Performance optimisation addresses “faster”, but the real bottom line for websites is two things:

  • surety: Try not to get into trouble (don't get hacked, don't get hung, don't get crashed, don't get interfaces swiped, don't get tampered with)
  • backing up: quick recovery even if something goes wrong (accidental deletion, upgrade rollover, server failure, rollback after ransom/intrusion)

The following two things complement each other:

  • If you only do security but not backups, you can still go to zero overnight if you encounter uncontrollable problems.“
  • If you only do backups but not security, you will fall into the cycle of “getting hit every day and restoring every day”, and the time and cost will be out of control!

You should be able to do that after reading it:

  • Knowing exactly what to cover with “backup and security” (to avoid buying the wrong one, installing the wrong one, and assuming it's foolproof)
  • Ability to select the right solution by site type (content site/business site/e-commerce/membership site)
  • Able to go live progressively on a roadmap (resilient, then controllable, then systematic)
  • Can be verified with self-test checklist: backupIt's really recoverable.SecurityThere really is a defence.
  • Know where to look first when problems occur (backup failure, recovery failure, suspected hacking, etc.)

1. Goal: You need a “recoverable system”, not a “plug-in”.”

Backups are not about “having a backup file.”

Instead:Can you get the site back to the way you want it when you need it。

So the key indicator of backup is not “backup plugin installed”, but these two things:

  • Acceptable Data Loss Window (RPO): How long can you accept losing data in the worst case scenario?
    Example: a content site losing 24 hours of articles might be acceptable; an e-commerce site losing 30 minutes of orders is serious.
  • Acceptable Recovery Time (RTO): How quickly do you expect to be back online after the accident?
    Example: an enterprise site may want to recover within 1 hour; an e-commerce site may want to recover within 10-30 minutes.

You don't have to write these metrics into a formula, but use them to decide:Backup frequency, retention time, need for real-time/incremental backups, need for one-click recovery/off-site recovery。

2. Rapid strategy development by site type (orientation, then tool selection)

Strategy Advice:

A. Content sites / blogs

  • Frequency of change: usually “daily/weekly”
  • Recommended backup frequency:everydayBackup database + wp-content (uploads/themes/plugins)
  • Recovery Goal: Yesterday's/today's version is sufficient (with a focus on not losing articles and the media library).

B. Business site / marketing site (form leads are important)

  • Frequency of change: not necessarily high, but forms/leads are critical
  • Recommended backup frequency: database at leasteverydayThe form data and email/CRM will not be “in one place”.”
  • Recovery goal: quick rollback in case of problems with update/revision/add tracking scripts

C. E-commerce site (WooCommerce)

  • Frequency of change: orders/inventory/user behaviour ongoing
  • Recommended backup frequency: preferredhigher frequency(hourly, or even real-time/near real-time), at least make database protection strong
  • Recovery goal: Minimal loss of order data; ability to quickly restore payment/order links

D. Membership site / course site / community

  • Frequency of change: user progress, permissions, content unlocking, interaction data
  • Recommended backup frequency: higher frequency for databases; with “point-in-time” recovery points
  • Recovery goal: user data is not messed up, permissions are not lost, and content is not tampered with

3. Backup roadmap (it is recommended to move forward in these 3 phases)

Highlights:Let's make “capable recovery” first, and then talk about “automation and systemisation”.

Stage 1: Start with “Automatic Backup + Offsite Storage”

That's the bottom line. No matter what tool you use, it has to be met:

  • automatic:: Don't rely on “I'll remember to click it manually.”
  • off-site storage: Don't just put backups on the same server
    The reason is very simple: the server hangs/disk is broken/account is invaded to delete the library, your “local backup” may be gone together.

