How to Backup WordPress Site

Backing up your WordPress site is not just a best practice—it’s a critical necessity for every website owner. Whether you run a personal blog, an e-commerce store, or a corporate portal, your WordPress site contains valuable data: content, themes, plugins, media files, user information, and database records. A single server failure, malware attack, human error, or failed update can wipe out months—or even years—of work in seconds. Without a reliable backup, recovery is often impossible. This comprehensive guide walks you through every aspect of backing up a WordPress site, from manual methods to automated solutions, ensuring your digital presence remains secure, recoverable, and resilient.

By the end of this tutorial, you’ll understand why backups matter, how to implement them effectively, which tools to trust, and how to test your recovery process. You’ll also learn from real-world examples and avoid the most common pitfalls that lead to irreversible data loss. This isn’t just a checklist—it’s your WordPress survival plan.

Step-by-Step Guide

Understanding What Needs to Be Backed Up

Before you begin backing up your WordPress site, it’s essential to know exactly what components require protection. A complete WordPress backup consists of two primary elements:

• Files: These include your WordPress core files, themes, plugins, media uploads (images, videos, documents), and custom configuration files like wp-config.php.
• Database: This is where all your dynamic content lives—posts, pages, comments, user accounts, settings, metadata, and plugin data. The database is typically stored in MySQL or MariaDB.

Without both components, your site cannot be fully restored. Backing up only the files means you lose all your content. Backing up only the database means you lose your design, functionality, and media. A true backup includes both.

Method 1: Manual Backup via FTP and phpMyAdmin

This method gives you full control and requires no third-party tools. It’s ideal for users comfortable with server interfaces and who want to understand the underlying structure of their site.

Step 1: Access Your Website Files via FTP

Use an FTP client such as FileZilla, Cyberduck, or WinSCP to connect to your hosting server. You’ll need:

• FTP hostname (usually your domain or server IP)
• FTP username and password (provided by your host)
• Port number (typically 21 for FTP, 22 for SFTP)

Once connected, navigate to your site’s root directory—usually public_html, www, or a subdirectory like /wordpress/. Select and download the entire folder. This includes:

• wp-content/ (themes, plugins, uploads)
• wp-config.php
• .htaccess
• index.php
• Any other custom files or folders

Right-click and choose “Download” to copy all files to a secure local folder on your computer. Name the folder something descriptive, like “mywebsite-backup-2024-06-15”.

Step 2: Export Your Database via phpMyAdmin

Log in to your hosting control panel (cPanel, Plesk, etc.) and locate phpMyAdmin. Click to open it.

In the left-hand sidebar, select your WordPress database. It usually starts with your username followed by an underscore and “wp” (e.g., user123_wp). Once selected, click the “Export” tab at the top.

Choose “Quick” export method and ensure the format is set to SQL. Under “Format-specific options,” select “Add DROP TABLE / VIEW / PROCEDURE / FUNCTION / EVENT” to ensure clean restoration. Click “Go” to download the .sql file.

Save this file in the same folder as your downloaded files. You now have a complete manual backup.

Step 3: Verify Your Backup

Open the .sql file in a text editor like Notepad++ or VS Code. Scroll to the top and confirm it contains your table names (e.g., wp_posts, wp_users). Check the file size—it should be several MB or more, depending on your content volume. If it’s under 100 KB, you likely exported the wrong database.

Ensure your file folder contains all expected directories: wp-content/uploads/, wp-content/themes/, wp-content/plugins/, and wp-config.php. Missing any of these means your backup is incomplete.

Method 2: Using WordPress Plugins (Recommended for Most Users)

Plugins automate the backup process and are the most popular choice for WordPress users. They handle both files and database in one click, often with scheduling, cloud storage, and restoration features.

Step 1: Install a Reliable Backup Plugin

Go to your WordPress dashboard > Plugins > Add New. Search for one of these trusted plugins:

• UpdraftPlus – Most popular, free and premium versions, supports Google Drive, Dropbox, Amazon S3, and more.
• BackupBuddy – Robust, with migration features, premium-only.
• Wordfence – Security-focused, includes backup as part of its suite.
• BlogVault – Real-time backups, excellent for e-commerce.

Install and activate UpdraftPlus (free version) as a starting point.

Step 2: Configure Backup Settings

Navigate to Settings > UpdraftPlus Backups. Under “Backup/Restore,” click “Configure” next to “Where to store your backups.”

