Best WordPress Backup Plugins With Off-Site Storage
A backup stored on the same server as the site is not a backup. It is a second copy of the same risk. Every scenario that destroys the site, a compromised server, a hosting account suspended, a provider failing, a disk lost, takes the copy with it, and the one scenario it does protect against, an update breaking your layout, is also the least serious.
Off-site is therefore the whole requirement, and it comes with a cost structure nobody prices in advance: where the files go, how much you pay to keep them, and what it costs to get them back. This article covers the storage economics, the incremental-versus-full trade, and the restore test almost nobody runs.
Verified August 2026. Prices confirmed against vendor pages.
Why same-server backups fail when needed
Four failure modes, and the same-server backup survives none of them. A compromise gives the attacker your backup directory along with everything else, and encrypting or deleting backups is standard practice precisely because it removes your options. A suspension, whether for a payment dispute, a terms violation, or because the host believes you are sending spam, locks you out of the account holding both copies.
Provider failure is rarer and total. Hosting companies do go under, sometimes abruptly, and “we have backups” from a company that has stopped answering the phone is not a recovery plan. And infrastructure loss, a failed disk or a data centre incident, takes whatever shares that infrastructure.
The rule of thumb worth adopting is that a backup must survive the loss of the account it protects. If you can only reach it by logging into the same hosting control panel, it does not.
The 6 options compared
1. UpdraftPlus
The most widely used backup plugin, and the one with the best licensing economics for anyone running more than one site. Premium runs Personal $70 a year for 2 sites, Business $95 for 10, Agency $145 for 35, Enterprise $195 for unlimited, and Gold $399 with unlimited sites and 50GB of storage; the lower tiers include 1GB.
Its model is bring-your-own-storage, which is the important structural point. The free version already sends backups to Dropbox, Google Drive, Amazon S3 and similar, so you can have genuine off-site backups for nothing using storage you already pay for or get free. Premium adds incremental backups, which back up only what changed and are the difference between a workable schedule and a nightly full copy of a 5GB site. At $195 for unlimited sites it is dramatically cheaper than per-site managed services, at the cost of managing your own destinations and retention.
- Price: Free with off-site destinations; Premium $70 to $399/yr
- Storage: Yours, or 1GB included, 50GB on Gold
- Best for: Multi-site owners and anyone wanting free off-site backups
- Watch out for: Incremental backups are premium only
2. BlogVault
Managed backups with storage included, which removes the configuration burden entirely. Personal is $99 a year for one site or $299 for five, Business $299 or $899, and WooCommerce $499 or $1,499, with storage bundled at every tier.
Read the tiers as three different retention and frequency products. Personal gives daily backups, 30-day retention and 20GB; Business gives twice-daily, 90-day retention and 50GB; WooCommerce gives real-time backups at one-hour intervals, 365-day retention and 100GB. Retention is the number to buy on. A compromise discovered in week six is unrecoverable from a 30-day archive, and that scenario is common enough that a content site with infrequent changes should think hard before choosing the cheapest tier. Staging is included, one day on Personal, thirty on Business, six months on WooCommerce, which makes restore testing practical rather than theoretical.
- Price: $99, $299 or $499 a year for one site
- Storage: Included, 20GB to 100GB by tier
- Best for: Sites wanting backups handled with staging included
- Watch out for: 30-day retention on Personal is short for compromises
3. Jetpack VaultPress Backup
Real-time backup from Automattic, storing copies on their infrastructure with a one-click restore that works even when the site is entirely unreachable, which is the scenario that matters most and the one self-managed backups handle worst.
Real-time here means every change is captured as it happens rather than on a schedule, so an ecommerce site does not lose the orders placed between the nightly run and the incident. That is the case where real-time genuinely earns its price and where scheduled backups quietly cost you money. The restore-from-anywhere property is the other differentiator: because the backups and the restore mechanism live outside your hosting, a completely dead site is recoverable from a phone. Confirm current pricing and storage allowances directly, as the plans are periodically restructured, and check the retention window against the tier you are pricing.
- Price: Confirm current tiers with the vendor
- Storage: Included, by tier
- Best for: Stores and sites where minutes of data loss matter
- Watch out for: Check retention length, not just backup frequency
4. WPvivid and BackWPup
Two capable free plugins that send backups off-site without a licence, and the honest budget answer for a small site. Both support the usual remote destinations, both schedule, and both do the essential job at no cost.
What you give up against paid tools is mostly convenience and confidence: incremental backups, one-click restore into a fresh environment, staging, and a support channel when a restore misbehaves at an unhelpful hour. For a brochure site, a portfolio, or a blog that changes weekly, that trade is entirely reasonable, and a free plugin writing nightly to cloud storage you already have is enormously better than the paid tool you did not buy. The failure mode to avoid is the one these share with every self-managed option: nobody checks the backups are still running until the day they are needed.
- Price: Free, with paid upgrades available
- Storage: Yours, via cloud destinations
- Best for: Small sites with infrequent changes and a tight budget
- Watch out for: No alerting when a scheduled backup silently stops
5. Duplicator and All-in-One WP Migration
Migration tools that produce a complete portable package of a site, frequently recommended as backup plugins and better understood as something adjacent.
