WordPress Site Maintenance — Backups, Updates, Staging and Migration

In this tutorial, you'll learn how to maintain a WordPress site — implementing the 3-2-1 backup strategy, managing updates for core, themes, and plugins, setting up staging environments, migrating between hosts, and following a monthly maintenance checklist.

What You'll Learn

• Backup strategy — 3-2-1 rule: 3 copies, 2 media types, 1 offsite
• Automated backups with UpdraftPlus, BlogVault, and manual exports
• Testing backups — monthly restore test, file integrity verification
• Update workflow — backup first, update on staging, test, deploy to live
• WordPress core updates — major vs minor vs security, automatic updates
• Plugin and theme updates — compatibility checks, rollback strategy
• Staging environments — hosting staging, LocalWP, Duplicator, WP Stagecoach
• Migrating WordPress — host to host, domain to domain, search/replace
• Content maintenance — reviewing old posts, fixing broken links, removing unused media
• Monthly maintenance checklist — performance, security, software updates

Why It Matters

Every WordPress site will eventually break. A plugin update will conflict with your theme. Your host will have a server failure. An attacker will find a vulnerability. When disaster strikes, your backup is your lifeline. Without a tested backup, you lose everything — content, design, settings, customer data, and SEO rankings. The cost of a proper backup system is near zero. The cost of losing your site is immeasurable. Beyond disasters, regular maintenance prevents problems from accumulating — outdated plugins, bloated databases, broken links, and security holes that attackers actively scan for.

Real-World Use

A design agency manages 30 client WordPress sites. They use UpdraftPlus with scheduled daily backups to Google Drive and weekly Amazon S3 backups. One Monday, a client's site shows a white screen after a weekend plugin update. The agency restores the site from Friday's backup in 15 minutes. While the site is live again, they replicate the issue on staging, find the incompatible plugin, update it to a compatible version, and push the fix to production. Without the backup, they would have spent hours debugging under pressure with clients waiting.

Learning Path

flowchart LR
    A["Performance Optimization"] --> B["Maintenance & Backups
You are here"]:::current
    B --> C["Multisite Network"]
    C --> D["User Roles & Capabilities"]
    D --> E["Custom Post Types"]

    classDef current fill:#38bdf8,color:#0f172a,stroke-width:2px

Backup Strategy — The 3-2-1 Rule

The 3-2-1 backup rule is the industry standard:

• 3 copies of your data (1 production + 2 backups)
• 2 different media types (e.g., cloud storage + external drive)
• 1 copy stored offsite (different physical location from your server)

For a WordPress site, the "data" means two things:

1. Database — all your content, settings, user accounts, comments, and plugin configurations stored in MySQL
2. Files — wp-content (themes, plugins, uploads), wp-config.php, .htaccess, and any custom files

A backup that includes only the database or only the files is incomplete. You need both.

What Happens Without the 3-2-1 Rule

Your host has a RAID array failure that corrupts your database. You have one backup on the same server. That backup is also corrupted. You have no offsite copy. Your site is gone forever. The 3-2-1 rule ensures that even if one backup fails, another exists on a different system in a different location.

Automated Backups

UpdraftPlus (Free and Premium)

UpdraftPlus is the most popular backup plugin for WordPress. It supports scheduled backups to cloud storage services:

# Install UpdraftPlus
wp plugin install updraftplus --activate

Configure backups via Settings > UpdraftPlus Backups:

// UpdraftPlus configuration (stored in WordPress options)
// Set a schedule: daily database backups, weekly file backups
// Remote storage: Google Drive, Dropbox, Amazon S3, or any of 15+ destinations

Important: Schedule database backups daily (your content changes frequently) and file backups weekly (themes and plugins change less often). The backup files are compressed into .zip archives:

backup_2026-06-27-1234_My_Site_1234567890-db.gz   (database backup)
backup_2026-06-27-1234_My_Site_1234567890-plugins.zip  (plugins)
backup_2026-06-27-1234_My_Site_1234567890-themes.zip   (themes)
backup_2026-06-27-1234_My_Site_1234567890-uploads.zip  (uploads)
backup_2026-06-27-1234_My_Site_1234567890-others.zip   (wp-config, .htaccess, etc.)

