How to Schedule WordPress Backups to Google Drive or Dropbox

To schedule WordPress backups with copies off your server, install Backup & Restore by WpExperts Hub, add a schedule under Site Backup → Schedules, connect Google Drive, Dropbox or an SFTP server under Remote Storage and tick it as a destination. Turn on encryption if the copies hold anything private. One must-do first: store the encryption passphrase somewhere safe, because the site does not keep it and there is no reset. Without it every encrypted backup is unreadable, including the copies on Drive or Dropbox.

Why schedule backups and copy them off the server

A backup that sits on the same server is lost when the server is. The plugin makes complete backups of your database and files, reads each one back to check it, and can upload a copy to storage you own, straight from your site. What it does not do:

• No incremental backups. Every backup is complete, so a restore never depends on earlier ones.
• No OneDrive, WebDAV or S3, and no WordPress multisite.
• The database is read table by table, not as one snapshot, so an order placed during a long backup may be missing.
• A single file over 2 GB cannot be archived. It is listed as skipped.

At version 0.9.1, according to its documentation, Google Drive and Dropbox were tested against simulated servers and SFTP against a real SSH server, so press Test on your own storage and rehearse a restore before you rely on it.

What you need

• WordPress 6.5 or later (tested up to 7.1) and PHP 8.1 or later with zlib, hash and mysqli, plus the sodium extension (Argon2id) for encryption. The System check row Encryption libraries also passes with openssl alone.
• MySQL or MariaDB, with a database user that may create, rename and drop tables.
• A single-site install.
• Free disk space: backups are made on the server first and a restore keeps a safety copy.
• A Google Cloud project, a Dropbox app or an SFTP server for the copies.

It is a paid plugin, but no backup, restore or migration feature checks the licence. The licence client only handles activation and update checks, under Plugins → WpExperts Hub Licences.

Step-by-step setup

Install the plugin and turn on encryption

1. Download the zip from your account on wpexpertshub.com. In WordPress open Plugins → Add Plugin → Upload Plugin, install it and activate it. A Site Backup menu appears.
2. Open Site Backup → Encryption. Enter a Passphrase of at least 12 characters twice, tick I understand that a lost passphrase cannot be recovered and click Turn on encryption.
3. Put the passphrase in a password manager. Then type it under Check that you still know the passphrase and click Check.

Steps 2 and 3 are optional, but backups made before you turn encryption on stay unencrypted. If Turn on encryption cannot derive the key, ask your host to enable sodium.

Connect a storage

Open Site Backup → Remote Storage. Each card has a Set up (once) list. In short:

• Google Drive: create a Google Cloud project, enable “Google Drive API”, add the scope .../auth/drive.file on the OAuth consent screen and press “Publish app” (access expires after 7 days while it stays in “Testing”). Create a Web application OAuth client with the redirect URI the screen shows, paste the Client ID and Client secret, click Save, then Connect with Google. The plugin sees only files it created.
• Dropbox: create an app in the Dropbox App Console with Scoped access and App folder (recommended), tick files.metadata.read, files.metadata.write, files.content.read and files.content.write, and add the Redirect URI shown. Paste the App key and App secret, click Save, then Connect with Dropbox.
• SFTP: enter Host, Port, User name, a Private key (recommended) or Password, and Folder on the server. Click Look up the server key and trust the fingerprint only if it matches the one your server administrator gave you, then click Save.

1. Click Test on the card.
2. Under Where backups are sent, tick the storage next to Send every backup to and click Save. Connecting a storage does not select it.

Add a schedule

1. Open Site Backup → Schedules and click Add a schedule.
2. Name it, then choose How often (from Every 6 hours to Monthly, or Every N hours (custom)), At (time) and What to back up (Full site, Database only, Files only or Custom parts).
3. Keep Send to the storages chosen on the Remote Storage page ticked, or untick it to pick storages for this schedule alone.
4. Click Save schedules. You can add up to 5 schedules.

Times use the site’s time zone unless you choose another under Time zone for the times above. WordPress runs scheduled tasks only when somebody visits, so on a quiet site a backup can start late. The Schedules screen shows a cron line for your site:

* * * * * curl -s https://example.com/wp-cron.php?doing_wp_cron > /dev/null 2>&1

Add it to the server’s crontab, then set define( 'DISABLE_WP_CRON', true ); in wp-config.php so visitors do not also trigger it.

Test it

1. On the Schedules screen click Run now on your schedule.
2. Open Site Backup → Backups and click Details on the new backup. It should show Encrypted, with This server complete and your storage verified under Copies. Then rehearse a restore with a dry run, as described below.

What is encrypted, and where

Encryption is one setting for the copy on your server and the copies on Drive, Dropbox or SFTP. It runs after a backup is made and checked, and each plain file is deleted once its encrypted twin is complete, so readable archives exist in the backup folder while the job runs.

