A reliable backup can make the difference between recovering your WordPress website and having to rebuild it after something goes wrong.
Your website could be affected by a failed update, accidental deletion, malware infection or hosting problem. Without a usable backup, restoring your content, settings and functionality can become much more difficult.
Fortunately, you do not need to be a developer to put a sensible backup system in place. Many hosting providers and WordPress backup tools can automate much of the process.
This guide explains what to back up, how to create manual and automated backups, where to store them and how to check that you can restore your website when you need to.
What should a complete WordPress backup include?
A typical WordPress website has two main components: its files and its database.
You usually need both to restore the entire website.
WordPress files
Your website files include:
- WordPress core files.
- Installed plugins and themes.
- Images, documents and other uploaded media.
- Custom code and configuration files.
The wp-content directory is particularly important because it contains your themes, plugins and uploaded files.
Your backup may also need files such as wp-config.php, .htaccess and other custom configuration files, depending on how your website is hosted.
Some installations depend on additional files or server settings outside the normal WordPress directory. Check whether these need separate backups or documentation.
WordPress database
The database stores much of the information that makes your website work, including posts, pages, comments, settings and user accounts.
Plugins can also store important information in their own database tables.
For example, a WooCommerce website may store orders, products, customer information and other business data in its database.
Downloading the WordPress files alone will not normally back up the database.
Likewise, exporting the database without the corresponding website files can leave you without important themes, plugins, uploads and configuration.
Aim to create a complete backup set containing matching copies of the files and database from approximately the same point in time.
Why should you back up your WordPress website?
Backups provide a recovery option when something happens to your website that you cannot easily reverse.
Common situations include:
A failed update or accidental change. An update might introduce a compatibility problem, or someone could delete important content or files by mistake.
Malware or a security incident. A backup from before the compromise may help with recovery, although it must be checked before use. Restoring an infected backup can reintroduce the problem.
Hosting or infrastructure failure. A server problem, damaged storage or an unavailable hosting account could prevent you from accessing your website.
An unsuccessful migration. A complete backup gives you another recovery option if moving your website to a different server does not go as planned.
Backups are not a substitute for updates, security monitoring or troubleshooting. They are one part of a wider website maintenance and recovery strategy.
How to back up your WordPress website
There are three common approaches: using your hosting provider’s backup system, using a WordPress backup plugin or service, and creating a manual backup.
You can also combine methods to avoid relying entirely on one system.
Method 1: Use your hosting provider’s backups
Many WordPress hosting providers offer scheduled backups through their hosting control panel.
Depending on your hosting package, you may be able to create an additional backup before making changes or restore an earlier version of your website.
Start by checking your hosting dashboard or asking your provider what backup facilities are included.
Find out:
- Whether backups include the entire website and database.
- How frequently backups are created.
- How long previous versions are retained.
- Whether backups are stored separately from the live server.
- Whether you can download or independently access a copy.
- How restoration works and whether there are additional charges.
Do not assume that your hosting provider’s backups cover everything you need.
For example, a hosting backup might not include your domain configuration, external services or files stored outside the hosting account.
It is also worth considering what would happen if your hosting account became inaccessible or the provider experienced a wider outage.
An independent backup stored elsewhere gives you another recovery option.
Method 2: Use a WordPress backup plugin or service
A WordPress backup plugin can automate backups without requiring you to download files and export the database manually each time.
Many backup tools offer scheduled backups, remote storage and restoration features.
Some services operate outside WordPress and can offer additional recovery options if the dashboard becomes inaccessible.
When choosing a backup tool, look for the following capabilities.
Complete backups: Can it capture your database, uploads, themes, plugins and other required files?
Automatic scheduling: Can you set an appropriate frequency and confirm that scheduled jobs actually run?
Remote storage: Can backups be sent to a storage location independent of your hosting account?
Backup retention: Can you keep several recovery points rather than automatically replacing the previous backup?
Restoration: Can you restore your website if WordPress itself is no longer accessible?
Reporting: Will you receive useful notifications when a backup fails?
Compatibility: Does the tool support your website’s size, hosting environment and important functionality?
A plugin that creates backups but cannot reliably restore them is not enough.
Before depending on any solution, confirm that you understand its restoration process and have tested it.
For a relatively straightforward WordPress website, an established backup plugin may provide the functionality you need.
More complex websites may require a dedicated backup service, hosting-level snapshots or a combination of approaches.
Method 3: Back up WordPress manually
Manual backups are useful when you want an additional independent copy, need to prepare for a migration or cannot rely on your existing backup system.
The exact steps depend on your hosting environment, but the process normally involves downloading your website files and exporting your database.
You will need access to your hosting files and database management tools.
Step 1: Download your website files
Connect to your hosting account using its file manager or a secure file transfer method such as SFTP.
