On the night of March 9 to 10, 2021, a fire tore through OVH’s data center in Strasbourg. Among the customers hit, a network of home renovation franchises lost its server and its backup at once. Its daily backup, replicated three times, sat in the same building as the server.
Its latest known chapter played out before the Douai Court of Appeal in April 2025, and it contains almost everything there is to know about backing up a website. We tell it in detail below.
Its lesson fits in one sentence: a backup is only worth the restore you have tested, from a place the same incident cannot reach.
The ten solutions compared here are judged on that standard: how you restore, where copies are stored, what they really cost, and what they do not do.
How we ranked them
We used six criteria. The first is the restore path: from the admin, and above all when the site no longer responds. The second is storage off the server. The third is incremental backup, which only copies what changed and lightens the load on large sites.
Then come database consistency (a store taking orders during the backup), WordPress Multisite support, and the real price, renewal included. Install counts and prices were read in October 2026 on WordPress.org and on the vendors’ official pages.
The 3-2-1 rule in one minute
The US Cybersecurity and Infrastructure Security Agency (CISA) sums it up this way: three copies of important files, on two different types of storage media, one of them off-site. It adds two instructions people often forget: test the restore procedure, both full and partial, and be able to roll back at least seven days.
The WordPress documentation says the same. It recommends keeping at least three to five recent backups in different locations, and occasionally doubling automatic backups with a manual one to check that the process works.
Backup, restore, recovery: three different things
A backup is a copy. A restore is the operation that brings that copy back into service, with its delays and pitfalls: a database too heavy for the import tool, missing media, URLs to rewrite. A disaster recovery plan describes who does what, in which order and on which fallback infrastructure, once the server is gone.
The plugins on this list mostly handle the first, sometimes the second. The third remains your job. Two figures help you frame it: the downtime your business can accept, and the amount of data you can afford to lose, which is the interval between two backups.
What WordPress does on its own, and what it does not
WordPress has no backup feature. Since version 6.3, it keeps a temporary copy of a plugin or theme during a manual update so it can roll back on failure, and since 6.6 it rolls back a plugin’s automatic update when it triggers a fatal error. These are one-off safety nets: they do not let you go back to last week’s state.
1. UpdraftPlus: the free benchmark
What it does
UpdraftPlus, with more than 4 million active installs, schedules backups of files and database and sends them to remote storage. The plugin is now sold under the TeamUpdraft brand. Archives are standard zip and SQL files, which you can restore by hand if the plugin is no longer available.
Strengths
The free version already sends backups to Google Drive, Dropbox, Amazon S3, an FTP server and other destinations. Restoring happens from the admin, component by component: plugins, themes, uploads, database. If the site is gone, you reinstall WordPress and the plugin, then rescan the remote storage.
Limits
The free version offers no incremental backup, no database encryption, no automatic backup before updates, and no multisite support. The restore runs in PHP inside the site being restored, which can hit time limits on a large site, even though the documentation provides for resuming.
Price and audience
Premium starts at $70 per year for two sites, in October 2026. The free version with remote storage is the sensible default for a small budget. It also appears in our selection of essential WordPress plugins.
2. BlogVault: backups that do not weigh on the server
What it does
BlogVault is an online service: the plugin on your site is a connector, but backups are processed and stored on the vendor’s infrastructure. Copies are therefore off your server from the start.
Strengths
Every plan is incremental. Restores start from the BlogVault dashboard, including when the site is offline, and a differential restore speeds up recovery. The WooCommerce plan captures orders in real time. Multisite is only included from the Business plan up ($299 per year at list price), with up to 25 subsites, 100 on the WooCommerce plan.
Limits
You do not choose the storage destination: it is BlogVault’s servers, with the option to download copies. The price is per site, which adds up quickly for an agency. The pricing page shows a 50% discount against list price, so check what you will pay at renewal.
Price and audience
The Personal plan lists at $99 per year per site, for daily backups kept for 30 days. BlogVault suits WooCommerce stores and sites whose server should not carry the backup load.
3. Jetpack VaultPress Backup: real time, no multisite
What it does
Automattic’s backup, built into Jetpack or available as a standalone plugin, records changes in real time and stores them on Jetpack’s servers. Each change appears in an activity log, with a “Restore to this point” button.
Strengths
No server-side configuration, full, incremental and differential backups, and an option specific to stores: restoring the site while keeping orders and products current. When the site is down, the restore goes through the server’s SSH or SFTP credentials.
Limits
Jetpack says so itself: VaultPress Backup does not support WordPress Multisite. The documentation also warns that a restore completely replaces the database. The displayed price is a first-year rate that doubles at renewal.
Price and audience
The regular price is $9.95 per month billed yearly ($119.40 per year), or $14.95 billed monthly, with 10 GB of storage and a 30-day archive. VaultPress Backup suits single sites and stores that want real time with nothing to configure.