Typical implementations of the tool include:

  • Backup plugin pushes backups to cloud drive/object storage/FTP (UpdraftPlus Explicitly supports multiple targets such as Dropbox, Google Drive and Amazon S3)
  • A cloud backup service puts backups in its cloud and offers one-click recovery (Jetpack VaultPress Backup Cloud backup and one-click restore, but must include a paid plan with Backup

Phase 2: Upgrading backups to “recoverable systems”

A lot of sites really roll over, not because of a lack of backups, but because of:

  • Incomplete backup (only database, not uploads/themes/plugins)
  • Corrupted backup file/incorrect permissions
  • When you need to recover, you realise that “the recovery process just doesn't work.”

The objectives of phase 2 are therefore:Do a regular recovery exercise(even in a test environment/temporary directory recovery), confirm the following points:

  • The database can be recovered.
  • The media library can be restored (wp-content/uploads/）
  • Themes/plugins can be restored (wp-content/themes/、wp-content/plugins/）
  • After recovery, the site can be accessed normally, the backend can be logged in normally, and the key functions can be run through (e-commerce to test the order/payment process, and the membership site to test the login/permissions).

This is why many commercial backup solutions emphasise “one-click recovery”, “minute-by-minute recovery” and “incremental backups to reduce load”. For example BlogVault In the plugin description it is emphasised that **automatic, incremental backups (including databases, themes, plugins, media)** and staging/migration functions are provided.ManageWP Emphasis is also placed on reducing the load with incremental backup techniques and providing one-click recovery.

Phase 3: Tie backups to the Update/Release process (rollback point)

By this stage, your goal is:Rollback point before each major change。

Typical scenarios include:

  • WordPress core major version upgrade
  • Change of theme/overhaul of template
  • Installation or replacement of key plug-ins (e-commerce payments, membership systems, form systems)
  • Batch image replacement / mass content migration

The point of Stage 3 is that you don't need to “pray that the change is OK”, but rather that you can quickly roll back to “the moment before the change” if the change goes wrong.

4. Backup what exactly to backup (many people backup missed these key points)

Essential 1: Database (where orders/users/content/settings go)

  • Articles, Pages, Comments
  • Users, permissions
  • WooCommerce Orders, Inventory, Coupons
  • Plug-in configuration (large number of configurations stored in database)

Essential 2: wp-content (this is the bulk of the WordPress site's “visible assets”)

  • uploads: pictures, attachments, media library (the easiest place to “forget to back up”)
  • themes: Theme files (custom code/templates)
  • plugins: plugin files (some plugins also write custom files)

As appropriate: configuration and operating environment information

Don't ignore environmental differences:

  • Version differences may cause errors after recovery
  • Specific extension/cache component differences may result in different behaviours
  • Reverse proxy/CDN/Security rules may affect login and backend APIs

Recovery is not just about putting the file back, but also ensuring that the operating environment and configuration can support it to run.

5. Backup programme selection

Type A: Plug-in timed backups (a suitable start-up solution for most sites)

Characteristics: low cost, controllable, fast deployment; but you have to do a solid “off-site storage + recovery drill”.

Representation tools:

  • UpdraftPlusFocuses on scheduled backup and restore, and clearly supports multiple backup destinations on the plugin page (Dropbox, Google Drive, Amazon S3, FTP, email, etc.).
    Ideal for: content sites/business sites starting out; and sites that want “backups to their own controlled storage”.
  • WPvivid Backup & Migration: The plugin page highlights backups, migrations and staging (staging can be created in a subdirectory to test changes).
    Ideal for: people who migrate sites frequently and often need to test changes on an ad-hoc basis.
  • Duplicator: Plugin page emphasises backup/packaging/migration/cloning of sites to new hosts or new domains.
    Ideal for: migrating, replicating sites, building test sites, making “relocatable packages”.

UpdraftPlus is more of a “backup system starter”.”

WPvivid/ Duplicator is better at “migration/packaging/copying” but can also do backups.

Type B: Cloud Backup/Near Real-Time Backup (more suitable for sites that are more sensitive to data and recovery time)

Features: Emphasis on “per change/high-frequency change protection” and “one-click recovery”, more like a set of services.