• Encrypted: the database dump and every archive part, with names ending in .enc. The site-root part includes wp-config.php, which a restore never writes back, so an unencrypted copy on Drive would hold your database login.
• Not encrypted: manifest.json and the job log, both uploaded as they are. The manifest lists archive names, table names, sizes, the site address, the server folder path and the paths of skipped items, but no content, and a changed manifest is refused.
• Not covered: backups made before you turned encryption on, and backups made with Encrypt this backup unticked on the Dashboard. Scheduled and before-update backups follow the setting.
• The key: Argon2id turns the passphrase into a key pair, and the site keeps only the public half, which locks backups but cannot open them. Each backup gets its own random key, sealed to it and stored in the manifest. Files use XChaCha20-Poly1305, which detects tampering.

If you lose the passphrase

The site stores the public key, a salt and the Argon2id settings, never the passphrase, and the Encryption screen warns that no one can open the backups, including WpExperts Hub. There is no reset.

• If the site still runs, open Site Backup → Encryption → Choose a new passphrase and click Use this passphrase. It covers later backups only. Older ones need the passphrase they were made with.
• A Verified badge does not prove the passphrase works. For encrypted backups, Verify and the automatic check compare checksums only. Deep verify (passphrase) or a dry run decrypts the files.

Restore, dry run and undo

Check, rehearse, then restore

1. Open Site Backup → Restore, choose a backup and tick the parts to restore. Open Only some database tables (advanced) or Only some files or folders (advanced) if you want less.
2. Click Check this restore. It checks the database and folder permissions and the disk space, and warns if the site has more posts, users or comments than the backup, since those would be lost. Dry run and Restore now appear once the check passes.
3. If the backup is encrypted, enter its passphrase. Click Dry run (changes nothing). It loads the data into temporary tables, applies any address changes, counts the files and discards it all. Read the Report under Previous restores.
4. Click Check this restore again, type RESTORE in capital letters and click Restore now.

What a restore replaces and what it leaves

• Replaced: the tables in the backup (or the ones you chose) and the files in the parts you ticked, so posts, orders and users created after the backup are replaced too. The old tables stay as wphub_old... until you delete the safety copies.
• Left alone: wp-config.php, this plugin’s own folder, files that are not in the backup, and this plugin’s own settings, schedules and storage connections.
• Safety: each replaced file is first copied to a safety folder, and the database loads into temporary tables before one RENAME TABLE step switches them in. If a step fails before that, the files are put back. Visitors see a 503 page while files and tables are swapped, but not during a dry run.
• Signing in: the restored database brings its own users, so sign in with an account from the backup.

To undo a finished restore, click Undo under Previous restores. It puts replaced files back from their safety copies, removes the files the restore created and renames the old tables back, so content added after the restore is no longer live. Delete safety copies ends the option to undo; until then the copies use disk space.

Moving a site to a new address

1. On the old site make a Full site backup. Open Site Backup → Migration, click Create package and download the .tar file. An encrypted backup stays encrypted.
2. On the new site install the plugin and use Upload and import under Migration.
3. Open Restore, choose the imported backup, keep Adapt the backup to this site (recommended) ticked, run the Dry run, then restore.

Adapt rewrites the site and home addresses everywhere, including inside serialized data, plus the folder path and table prefix. Post guid values and wp-config.php are not changed. The Backups here list shows only backups stored for the current site address, so use a package when the address changes.

Good to know and troubleshooting

• Nothing reaches the storage: no storage is ticked under Send every backup to, or the schedule has its own list. Details → Copies shows uploading, verified or failed for each one. An earlier backup is not sent on its own; use Send to followed by the storage name.
• A scheduled backup is late: the Schedules screen flags it as overdue and the plugin emails you by default. Add the cron line shown earlier.
• Only a few days of history: by default the newest 10 full and 10 database backups are kept on the server and 10 per storage, so a database backup every 6 hours covers about 2.5 days. Raise them under Site Backup → Settings → Keeping and cleaning up backups and Site Backup → Remote Storage → Keep on remote storage.
• Google shows redirect_uri_mismatch or Access blocked: the redirect URI must match the screen exactly, including http versus https, and your account must be a test user while the app is in Testing.
• Needs reconnecting, or SFTP refuses the server key: click Connect again, or Check the server key again once your server administrator confirms the change.
• “That passphrase does not open this backup”: capital letters and spaces count, or the backup was made under an earlier passphrase.

The full documentation covers notifications, WP-CLI commands, hooks, the backup format and recovering by hand.

Links

Plugin page: Backup & Restore by WpExperts Hub. Settings reference: Backup & Restore documentation. More tools: Browse all plugins.