How to Backup a WordPress Website Step by Step
A complete beginner's walkthrough covering free plugins, manual cPanel backups, automation, and restoring your site when something goes wrong.
It happens more often than anyone wants to admit. A plugin update goes wrong, a hosting server has a bad day, or someone on your team accidentally deletes the wrong page — and suddenly the website you have spent months building looks like it never existed. If you have never sat through that particular kind of panic, count yourself lucky, and let's make sure you never have to.
Backing up a WordPress website is one of those tasks that feels optional right up until the moment it isn't. The good news is that it is not complicated, it does not require a developer, and once you set it up properly, you will barely think about it again. This guide walks through exactly how to back up a WordPress website step by step, using both free plugins and manual methods, so you have a real recovery plan instead of just hoping nothing ever breaks.
What makes this different from a lot of backup tutorials is that we are not just covering the "click this button" version. You will also see why file backups and database backups are two separate things, how to know which backup method fits your situation, how to actually test that a backup works before you need it, and what a proper restore looks like when the moment finally comes. By the end, backing up your site should feel less like a chore you keep postponing and more like a five-minute habit you barely notice anymore.
Quick Answer
The fastest way to back up a WordPress website is to install a free plugin like UpdraftPlus, connect it to a cloud storage account such as Google Drive, and schedule automatic daily database backups plus weekly full-site backups. For a backup method that does not rely on WordPress loading at all, use your hosting control panel's File Manager to download your files and phpMyAdmin to export your database manually.
Table of Contents
- Why WordPress Backups Actually Matter
- The Two Parts of Every WordPress Backup
- Backup Methods Compared
- Method 1: Backing Up with a Free Plugin
- Method 2: Manual Backup via cPanel and phpMyAdmin
- Method 3: Using Your Host's Built-In Backup Tool
- Automating Your Backups the Right Way
- Choosing the Right Cloud Storage for Your Backups
- When You Should Always Take a Manual Backup First
- Best WordPress Backup Plugins Compared
- How to Restore a WordPress Site from a Backup
- Common Backup Mistakes to Avoid
- Pre-Publish Backup Checklist
- Frequently Asked Questions
Why WordPress Backups Actually Matter
WordPress powers a huge share of the websites you visit every day, which also makes it a common target for automated attacks, and a common victim of ordinary human error. Neither of those things requires malice. A theme update that conflicts with a plugin, a hosting migration that goes sideways, an accidental bulk-delete in the media library — any of these can take a site offline in seconds. Without a backup, "offline" can quietly turn into "gone."
There is also a business cost that people underestimate. Every hour a site is down or broken is an hour of lost search visibility, lost ad impressions, and lost trust from returning visitors. Search engines notice repeated downtime too, and recovering rankings after an extended outage can take far longer than the outage itself. A backup is not just a technical safety net; it is what lets you fix a disaster in twenty minutes instead of twenty days.
Think about backups the same way you think about a spare tire. You might drive for years without ever needing it, but the one time you do, nothing else will substitute for having it ready in the trunk.
There is a security dimension to this too. WordPress sites get scanned constantly by automated bots looking for outdated plugins, weak passwords, and unpatched vulnerabilities. Most site owners will experience at least one attempted intrusion at some point, whether or not it succeeds. When one does succeed, the fastest and most reliable fix is almost never a manual clean-up of infected files line by line — it is rolling back to a known-clean backup taken before the compromise happened, then hardening the site and updating everything before bringing it back online. Without a recent clean backup, you are left guessing which files are safe and which ones are not, which can drag a one-hour fix into a multi-day investigation.
None of this is meant to make WordPress sound fragile. It is a mature, widely used platform, and most sites run for years without a serious incident. But "most" is not "all," and the entire point of a backup routine is that it does not care whether the next incident happens to you tomorrow or five years from now. It just needs to already be in place when it does.
The Two Parts of Every WordPress Backup
Before choosing a method, it helps to understand what actually needs to be saved. A WordPress website is really made up of two separate pieces, and a genuine backup has to cover both.
1. The Files
This includes your WordPress core installation, your active theme (and any child theme, if you followed our child theme guide), every installed plugin, and the wp-content/uploads folder where every image, PDF, and media file lives. If your uploads folder disappears, every image on every post disappears with it, even if the post text is fine.
2. The Database
Your database is a MySQL database that stores your actual content: post text, page content, comments, user accounts, site settings, permalink structure, widget configuration, and plugin settings. If you have already set up SEO-friendly permalinks, that structure lives here too, which is one more reason database backups matter even on a site with very few images.