BlogVault (Real-Time Backups)

BlogVault offers real-time continuous backups. Every change — a new comment, an edited post, a setting change — is backed up within seconds:

# BlogVault is a SaaS service, not a self-hosted plugin
# Sign up at blogvault.net and connect your site via their dashboard

BlogVault also includes a one-click staging environment and automated migration tools.

Manual Backups

Automated backups may fail silently. Know how to back up manually:

Database Export via phpMyAdmin

-- In phpMyAdmin, select your WordPress database
-- Click Export > Custom
-- Select all tables
-- Check "Add DROP TABLE / VIEW" (safe restore)
-- Check "Enclose table and column names with backquotes"
-- Compression: gzipped or none
-- Click Go

Or via command line:

# Export database via mysqldump
mysqldump -u username -p database_name > wordpress_backup_$(date +%Y%m%d).sql

# With compression
mysqldump -u username -p database_name | gzip > wordpress_backup_$(date +%Y%m%d).sql.gz

# Restore from backup
mysql -u username -p database_name < wordpress_backup_20260627.sql

# Restore compressed backup
gunzip < wordpress_backup_20260627.sql.gz | mysql -u username -p database_name

FTP wp-content Download

# Using rsync to download wp-content
rsync -avz --progress user@yourserver.com:/var/www/html/wp-content/ /local/backup/wp-content/

# Or using WP-CLI to create a file backup
wp db export backup.sql
wp plugin list --status=active > active-plugins.txt

Testing Backups

A backup is worthless if you cannot restore it. Many site owners discover their backups are corrupted only when they need them most.

Monthly Restore Test

# Restore to a staging environment
# 1. Create a fresh WordPress installation on staging
# 2. Import the database:
mysql -u staging_user -p staging_database < backup.sql

# 3. Copy wp-content files:
rsync -avz backup/wp-content/ /var/www/staging/wp-content/

# 4. Update wp-config.php with staging database credentials
# 5. Visit the staging site and verify:
#    - All pages load correctly
#    - Images display
#    - Forms and interactive elements work
#    - Admin dashboard is accessible
#    - All plugins are active and working

File Integrity Verification

# Verify backup archive integrity
tar -tzf backup.tar.gz > /dev/null && echo "Backup archive is valid"
# Or for .zip files:
unzip -t backup.zip | tail -5

Update Workflow

The wrong way to update: click "Update All" on the dashboard and hope nothing breaks.

The right way:

Step 1: Backup the site (database + files)
Step 2: Update on staging environment
Step 3: Test everything on staging
Step 4: Deploy updates to live site
Step 5: Test on live site

Why This Workflow Matters

A plugin update can introduce a breaking change. A theme update can override customizations. A core update can deprecate functions your site relies on. Even minor updates have caused major outages. By following the backup-staging-test-deploy cycle, you eliminate risk. If something breaks on staging, you fix it there. The live site never experiences downtime.

WordPress Core Updates

WordPress releases three types of updates:

• Major releases (6.0, 6.1, 6.2) — New features, architectural changes. Test thoroughly before deploying.
• Minor releases (6.1.1, 6.1.2) — Bug fixes and performance improvements. Generally safe but still test.
• Security releases (6.1.1-security) — Patch vulnerabilities. Deploy promptly — these fix actively exploited issues.

Configuring Automatic Updates

// In wp-config.php

// Enable automatic updates for minor and security releases only (default)
define('WP_AUTO_UPDATE_CORE', 'minor');

// Enable all automatic updates (major, minor, security)
define('WP_AUTO_UPDATE_CORE', true);

// Disable all automatic updates (not recommended)
define('WP_AUTO_UPDATE_CORE', false);

For sites with high reliability requirements, disable automatic updates and manage all updates manually via the backup-staging-test-deploy workflow.