Locate your WordPress installation and download the files needed to restore it.
Make sure you include your uploaded media, plugins, themes and relevant configuration files.
Hidden files, such as .htaccess, may not appear automatically in every file manager.
Check whether your website also depends on custom server configuration or other files stored outside the main WordPress directory.
Keep the downloaded files together in a clearly named backup folder.
For example, a folder name containing the website and backup date can help you identify the correct recovery point later.
Step 2: Export your WordPress database
Many hosting providers offer phpMyAdmin or another database management tool.
If phpMyAdmin is available:
- Open phpMyAdmin through your hosting control panel.
- Select the database used by your WordPress website.
- Open the Export section.
- Select an appropriate SQL export option.
- Ensure that the export includes all the tables required by your website.
- Download the resulting SQL file.
For a straightforward database, phpMyAdmin’s Quick export option may be sufficient.
More complex installations may require additional export settings or a different backup method, particularly if the database is large or frequently changing.
If you are unsure which database belongs to your website, its connection details are normally defined in wp-config.php.
Do not publish or share the database credentials contained in that file.
You can find further instructions in the official WordPress database backup documentation.
Step 3: Store the files and database together
Your manual backup should now contain the website files and a database export.
Keep these together as one identifiable backup set so you do not accidentally combine files from one date with a database from another.
Check that the files have transferred successfully and that the database export is present and has a plausible size.
A completed download is a useful initial check, but it does not prove that the website can be restored.
For a busy website, avoid making significant changes while creating an inconsistent file-and-database backup. Use a backup tool that supports a suitable consistency process, or arrange an appropriate maintenance window.
Step 4: Move the backup to a secure location
Do not leave your only manual backup inside the same hosting account as your live website.
Move it to a separate, appropriately protected storage location and restrict access to authorised people.
Backups can contain personal information, passwords, configuration secrets and other sensitive data, so protect them accordingly.
Remember that a manual backup represents your website at a particular point in time. It will not protect changes made afterwards unless you create another backup.
How often should you back up WordPress?
Your backup frequency should reflect how often your website changes and how much data you can afford to lose.
Consider two questions:
How much data could you afford to lose?
If you back up your website once a day, a restoration could potentially lose changes made since the previous successful backup.
A busy online store might receive important orders throughout the day, making a daily database backup insufficient.
A small brochure website that changes infrequently may have very different requirements.
How quickly would your website need to be restored?
Having a backup is useful, but the time required to retrieve, transfer and restore it also matters.
A large website may take considerably longer to recover than a small informational site.
These considerations are sometimes called the recovery point objective and recovery time objective.
You do not need to use the technical terminology to make a sensible decision. Simply establish how much information you can afford to lose and how long your business could operate without the website.
A practical backup schedule
| Website type | Suggested starting approach |
|---|---|
| Small brochure website | Scheduled backups appropriate to content changes, plus a backup before significant updates. |
| Regularly updated blog | Automated backups frequent enough to protect recent posts and uploads. |
| Busy WooCommerce store | More frequent database backups or a suitable real-time backup solution. |
| Business-critical website | Backup and recovery arrangements based on the impact of downtime and data loss. |
These are starting points, not fixed rules.
Adjust the schedule to suit your website, and remember that backups which fail silently provide little protection.
Where should you store your WordPress backups?
A useful backup strategy protects against more than one type of failure.
If your live website and every backup depend on the same hosting account, losing access to that account could leave you unable to recover.
The UK National Cyber Security Centre recommends maintaining multiple copies of important information in separate locations.
A commonly used approach is the 3-2-1 backup rule:
- Keep at least three copies of important data, including the original.
- Store copies using two different devices or storage arrangements.
- Keep at least one copy off-site.
For WordPress, this might mean your live website, a hosting backup and an independent backup stored with another provider.
However, simply having three copies does not guarantee that they are safe.
If every backup can be deleted or overwritten using the same compromised account, they may all remain vulnerable.
Where appropriate, consider backup storage that is isolated from your website, protected by separate access controls or designed to resist modification and deletion.
Use strong authentication and limit who can access or remove backup files.
The most important principle is to avoid a single failure leaving you without any usable recovery point.
How long should you keep WordPress backups?
Keeping only the latest backup can create problems when an issue goes unnoticed.
For example, a website may become compromised without immediately showing obvious symptoms. If every new backup replaces the previous one, you could eventually be left with copies that already contain the problem.
A retention policy gives you the ability to recover from an earlier point in time.
Consider keeping several recent backups alongside older recovery points where appropriate.
The right retention period depends on your website, available storage, recovery requirements and any relevant data-retention obligations.
Do not assume that retaining backups indefinitely is necessary or appropriate.
You should also understand when your backup provider automatically deletes older copies and what happens when your storage allowance is reached.