Representation tools:

  • Jetpack VaultPress Backup (Jetpack Backup): The plugin page emphasises cloud backup and one-click restore, and clearly states that it requires a paid Jetpack plan that includes Backup, whichThe official subscription page also highlights“Save every change, quickly return to a usable state with one-click recovery”.
    Ideal for: e-commerce/membership/sites that are sensitive to “recovery speed”, or those who want to outsource backup operations to a mature service.
  • BlogVault: The plugin description explicitly includes “automatic, secure, incremental backups (database, themes, plugins, media)” with built-in staging and migration capabilities.
    Ideal for: Sites where “Backup + Test + Migration” is a complete workflow.
  • ManageWP: Emphasis on incremental backup techniques to reduce server load and provide one-click recovery.
    Ideal for: people (studios/teams) who manage multiple sites and want to do backups/updates/monitoring in one panel in a unified way.

Type C: Host-side snapshot/automated backup (highly recommended as a “second line of insurance”)

The value of a host backup: it tends to be a “system-level snapshot” with broader coverage (including the state of databases and files, and even the environment at some level).

Common Misconceptions:

  • Host Backup ≠ Migratable Backup: Hosting backups may not be convenient when you change hosts, or need to take your backups away.
  • Plug-in backups are more migratoryBackups fall on storage you can control, making recovery across environments more flexible.

Therefore the most stable combination is usually:

Hosted Backup (under the hood) + Plugin/Cloud Backup (application layer migratable + granular recovery points)

6. Security road map (start with the most effective basics, not with a bunch of plug-ins)

Security is not about “installing ten plug-ins”, it is about building defences on a layer-by-layer basis:

Stage 1: Accounts and Privileges (greatest and most immediate benefits)

What you want to do at this stage is to “make the most common entry points harder”:

  • Administrator account minimisation: only for those who need it
  • Strong password strategy: don't reuse, don't use weak passwords
  • 2FA (two-step verification)This is one of the most effective enhancements in the era of “crash/leak passwords”.
    for example Solid Security The plugin page explicitly supports multiple 2FA methods (Authy, Google Authenticator, email, alternate codes, etc.).
  • Login protection: Limit brute force attempts, avoid swiped logins
  • Accounts not in use disabled/deleted; themes/plugins no longer in use deleted (not only deactivated)

Stage 2: Updates and Exposure Management (Don't Leave Risks in Old Versions)

A large number of WordPress intrusions come from “old plugins/themes/core with publicly available vulnerabilities”.

Therefore, “update” is one of the core aspects of the security strategy.
The WordPress documentation mentions the introduction of automatic background updates from WordPress 3.7 to improve security, and states that automatic updates are enabled by default on most sites, and from the 5.6 Starting a new site is automatically enabledStrategies such as major vs. minor version updates.

Principle:

  • Core/themes/plugins to have a clear update strategy (automatic/semi-automatic/manual review)
  • Rollback points before major updates (go back to Section 3, “Backup Stage 3”)
  • Plug-ins that are no longer maintained should be replaced as soon as possible (this is the most direct way to “reduce exposure”).

Stage 3: Protection and Detection (make it harder for attacks to succeed and for anomalies to be detected earlier)

What you want to do at this stage is to be “more like a systematic defence”:

  • Firewall/WAF (blocking a portion of junk traffic before it gets to WordPress)
  • Malicious code scanning, file integrity monitoring
  • Security logs and alerts: abnormal logins, privilege changes, altered files
  • Monitoring: downtime monitoring, certificate expiration, anomalous 5xx, anomalous traffic spikes

Representation tools:

  • Wordfence: The plugin page clearly includes firewall, malware scanning and login security, and mentions that Premium gets firewall rules and malware signature updates in real time, whereas the free version has a 30-day delay.
    Recommendation: The free version significantly improves baseline security, but if your site is more risky or relies more on “up-to-date threat intelligence”, understand the difference in “update delays”.
  • Patchstack(virtual patching/exploit protection ideas): Its official website highlights the protection of sites from vulnerable plugins/themes through virtual patchesPatchstack; and there are instructions for the free version to provide vulnerability alerts, the paid version to provide automated vulnerability protection, and other ideas.
  • Sucuri(Clearance and servicing security): Its service page emphasises malware cleanup with the ability to continuously scan/block future intrusions Sucuri.

