Off-site vs on-site backup: where to safely keep your WordPress site copies

You have a WordPress site that brings you clients, orders, or at least the first impression of your business. The real question isn’t whether you need a backup, but where you keep it. This is where the discussion about off-site vs on-site WordPress backup begins: the same copy of your site can sit right next to it, on the same server, or far away, in a completely separate place. The difference looks like a technical detail, but on the day the server goes down, it decides whether you recover your site in ten minutes or lose it for good. And it’s not an exaggerated worry: sites go down for the most mundane reasons, from a bad update to an expired hosting account.

What on-site and off-site actually mean

An on-site backup is a copy kept in the same place as the site: on the same hosting account, the same server, sometimes even the same folder. It’s fast to create and fast to restore, because everything is within reach. In practice, most backup plugins save everything to your hosting account by default — so, from the start, on-site.

An off-site backup is the same copy, but moved outside the server: to a cloud like Google Drive, Dropbox or Amazon S3, to a dedicated backup server, or to a disk at home. If the main server disappears, the copy stays intact, because it was never there. The cost is minimal, and the peace of mind it gives you is disproportionately large.

Why an on-site backup alone leaves you exposed

An on-site copy handles small problems very well: you deleted a page by mistake, a plugin update broke something, you want to roll back to yesterday’s version. For these accidents, a copy on the same server is exactly what you need.

The trouble starts when the server itself goes down. Here are the situations where an on-site backup helps you with nothing:

• The hosting server fails physically or your account gets suspended.
• A ransomware attack encrypts the whole account, backups included.
• You accidentally delete the entire hosting account.
• The provider has a major incident and loses the data with no backup of its own.
• Someone compromises your account and deliberately deletes everything they find.

In every one of these scenarios, the copy sits next to the disaster and disappears with it. That’s why an on-site backup isn’t a complete strategy, only its first half.

Off-site vs on-site WordPress backup: the 3-2-1 rule

The simplest rule professionals use is called 3-2-1, and it solves exactly this dilemma. The name comes from three easy-to-remember numbers. The idea is not to choose between on-site and off-site, but to combine them: on-site for speed, off-site for safety.

In plain terms: you keep three copies of your site, on two different types of storage, and at least one lives completely off the server. The on-site copy gives you fast day-to-day restores, while the off-site one saves you in the rare but catastrophic case where the hosting vanishes entirely. You don’t have to do it all manually — a serious plugin sends the off-site copy automatically right after creating it locally. This combination is also why we include automatic off-site backups in every WordPress maintenance plan we manage.

How often to back up and how long to keep copies

Frequency depends on how often the site changes. A brochure site updated monthly doesn’t need the same rhythm as an online shop taking orders every hour.

• Brochure site: a full weekly backup is usually enough.
• Active blog: daily for files and database.
• WooCommerce shop: daily or even every few hours, so you don’t lose orders.

Retention matters just as much: keep at least 7 to 30 days of copies. If malware infects your site today but you only notice two weeks later, you’ll need an older, clean copy to return to. As an example, a shop that keeps 30 days of copies can roll back to the stock and orders from three weeks ago, not just yesterday’s. Older copies take up space, but they’re cheap in the cloud and can save your business.

A backup you haven’t tested isn’t a backup

This is where most site owners go wrong: they assume that if the plugin says “backup successful,” everything is fine. In reality, a corrupt or incomplete archive only reveals itself when you try to restore it — at the worst possible moment. A successful test means the restored site loads fully, with images, products and settings in place, not just an archive that unzips.

Test a restore periodically on a staging site and check the official documentation on WordPress backups to make sure you’re saving everything that matters: files, database and the wp-content folder. If you want an objective opinion on where you stand now, you can start with a free audit of your site.

Conclusion: don’t choose, combine

Off-site vs on-site backup isn’t a contest where only one wins. On-site gives you speed and convenience for minor accidents; off-site gives you the peace of mind that, whatever happens to the server, your site still exists somewhere. The 3-2-1 rule, a frequency matched to your traffic, and a restore tested now and then turn backups from a forgotten checkbox into a real safety net.