Manual Core Update via WP-CLI

# Check for available updates
wp core check-update

# Update to the latest version
wp core update

# Update to a specific version
wp core update --version=6.4.2

Manual Core Update via FTP

If you cannot use WP-CLI (some shared hosts block it):

# Download the latest WordPress version from wordpress.org
wget https://wordpress.org/latest.zip

# Unzip
unzip latest.zip

# Overwrite all files except wp-content and wp-config.php
# Do NOT delete wp-content/ — it contains your themes, plugins, and uploads
# Do NOT overwrite wp-config.php
cp -r wordpress/* /var/www/html/

# Run the database update script
# Visit: https://yourdomain.com/wp-admin/upgrade.php

Plugin Updates

Update Individually

Always update plugins one at a time, testing between each:

# Update a single plugin via WP-CLI
wp plugin update woocommerce

# Update all plugins
wp plugin update --all

# Update with a dry-run to see what would change
wp plugin update --all --dry-run

Test Critical Plugins First

Some plugins are critical to your site's operation and can break everything if updated incorrectly:

• E-commerce plugins (WooCommerce, Easy Digital Downloads)
• Page builders (Elementor, Beaver Builder, Divi)
• SEO plugins (Yoast, Rank Math)
• Security plugins (Wordfence, Sucuri)
• Caching plugins (WP Rocket, W3 Total Cache)

Update these on staging first, always.

Watch for Compatibility Breaks

Before updating a plugin, check:

1. The plugin changelog — does the new version require a higher PHP version?
2. The WordPress version required — does it need WordPress 6.2+?
3. User reviews of the new version — are there reports of issues?
4. Your current version — do you even need the features in the update?

# Check plugin changelog from WP-CLI
wp plugin get woocommerce --fields=version,update_version,update

Theme Updates

Check the Changelog

Before updating a theme, read the changelog:

• Does the update remove deprecated features your site uses?
• Does it change template file structure (breaking child themes)?
• Does it introduce new dependencies?

Update Parent Themes Before Child

If you use a child theme, the parent must be updated first:

# Check for theme updates
wp theme list

# Update a specific theme
wp theme update twentytwentyfour

# Update all themes
wp theme update --all

After updating, check your site thoroughly:

• All page templates still render correctly
• The header, footer, and sidebar are unchanged
• Custom styling in the child theme still applies
• No deprecated function warnings in debug.log

Staging Environments

A staging environment is an exact copy of your live site where you test changes before deploying.

Hosting-Provided Staging

Many managed WordPress hosts include one-click staging:

• WP Engine — Staging, Development, Production environments
• SiteGround — Staging tool in Site Tools
• Flywheel — Blueprint and staging features
• Kinsta — One-click staging environment

LocalWP for Local Staging

LocalWP lets you create a local copy of your live site:

# Install LocalWP from https://localwp.com
# Create a new site
# Use the "Connect" feature to pull a live site down

# LocalWP handles:
# - Downloading files via SSH/FTP
# - Importing the database
# - Updating URLs from live to local
# - Setting up local SSL

Duplicator for Self-Hosted Staging

The Duplicator plugin creates a package of your site that you can deploy anywhere:

# Install Duplicator
wp plugin install duplicator --activate

# Create a new package: Duplicator > Packages > Create New
# Download the installer.php and archive.zip files
# Upload both to your staging subdomain
# Run installer.php and follow the wizard

WP Stagecoach

A SaaS staging service that creates a staging copy of your site on their servers:

# Create an account at wpstagecoach.com
# Connect your site
# Click "Create Staging Site"
# Test changes, then "Deploy to Live"

WP Stagecoach handles the URL search/replace and database cloning automatically.

Migrating WordPress

Migration is moving your site from one location to another — a new host, a new domain, or both.

All-in-One WP Migration

The easiest migration plugin. It creates a single file containing your entire site:

# Install All-in-One WP Migration
wp plugin install all-in-one-wp-migration --activate

# Export: All-in-One WP Migration > Export > File
# This creates a .wpress file containing everything

# On the new server, install WordPress fresh
# Install All-in-One WP Migration
# Import > File > Select the .wpress file
# Done — the import handles everything including URL updates

Free version has a 512MB file size limit. The unlimited extension removes this.