7. Risk alerts

Backup-related high-frequency pitfalls

  1. Backups are local to the server only
    When servers go wrong, local backups are often gone along with them.
  2. Database only not wp-content
    Upon restoration you will find: the post is in, the image is gone; or the theme customisation is gone; or the plugin files are inconsistent resulting in an error.
  3. Never do a recovery drill.
    It is only at the critical moment that you realise that the recovery has failed, the backup is corrupted, or critical files are missing.
  4. Backup frequency does not match the business
    E-commerce/membership sites that backup once a day, at worst you could lose a day's worth of order/user behaviour data, at a cost that could far exceed the cost of the backup.

Safety-related high-frequency pits

  1. Security plug-in installed but not updated for a long time
    Security plugins are not a substitute for updates. The old vulnerabilities are out there and the risk won't go away.
  2. Too many administrator accounts/shared accounts
    Permissions are out of control, logs are hard to trace, and exit handovers are risky.
  3. Assuming that “with WAF/CDN in place, it’s absolutely safe”
    WAFs can stop many generic attacks, but they can't fix weak passwords, old vulnerabilities, backdoor plug-ins, etc. The safest approach is “multi-layered defence”. The safest thing to do is to have "multiple layers of defence".
  4. Stacking multiple security plugins that conflict with each other also slows down the site
    Security policies should prioritise “less is more”: 2FA + updated policies + firewall/scanning + alerts; not “the more you install the more secure you are”.

8. Validation checklist

Backup verification (don't say “I have a backup” if you don't pass these 8)

  • Whether automatic backups are enabled (not manual)
  • Whether the backup contains a database + wp-content (uploads/themes/plugins)
  • Whether backups are stored offsite (cloud drive/object storage/standalone server)
  • Is there a clear retention strategy (e.g. 7/30/90 days retention)
  • Whether the last backup was successful (not “schedule exists”)
  • When was the last recovery exercise? Was it successful?
  • Is there an additional rollback point generated before the big update?
  • Critical path availability after recovery (login, forms, e-commerce ordering/membership access, etc.)

Security validation (get the basics down first)

  • Is the administrator account minimised? Is there an exit account clean-up mechanism?
  • Enable or disable 2FA(at least administrator/editor/store manager roles with high authority)
  • Is there a clearUpdate Strategy(Core/themes/plugins)
  • Whether to remove unused plugins/themes (not just deactivate them)
  • Availability of firewall/login protection/malicious scanning (Wordfence (etc. may cover a portion)
  • Availability of vulnerability alerts/virtual patching ideas (Patchstack etc.)
  • Availability of alarms (abnormal logins, file changes, downtime, certificate expiration)
  • Availability of “contingency plans”: what is the first step to take in case of hacking/tampering

common problems

1. Is it enough to use only the host's own backup?

It is usually not recommended to rely on only one source.
Hosting backups are great, but they don't necessarily make it easy for you to “take away, migrate, and roll back finely”. It's more stable:Hosted Backups for underpinning + Plugin/Cloud Backups for migratability and controlled recovery points。

2. How often should I back up?

According to the “rate of change of data”:

  • Content sites: usually enough per day
  • Enterprise site: daily (especially if there are form leads) and confirm that the leads are not only on the site
  • E-commerce/membership: more high-frequency (hourly or even near-real-time) is recommended, as order/user data is more valuable

3. How long are the backups to be retained?

Depending on the content and compliance needs, you can use this idea:

  • Keep at least 7-30 days for regular rollback
  • If you're concerned about “latent backdoors/chronic tampering”, it's more valuable to keep the cycle longer (e.g., 90 days) so you can go back to an earlier, cleaner version.

