UpdraftPlus Backup and Restore Review: Is It Reliable Enough?

You clicked Backup Now before a plugin update, saw a message saying the backup had completed, and carried on. Twenty minutes later, the update has broken your checkout page. You’re staring at a list of dated backups under Existing Backups, quietly asking yourself the question every site owner dreads: can any of these actually bring the site back?

Take a breath. You’re in a better position than you think. A backup you’ve never restored is only a hope, but a backup you’ve tested is a plan, and turning one into the other takes less skill than UpdraftPlus’s crowded settings screen suggests.

This guide walks you through backing up your WordPress site, storing, restoring, and recovering with UpdraftPlus, step by step, whether you’re a beginner who’s never touched a settings file or a developer who wants the edge cases. You’ll also find out whether UpdraftPlus is worth relying on, and when a Premium upgrade or a managed service protects you better.

TL;DR: Create complete backups, store them away from your server, schedule regular copies, and test the restore process. Backup plugins can automate these tasks, but a premium or managed solution may be more suitable if you need independent recovery access.

If you use UpdraftPlus today, update it to version 1.26.13 or later and check your UpdraftCentral connections right now. UpdraftCentral is the optional remote-management feature built into the plugin, and an October 2026 security incident targeted it. The steps are near the end, so you can do this first and read on afterward.

Backup your site

A manual backup takes four clicks, and the part that protects you is checking afterward that every piece of your site made it into the set.

1. Open Settings > UpdraftPlus Backups and select the Backup / Restore tab.
2. Click Backup Now.
3. Choose whether to back up the database, the files, or both.
4. Click Backup Now again and wait for the completion message.

Choose both every time. A partial set can lack the one piece you need on recovery day, and that’s the moment nobody wants to discover a gap. Large backups use your server’s resources, so run them when traffic is quiet.

UpdraftPlus saves your site as five components: the database (which holds your posts, pages, users, and settings), plugins, themes, uploads, and other files. One backup is a set of several files, listed together under Existing Backups.

The free plugin leaves out WordPress core files, wp-config.php, and .htaccess. You can re-download core from wordpress.org, but your wp-config.php holds your database details, so keep your own copy somewhere safe.

📝 Note: Free UpdraftPlus doesn’t back up before updates on its own, so run Backup Now yourself before every plugin, theme, or WordPress update. Premium can take that backup for you automatically.

Store a copy away from your server

Once the set is complete, move a copy off your server, because UpdraftPlus stores its default copy inside your own hosting account. That copy lives in the wp-content/updraft folder, so a server failure or a lost hosting account can take your site and its backups out together. We’ve seen owners find this out only after their host went down.

Setting up remote storage takes a few minutes, and every later backup follows it automatically:

1. Open the Settings tab and find Choose your remote storage.
2. Click the icon for your provider, such as Google Drive or Dropbox.
3. Follow the prompts to authenticate, then click Save Changes.

The free plugin supports Dropbox, Google Drive, Amazon S3-compatible storage, Rackspace Cloud Files, FTP, DreamObjects, OpenStack Swift, and email. It sends backups to one destination at a time, which is enough for most small sites.

You can also download a set yourself:

1. Scroll to Existing Backups and click the component you want, such as Plugins.
2. Choose Download to your computer from the panel that appears.
3. Repeat for every component and keep the files together.

The database arrives as a .gz file and every other component as a .zip file. The same panel offers Delete from web server and Browse contents. Hold off on deleting anything from the server until you’ve confirmed a copy exists somewhere else.

📝 Note: Your remote copies are only as safe as the account holding them. Use a strong, unique password and two-factor authentication, because whoever controls that account controls every copy of your site.

Set a schedule and retention

A backup you run by hand protects you only on the days you remember, so set a schedule that runs without you. Retention, the number of backups UpdraftPlus keeps before deleting the oldest, matters just as much.

1. Open the Settings tab.
2. Set the Files backup schedule and the Database backup schedule, which are separate settings.
3. Set how many backups to keep beside each schedule, under the label Retain this many scheduled backups.
4. Click Save Changes.

Your database changes far more often than your plugin and theme files, so a common pattern is a daily database backup with a weekly files backup. A store taking orders all day may want database backups more often than that.

Retention decides how far back you can recover. Support threads are full of owners who kept the number too low and ended up with only two sets to choose from. Set it high enough to reach back several weeks, within the space you have.

Premium adds advanced retention rules, such as keeping one backup a day once a set is older than two days, so you can reach further back without filling your storage.

Check your newest scheduled backup every so often. A schedule that has quietly stopped is one of the most common ways owners end up with no usable restore point.

Restore a backup from WP Admin

With complete sets stored safely, restoring from WP Admin (your WordPress dashboard) takes six steps, and the choices in the middle decide how much of your site changes.