Their strength is the single-file archive that rebuilds a site anywhere, which makes them excellent for moving hosts, spinning up a copy for development, and taking a deliberate snapshot before a major change. Their weakness as a backup strategy is that they are manual by nature: an archive you remember to create is not a backup regime, and the moment you need one is exactly the moment you last thought about it three months ago. Use them alongside a scheduled backup, not instead of one, and keep the pre-upgrade snapshot habit, which is genuinely valuable and takes two minutes.
- Price: Free versions; paid tiers for larger sites
- Storage: Wherever you put the archive
- Best for: Migrations and deliberate pre-change snapshots
- Watch out for: Manual by design; not a backup regime
6. Your host’s backups, understood properly
Usually included, usually adequate for the common case, and usually misunderstood in three specific ways worth checking today rather than during an incident.
Where do they live? If the answer is the same infrastructure as your site, they fail the survival test above. How long are they kept? Many hosts retain seven or fourteen days, which is short against a compromise you discover in week three. Can you restore selectively? Rolling back the whole account to Tuesday also discards Wednesday’s orders and Thursday’s posts, and file-level or table-level restore is what you actually want. Host backups are a reasonable first layer and a poor only layer. Keep them, and keep something independent as well, because the point of a second copy is that it is not subject to the same failure.
- Price: Usually included in hosting
- Storage: Frequently the same infrastructure as the site
- Best for: A convenient first layer for recent mistakes
- Watch out for: Short retention and all-or-nothing restores
Comparison table
| Option | Price | Storage | Incremental | Retention |
|---|---|---|---|---|
| UpdraftPlus | Free; $70 to $399/yr | Yours; 1GB to 50GB | Premium only | Your choice |
| BlogVault | $99 to $499/yr | Included, 20 to 100GB | Yes | 30, 90 or 365 days |
| Jetpack VaultPress | Confirm with vendor | Included | Real time | By tier |
| WPvivid / BackWPup | Free | Yours | Limited | Your choice |
| Duplicator / AIOWPM | Free and paid | Yours | No | Manual |
| Host backups | Included | Often same infrastructure | Varies | Often 7 to 14 days |
Test the restore, because almost nobody does
An untested backup is a hypothesis. The failure that catches people is never “there was no backup”, it is “the backup was incomplete”, “the archive was corrupt”, “it had been failing since March”, or “the restore needed more memory than the server had”. All four are discoverable in an hour, once a year.
- Restore into a staging site, not over the live one. BlogVault includes staging on every tier; otherwise use a subdomain or a local environment.
- Check the database restored, not just the files. A site that loads with no posts means the archive contained files only, which is a common and quiet misconfiguration.
- Log in. If user tables did not come across, you have a copy of your content and no way into it.
- Check uploads. Large media directories are the most frequent thing excluded to keep archives small, usually deliberately and usually forgotten.
- Time it. Knowing a restore takes forty minutes changes what you promise a client during an incident. Guessing does not.
- Then check the schedule is still running. Backups stop silently when a password changes, storage fills, or a cron job breaks. Set an alert for a missing backup, not just for a failed one.
On storage costs: cloud storage is cheap to fill and can be expensive to empty. Some providers charge egress fees for downloading data out, which is precisely what a restore does, and a large site pulled back during an emergency is the moment to have already known that number. Object storage aimed at backups frequently has no egress charge, which is worth more than a slightly lower per-gigabyte rate.
Related guides
Frequently asked questions
How often should I back up?
As often as you would mind losing work. A blog posting weekly is fine on daily backups; a store taking orders hourly needs real-time, because a nightly schedule means losing up to a day of transactions.
How long should I keep backups?
Long enough to predate a compromise you have not yet noticed, which argues for months rather than days. Thirty days is the common default and is short; ninety is a better target for anything important.
Is incremental backup worth paying for?
Above a few gigabytes, yes. Full nightly backups of a large site consume storage and server resources disproportionately, and the slowdown during the run is noticeable. Below that, full backups are simpler and fine.
Can I restore if my host has suspended the account?
Only if the backups live elsewhere and you can reach them without that account. This is the scenario that makes off-site storage non-negotiable rather than merely advisable.
Do backups protect against being hacked?
They let you recover, which is different from being protected. Restoring without closing the original hole reproduces the compromise, often within days, so treat the restore as one half of the job.
Should I keep backups in more than one place?
For anything that would be painful to lose, yes. Two destinations with different providers costs little and removes the single point of failure that is the whole premise of this article.
The verdict
For most sites: UpdraftPlus. The free version already sends backups off-site to storage you probably already have, which is the entire requirement met for nothing. Premium from $70 a year adds incremental backups, and $195 covers unlimited sites.
If you would rather not manage it: BlogVault from $99 a year with storage and staging included, choosing the $299 Business tier if 90-day retention matters more than the price difference.
If you run a store: real-time backup, whether BlogVault’s WooCommerce tier or Jetpack VaultPress. A nightly backup means losing a day of orders, and that is a number you can calculate.
Then restore one, into staging, this month. Check the database came back, log in, look at the uploads, and time it. An untested backup is a plan you have never read.
