Originally published: April 19, 2025 · Last reviewed and updated: October 2026
A WordPress backup has two parts: the files (themes, plugins, uploads, and wp-config.php) and the database (posts, pages, users, settings, and comments). A backup that misses either part cannot fully restore your site, and a backup you have never tested may not restore it at all.
This guide explains what to back up, how often, where to store it, and how to check that a restore actually works.
The Short Answer
Use an automatic backup tool (your host’s backup system or a plugin such as UpdraftPlus) to back up both the database and the wp-content folder on a schedule that matches how often your site changes. Store copies off the server, for example in cloud storage, and follow the 3-2-1 rule that CISA recommends: three copies, on two types of storage, with one off-site.
Take an extra backup before every update, and restore a backup to a staging site every few months to prove it works.
What a WordPress Backup Must Include
The WordPress backup documentation points out that the database lives outside your WordPress folder, so downloading the files alone does not capture your content.
| Component | Where it lives | What it holds | Changes how often |
|---|---|---|---|
| Database | MySQL/MariaDB server | Posts, pages, comments, users, settings, plugin data | Every time content or settings change |
wp-content/uploads | Web server | Images, PDFs, other media | Whenever you upload media |
wp-content/themes and plugins | Web server | Theme and plugin code, including custom child themes | On updates and installs |
wp-config.php and .htaccess | Site root | Database credentials, security keys, server rules | Rarely |
| WordPress core files | Site root | wp-admin, wp-includes | Only on core updates (can be re-downloaded) |
Core files are the least important to back up because you can download them again from WordPress.org. Your database, uploads, and any custom code cannot be replaced.
How Often to Back Up
Match the schedule to how much work you would lose between two backups.
| Site type | Database | Files | Retention |
|---|---|---|---|
| Blog posting weekly | Daily | Weekly | At least 30 days |
| Business site with forms | Daily | Weekly, plus before updates | At least 30 days |
| WooCommerce or membership site | Every few hours or real-time | Daily | 30–90 days |
| Site under active development | Before every change | Before every change | Keep milestone versions |
Keep several older versions, not just the latest. If malware or a bad edit goes unnoticed for a week, a backup from yesterday contains the same problem.
Choose a Backup Method
There are three common approaches. Many sites use two of them together.
Hosting backups
Most managed WordPress hosts and many cPanel hosts take automatic daily backups. Check how long they are kept, whether you can download them, and whether they are stored on a different server. Treat host backups as one copy, not your whole strategy: if you lose access to the hosting account, you lose those backups too.
Backup plugins
Plugins such as UpdraftPlus, BackWPup, or Jetpack VaultPress Backup run on a schedule and send copies to remote storage (Google Drive, Dropbox, Amazon S3, and others, depending on the plugin). They are the easiest way to get off-site backups you control. When choosing one, check that it can restore as well as back up, supports your storage provider, and has been updated recently.
Manual and command-line backups
For a one-off backup before a risky change, you can export the database with phpMyAdmin or with WP-CLI’s wp db export command, then download wp-content by SFTP or your host’s file manager:
wp db export backup-before-update.sqlBack up the database first, then the files, as the WordPress documentation recommends, and store both files together.
Step-by-Step: Set Up Automatic Off-Site Backups
- Check your host’s backups and note the schedule, retention, and how to download or restore.
- Install a backup plugin if your host’s backups are not off-site or not downloadable.
- Connect remote storage (for example Google Drive or Amazon S3). Use a storage account with its own strong password and 2FA.
- Set the schedule using the table above, with separate database and file schedules if the plugin allows.
- Set retention so several older copies are kept.
- Run the first backup manually and confirm both the database and files appear in remote storage.
- Test a restore on a staging site. Our roundup of WordPress staging plugins lists tools that make this easy.
How to Test a Restore
A backup is only proven when it has been restored. Every few months, restore your latest backup to a staging copy and check that posts, images, menus, forms, and logins work. Note how long the restore took; that is roughly how long your site would be down after a real failure.
If a restore fails, the most common causes are an incomplete database export, a backup file that exceeded a storage or upload size limit, or a different PHP version on the target server.
Keep Backups Secure
Backups contain everything an attacker would want: user emails, password hashes, and the database credentials in wp-config.php.
- Store backups outside the public web folder or in private cloud storage.
- Protect storage accounts with strong passwords and two-factor authentication.
- Delete old backups you no longer need, especially on the web server.
- Keep at least one copy that a compromised WordPress admin account cannot delete.
For the rest of your security setup, see our WordPress security best practices.
Common Mistakes
- Backing up only files or only the database. You need both for a full restore.
- Storing every copy on the same server. A server failure or hack removes them all.
- Never testing a restore. Many owners discover broken backups only when they need them.
- Keeping only one version. Problems found late need an older clean copy.
- Skipping the pre-update backup. Updates are the most common moment you will need a quick rollback.
FAQ
Are hosting backups enough?
They are a good start, but not enough on their own. Keep at least one copy outside your hosting account so you can recover if the account is suspended, hacked, or the host has an outage.
How large will my backups be?
Mostly as large as your uploads folder plus the database. Media-heavy sites can produce multi-gigabyte backups, so check your storage quota and the plugin’s file-splitting options.
Can I use a backup to move my site to a new host?
Yes. Many backup plugins can restore to a different server. Our guides on migrating WordPress to a new host and WordPress site cloning cover the extra steps, such as updating URLs and DNS.
Should I back up before cleaning the database?
Always. Database cleanup tools delete data permanently. Follow the steps in our WordPress database optimization guide only after you have a fresh backup.
The Bottom Line
A reliable WordPress backup setup is simple: back up the database and wp-content automatically, keep several versions in at least one off-site location, take an extra copy before updates, and test a restore regularly. The test is the step most people skip, and it is the one that tells you whether your backups will actually save the site.
Sources & Further Reading
- WordPress Advanced Administration: Backups
- WordPress Advanced Administration: Backing Up Your Database
- WP-CLI: wp db export
- CISA: Data Backup Options
- CISA: Back Up Business Data
- WordPress.org: UpdraftPlus plugin
- WordPress.org: BackWPup plugin
Articles are editorially reviewed by Jackober and factual claims are checked against cited sources.
2 comments