WordPress Backups and Staging: A Safe Update Routine
- What should you back up?
- Where should backups be stored?
- How often should you back up?
- How do you test a restore?
- What is a staging site?
- What is a safe update routine?
- What about automatic updates?
- What should you do if an update breaks the site?
- What should you check before changing PHP versions?
- What mistakes should you avoid?
- How does DAB handle this?
- Need help with WordPress updates and backups?
- FAQ
Before updating WordPress, take a full backup (files and database) stored away from your server, apply the updates on a staging copy, test the pages that earn you enquiries, then update the live site and check it again. Keep several backup versions and test a restore occasionally, because an untested backup may not work.
Most WordPress problems after an update are avoidable. A plugin conflicts with a new version, a theme stops working with a newer PHP, or a page layout breaks. With a good backup and a staging copy, these become small, fixable events instead of emergencies. This guide explains what to back up, how staging works and a routine you can follow.
Key takeaways - Back up files and the database, and store a copy away from your hosting account. - Test a restore. A backup you have never restored is a guess. - Use a staging site to try updates before they reach the live site. - Keep staging out of search results. - Update in a planned order, check key pages after each update and avoid busy trading periods.
What should you back up?
A WordPress site has two parts, and you need both:
| Part | What it contains |
|---|---|
| Files | Themes, plugins, uploads (images and documents), configuration files |
| Database | Pages, posts, settings, users, form entries, and orders for online stores |
A backup of only one part cannot restore a working site. Many hosts offer backups, and many plugins and services can create them too.
Where should backups be stored?
Do not rely only on backups kept in the same hosting account as your site. If the account is suspended, hacked or deleted, the backups go with it. A simple rule is to keep several copies, in more than one place, with at least one away from your hosting provider, such as cloud storage. Protect the stored backups with a strong password and, where possible, encryption.
How often should you back up?
Match the frequency to how often the site changes:
| Type of site | Suggested approach |
|---|---|
| Brochure site that rarely changes | Weekly, and before every update |
| Site with regular blog posts or enquiries | Daily |
| Online store with orders | Frequent database backups, plus daily full backups |
These are suggestions. If you could not afford to lose a day of orders or enquiries, back up more often. Keep several versions, not only the latest, because a problem may not be noticed straight away.
How do you test a restore?
- Restore the backup to a staging site or a test environment, not the live site.
- Open the restored site and check key pages, forms and, for stores, the checkout.
- Confirm that images, menus and plugins work.
- Note how long the restore took and any steps that were unclear.
- Repeat this check a few times a year, and after changing hosting or backup tools.
What is a staging site?
A staging site is a private copy of your website where you can test changes without affecting visitors. Many hosts offer one-click staging, and some plugins can create it. You apply the update on staging, check that everything works, and only then repeat it on the live site.
Staging must be set up carefully:
- Keep it out of search results. Block indexing and protect it with a password so Google does not treat it as a duplicate of your site.
- Turn off live emails and payments. Staging should not send real customer emails or take real payments.
- Do not overwrite the live database on a site that takes orders. Pushing a staging database to the live site can delete orders and form entries made in the meantime. Move only the changes you need.
What is a safe update routine?
- Review the updates. Note which plugins, themes and WordPress core updates are available, and read the changelogs for major changes.
- Back up. Take a full backup and confirm it completed.
- Update on staging. Apply the updates to the staging copy first.
- Test. Check the homepage, main service pages, contact and enquiry forms, search, login, and for stores, add to cart and checkout. Check mobile as well as desktop.
- Choose a quiet time. Avoid your busiest hours and big campaign or sale days.
- Update the live site. Apply the same updates, in small groups so you can tell which one caused a problem.
- Test again. Repeat the key checks on the live site.
- Monitor. Watch for errors in the days after, and keep the backup until you are satisfied.
Apply security updates promptly. For feature updates, a planned schedule, such as weekly or monthly, is easier to manage than updating whenever you remember.
What about automatic updates?
WordPress applies minor security releases of its core software automatically by default, and you can switch on automatic updates for plugins and themes. Newer installations may also update to major versions automatically unless that is switched off. Automatic updates save time, but a faulty update can break the site while nobody is watching. Many businesses use automatic updates for small, low-risk plugins and handle larger or business-critical ones manually, with backups and testing.
What should you do if an update breaks the site?
- Do not panic and do not make many changes at once.
- Note what you updated and when.
- If you can, switch off the plugin or theme you updated most recently.
- If that does not fix it, restore the latest good backup.
- Reapply updates one at a time on staging to find the cause.
- If you are unsure, ask your developer or maintenance provider before changing more.
If the site goes down, see what to do when your website is down.
What should you check before changing PHP versions?
PHP is the language WordPress runs on. Hosts update it periodically, and old themes and plugins may not work on newer versions. Before changing PHP, check that your theme and plugins support the new version, test on staging, and keep a backup.
What mistakes should you avoid?
- Keeping the only backup on the same server
- Never testing a restore
- Updating the live site without a backup
- Leaving staging open to search engines
- Pushing a staging database over a live store
- Updating everything at once
- Ignoring updates for months
- Updating during a major sale or campaign
For related security topics, read what to do in the first 24 hours after a WordPress site is hacked and how to protect your website from attackers.
How does DAB handle this?
DAB provides website maintenance services billed hourly from ฿1,000 per hour, and has 18+ years of experience building and maintaining websites in Thailand. Our WordPress services include updates, backups and testing as part of keeping your site healthy.
Need help with WordPress updates and backups?
If you would rather not manage updates and backups yourself, contact DAB through LINE or our contact page. See how our website maintenance services work.
FAQ
How many backups should I keep?
Keep several versions, not only the latest. A problem may only appear days later, and you may need an older copy.
Is my hosting company's backup enough?
It is a good start but not enough on its own. Keep a copy away from your hosting account and test that you can restore it.
Do I need a staging site for a small website?
It is helpful for any site that earns enquiries or sales. Even a small site can break after an update, and staging lets you find out safely.
Can I update WordPress without a backup?
It is risky. Always take a backup first, so you can go back if something breaks.
Should I turn on automatic plugin updates?
For small, low-risk plugins it can be fine. For important plugins and your theme, a tested, planned update is safer.