Select your preferred cloud storage. For beginners, Google Drive or Dropbox are easiest. Connect your account by clicking “Authenticate with Google” or “Connect to Dropbox.”

Under “What to back up,” ensure “Database,” “Files,” and “Media” are all checked. You can exclude specific folders if you’re confident they’re not critical (e.g., cache folders), but avoid excluding wp-content unless you know what you’re doing.

Step 3: Schedule Automatic Backups

Scroll down to “Schedule Backups.” Choose “Daily,” “Weekly,” or “Monthly.” For most sites, daily is recommended. Set the time when traffic is lowest (e.g., 2:00 AM).

Enable “Email me when backups are done” to receive notifications. This ensures you’re alerted if a backup fails.

Step 4: Run Your First Manual Backup

Click “Backup Now.” The plugin will begin compressing your files and exporting your database. Depending on your site size, this may take 1–10 minutes.

Once complete, you’ll see a success message with a timestamp and file size. Click “View” to see your backup in the cloud storage. Confirm the files exist and are named appropriately (e.g., mysite-database-2024-06-15-1430.zip).

Method 3: Hosting Provider Backups

Many web hosts offer built-in backup services. Examples include:

• SiteGround – Daily backups included with all plans
• Bluehost – Weekly backups on select plans
• WP Engine – Daily automated backups with one-click restore
• Cloudways – Daily backups with S3 integration

While convenient, hosting backups have limitations:

• You may not control retention periods (e.g., only 7 days of backups)
• Restoration may require submitting a support ticket
• You can’t restore individual files or databases easily
• If your host suffers a catastrophic failure, your backups may be affected

Never rely solely on your host’s backup system. Use it as a secondary layer, not your primary strategy. Always maintain your own backups using plugins or manual methods.

Method 4: Command Line Backup via SSH

For advanced users or server administrators, backing up via SSH (Secure Shell) offers speed and automation potential.

Step 1: Connect via SSH

Open your terminal or command prompt and connect to your server:

ssh username@yourdomain.com

Step 2: Navigate to Your WordPress Directory

Use cd to enter your site’s root folder:

cd /var/www/html

Step 3: Create a Compressed File of Your Site

Run this command to zip all WordPress files:

tar -czf /home/username/backup-2024-06-15-files.tar.gz wp-content/ wp-config.php .htaccess index.php

Step 4: Export the Database

Use mysqldump to export your database:

mysqldump -u username -p database_name > /home/username/backup-2024-06-15-db.sql

You’ll be prompted for your MySQL password.

Step 5: Download the Backup Files

Use SCP to transfer files to your local machine:

scp username@yourdomain.com:/home/username/backup-2024-06-15-*.tar.gz /local/backup/folder/

Repeat for the .sql file.

You can automate this entire process using cron jobs for daily execution. This method is ideal for developers managing multiple sites or those who need script-based backups.

Best Practices

Backup Frequency: Match It to Your Site’s Activity

How often you back up depends on how frequently your content changes:

• Static blogs or portfolios – Weekly backups are sufficient
• Business blogs with daily posts – Daily backups recommended
• E-commerce sites (WooCommerce) – Hourly or real-time backups ideal due to transactions and user data
• Membership or community sites – Daily minimum, with additional backups after major user activity

Always perform a backup before:

• Updating WordPress core
• Updating themes or plugins
• Installing new plugins
• Changing hosting providers
• Modifying the database structure
• Launching a new design or feature

Storage Location: Don’t Keep Backups on the Same Server

Storing backups on your web server defeats the purpose. If your server crashes, gets hacked, or is corrupted, your backups vanish with it. Always store backups off-site:

• Cloud storage (Google Drive, Dropbox, OneDrive)
• External hard drives (encrypted and stored securely)
• Remote FTP/SFTP servers
• Specialized backup services (Backblaze, Amazon S3)

Use at least two storage locations. For example, keep one copy on Google Drive and another on an external drive. This is the 3-2-1 backup rule: 3 copies, 2 different media, 1 off-site.

Encryption and Security

Backups contain sensitive data: usernames, passwords, email addresses, payment records (if using WooCommerce), and configuration details. Never leave them unencrypted.

Use password-protected ZIP files or encrypt your .sql files with GPG or similar tools. If using cloud storage, enable two-factor authentication on your account. Avoid public file-sharing links.