Periodically check that your retention settings still match your needs.
How to test a WordPress backup
A successful backup notification confirms that a process reported success. It does not prove that every required file was included or that restoration will work.
The most useful test is to restore a backup in a safe environment.
Where possible, use a separate staging or testing environment rather than overwriting your live website.
A practical restoration test involves:
- Selecting a recent backup and identifying its files and database.
- Restoring the backup into an appropriate test environment.
- Confirming that WordPress loads and administrator access works.
- Checking that important pages, images and functionality are present.
- Testing essential forms, integrations and other relevant features.
- Recording any problems and updating your recovery instructions.
Make sure the test environment cannot accidentally send real customer emails, process live payments or trigger other production integrations.
A restoration test may also reveal missing configuration, incompatible software versions or files that your backup process has overlooked.
Repeat testing periodically and after important changes to your backup arrangements.
If you cannot restore the website yourself, confirm who can perform the restoration and how to reach them during an incident.
How to restore a WordPress website from a backup
The restoration process depends on the backup method, hosting environment and problem you are trying to resolve.
A hosting provider or backup plugin may offer a guided restoration process.
A manual restoration usually requires replacing the relevant website files and importing the backed-up database, followed by configuration and functionality checks.
Before restoring anything, establish what went wrong and which recovery point is appropriate.
1. Preserve the current website state
Where practical, make a separate copy of the current files and database before restoring an older backup.
Even a damaged website may contain recent orders, customer records or other information that does not exist in your previous backup.
Preserving its current state may also help with troubleshooting or investigating a security incident.
2. Choose the correct recovery point
Identify the most recent backup that is both usable and appropriate for the problem.
The newest backup is not always the right choice.
For example, if malware was present before the latest backup was created, restoring that backup may bring the infection back.
A backup taken before a faulty update may be useful for recovering from that update, but it may also omit newer content and data.
3. Restore the files and database
Follow the documented restoration process for your backup system.
If you are restoring manually, make sure the website files and database belong to the intended backup set.
Restoring an older database over your current database can overwrite changes made after the backup was created.
Avoid blindly restoring everything when a more targeted recovery would preserve important recent data.
If the website uses a different server or database connection after recovery, configuration changes may also be required.
4. Check the recovered website
Once restoration is complete, verify that:
- The website and WordPress dashboard are accessible.
- Important pages and images load correctly.
- Forms and other essential functionality work.
- User accounts and permissions are appropriate.
- The website uses the correct domain and HTTPS configuration.
- Any original security or technical problem has been resolved.
For a website affected by malware, additional cleanup, vulnerability remediation and security checks are necessary before considering recovery complete.
Do not assume that restoring a backup automatically removes every security problem.
Important considerations for WooCommerce and other busy websites
Restoring an older database can be particularly risky when your website processes transactions or constantly changing information.
For example, a WooCommerce store may receive orders after a backup has been created.
If you restore the entire database from that earlier backup, you could lose newer orders, customer records or changes to stock information.
Subscription websites can introduce additional complications involving renewals and scheduled actions.
Before restoring a busy website, identify what data has changed since the recovery point and how that information will be preserved or reconciled.
Depending on the problem, this may involve a more recent backup, a targeted restoration or specialist assistance.
Do not overwrite a live store’s database without understanding the potential consequences.
Common WordPress backup mistakes to avoid
Even with an automated backup system, a few common mistakes can undermine your recovery plan.
Backing up only the database or files. A typical WordPress site needs both for a complete restoration.
Keeping every backup on the same server. A server failure or compromised hosting account could affect the live website and its backups.
Never checking backup results. A scheduled job can fail because of storage limits, permissions problems or other technical issues.
Keeping only one recovery point. The latest backup might already contain corrupted or compromised information.
Never testing restoration. You may only discover missing files or an unusable backup when you urgently need it.
Using an old backup without checking newer data. Restoring the database can overwrite recent orders, enquiries, comments and other changes.
Treating Git or a WordPress XML export as a complete backup. Version control can preserve code history, while WordPress’s built-in content export can transfer certain content. Neither automatically provides a complete, restorable copy of every website component.
Keep your WordPress backups reliable
A backup strategy does not need to be complicated, but it does need to be dependable.
Start by confirming that your files and database are backed up, copies are stored independently, failed backups are noticed and you know how to restore the website.
Then adjust your backup frequency and retention to reflect how important your website is to your business.
Backups work best as part of a wider maintenance routine that also includes software updates, monitoring and regular functionality checks.
Our WordPress maintenance checklist covers the other important tasks involved in keeping your website properly looked after.
If you would prefer ongoing help, explore our WordPress Care Plans to compare the available levels of website care and choose the support that suits your needs.
If your website has already developed a problem and you need help recovering it, our WordPress support services provide a separate route for one-off assistance.
