Why host backups share the host's failure domain
Every copy your host makes is reachable only through your account with that host. If the account is locked after a payment failure, suspended in a dispute, or taken over by someone who has your login, the backups go with the site. If the copies sit on the same machine as the site, as Kinsta documents for its backups, a problem with that machine can affect both.
The long-standing rule for this is 3-2-1, which a US-CERT paper sums up as: keep three copies of any important file (one primary and two backups), keep them on two different media types, and store one copy offsite. For a WordPress course site, offsite means outside the hosting account, not just on another server the host runs.
WordPress's own documentation makes the same point in plainer terms: keep copies in different locations, such as the hosting server, cloud storage and a local computer, and keep at least three, ideally five, recent backups. It also reminds you that a full restore needs both the files and the database.
Where each host keeps its copies
None of these are bad backup systems. WP Engine's and SiteGround's copies are not on the site's server, which protects against a server failure. The gap is the account: all three depend on you being able to log in to that host to get your data back.
| Host | Default schedule and retention | Where the host stores them | Built-in way to send a copy elsewhere |
|---|---|---|---|
| Kinsta | Daily; 14, 20 or 30 days by plan; up to 5 manual backups | On the same host machine as the site | External Backups add-on to your Amazon S3 or Google Cloud Storage, weekly or monthly; downloadable backup once a week, available for 48 hours |
| WP Engine | Daily checkpoints; 30 days kept | Offsite on Amazon S3 in the same region as the site, encrypted in transit and at rest | No automatic export; full or partial ZIP downloads available for 7 days; use your own integration, not on the same server |
| SiteGround | Daily; up to 30 copies on shared hosting, up to 7 on Cloud | On a server separate from the one hosting the site | No external destination documented; downloads are a paid Premium backup feature with a 24-hour link |
Three ways to add a second copy
Host add-on. Kinsta's External Backups add-on sends files, the database or both to your own Amazon S3 or Google Cloud Storage bucket, weekly or monthly. Kinsta charges $2 per site per month plus $1 per GB per month of bandwidth, and AWS or Google bill the storage separately. Kinsta's own example: three sites of 5, 8 and 20GB cost $39 a month before storage. The advantage is that nothing runs inside WordPress. The limit is frequency: weekly at best.
Backup plugin to object storage. A WordPress backup plugin can push files and a database dump to a bucket you own on a schedule you choose, including daily. This works on any host, including WP Engine, which says you can offload backups with your own integration as long as it is not stored on the same server. It does use PHP and disk on your plan while it runs, so schedule it outside your busiest hours, and check your host's rules on backup plugins before installing one.
Manual download. All three hosts let you download an archive: Kinsta once a week, WP Engine as a ZIP prepared on request, SiteGround with Premium backups. A monthly download to an encrypted drive is the cheapest second medium, but only if someone actually does it.
A 3-2-1 plan with costs
Worked example for one course site with 8GB of files and database. The numbers use published list prices; storage you may already pay for is excluded.
- B2 also includes free egress up to three times your average monthly storage, so a restore download of a few backups normally stays inside that allowance.
- KnownHost's Remote Backup Space ($10 a month for 500GB per location, available without another KnownHost service) is another SFTP or rsync target if you prefer that to object storage.
- The offsite copy's age sets your worst case if the host account is lost: weekly copies mean up to a week of lost enrollments and orders.
| Copy | Where | How often | Monthly cost |
|---|---|---|---|
| 1. Host backups | Your managed host | Daily | Included in the plan |
| 2a. Offsite, Kinsta route | Your S3 or Google Cloud bucket via External Backups | Weekly | $2 + 8GB x $1 = $10, plus the cloud provider's storage charge |
| 2b. Offsite, plugin route | Backblaze B2 bucket | Daily or weekly | Keeping four weekly 8GB copies is 32GB; the first 10GB is free, so about 22GB at $6.95 per TB is roughly $0.15, plus any plugin licence |
| 3. Second medium | Encrypted external drive or local computer | Monthly download | No ongoing fee |
What the offsite copy must contain
Both files and the database, every time. WordPress's documentation says you need both to fully restore a typical site, that copying the WordPress folder does not capture the database, and to back up the database first, then files. When restoring, it says to put the files back first, then import the database.
Host settings are usually not in the archive. Kinsta's downloadable backup is the site files and SQL database only, and excludes MyKinsta settings, redirects, custom Nginx rules, IP deny rules, PHP and MySQL configuration changes and add-ons. Keep a text file alongside your backups listing redirects, cache exclusions, cron jobs and DNS records, so a rebuild on another host does not depend on memory.
Encrypt the bucket or the archive, and use a storage key that can write new backups but cannot delete old ones, where your storage provider supports that. Otherwise, someone who takes over your site may be able to delete the offsite copies too.
Who needs this and who can wait
You need an offsite copy if the site earns money, holds student records you could not rebuild, or is the only place your course content lives. For those sites, the monthly cost in the table is small next to rebuilding courses or reconciling a week of lost sales.
A brochure site whose content also exists elsewhere can live with host backups plus an occasional manual download. So can a site you are about to rebuild from scratch anyway.
Checklist
- Host backups confirmed: schedule, retention and where they are stored.
- One copy outside the hosting account, in storage you own and can log in to separately.
- Each offsite copy contains files and a database dump.
- Storage credentials kept in a password manager, not in the WordPress database or the plan document.
- At least three recent backups kept; five where storage allows.
- Redirects, cache rules, cron jobs and DNS records exported to a text file next to the backups.
- A test restore from the offsite copy to a staging or local site at least twice a year, with the time it took written down.
Questions before you decide
Does Kinsta store backups offsite?
Not by default. Kinsta says each backup is stored on the same host machine as the site. Its External Backups add-on sends weekly or monthly copies to your own Amazon S3 or Google Cloud Storage for $2 per site per month plus $1 per GB.
Can I export WP Engine backups automatically to my own storage?
WP Engine says there is currently no way to automatically export its backups to another service. You can download ZIP backups manually, or use your own backup integration that does not store copies on the same server.
What is the 3-2-1 backup rule?
Keep three copies of important data (one primary and two backups), on two different media types, with one copy offsite. For a hosted WordPress site, offsite should mean outside the hosting account.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- Kinsta: Backups Accessed 30 Oct 2026
- WP Engine: Backup and restore Accessed 30 Oct 2026
- SiteGround: Backup service Accessed 30 Oct 2026
- Backblaze: B2 Cloud Storage pricing Accessed 30 Oct 2026
- KnownHost: Remote Backup Space Accessed 30 Oct 2026
- WordPress Developer Resources: WordPress backups Accessed 30 Oct 2026
- US-CERT (CISA): Data Backup Options Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.