How to Back Up a WordPress Site (and Know It Will Restore)

If you’re learning how to back up a WordPress site, the core idea is simple. You need two things saved together: a copy of the database (your posts, pages, settings and users) and a copy of the files (themes, plugins, uploads and configuration). The easiest reliable setup is an automated backup that runs on a schedule, stores copies somewhere other than your web server, and that you have actually tested restoring.

This guide walks through four different backup methods, how often to run them, where to keep the copies, and how to prove the backup works before you need it.

What a complete WordPress backup includes

WordPress keeps its content in two separate places, and backing up one does not back up the other. The official WordPress backup documentation makes the same point: you need both to restore a typical site.

WordPress core files can be downloaded again from wordpress.org, so they matter less. Everything else is unique to your site and must be in the backup.

How to back up a WordPress site: four methods

1. Your host’s built-in backups

Many hosts take automatic snapshots of your account or server. Check your hosting dashboard for a backups or snapshots section and find out three things: how often backups run, how long they are kept, and whether they are stored on a different machine from your site. Host backups are a good safety net, but they shouldn’t be your only copy, because a problem with your hosting account can affect the backups too.

2. A backup plugin

Backup plugins run inside WordPress and can schedule database and file backups, then send them to cloud storage such as an S3-compatible bucket, Google Drive or Dropbox. When choosing one, look for:

• Separate schedules for the database and files, since the database usually changes more often.
• Off-site storage destinations, not just a folder on the same server.
• Incremental backups for larger sites, so each run doesn’t copy everything again.
• A one-click or documented restore process.
• Active maintenance and good reviews in the WordPress.org plugin directory.

Be aware that plugin backups run on your web server and use its resources. On very large sites or low-powered hosting, they can time out or slow the site down while running.

3. Manual backup through your hosting panel

If you just need a one-off copy before a big change, you can do it by hand:

1. Export the database using phpMyAdmin (or your panel’s database tool) and save the .sql file.
2. Download the wp-content folder and wp-config.php using your file manager, SFTP or a compressed archive created in your hosting panel.
3. Store both together in a folder named with the date and site name.

4. WP-CLI and server-level scripts

If you have SSH access, WP-CLI makes backups fast and scriptable. A basic manual backup looks like this:

cd /path/to/your/site
wp db export ~/backups/site-database.sql
tar -czf ~/backups/site-files.tar.gz wp-content wp-config.php

Rename the files with the date so older copies aren’t overwritten. Developers and hosts often wrap commands like these in a scheduled script that also copies the archives to remote storage and deletes old copies. This is how we handle backups for the WordPress sites we host: automated, server-level and sent off-site.

How often should you back up?

There is no single right schedule. Base it on how much work you could afford to lose:

• Brochure sites that rarely change: a weekly full backup plus a backup before every update is often enough.
• Blogs and content sites: daily database backups, with files backed up at least weekly (or whenever you upload new media).
• WooCommerce stores and membership sites: frequent database backups, because orders and sign-ups happen all day. Ask yourself how many hours of orders you could recreate by hand.

Also take a fresh backup before any risky change: plugin or theme updates, a WordPress major release, a PHP version upgrade, a migration or a redesign.

Where to store backups: the 3-2-1 rule

A backup stored on the same server as your website disappears along with the website if the server fails, gets hacked or your account is suspended. A widely used guideline is the 3-2-1 rule:

• 3 copies of your data (the live site plus two backups).
• 2 different storage types (for example, your host’s snapshots and a cloud storage bucket).
• 1 copy off-site, in a different provider or location from your server.

Also decide on retention: how many old backups you keep. Keeping several weeks of history lets you go back to a point before a problem started, which matters for malware that may sit unnoticed for a while.

Protect the backups themselves

Backups contain everything an attacker would want: your database, user emails and password hashes, and your wp-config.php with database credentials. Treat them as sensitive data.

• Never leave backup archives in a public folder on your web server, where anyone who guesses the filename could download them.
• Use storage with access controls, and limit who has the keys.
• Prefer encrypted storage or encrypted archives for sites that hold customer data.
• Use credentials for the backup destination that can write new files but cannot delete old ones, where your provider supports it. That way, if your site is compromised, the attacker cannot wipe your backups too.

These measures fit into wider site hardening; our guide on how to secure a WordPress website covers the rest.

Test your restore before you need it

A backup you have never restored is an assumption, not a backup. Every few months, or after changing your backup setup, run a test:

1. Create a staging site or a local copy.
2. Restore the latest database and files there.
3. Update the site URL if needed, then log in and click through key pages, forms and checkout.
4. Check that recent media uploads and recent content are present.
5. Write down how long the restore took and any steps that were confusing, so the real restore is faster.

Common WordPress backup mistakes

• Backing up files but forgetting the database, or the other way around.
• Storing all backups on the same server as the site.
• Never checking whether scheduled backups are still running after an update or a full disk.
• Keeping only the most recent backup, which may already contain the problem you’re trying to undo.
• Excluding the uploads folder to save space and losing years of media.
• Relying on a plugin backup on a site that’s too large for it, so the job silently times out.

When to let someone else handle it

Knowing how to back up a WordPress site is straightforward. Remembering to check it every week, keeping off-site storage organised and testing restores is where things slip. If you’d rather not think about it, a WordPress maintenance plan can take over backups, updates, uptime checks and restore tests, so there’s a tested copy ready when something goes wrong.

FAQ

Does my hosting company back up my WordPress site?

Many hosts do, but schedules, retention and storage location vary. Check your hosting dashboard or ask support, and keep at least one additional copy off-site so a problem with your hosting account doesn’t take your backups with it.

Can I back up WordPress for free?

Yes. You can export the database with phpMyAdmin and download your files manually, or use a free backup plugin. Paid tools and managed plans mainly add automation, off-site storage, incremental backups and easier restores.

How do I restore a WordPress backup?

Restore the database export into an empty database, upload the wp-content folder and wp-config.php, then update the site URL if the domain changed. Backup plugins usually include a guided restore. Test the process on a staging site first.

Should I back up WordPress before updating plugins?

Yes. Take a fresh backup before plugin, theme, core or PHP updates so you can roll back quickly if an update breaks something.