1. Go to Settings > UpdraftPlus Backups and find your set under Existing Backups.
2. Click Restore under Actions.
3. Select the components you want back, then click Next.
4. If the set includes WordPress core files, choose whether to restore wp-config.php. Most restores don’t need it.
5. Read the warnings UpdraftPlus shows after it processes the files, then click Restore again.
6. Wait for the message “Restore successful!”, then check the frontend, log in, and test the pages that matter.

Restoring every component brings back the whole site. Restoring one component at a time lowers the risk when you already know what broke, such as a single plugin, but a set without the database can’t bring back deleted posts.

If you need to compare other recovery methods, our guide explains how to restore WordPress from a backup using a plugin, your hosting control panel, or other available methods.

📝 Note: A restore replaces your current database with the older one, which erases orders, comments, and posts created after that backup. If the site still partly works, download its current state before you restore.

If the site was hacked, an older backup can bring back the same vulnerable plugin or theme code that let the attacker in. Update everything and inspect the site after any recovery, rather than assuming an older copy is automatically safe.

Find a backup that isn’t listed

If your backup is missing from Existing Backups, the Restore button has nothing to work with, so bring the files back into view with one of three routes.

• Rescan remote storage. Reconnect the storage account in Settings, save, and use the Rescan remote storage link in Existing Backups.
• Upload the files. Choose Upload backup files under More Tasks, then drag and drop the files or use Select Files. The free plugin accepts only backups that UpdraftPlus created.
• Copy the files in by FTP. Place them in wp-content/updraft, then choose Rescan local folder for new backup sets under More Tasks.

Keep the database file and every other component together. The restore process needs the whole set to recognize it, and the same routes work on a fresh WordPress install.

Fix a restore that stalls or fails

A restore that stalls or throws an error is almost always hitting a server limit, not a broken backup, so match the symptom to the likely cause before you panic.

If troubleshooting doesn’t get your site back online, follow our guide to recovering a WordPress website for additional recovery options.

Read the backup’s log before you change anything. You’ll find it under Existing Backups, and it often names the exact step that failed. A warning such as “Cannot set max execution time limit due to system policy” means your host is capping the process, so ask your host to raise the I/O limit, the maximum execution time, and the memory limit.

If you can edit wp-config.php, you can also raise WordPress’s memory limit yourself, though some hosts cap it anyway. Add this line above the one that says stop editing:

define( 'WP_MEMORY_LIMIT', '256M' );

Large sites fail most often. Restores on them can fail repeatedly, with messages such as “A very large file was encountered”. In our own testing, a 10 GB site went far less smoothly than a mid-sized one and gave us few detailed error messages to work from.

If a restore still fails after these changes, the manual route below uses the same files and skips the dashboard entirely.

Restore manually when WP Admin won’t load

When dashboard restores keep failing, or the dashboard itself is gone, you can rebuild the site by hand, because UpdraftPlus backups are standard zip and database files. This route suits someone comfortable with FTP and a database tool. If that sounds unfamiliar, your host’s support team can walk you through the import.

1. Download your backup files from remote storage, or from wp-content/updraft on the server.
2. Unpack a fresh copy of WordPress from wordpress.org, unless your set includes a core zip that already holds the old files.
3. Edit wp-config.php in a text editor with your real database details, starting from wp-config-sample.php. Avoid opening the site in a browser until every step is finished.
4. Unzip each plugins, themes, uploads, and other archive and merge them into wp-content, so the folders end up as wp-content/plugins and wp-content/uploads.
5. Import the database file through your host’s database tool, such as phpMyAdmin.
6. Open the site and test it.

If the server and database still respond, copy the current files and export the database before you overwrite anything. An older backup can erase newer orders and comments, and a copy of the current state gives you a way back.

Test your restore before you need it

Having seen both restore routes, the last step is proving they work on your site, because a restore you’ve never tried is only a guess. Restore a set onto a staging copy (a private test version of your site) or a spare WordPress install. Then check the frontend, your WP Admin login, media, URLs, forms or checkout, and your plugin, theme, and WordPress versions.

A restore that finishes while checkout is broken or media is missing hasn’t recovered your site. It only looks finished.

That’s why BlogVault allows you to run test restores for customers in a temporary environment before a real emergency, so you can see whether a backup works without touching your live site. You can build the same habit yourself with a staging copy or a spare install, and the four conditions below show what a good test covers.

A good test meets four conditions:

• Complete sets. Every backup contains the database and all the files your site needs.
• Off-server storage. At least one remote copy sits in an account secured separately from your site.
• Enough history. Your retention setting reaches back far enough to catch a problem discovered days later.
• A repeatable result. You can run the restore again after any major change to the site.

Is UpdraftPlus worth it for your site?

The answer depends on how large your site is and how fast it changes. In our detailed UpdraftPlus review, we examine the plugin’s features, ease of use, backup options, and limitations. The table below shows where the free plugin stops and Premium starts. The free plugin suits a small site where a few hours of downtime costs little. Premium closes most of the gaps for busier ones.