4. Duplicator: migration first
What it does
Duplicator, with more than one million installs, creates a “package”: an archive of the site plus an installer.php file that deploys it on any server. It was born to clone and move sites, and backups came later.
Strengths
The free version handles encrypted archives of any size, with one-click restore. Its only online storage is Duplicator Cloud, the vendor’s own space, sold separately; other destinations (Dropbox, Google Drive, S3, FTP) and scheduled backups require a paid license. It lets you choose the archive engine and the database export method, including mysqldump. From the Basic plan up, a recovery point lets you restore even when the admin no longer responds, through a recovery link to keep outside the site.
Limits
Duplicator states it in its knowledge base: every backup is complete, never incremental. On a large site, that weighs on disk space and on the server. Multisite is only available from the Pro plan. And the installer file must be deleted after use, since it is a security risk.
Price and audience
The Basic plan lists at $79 per year for two sites, the Pro plan at $399. Duplicator suits migrations first, as our guide on how to migrate a WordPress site without downtime shows, and agencies that move sites between hosts.
5. WPvivid: the most complete free version
What it does
WPvivid, with more than 900,000 installs, combines backup, migration and a staging site. Its free version sends backups to Dropbox, Google Drive, Amazon S3, OneDrive, DigitalOcean Spaces, FTP or SFTP, and restores in one click from the admin.
Strengths
Its free version is one of the most complete in this list, staging included. WPvivid also sells lifetime licenses, useful to agencies.
Limits and security
Incremental backup, multisite and database encryption are reserved for the Pro version. Above all, a critical flaw was fixed in January 2026 in version 0.9.124: an unauthenticated file upload allowed code execution in versions up to 0.9.123. Exploitation required the option to receive a backup from another site to be active.
It is not an isolated case: a backup plugin reads and writes your whole site, so it is part of the attack surface. Update it like everything else, following the WordPress security measures that really matter.
Price and audience
The Blogger plan costs $49 per year for two domains, or $99 for life. WPvivid suits single sites that want the most without paying.
6. BackWPup: many destinations, manual restore in the free version
What it does
BackWPup, in the directory since 2009 and now developed by WP Media, backs up files and database to a long list of free destinations: Amazon S3, Dropbox, Azure, FTP, FTPS and others. It has more than 400,000 installs.
Strengths
Multisite is supported from the free version, which is rare. Jobs can be triggered from the command line in both editions.
Limits
In the free version, restoring is manual: you upload the archive yourself. One-click restore, encryption and a standalone restore app that works without WordPress are Pro features. The current documentation does not mention incremental backups.
Price and audience
The Starter plan costs $49 per year for two domains. BackWPup suits small budgets that want many destinations and can restore by hand, as well as cost-conscious multisites.
7. Backuply: simple, with its own storage
What it does
Backuply, from Softaculous, with more than 600,000 installs, offers local backup, one-click restore and upload to FTP or Google Drive for free. Paid versions add scheduled automatic backups, many destinations, backup rotation and storage space with the vendor.
Strengths and limits
The tool is simple and inexpensive. On the other hand, scheduled backups are paid, and the pricing documentation does not mention incremental backups or multisite. The Backuply Cloud plan, at $18 per year with 10 GB, is enough to schedule backups to the vendor’s storage; the Personal plan, at $39, adds the other destinations.
What about Solid Backups?
You will look in vain for Solid Backups. In May 2026, Liquid Web stopped selling SolidWP products separately. The former BackupBuddy, now Kadence Backups Legacy, is in maintenance mode. The active product, Kadence Backups (formerly Solid Backups NextGen, with backups stored by the vendor and managed from Kadence Central), is included in the Kadence Pro ($299 per year) and Elite plans. Existing customers keep their plans.
8. All-in-One WP Migration: a migration tool, not a strategy
What it does
All-in-One WP Migration, with more than 5 million installs, exports an entire site into a single .wpress file that you import elsewhere. For moving a small site, it is remarkably simple.
Why it is not enough as a backup
In the free version, import is limited by the maximum upload size your host allows. Scheduled backups and cloud uploads are paid extensions, as is multisite. The format is proprietary, and no copy leaves the server without intervention.
Price and audience
The Unlimited extension costs $69 per year, for up to 50 sites; the Pro plan, at $99 per year, adds online storage and scheduled backups. The tool suits one-off migrations and manual snapshots of small sites, not an automatic daily backup.
9. Host backups: useful, never sufficient
What they provide
Most managed WordPress hosts take a daily backup and offer one-click restore. It is fast, consistent at the server level, and often the first resort after a mistake.