4. Is UpdraftPlus / WPvivid / Duplicator the “same thing”?

They both back up, but with different emphases:

  • UpdraftPlus More typical is “Scheduled Backup + Multi-Target Storage + Recovery”.”
  • WPvivid Emphasis on backup + migration + staging Testing capabilities
  • Duplicator Very strong in “pack/migrate/clone site”

If you use “type” to select, you won't be confused by the name.

5. Why is Jetpack Backup paid? When is it suitable?

Because it's essentially more of a “cloud backup service” - with an emphasis on cloud saving and one-click restoration - the plugin page explicitly needs to include Backup paid planThe official subscription page emphasises saving every change and quick one-click recovery.
Ideal for: people who are more sensitive to recovery speed and want to leave backup O&M to a mature service.

6. What is the point of “incremental backups” like BlogVault / ManageWP?

Incremental backups are at their core:Backup only the changes, which reduces server load while allowing recovery points to be generated at a higher frequency.

  • BlogVault PluginThe instructions emphasise automatic, incremental backups and overwriting of databases/themes/plugins/media, with built-in staging and migration;
  • ManageWP Incremental backup techniques are also emphasised to reduce load and provide one-click recovery.

Ideal for: large sites, lots of media, frequent updates, or if you manage multiple sites.

7. Is one security plug-in enough?

For most sites, “one main security plugin + getting the base policy right” is usually more effective than “a bunch of them”.
for example Wordfence Can cover baseline capabilities such as firewall, scanning and login security; coupled with the 2FA(Solid Security offers a variety of ways to do this), can already significantly drive up the cost of an attack.

8. Does the free version of Wordfence work? Why do some people talk about going on Premium?

Wordfence plugin pageClarity: Premium provides real-time firewall rule and malicious signature updates, while the free version delays by 30 days.
Whether or not you need Premium depends on your risk and tolerance level:

  • Low-risk sites: free version + timely updates + 2FA, usually helpful already!
  • Higher risk or greater reliance on “up-to-date threat intelligence”: the need to understand the window of opportunity that “delayed updates” can create

9. What exactly does a “virtual patch” like Patchstack solve?

The idea is that rules are used to block the attack surface of known vulnerabilities at the application layer before plugin/theme vulnerabilities are exploited (or before patches are fully widespread).Patchstack official websiteEmphasis on virtual patch protection vulnerable plugins/themes, with explanations of free/paid differences in alerts and automated protection.
This is not a replacement for updates, but rather a way to minimise the risk of a “patch window”.

10. Will I lock myself out if I activate 2FA?

It is recommended that you prepare in advance:

  • Alternate code/recovery method (Solid Security Also mentions backup codes and other options）
  • Maintain at least one “emergency manager” and secure recovery information
  • The key: don't put the recovery information in the same place where a breach can get to it

11. Should WordPress auto-update be turned on or not?

WordPress DocumentationExplain that the automatic background update mechanism is intended to improve security and is enabled by default for most sites, and that different types of update policies can be configured.
Recommendation:

  • Security and minor version updates: tend to be automated (reduce time to expose known vulnerabilities)
  • Major releases/critical plugin updates: combine backup rollback points with a test process before moving forward (at least to be able to roll back)

12. What is the first step if I suspect that a website has been hacked?

Correct order (to avoid making a bigger mess):

  1. Stop the bleeding first.: Temporarily restricting background logins, suspending suspicious functions, and opening maintenance pages when necessary
  2. Preservation of Evidence & Recovery Points First: Make an immediate current state backup (for analysis) while preparing a clean rollback point
  3. Rollback/clean-up: Prioritise recovery to a known clean point in time, or use a professional cleaning service (Sucuri etc. emphasising malicious clean-up and ongoing protection)
  4. patch a hole: update core/plugins/themes, reset passwords and keys, turn on 2FA, remove suspicious accounts and plugins

13. I do security and backup, why do I need to monitor?

Because “early detection” minimises losses.
Downtime, expired certificates, abnormal traffic, abnormal logins, abnormal orders - these are all “the sooner you know, the better” issues.