Test Your Restoration Process Regularly

Many users back up religiously but never test restoring. A backup is useless if it can’t be restored.

Every 3–6 months, perform a test restore on a local development environment:

• Install Local by Flywheel or XAMPP
• Import the database dump into phpMyAdmin
• Upload your backup files to the web root
• Update wp-config.php with local database credentials
• Visit your local site and verify all content loads correctly

If anything breaks—missing images, 404 pages, login errors—you need to adjust your backup process. Testing reveals hidden issues like incomplete uploads or corrupted SQL files.

Version Control and Naming Conventions

Use consistent naming for your backup files:

yourdomain-db-YYYY-MM-DD-HHMM.zip
yourdomain-files-YYYY-MM-DD-HHMM.zip

Include timestamps to track versions. Avoid generic names like “backup.zip.”

For advanced users, consider integrating version control with Git for code-based changes (themes, plugins, custom functions). This doesn’t replace file/database backups but complements them for developers.

Monitor Backup Status

Enable email notifications from your backup plugin or script. Review them weekly. If a backup fails repeatedly, investigate immediately:

• Is your cloud storage full?
• Did your authentication token expire?
• Is your server running out of disk space?
• Is a plugin conflict causing timeouts?

Set up a simple calendar reminder to check your backup logs every Monday.

Tools and Resources

Top Backup Plugins

• UpdraftPlus – Free, intuitive, supports 15+ cloud services. Ideal for beginners and professionals.
• BackupBuddy – Premium-only. Offers migration, staging, and cloud sync. Excellent for agencies.
• BlogVault – Real-time incremental backups. Trusted by enterprise clients. Includes malware scanning.
• Jetpack Backup – Part of Jetpack suite. Simple, reliable, but limited in free version.
• All-in-One WP Migration – Great for site transfers. Free version limited to 512MB; premium removes limits.

Cloud Storage Services

• Google Drive – 15GB free, easy integration, widely supported.
• Dropbox – 2GB free, reliable API, good for small sites.
• Amazon S3 – Scalable, secure, low cost for large backups. Requires technical setup.
• Microsoft OneDrive – 5GB free, integrates well with Windows.
• Backblaze B2 – $0.005/GB/month. Excellent for large-scale backups. Used by many professionals.

Local Development Tools

For testing restores:

• Local by Flywheel – Free, intuitive, one-click WordPress install.
• XAMPP – Open-source, supports Windows, macOS, Linux.
• DesktopServer – Paid, but excellent for developers.
• Docker – Advanced, containerized WordPress environments.

Database Tools

• phpMyAdmin – Built into most hosts. For manual exports.
• Adminer – Lightweight alternative to phpMyAdmin.
• MySQL Workbench – Desktop tool for advanced database management.
• WP-CLI – Command-line tool for WordPress. Can export databases via wp db export.

Monitoring and Alerting

Use these tools to monitor backup health:

• UptimeRobot – Monitor site uptime; set alerts for downtime after failed backups.
• Health Check & Troubleshooting – WordPress plugin that checks backup status.
• Google Sheets + Zapier – Automate backup success/failure logs into a spreadsheet.

Documentation and Learning

Keep a simple backup checklist in a text file or Notion page:

• Backup date and time
• Storage location
• File sizes
• Restoration test date
• Notes on issues encountered

Recommended reading:

• WordPress Codex: https://wordpress.org/support/article/backup/
• WPBeginner’s Backup Guide
• “WordPress Security” by WPMU DEV

Real Examples

Example 1: E-Commerce Store Loses Database Due to Plugin Conflict

A small WooCommerce store using a discount plugin experienced a fatal error after an update. The site went down, and the admin couldn’t log in. The owner had been using UpdraftPlus with daily backups to Google Drive.

They:

1. Accessed Google Drive and downloaded the latest backup (from 24 hours prior)
2. Used the UpdraftPlus restore feature from within the WordPress dashboard (accessed via FTP by renaming the plugins folder to disable all plugins)
3. Restored the database and files
4. Reactivated plugins one by one to identify the culprit

Result: Site restored within 45 minutes. Lost only 12 hours of order data (which was recoverable from email receipts). No revenue loss.

Example 2: Developer Accidentally Deletes Theme Folder

A freelance developer working on a client’s site accidentally deleted the entire /wp-content/themes/ folder while testing a new design. The site lost all styling and appeared as plain HTML.