Where they stop
Read where they are stored. At Kinsta, standard backups sit on the same machine as the site, and a paid add-on is needed to send them to Amazon S3 or Google Cloud. At WP Engine, they are off the server, on Amazon S3, but in the same region and with the same provider.
In both cases, an account suspension, an accidental deletion or an incident at the provider can take the site and its copies together. Host backups may tick the off-site box, but never that of a copy with another provider, under other credentials. Our comparison of WordPress hosting providers details what each one offers.
10. wp db export: the command-line benchmark
What it does
WP-CLI’s wp db export command runs mysqldump with the credentials from wp-config.php and produces a standard SQL file. It is the yardstick for every plugin: can your tool give you an SQL export any server can read?
The detail that matters
WP-CLI does not add the --single-transaction option by default. Yet that option is what produces a consistent snapshot of an InnoDB database without locking the site, which matters on a store recording orders during the export:
wp db export --single-transaction - | gzip > db-$(date +%F).sql.gzThen copy the file off the server, along with the files in the wp-content folder, and test the restore with wp db import on a test copy. The other essential WP-CLI commands round out this routine.
Limits and audience
You need SSH access, the command only backs up the database, and it handles neither scheduling nor rotation without a cron job. It suits developers and agencies, alongside a plugin or a service.
The real case: the OVH fire and what the courts said about backups
The France Bâti Courtage versus OVH case is one of the best documented there is, because it went to court twice. It illustrates the 3-2-1 rule almost word for word.
The night of March 10, 2021
The fire started on the ground floor of the SBG2 building at OVH’s Strasbourg site. It destroyed that building, part of the neighboring SBG1 building, and affected SBG3. The report of the French industrial accident investigation office (BEA-RI), published in May 2022, noted that the power rooms had fire detection but no automatic extinguishing system.
That same morning, Netcraft measured some 3.6 million websites offline. Offline does not mean lost, but some customers, like the one in this case, also lost their backups.
Three copies, one building
France Bâti Courtage runs the “La maison des travaux” franchise network. Its business runs almost entirely through its website, with 183 subdomain sites for its 123 franchisees. The company rented a virtual private server from OVH and, since 2018, the automated backup option: a daily backup replicated three times, stored according to the contract in a space “physically isolated” from the server’s infrastructure.
Yet the server and its backup were in the same building. On April 9, 2021, OVH confirmed both were unrecoverable. The company rebuilt its sites from old data it had kept, and recovered the list of its more than 25,000 URLs through Google Search Console.
From €101,102 to €1,800
In January 2023, the Lille Métropole commercial court ordered OVH to pay €94,102 in damages, plus €7,000 in legal costs. It set aside force majeure and the contract’s liability caps.
On April 24, 2025, the Douai Court of Appeal confirmed that OVH had breached its obligation: a backup must make it possible to restore the data. But it ruled that “physically isolated” storage means distinct infrastructure, not necessarily geographic distance. Above all, it applied the liability caps agreed between professionals: OVH now owed only €1,800.48.
The court also noted that OVH offered a separate disaster recovery option, which the customer had not taken. Under this contract, backup and business continuity were two separate services.
What it means for a WordPress site
Three copies in the same building are worth a single copy in a fire: the “1 off-site” of the rule is what was missing. A hosting contract is read to the letter, and its liability cap, here six months of fees for the services concerned, sets what you get back, whatever you lose.
The only real protection is a copy you control, with another provider, that you have already restored at least once. The company only recovered its URL list afterwards, through Google Search Console, and argued that the URLs had become worthless in the meantime. So keep your own export of your URLs and redirects.
How to choose
Start with the restore question, not with the feature list. Ask yourself how you will bring the site back online if the server has disappeared, and how long it will take.
Test a restore
At least once a quarter, restore a backup onto a test copy. Check that the site displays, that login works and that media are present, and time the operation. Write down the procedure: on incident day, nobody wants to rediscover it.
WooCommerce: do not overwrite orders
Restoring a store’s database replaces the orders placed since the backup. Prefer a solution that handles this (Jetpack, BlogVault on its WooCommerce plan), or restore onto a copy and recover the missing orders before switching over. Cross-check this choice with the WooCommerce plugins that write to your database.
Multisite
Check support before buying: Jetpack does not handle it, UpdraftPlus and WPvivid reserve it for their paid versions, Duplicator for its Pro plan, and BackWPup offers it for free.
