A WordPress backup nobody has restored is a file, not a protection. On one blog that stays invisible. On twenty client sites it is the day an update breaks checkout.
What you actually copy
Files and database, together, at the same instant. A Tuesday database with Monday uploads is a site that “works” and 404 images. The child theme, wp-config.php, and the files outside uploads that nobody lists belong in the lot.
The copy before the update
The 3 a.m. job is useless if you update at 11 and the last dump is from 3. wpmcp takes a copy just before the lot, site by site, and keeps a way back without reopening twenty wp-admin. That is the WordPress backup that matches the gesture that breaks things: the update itself.
Test the restore
Once a quarter, restore a staging site from the last copy. If it fails, you learn it on a quiet Tuesday. Write down the real time. That number belongs in the contract, not “daily backup”.
