' flat doubling. Pro gestisce USD 159.60 contro USD 399, un salto di 2,5x. Elite matches that multiplier at USD 239.60 contro USD 599.

Set that against the alternatives at renewal and the case narrows. Duplicator Plus costs USD 199 in year two for 5 siti. BlogVault Personal is USD 99 flat for 1 luogo, with real offsite storage and 30-day retention. UpdraftPlus Premium is USD 70 per 2 siti. So Duplicator Basic’s USD 99 renewal buys 2 siti, matching UpdraftPlus at 41% più soldi. UpdraftPlus also includes incremental backups that Duplicator Basic does not.

Professionisti

• Best-in-class host-to-host migration with automatic URL rewriting
• Highest rating in this guide at 98/100 a partire dal 4,929 giudizi
• Free tier handles a one-off move at no cost
• 14-finestra di rimborso giornaliera

Contro

• La versione gratuita ha no scheduling and no cloud storage
• Renewals run at full list price, fino a 2.5x year one
• Users report renewal notices that omit the new price

Prezzi: The free tier covers manual local backups. Pro is annual, with a 14-day money-back guarantee:

• Di base: Dollaro statunitense 69.30 primo anno, poi Dollaro statunitense 99 (2 siti)
• Più: Dollaro statunitense 99.50 primo anno, poi Dollaro statunitense 199 (5 siti)
• professionista: Dollaro statunitense 159.60 primo anno, poi Dollaro statunitense 399 (20 siti)
• Elite Bundle: Dollaro statunitense 239.60 primo anno, poi Dollaro statunitense 599 (100 siti)

Meglio per: Moving a site between hosts, or cloning production to staging.

Salta se: You want scheduled offsite backups, which is what most people arrive here for.

Verdetto: Buy Duplicator Pro if migrations are recurring work, where the 20-site tier spreads that USD 399 renewal across real client billing. For scheduled nightly backups on one site, non. UpdraftPlus Premium does that job for USD 70 against Duplicator Basic’s USD 99 rinnovo, and does it incrementally.

Jetpack VaultPress Backup: In tempo reale, Priced by Storage

USD 119.40/year for 10 GB | Dollaro statunitense 14.95 fatturato mensilmente | Built by Automattic

Every other tool in this guide takes a snapshot on a timer. Jetpack VaultPress Backup records changes as they happen. That sounds like marketing until you own a shop. Picture a nightly backup running at 3am and a database corruption at 8pm. You’ve lost seventeen hours of orders, and those orders are money customers already paid you. Real-time backup means the recovery point is seconds old, non ore.

Backups go to Automattic’s own cloud. Not to your server, and not to a Drive folder you manage. Restores run from a web dashboard that keeps working when your site does not. That’s the scenario that matters. A backup plugin living inside a site that won’t load is a plugin you can’t reach.

Il piano base include 10 GB di memoria, and retention is yours to choose: 7 giorni, 30 giorni, 120 days or a year. There’s a trap in that choice worth understanding before you make it. Jetpack calculates storage as your latest daily backup multiplied by how many daily backups it holds. Quindi a 1 GB site set to 120-day retention wants roughly 120 GB, e il tuo 10 GB allowance is gone on day eleven. Pick the long retention and you’re buying a storage add-on too. Those run USD 2.95/month for 10 GB, Dollaro statunitense 5.95 per 100 GB, o USD 9.95 per 1 TB.

Run the annual maths against the alternatives. Il 10 GB tier costs USD 119.40 un anno, which works out at USD 9.95 un mese fatturato annualmente. Paying month to month instead costs USD 14.95, un' 50% pena for the flexibility. BlogVault’s real-time WooCommerce tier is USD 499/year, so VaultPress delivers real-time backups at 76% meno. Against UpdraftPlus Premium’s USD 70 per due siti, VaultPress costs 71% more for one. What that premium buys is the difference between nightly and continuous.