Summary table
| Solution | Off the server | Incremental | Multisite | Entry price (Oct. 2026) |
|---|---|---|---|---|
| UpdraftPlus | Yes, with remote storage | Premium | Premium | Free, $70 per year |
| BlogVault | Yes, vendor servers | Yes | Business plan and up | $99 per year per site |
| Jetpack VaultPress Backup | Yes, vendor servers | Yes, real time | No | $119.40 per year |
| Duplicator | With a license or Duplicator Cloud | No | Pro plan | Free, $79 per year |
| WPvivid | Yes, with remote storage | Pro | Pro | Free, $49 per year |
| BackWPup | Yes, with a remote destination | Not documented | Yes, free | Free, $49 per year |
| Backuply | Yes, with a remote destination | Not documented | Not documented | Free, $18 per year (Backuply Cloud) |
| All-in-One WP Migration | Paid extensions | No | Paid extension | Free, $69 per year |
| Host | Depends on the host | Depends on the host | Whole account | Included or add-on |
| wp db export | If you copy it | No | Whole database | Free |
Frequently asked questions
Are my host’s backups enough?
Not on their own. They are convenient, but they depend on the same provider and often the same region, sometimes the same machine. In May 2024, Google Cloud mistakenly deleted the Australian pension fund UniSuper’s private cloud, in both of its regions at once. According to the joint statement, backups kept with another provider limited data loss; Google also cites copies that remained intact on its own storage. Always keep a copy with another provider.
How often should I back up?
As often as the amount of data you could accept to lose. Once a week is enough for a brochure site that rarely changes. An active blog needs a daily backup, a store at least a daily database backup, ideally real time. In every case, back up before each major update.
Are incremental backups reliable?
Yes, when the service can rebuild a complete backup from the changes. Some, like BlogVault, transfer only the changes but store each version in full. What matters most is testing a real restore.
Where should I store my backups?
With a provider other than your host, using credentials the site does not know, so that an intruder who takes over the site cannot delete them. Ideally, add one more copy that is offline or immutable.
Is my backup plugin a security risk?
It can be, since it handles the whole site. Flaws have affected WPvivid in 2026, UpdraftPlus in 2022 and Backup Migration in 2023. Keep it updated, and avoid leaving downloadable archives in a public folder.
Conclusion
The choice of tool matters less than three habits: a copy outside your host, several generations of backups, and a restore tested regularly. Free UpdraftPlus or WPvivid, sent to remote storage, already covers the essentials for a small site. A store will gain from paying for real time.
The Strasbourg fire reminded thousands of businesses of this: a backup that has never been restored, stored in the same place as the server, protects against very little. In this case, the appeal court added that the hosting contract paid back almost nothing.
Sources
- CISA. Back Up Business Data
- WordPress Advanced Administration Handbook (June 2026). Backups
- Make WordPress Core (July 11, 2023). New in 6.3: Rollback for failed manual plugin and theme updates
- TeamUpdraft (October 2026). UpdraftPlus: Free vs Premium
- BlogVault (October 2026). Pricing
- Jetpack (October 2026). VaultPress Backup
- Duplicator. Advanced Data Migration Strategies
- BackWPup. What is the difference between BackWPup Free and BackWPup Pro?
- NVD (February 2026). CVE-2026-1357
- Liquid Web (2026). A New Era for WordPress: One Suite, Four Powerhouse Tools
- Kinsta Docs. WordPress backups
- WP Engine Support (June 2026). How to Backup and Restore Your Site
- WordPress Developer Resources. wp db export
- MariaDB Docs. mariadb-dump
- BEA-RI (May 24, 2022). Investigation report on the fire at the OVH data center in Strasbourg (in French)
- Netcraft (March 10, 2021). 3.6 million websites taken offline after fire at OVH datacenters
- Legalis. Lille Métropole commercial court, judgment of January 26, 2023 (in French)
- Douai Court of Appeal (April 24, 2025). OVH v. France Bâti Courtage, RG 23/00858 (in French)
- LeMagIT, Yann Serra (April 30, 2025). Incendie de 2021 : OVHcloud gagne en appel face à Bâti Courtage
- UniSuper (May 8, 2024). A joint statement from UniSuper and Google Cloud
- BleepingComputer, Bill Toulas (February 2026). WordPress plugin with 900k installs vulnerable to critical RCE flaw
- Search Engine Journal (May 13, 2026). Liquid Web WordPress Plugin Rebrand Triggers Backlash
- Nexcess Docs (September 2026). Handling Kadence Backups: Legacy vs NextGen
- Liquid Web (October 2026). Kadence plans
- TeamUpdraft (October 2026). UpdraftPlus Premium pricing
- Duplicator (October 2026). Pricing
- WPvivid (October 2026). Pricing
- BackWPup (October 2026). Pricing
- Backuply (October 2026). Pricing
- ServMask. Unlimited Extension
- Google Cloud (May 2024). Details of Google Cloud GCVE incident
- Make WordPress Core (June 25, 2024). WordPress 6.6 Field Guide
LaFactory designs, builds and maintains WordPress and WooCommerce sites, with tested backups and restores, and develops its own plugins. Talk to us about your WordPress project.