How to Back Up a WordPress Site (and Restore It When Things Go Wrong)

Sooner or later, something will go wrong with your website: a plugin update breaks the layout, a hacker gets in, a hosting server fails, or someone deletes the wrong page. When that happens, a recent backup is the difference between a ten-minute fix and losing years of work.

I’ve helped businesses recover sites with and without backups, and I can tell you which is less stressful. In this guide I’ll show you how to back up a WordPress site properly, how often to do it, and how to restore it.

What you need to back up

A WordPress site has two parts, and you need both to restore it:

Back up only the files and you’ll have a design with no content. Back up only the database and you’ll have content with no images, theme or plugins.

The most important things are the database and the wp-content folder, plus your wp-config.php file (which holds your database settings).

The 3-2-1 backup rule

A simple, widely used rule:

• 3 copies of your data (your live site plus two backups)
• on 2 different types of storage
• with 1 copy stored off-site, away from your web host

Why off-site? If your host has a serious problem, or your hosting account is hacked, backups stored only on the same server can be lost too.

How often should you back up?

Back up as often as you’d be unhappy to lose the changes:

Always take a fresh backup before updating WordPress, themes or plugins, and before any big change.

Keep several backups (for example 14–30 days of daily backups), not just the latest one. If a problem goes unnoticed for a week, you’ll need an older copy.

Option 1: Use your host’s backups

Many good hosts make automatic daily backups and offer one-click restores. Check:

• how often backups run and how long they’re kept
• whether they include files and database
• whether you can download them
• whether restores cost extra

Host backups are a great first layer, but don’t rely on them alone. Keep at least one copy off-site. My guide to choosing web hosting explains what backup features to look for.

Option 2: Use a backup plugin

Backup plugins can schedule automatic backups and send them to off-site storage such as Google Drive, Dropbox or Amazon S3. Popular options include UpdraftPlus, BlogVault, Jetpack VaultPress Backup, Duplicator and BackWPup. Features and pricing vary, so compare:

• scheduled backups of files and database
• off-site storage options
• incremental backups (only changes, which is lighter on large sites)
• one-click restore and migration
• whether backups run on the plugin company’s servers (lighter on your hosting)

Setting up a typical backup plugin

1. Install and activate the plugin from Plugins › Add New.
2. Open its settings and choose a schedule for files and database (for example daily database, weekly files for a blog).
3. Set how many backups to keep.
4. Connect a remote storage service, such as Google Drive or Amazon S3.
5. Run a first backup manually and check that the files appear in your remote storage.

Option 3: Manual backup

Useful to understand, and handy before a big change:

1. Files: download your site’s files using your host’s file manager or an SFTP client such as FileZilla. At minimum, download wp-content and wp-config.php.
2. Database: in your hosting control panel, open phpMyAdmin, select your WordPress database and use Export (quick, SQL format). Many hosts also offer a one-click database download.
3. Store both somewhere safe off your server.

Developers can also use WP-CLI, for example wp db export to export the database.

How to restore a WordPress backup

The exact steps depend on your method:

• Host backup: use your host’s restore button and choose a date.
• Plugin backup: if you can still log in to WordPress, use the plugin’s Restore button. If you can’t, install a fresh WordPress, install the same plugin, connect your remote storage and restore from there.
• Manual backup: upload your files via SFTP, create or empty the database, import your SQL file in phpMyAdmin, and check that wp-config.php has the right database details.

After restoring, clear your caches, log in, and check key pages, forms and checkout.

Test your backups

A backup you’ve never tested is just a hope. Every few months:

• Restore a recent backup to a staging site or local copy.
• Check the site loads, images appear and you can log in.
• Confirm your backups are still running on schedule and reaching off-site storage.

Backups and security

Backups are your last line of defence, not your only one. Combine them with updates, strong passwords, two-factor authentication and a firewall. My website security checklist covers the full list.

Also remember that backups contain sensitive data (user details, orders, sometimes password hashes). Store them securely and limit who can access them.

Common backup mistakes

• Only backing up files, not the database (or the reverse).
• Keeping backups only on the same server.
• Keeping only one backup.
• Never testing a restore.
• Forgetting to back up before updates.

Frequently asked questions

Does WordPress back itself up automatically? No. WordPress itself doesn’t create full site backups. You need your host, a plugin or a manual process.

Are free backup plugins good enough? For many small sites, yes, as long as they send backups off-site on a schedule and you test restores. Busy shops may need real-time or incremental backups.

How much storage do backups need? Roughly the size of your site multiplied by the number of copies you keep. Uploads (images and videos) are usually the largest part.

Related guides on WebTechHelp

• Website security checklist
• How to choose web hosting
• How to speed up WordPress
• How to fix the 500 internal server error in WordPress
• WordPress SEO: the complete setup guide

Sources

• UpdraftPlus: The 3-2-1 backup rule explained
• WordPress Developer Resources: WP-CLI wp db export