One more thing the pricing cards don’t advertise. Jetpack discounts the first year heavily, attualmente 45% spento. Its own footnote reads: “Discount is for the first year only; tutti i rinnovi sono a prezzo pieno.” That’s the same structure Duplicator uses. Budget year two at the full USD 119.40, non il tasso di lancio.

The awkward part is the plugin itself. The main Jetpack plugin carries 3 million installs but only a 74/100 valutazione, the lowest of anything here. Much of that reflects long-standing complaints about bundling and upsells rather than backup quality. The standalone Jetpack VaultPress Backup plugin rates 90/100, but from just 35 valutazioni in tutto 20,000 installa. That’s too thin a sample to lean on.

Professionisti

• Real-time backups, not scheduled snapshots
• Restore dashboard works when your site is down
• Offsite by default, on Automattic infrastructure
• Retention configurable up to un anno

Contro

• First-year discount, poi renewals at full price
• 10 GB base storage is thin once retention goes past 30 giorni
• Parent Jetpack plugin rates just 74/100

Prezzi: Il 10 GB tier is USD 119.40/year, o USD 14.95 mese dopo mese. UN 1 GB tier runs USD 35.88/year and a 1 TB tier USD 359.40/year. Storage add-ons cost USD 2.95/month for 10 GB, Dollaro statunitense 5.95 per 100 GB and USD 9.95 per 1 TB.

Meglio per: WooCommerce stores and membership sites, where an hour of lost data means lost orders.

Salta se: You publish twice a month, since nothing changes between nightly backups anyway.

Verdetto: Choose VaultPress if you take orders and can only afford to lose minutes of data. If the answer is measured in days, this is a USD 119.40 annual bill for a feature you’ll never use. UpdraftPlus free pushing to Google Drive covers you for nothing. If you need real-time plus 90-day retention, BlogVault Business is the closer fit.

BlogVault: Offsite by Design, Priced Per Site

Personal USD 99/year | Business USD 299/year | WooCommerce USD 499/year | Incremental, multicloud

BlogVault sells no free tier. That turns out to be the honest version of what it is. This is a hosted backup service with a WordPress plugin attached, rather than a plugin with storage bolted on. Backups run incrementally, transferring only what changed since the last one. They’re processed on BlogVault’s servers instead of yours. On a shared plan where a full nightly archive can trip your host’s resource limits, that architectural difference is the whole product.

Retention is where the tiers separate, and it’s the number to buy on. Personal at USD 99/year keeps 30 days with daily backups. Business at USD 299/year keeps 90 days and backs up twice daily. WooCommerce at USD 499/year keeps a full 365 days with real-time backups. All three cover one site. Five-site bundles run USD 299, Dollaro statunitense 899 e USD 1,499.

Why does retention deserve that weight? Because the failures that end sites are the slow ones. Ransomware sits quiet for weeks. A bad plugin update corrupts a custom field type, and nobody notices until a client asks where the data went. Thirty days of history covers the disasters you spot immediately. Ninety days covers the ones you don’t.

Compare it against the field on price per retained day. BlogVault Personal costs USD 99 per 30 days of history on one site. SiteGround include 30 daily copies inside a shared plan you’re already paying for, which makes BlogVault Personal hard to justify there. Kinsta’s smaller plans retain 14 days on the same machine as the site. Against those, BlogVault Personal buys double the history and real separation for USD 99. And the USD 499 WooCommerce tier is 4.2x the USD 119.40 Jetpack VaultPress charges for real-time. What that buys is 365-day retention and store-specific order logging.

Professionisti

• Incremental backups processed offsite, so no server load
• Retention up to 365 giorni on the top tier
• Multi-cloud redundant storage, crittografato
• Staging and migration bundled in

Contro

• Nessun livello gratuito affatto, unlike every other plugin here
• Priced per site, which scales badly across a portfolio
• Dollaro statunitense 499 WooCommerce tier is the priciest option Qui

Prezzi: All plans are annual and cover one site:

• Personale: 99 USD/anno, backup giornalieri, 30-ritenzione giornaliera
• Attività commerciale: USD 299/year, twice daily, 90-ritenzione giornaliera
• WooCommerce: USD 499/year, tempo reale, 365-ritenzione giornaliera
• Five-site bundles: Dollaro statunitense 299, Dollaro statunitense 899 e USD 1,499 rispettivamente

Meglio per: Sites on cheap shared hosting, where local backups would trip resource limits.

