Your backup plugin might run every night, but have you ever restored one of its files? Until you test those nightly copies, you can’t know if they’d work after a hack. Secure backup and restore systems only prove they work through a test run, so schedule one before a breach forces a rushed recovery.
Our team at WP Guard, a managed WordPress security and maintenance service, handles those rushed recoveries for hacked websites. We manage remote storage for more than 1,000 WordPress installs and guarantee covered sites are clean and working again within 12 hours.
This guide covers three areas to check before an attack. We’ll walk through how long to keep copies, where to store them, and how to run a trial restore on staging.
Backup Retention Period: Keep Copies From Before the Malware Got In
Some infections stay hidden for months. The Japanese keyword hack, for example, shows spam pages to search engines while the site looks normal to logged-in owners. Even companies with full security teams miss breaches for months.
IBM’s 2026 Cost of a Data Breach Report found they took an average of 183 days just to identify one. A small site without round-the-clock monitoring may go even longer than six months.
So a plugin that keeps only 14 days of copies will hold a three-week-old infection in every one of them. A layered schedule closes that gap with three tiers of snapshots:
| Schedule | Keep For | Protects You If |
|---|---|---|
| Daily | Two weeks | A bad update or corrupted file breaks the site |
| Weekly | Eight weeks | Malware hid for a month before anyone noticed |
| Monthly | 12 months | An infection went undetected for most of a year |
That way, you can reach back a full year with 34 snapshots instead of 365, which cuts storage space and costs. Those restore points still won’t help if they sit on the same server the attacker just took over.
Why Offsite Storage Protects Backups When Your Server Gets Hacked
Offsite storage moves your backups to a different machine, account, or provider than your live website. Three weak points decide whether those copies survive a breach: where they sit, who can log in, and how many locations hold them.
Backups on Your Hosting Server Get Hacked Along With Your Site
Backups stored on your hosting server share the same folders and login as your live WordPress site, so one break-in gives attackers control of both.
Many backup plugins also store their archives inside the wp-content folder by default, right beside your site’s own files. We’ve opened those folders on compromised sites and found the attacker’s code inside the zip files too.
WP Guard’s managed offsite backups avoid that problem by storing a clean copy outside your hosting account, where an attacker on your server can’t alter or delete them.
Limit What Your Site Can Do in Storage
A remote account fixes the shared-server problem, but who else can open that account if an attacker takes over your site? Your plugin probably saves its link to Dropbox or Google Drive, so an intruder inside WordPress gets that access too (backup deletion included).
Secure offsite storage services like Amazon S3, Backblaze B2, and Wasabi can block that deletion with two features. Versioning lets you recover previous copies of each file, and object lock prevents anyone from deleting them for a set number of days.
A third safeguard comes from your provider’s settings. When upload-only permission is available, your site can add new archives but can’t erase existing ones.
Why Backups Need a Second Location
Logins won’t help if the building that houses your server floods or burns. Businesses handled that risk with paper decades ago by moving records to separate facilities, so one fire couldn’t destroy every document.
The website version is a duplicate in another region, which stays reachable when a disaster or outage knocks a data center offline. Online stores that hold shopper records may also have legal duties to keep that data protected and recoverable.
Does Regulatory Compliance Require Offsite Document Storage for Customer Data?
Often, though privacy and payment rules set protection and recovery standards and leave the exact location up to you. Offsite copies are one practical way to meet both standards.
WooCommerce stores often rely on payment gateways that never put card numbers on the site. That setup keeps card data off your server entirely.
If your store does keep cardholder details in its database, PCI DSS will require those backups to sit in a secure location. The store must also review that location’s security at least once every 12 months.
If you sell to customers in the EU, GDPR will expect you to restore their personal data in a timely way. (Its top fines reach €20 million or 4% of global annual revenue, whichever is higher.)
Client contracts and state regulations can also set their own retention rules. Your accountant or legal advisor can confirm how long you must keep customer records in offsite document storage to comply.
PCI DSS and GDPR both assume your backups restore cleanly, and a trial run on staging shows if yours do.
Test Your Disaster Recovery Plan With a Trial Restore on Staging
A backup can look complete in your dashboard and still fail the moment you try to restore it. CISA’s #StopRansomware Guide tells organizations to test their copies regularly in a disaster recovery scenario, so failures show up before an emergency.
Staging handles that testing without changing your live website, because it’s a private instance of your site that visitors never see. Some hosts run staging on the same server as your primary site, so schedule the restore process for a low-traffic hour.
Here’s how to test a WordPress backup once the staging copy loads:
- Pages Load Without Errors: Your homepage, menu links, and three inner pages should all open without errors. Broken images or 404 messages mean those files never reached the archive.
- Every Login Works: A clean sign-in proves your user accounts survived the transfer. An admin sign-in comes first, and a regular user with limited permissions comes second.
- Recent Content Appears: If last week’s posts, orders, or form entries are missing, you’ll know the database snapshot is older than it looks. Each missing day means permanent data loss.
- Malware Scan Passes: Restored code can carry the attacker’s original backdoor. A full scan on staging has to happen before you push anything live, because an infected copy reinstalls that backdoor on your site.
One client’s archive restored without a single error, and our scan still found a WordPress redirect hack hiding in a plugin folder. A snapshot that clears all four checks is one you can rely on during a live hack. New content and updates change your site every week, so one successful run won’t prove next month’s backup works.
Secure Backup and Restore Systems Start With a Backup You’ve Tested
To keep each backup reliable, schedule a quarterly trial restore, the same way you’d plan your car’s oil change.
Together, a layered retention schedule, offsite storage, and routine testing get your site back online after an attack. The three layers protect against different failures: old infections, deleted archives, and failed recoveries.
If you’d rather hand those layers off, WP Guard will maintain managed offsite backups and verify their health from day one. You’ll know a clean restore point exists long before you need one.
For a quick first look, our free scanner gives your WordPress install a health score and flags any issues.
Read More: How Digital Journalism Is Adapting to Changing Reader Expectations
Jhon AJS, the creative mind behind Grammar Update, is an experienced blogger passionate about simplifying English grammar. He focuses on explaining confusing word vs word differences, grammar rules, punctuation, and sentence structure in a clear and practical way. Through easy to understand guides and examples, Jhon helps readers improve their writing and communicate with confidence. With years of blogging experience, he continues to share helpful insights that make learning grammar simple, useful, and accessible for everyone.