They had a manual backup on an external drive from two days earlier. They:

1. Connected the drive and copied the themes folder
2. Uploaded it via FTP to the server
3. Activated the theme again in the WordPress admin

Result: Site restored in 15 minutes. Client was unaware of the incident. Developer implemented a weekly backup routine using BackupBuddy afterward.

Example 3: Hosting Provider Server Crash

A small business hosted on a budget shared server experienced a hardware failure. The host claimed they had backups, but the most recent was 10 days old and missing critical WooCommerce orders.

The business owner had been using BlogVault with real-time backups to Amazon S3. They:

1. Logged into BlogVault dashboard
2. Selected the backup from 1 hour before the crash
3. Restored to a temporary staging site
4. Verified all orders, products, and customer data
5. Migrated the restored site to a new host

Result: Zero data loss. Site back online in 3 hours. The host’s backup was never used.

Example 4: Malware Attack and Ransomware Attempt

A news site was infected with malware that encrypted files and demanded payment. The site was offline for 2 days.

They had:

• Weekly manual backups on an encrypted external drive
• Daily UpdraftPlus backups to Dropbox
• Version-controlled theme files via Git

They:

1. Wiped the entire server
2. Reinstalled a clean WordPress core
3. Restored the latest clean database from Dropbox
4. Reuploaded files from the external drive
5. Reinstalled only trusted plugins from the WordPress repository

Result: Site restored with no data loss. No ransom paid. Security hardened with Wordfence and two-factor authentication.

FAQs

How often should I backup my WordPress site?

For most sites, daily backups are recommended. If your site updates frequently—such as adding new products, blog posts, or user registrations—hourly or real-time backups are ideal. Static sites can get by with weekly backups.

Can I backup my WordPress site for free?

Yes. Manual backups using FTP and phpMyAdmin are completely free. Free plugins like UpdraftPlus and All-in-One WP Migration also offer robust backup features. The only cost is your time and storage space.

Do I need to backup my WordPress database?

Absolutely. The database contains all your content—posts, pages, comments, users, settings. Without it, your site is just a collection of empty files. Always backup both files and database together.

Where should I store my WordPress backups?

Never on your web server. Use cloud storage (Google Drive, Dropbox, Amazon S3), external hard drives, or remote servers. Follow the 3-2-1 rule: three copies, two different media, one off-site.

What’s the easiest way to backup WordPress?

Using UpdraftPlus with Google Drive integration. Install the plugin, connect your Google account, set daily backups, and click “Backup Now.” That’s it.

How do I restore a WordPress backup?

If using UpdraftPlus or similar plugins: Go to Settings > UpdraftPlus > Restore. Choose your backup file and click “Restore.” For manual backups: Upload files via FTP and import the .sql file via phpMyAdmin. Always test on a local site first.

What happens if my backup is corrupted?

Corrupted backups are useless. Always verify file sizes and open .sql files in a text editor to check for content. Test restores regularly to catch corruption early.

Should I backup my WordPress site before updating?

Always. Updates can break compatibility with themes or plugins. A backup ensures you can roll back instantly if something goes wrong.

Can I backup only specific parts of my site?

Yes. Most plugins let you exclude cache folders, logs, or non-essential files. But avoid excluding wp-content unless you’re certain. For most users, full backups are safer.

How long should I keep my WordPress backups?

Keep at least 30 days of backups. For critical sites, retain weekly backups for 6–12 months. Use cloud services with versioning to manage retention automatically.

Is my WordPress backup secure?

Only if you secure it. Encrypt files, use strong passwords for cloud accounts, and never share backup links publicly. Treat backups like sensitive documents.

Conclusion

Backing up your WordPress site is not a one-time task—it’s an ongoing discipline. The cost of not doing it is catastrophic: lost content, revenue, reputation, and trust. Whether you choose manual methods, plugins, or server-level tools, the key is consistency, verification, and off-site storage.

The examples above prove that even experienced users can make mistakes. But those who backup regularly recover quickly. Those who don’t, lose everything.

Start today. If you haven’t backed up your site in the last 7 days, do it now. Set up automated backups. Test a restore. Document your process. Share it with a colleague. Make backup a non-negotiable part of your website management routine.

Your content, your audience, and your business depend on it. Don’t wait for disaster to strike. Build your safety net now—before it’s too late.