Salta se: Your host already keeps 30 days of off-server copies, making Personal redundant.

Verdetto: Buy BlogVault Business at USD 299 when 90-day retention is the requirement. Nothing else here retains that long without a per-site premium. If you just want offsite dailies on one site, don’t pay USD 99 for it. UpdraftPlus free pointed at Google Drive does the same job, and the money belongs in your hosting plan.

Where BackupBuddy Went

If you’ve read an older backup guide, including the previous version of this one, you were probably told to buy BackupBuddy. Don’t go looking. It doesn’t exist as a product you can purchase.

The trail runs like this. iThemes built BackupBuddy and sold it for roughly fifteen years. StellarWP acquired iThemes and renamed the plugin Solid Backups. Then on 12 Maggio 2026, Liquid Web merged its brands into a single platform and retired four of them as standalone products, SolidWP among them. Solid Backups became Kadence Backups, available only inside a Kadence bundle. Security patches for the SolidWP line are scheduled to end in April 2027.

Two practical consequences follow. If you hold a Solid Backups licence, note that April 2027 cutoff and plan a move before then. An unpatched backup plugin is the exact risk the UpdraftPlus CVE demonstrated. Secondo, if a comparison article published this year still lists BackupBuddy at a standalone price, that page hasn’t been checked since May 2026. It’s a useful test for the rest of what’s on it.

Your Host’s Backups, and Exactly Where They Stop

Nearly every host takes backups, and most site owners treat that as the end of the conversation. It shouldn’t be. The reason is where those copies physically sit.

Kinsta states it plainly in its own documentation: “Each backup is stored on the same host machine as your site.” That isn’t a criticism of Kinsta, because same-machine snapshots are normal and they restore quickly. But the scenario backups exist for is the machine itself failing. A snapshot on that machine doesn’t survive it. Kinsta does sell genuine offsite backups to Amazon S3 or Google Cloud Storage as an add-on. Costa USD 2/month per site plus USD 1/GB of bandwidth. The cloud storage itself is billed separately by Google or AWS. Worth buying, and easy to miss.

Retention differs enough between hosts to change your plugin decision:

• Kinsta: backup giornalieri conservati 14 giorni on smaller plans, 30 on larger ones. Fino a 5 manual backups kept a minimum of 14 giorni. One downloadable ZIP per week, available for 48 ore. Hourly backups cost USD 100/site/month, o USD 20 for six-hourly.
• SiteGround: fino a 30 daily copies su piani condivisi, 7 su Nuvola, con 5 free manual slots on GrowBig and above. SiteGround states backups may be stored in a data center in another city, state or country. That’s the geographic separation Kinsta charges extra for.
• Hostinger: weekly backups on all plans. Daily backups start at Web Business and are kept for 7 solo giorni, though lower tiers can buy them. Su VPS, the daily upgrade runs USD 6.00/month and keeps just 2 più quotidiano 2 weekly copies.

Read those three next to each other and the spread is stark. SiteGround’s shared plans retain 30 daily copies at no extra charge. Hostinger’s daily backups retain 7 giorni, and only from the Business tier up. Questo è 4.3x more history included in the base price, and it never appears in a hosting comparison table. If you’re picking a host partly on this, la nostra carrellata di best managed hosting providers goes deeper on what each one includes.

A second limit applies to all of them. Host backups are only as available as your relationship with that host. Miss an invoice, trip a terms-of-service rule, or watch the company get acquired and restructured, and the backups go with the account. An offsite copy in storage you control is the version nobody else can switch off.