Duplicator

Duplicator is more flexible for large sites and server changes:

# On the old server
wp plugin install duplicator --activate
# Duplicator > Packages > Create New
# Download installer.php and the archive zip

# On the new server
# Upload both files to the web root
# Visit https://newdomain.com/installer.php
# Follow the installer wizard:
#   1. Enter database credentials
#   2. Validate server requirements
#   3. Run install
#   4. Update site URLs
#   5. Test the site

Manual Migration with Search/Replace

For those who want full control:

# Step 1: Export the database
mysqldump -u user -p old_database > database.sql

# Step 2: Search and replace the domain
# Uses WP-CLI's built-in search-replace
wp search-replace 'olddomain.com' 'newdomain.com' --skip-columns=guid

# Step 3: Copy wp-content files
rsync -avz --progress /old/wp-content/ /new/wp-content/

# Step 4: Update wp-config.php with new database credentials
# Change DB_NAME, DB_USER, DB_PASSWORD, DB_HOST

# Step 5: Test the site on the new server
# Visit all main pages, admin dashboard, check images load

Always use --skip-columns=guid with search-replace. The GUID column contains unique identifiers that should not change.

Content Maintenance

Your site's content degrades over time. Old posts have outdated information, broken links, and images that no longer load.

Review and Update Older Posts

# List posts older than 1 year
wp post list --year=2024 --format=table

# Export old posts for review
wp post list --posts_per_page=-1 --fields=ID,post_title,post_date > old_posts.csv

Review each post for:

• Outdated statistics or references
• Broken internal and external links
• Images that no longer display
• Outdated screenshots
• Deprecated plugin or tool references

Fix Broken Links

# Install a broken link checker plugin
wp plugin install broken-link-checker --activate

# Or use a SaaS tool like Ahrefs or Screaming Frog
# Export the broken links CSV
# Fix 404s by:
#   1. Updating the URL to the correct new location
#   2. Finding an alternative source for the referenced content
#   3. Removing the link if no alternative exists

Remove Unused Media

WordPress keeps every file you upload. Over time, the Media Library grows with images used in draft posts, old featured images, and imported media:

# Install Media Cleaner plugin
wp plugin install media-cleaner --activate

# Scan for unused media
wp media clean --dry-run

# Review the list and confirm deletions
wp media clean

Archive Outdated Content

Instead of deleting old content (which breaks links and loses SEO value), archive it:

# Create an "Archived" category
wp term create category Archived --description="Archived content preserved for reference"

# Assign old posts to the category
wp post term set 123 category Archived

# Consider: adding a banner to archived posts
# "This article was published in 2022 and may contain outdated information."

Monthly Maintenance Checklist

A systematic monthly review catches problems before they become emergencies:

Performance Check

# 1. Check page speed with Google PageSpeed Insights
# 2. Review Site Health: Tools > Site Health
wp site health check

# 3. Optimize database
wp plugin install wp-optimize --activate
# Run: WP-Optimize > Database > Run all optimizations

# 4. Check image sizes — are any uncropped or too large?
# 5. Check caching plugin — is it working? Check cache hit rate

Security Check

# 1. Review Wordfence logs for failed login attempts
# 2. Check file integrity
wp core verify-checksums

# 3. Update security plugin rules
# 4. Audit user accounts
wp user list --role=administrator
# Are all admin accounts still active and needed?

# 5. Review recent security emails
# 6. Check .htaccess and wp-config.php for unauthorized changes

Software Updates

# 1. Check PHP version
php -v
# Is it the latest stable version in your 8.x branch?

# 2. Check for outdated plugins
wp plugin list --update=available

# 3. Check for theme updates
wp theme list --update=available

# 4. Check for core updates
wp core check-update

# 5. Update everything on staging first
# Then deploy to production

The Complete Monthly Script

Save this as a Shell Script and run it monthly:

#!/bin/bash
# Monthly WordPress Maintenance Script
SITE="/var/www/html"
BACKUP_DIR="/backups/wordpress/monthly/$(date +%Y%m)"

# Create backup directory
mkdir -p $BACKUP_DIR

# 1. Backup database
wp db export $BACKUP_DIR/database.sql --path=$SITE

# 2. Backup files
tar -czf $BACKUP_DIR/files.tar.gz -C $SITE wp-content/

# 3. Optimize database
wp db optimize --path=$SITE

# 4. Check for updates
wp core check-update --path=$SITE >> $BACKUP_DIR/updates.log
wp plugin list --update=available --path=$SITE >> $BACKUP_DIR/updates.log
wp theme list --update=available --path=$SITE >> $BACKUP_DIR/updates.log

# 5. Verify file integrity
wp core verify-checksums --path=$SITE >> $BACKUP_DIR/integrity.log

# 6. List all admin users
wp user list --role=administrator --path=$SITE >> $BACKUP_DIR/admins.log

echo "Monthly maintenance complete. Review logs in $BACKUP_DIR"

Common Mistakes

1. Never testing backups. A backup that has never been restored is a wish, not a backup. MySQL corruption, incomplete file transfers, and expired storage links all silently break backups. Test a full restore to a staging environment at least once per month.