Premium starts at $70 per year for up to two sites, according to TeamUpdraft’s pricing page as of October 27, 2026, with higher tiers covering more sites.

Some limits apply on every plan, and you should know them before you rely on the plugin:

• The controls live inside WP Admin. We have seen a security or two-factor plugin lock a site’s owner out of the dashboard, which took the backup buttons with it. The manual route above still works in that situation.
• Each site has its own dashboard. Managing several sites means logging into each one, or adding UpdraftCentral, which is a separate product.
• Labelling is minimal. Existing Backups identifies a set by date and time only, and we found no way to rename one or add a note, so a pre-update backup can be hard to spot.
• The interface takes getting used to. It looks a lot like the standard WordPress admin screens, which can confuse beginners.
• Security tools aren’t included. Malware scanning, cleanup, and a firewall need a separate security plugin.

Match those limits to your situation:

• A small blog or brochure site. The free plugin with one remote destination and an occasional test restore is enough.
• A store, membership, or booking site. Premium’s pre-update and incremental backups fit better, since a daily full backup can lose a day of orders.
• A large site, several client sites, or a site where being locked out is unacceptable. Plan for more than the free plugin, either Premium with a rehearsed manual restore or a managed service.

If you’re weighing your options, our detailed BlogVault vs. UpdraftPlus comparison breaks down the differences in backup storage, restoration, staging, and recovery access.

Check your UpdraftCentral connections after the October 2026 incident

Several of those limits push people toward UpdraftCentral, so it’s worth knowing what went wrong with it in October 2026. TeamUpdraft reported unauthorized access to teamupdraft.com over the weekend of October 17 and 18. Attackers then used stolen UpdraftCentral connection keys to create administrator accounts and install malicious plugins on some sites.

You can have a connection without ever choosing one. The Add this website to UpdraftCentral box is ticked by default when you link a site to a teamupdraft.com account. TeamUpdraft says free users with no account and no connection key only need to keep the plugin updated. It also asked Premium users to check their sites even if they had never used UpdraftCentral. Self-hosted UpdraftCentral was not affected.

1. Update to 1.26.13 or later (1.26.14 is current) on each site’s own dashboard. This disconnects older connections, but it does not remove accounts or plugins an attacker already added.
2. Delete your keys under Settings > UpdraftPlus Backups > Advanced Tools > UpdraftCentral > Manage existing keys.
3. Review your users and plugins for administrators or plugins you didn’t add.
4. Change your passwords. Update your administrator passwords and your teamupdraft.com password, reset two-factor authentication there, and reconnect UpdraftVault if you use it.
5. Rotate remote storage credentials if you managed the site through UpdraftCentral, as TeamUpdraft recommends.
6. Restore an older backup if you find signs of a compromise. Choose one taken before October 17, then update and inspect the site.

Step 6 is where your retention setting pays off. A site that keeps only a few recent sets may have nothing from before the attack to restore.

When a managed backup service fits better

If all of this sounds like more upkeep than you want, a managed service handles storage, restore testing, and emergency recovery together. BlogVault, for example, stores encrypted copies away from your host automatically, takes incremental backups, and offers one-click restores.

Its external dashboard lets you restore a site even when you’re locked out of WP Admin, and its Emergency Connector covers sites where WordPress won’t load. Compare its plan limits against the routine you would otherwise maintain yourself.

FAQs

What does UpdraftPlus back up?

Your database, plugins, themes, uploads, and other files, stored as five components in one set. The free plugin leaves out WordPress core files, wp-config.php, and .htaccess.

How do I restore my UpdraftPlus backup?

Open Existing Backups, click Restore beside the set, choose your components, and click Restore again. Wait for the “Restore successful!” message, then test the site.

How do I download an UpdraftPlus backup to my computer?

Use Existing Backups. Click a component, choose Download to your computer, and repeat for every component, keeping the database .gz file and the .zip files together.

Will restoring a backup delete my newer posts and orders?

Yes, if you restore the database. The restore replaces your current database with the older one, so download the site’s current state first if it still partly works.

How do I delete old backups?

Find the set under Existing Backups and click Delete. This removes it from your server, so check your remote storage separately if you also want older remote copies cleared.

Why is my backup slow or failing on a large site?

Large file counts and big databases push against host limits such as memory, execution time, and I/O. Schedule backups for quiet hours, ask your host about those limits, and test a restore before you depend on it.

Conclusion

That list of dated backups can bring your site back, as long as each set is complete, stored away from your server, kept long enough, and restored at least once as a test.

UpdraftPlus gives you the tools for all of that, and the rest is routine you can handle one step at a time. Start today by opening Existing Backups, checking that your newest set contains every component, and restoring it onto a test site before you ever need it for real.

Written by

Akshat Choudhary

Akshat is the founder and CEO of BlogVault, MalCare, and WP Remote.