How to Back Up a WordPress Site Properly

Most people only think about backups after something goes wrong: a failed update, a hacked plugin, an accidental deletion. A proper routine takes an hour to set up and can save you weeks of rebuilding. This guide shows you how to backup a WordPress site so that you can actually restore it, covering what to include, three methods, where to store the copies, and how to test them.

What a WordPress backup must contain

A WordPress site has two halves, and a backup needs both:

1. Files: the WordPress core, themes, plugins and, importantly, the wp-content/uploads folder where your images and documents live. Also the wp-config.php file.
2. Database: a MySQL or MariaDB database holding posts, pages, comments, settings, users and much of your theme configuration.

If you only copy files, you lose your content. If you only export the database, you lose your media and the theme. A “full” backup includes both. Some backup tools also include the.htaccess file and custom code placed outside wp-content.

How often should you back up?

It depends on how often the site changes.

Site type	Suggested frequency
Brochure site, rarely updated	Weekly, plus before any change
Active blog	Daily
Online shop or membership site	Daily for files, more frequent database backups
Site with frequent orders or comments	Real-time or hourly database backups

A good rule: ask how much work you could stand to redo. If losing a day of orders would hurt, back up more often than daily.

Always take an extra backup immediately before updating WordPress, switching themes, installing a major plugin, or changing the site address.

The 3-2-1 idea

A simple principle used widely in IT: keep three copies of your data, on two different types of storage, with one copy offsite. For a small site that could mean:

• The live site on your server (copy one).
• A backup stored by your host (copy two, different system).
• A downloaded copy in cloud storage or on a local drive (copy three, offsite).

The key point is that backups kept only on the same server as the site disappear with it if the server fails or is compromised.

Method 1: Your host’s backups

Many hosts offer automated backups, sometimes included and sometimes as an add-on. Check:

• How often do they run?
• How many days are kept?
• Can you restore single files or the database, or only the whole account?
• Is the restore self-service or a support request?
• Are the backups stored away from your server?

Treat host backups as a safety net rather than your only plan. The terms may exclude certain failures, and restores can take time. Our hosting guide explains what to look for in a plan.

Method 2: A backup plugin

For most beginners, a reputable backup plugin is the most practical tool.

1. In the WordPress dashboard, open Plugins and Add New.
2. Search for a well-reviewed backup plugin, checking recent updates, active installations and support responses.
3. Install and activate it.
4. In its settings, choose a schedule for files and the database.
5. Connect a remote destination such as a cloud storage account, so copies leave your server.
6. Set a retention limit, for example the last several copies, so storage does not fill up.
7. Run the first backup manually and confirm it completes.

Look out for settings that exclude large folders to speed up backups. Excluding cache directories is sensible; excluding uploads is not.

A caution: a plugin that stores archives in a folder inside your own site only protects against some mistakes. The offsite destination is what makes it a real backup.

Method 3: Manual backup

Manual backups are slower but teach you what is involved, and they are useful before a risky change.

Back up the files

1. Connect to your hosting using SFTP, or open File Manager in your control panel.
2. Download the whole WordPress folder, or compress it into a zip in the control panel first, then download it. Include wp-content and wp-config.php.

Back up the database

1. Open phpMyAdmin from your control panel.
2. Select your WordPress database in the left column. If you are unsure which one it is, check the DB_NAME line in wp-config.php.
3. Click Export.
4. Choose the Quick method and SQL format, then Export.
5. Save the file next to your site files.

Label the folder with the date and store it somewhere safe. Some hosts also provide a “backup” tool in the control panel that creates a full account archive in one click.

Where to store backups

• Cloud storage accounts are convenient and usually offsite.
• An external drive works if you disconnect it afterwards and keep it somewhere sensible.
• A second hosting account can serve as a destination.

Protect the copies as carefully as the site: they contain customer data and database credentials. Use strong passwords, two-factor authentication on storage accounts, and consider encryption. If your backup includes personal data about customers, it falls under UK GDPR as well, so keep access limited and delete outdated copies you no longer need. This is general guidance; seek professional advice for sensitive data.

Test your restore

A backup you have never restored is only a hope. At least once, try a restore in a safe place:

1. Create a staging area or a local test environment.
2. Create an empty database and import your SQL file.
3. Upload the files and edit wp-config.php to match the new database details.
4. Load the site and check pages, images, menus and forms.
5. Note how long it took and what went wrong.

Many hosts and plugins offer a one-click staging or restore feature, which makes the test much easier. Repeat the test every few months, or after changing hosts.

What to do when something breaks

1. Stay calm and do not make it worse. Avoid random changes.
2. Identify the problem. Was it an update? A plugin? A hack?
3. Take a snapshot of the broken state if possible, because it may contain evidence or recent data.
4. Restore from the most recent clean backup.
5. Change passwords (WordPress, hosting, database, FTP) if you suspect a compromise, and update everything.
6. Review what caused it so it does not recur.

For a hacked site, a backup taken after the infection will carry the problem back with it. That is why keeping several dated copies matters.

Backup checklist

• Files and database both included
• Schedule matches how often the site changes
• At least one copy stored offsite
• Retention policy set
• Pre-update backups taken
• Restore tested
• Storage accounts protected with strong passwords

Web Hosting Explained: A UK Beginner’s Guide for 2026

FAQs

Is my host’s backup enough?

Not by itself. Keep at least one independent copy offsite, because host backups can be limited, delayed or lost along with the server.

How big will a backup be?

It depends on your media library. Most of the size is uploaded images and video. Excluding cache folders keeps archives smaller.

Can I back up WordPress for free?

Yes, through manual exports or free plugin tiers. Paid options generally add scheduling, incremental backups and easier restores.

How long should I keep backups?

Keep enough versions to go back before a problem began, for example a couple of weeks of dailies and a few monthlies. Delete older copies that contain personal data you no longer need.

Conclusion

To backup a WordPress site properly, copy both files and database, automate the schedule, send one copy offsite and test a restore. It is dull work until the day it saves your site. Set it up this week, and make a fresh backup before every major change.