2. Updating plugins and themes directly on production. The "Update All" button is tempting but dangerous. A single incompatible plugin update can take your entire site down. Always backup first, update on staging, test thoroughly, then deploy to production.

3. Using the same backup destination as production. If your backups are stored on the same server as your live site, a server failure destroys both. The "1 offsite" in the 3-2-1 rule is non-negotiable. Use cloud storage (Google Drive, Dropbox, S3) or a different physical server.

4. Forgetting to update wp-config.php after migration. After migrating to a new host or domain, the wp-config.php file still has old database credentials or the old site URL. Update DB_NAME, DB_USER, DB_PASSWORD, DB_HOST, and any domain-specific constants before going live.

5. Skipping content maintenance. Many site owners focus only on technical maintenance (updates, backups, security) and ignore content. Old posts with broken links hurt SEO. Outdated information damages credibility. Allocate time each month to review and refresh content alongside the technical checks.

Practice Questions

1. You just migrated a site from oldhost.com to newhost.com. Users can access the admin dashboard, but the homepage shows no styling. What went wrong? Answer: The site URL is likely still pointing to the old domain. The CSS and asset URLs in the database reference oldhost.com. Run wp search-replace 'oldhost.com' 'newhost.com' to update all URLs in the database.

2. What is the difference between a major, minor, and security WordPress release? Answer: Major releases (6.0, 6.1) add new features and may include breaking changes. Minor releases (6.1.1, 6.1.2) fix bugs and improve performance with high backward compatibility. Security releases patch vulnerabilities and should be deployed immediately — they often fix issues being actively exploited.

3. Why should you archive old posts instead of deleting them? Answer: Deleting posts breaks internal and external links, removes their SEO value, and creates 404 errors for visitors following old URLs. Archiving preserves the content (in an "Archived" category or with a notice banner) so existing links still work and search rankings are maintained.

Challenge: Build a complete maintenance system for a WordPress site. Set up UpdraftPlus with daily backups to Google Drive and weekly backups to Amazon S3. Create a staging environment using Duplicator. Write a monthly maintenance shell script that handles: database backup, file backup, database optimization, update checking, file integrity verification, and admin user audit. Run the script and verify it works. Then simulate a disaster — delete the site database — and restore from backup to staging. Document the entire Process including recovery time.

FAQ

Mini Project

Create a complete disaster recovery plan for a WordPress site:

1. Set up UpdraftPlus with daily automated backups to two offsite destinations (e.g., Google Drive + Amazon S3).
2. Write a shell script that runs monthly maintenance: database optimization, file integrity check, update audit, admin user audit.
3. Create a staging clone of your site using Duplicator on a subdomain (staging.yourdomain.com).
4. Simulate failure scenarios and practice recovery:
   • Scenario A: A plugin update white-screens the site. Revert and fix.
   • Scenario B: The database is accidentally dropped. Restore from backup.
   • Scenario C: The hosting company loses all data. Migrate to a new host from offsite backups.
5. Measure and document your recovery time for each scenario. Target: under 1 hour for any failure.
6. Share the disaster recovery plan with your team or write it as a standard operating procedure for client sites.

This exercise transforms you from someone who "has backups" to someone who can survive any disaster with confidence.

What's Next

Now that you have a solid maintenance and backup system, explore advanced WordPress features:

Continue to Multisite Network — Learn how to manage multiple sites from a single WordPress installation.

Related lessons:

• Security Hardening — Audit user accounts and harden security
• Custom Post Types — Extend WordPress beyond posts and pages
• PHP Error Handling — Debug white screens and fatal errors in WordPress