Backup Methods Compared
There are three realistic ways to back up a WordPress site, and each one fits a different situation. Here's how they stack up against each other before we walk through the steps for each.
Method 1: Backing Up with a Free Plugin
For most people, this is the right starting point. Plugins handle scheduling, compression, and cloud storage connections automatically, and you never need to touch a database directly.
Step-by-step: UpdraftPlus (free version)
- From your WordPress dashboard, go to Plugins → Add New and search for "UpdraftPlus."
- Install and activate the plugin, then open Settings → UpdraftPlus Backups.
- Click Backup Now to run a first manual backup and confirm everything works before scheduling automation.
- Go to the Settings tab and set your files backup schedule (weekly is usually enough) and your database backup schedule (daily is safer for active sites).
- Under Choose your remote storage, select Google Drive, Dropbox, or another option, then click Save Changes and follow the authentication prompts to connect your account.
- Run a second test backup after connecting storage, then check your cloud account to confirm the backup files actually arrived.
Method 2: Manual Backup via cPanel and phpMyAdmin
This method takes a bit more effort, but it is worth knowing because it works even when your WordPress dashboard will not load — which is exactly the situation where you are most likely to need a backup in the first place.
Step-by-step: Manual backup
- Log in to your hosting account's cPanel (or equivalent control panel) and open File Manager.
- Navigate to your WordPress root folder (often
public_html), select all files and folders, and choose Compress to create a single ZIP archive. - Download that ZIP file to your computer. This covers your themes, plugins, uploads, and core files.
- Return to the cPanel dashboard and open phpMyAdmin.
- Select your WordPress database from the left-hand list (check
wp-config.phpif you are unsure which database name is correct). - Click the Export tab, keep the "Quick" export method and SQL format selected, then click Go to download the database file.
- Store both the files ZIP and the SQL export together in a clearly labeled folder, dated, on an external drive or cloud account.
Method 3: Using Your Host's Built-In Backup Tool
If you are on managed WordPress hosting, there is a good chance backups are already partly handled for you. Providers like SiteGround, WP Engine, Kinsta, and Bluehost typically include a backup section directly inside their hosting dashboard, separate from WordPress itself.
What to check in your hosting panel
- How often automatic backups run (daily is standard on most managed plans)
- How many days or versions of backups are retained before older ones are deleted
- Whether you can trigger a manual, on-demand backup before making a big change
- Whether restoring is self-service or requires contacting support
Even with a solid host-provided backup, it is worth keeping one independent copy through a plugin or manual export as well. Relying on a single backup source, hosted in a single place, is its own kind of risk.
Automating Your Backups the Right Way
Manually remembering to back up a website is a plan that works fine for about three weeks. Automation is what actually protects you long-term, and the standard approach worth following is called the 3-2-1 rule.
Set your plugin or hosting tool to run automatically, but treat the first successful automated cycle as a checkpoint, not the finish line. Log in after the first week and confirm files actually landed in your cloud storage, are the size you expect, and are not silently failing due to an expired authentication token — this happens more often than people think.
It is also worth putting a recurring reminder on your own calendar, separate from the plugin's internal scheduling, to spot-check your backups every month. Cloud storage authentication tokens expire, hosting accounts change passwords, and plugin updates occasionally reset settings without warning. A five-minute monthly check — opening your cloud folder and confirming a recent, correctly sized backup file is sitting there — is the difference between a backup system you can actually trust and one that quietly stopped working three months ago without telling you.
Choosing the Right Cloud Storage for Your Backups
Picking a plugin is only half the equation — where those backup files actually land matters just as much. Most backup plugins support several remote storage destinations, and the right one usually comes down to how much you already use a particular service and how much storage your site realistically needs.
A common approach that works well in practice is to connect one cloud storage account inside your backup plugin for automated, scheduled uploads, and then periodically download a manual copy to an external hard drive or a separate cloud folder every month or two. That second, independent copy is what actually satisfies the "two different storage types" part of the 3-2-1 rule, rather than just having two automated backups sitting in the same ecosystem.
When You Should Always Take a Manual Backup First
Scheduled automatic backups cover the everyday risk, but certain actions carry enough risk on their own that waiting for the next scheduled run is not good enough. Get in the habit of triggering a fresh, on-demand backup immediately before any of the following:
- Updating WordPress core to a new major version
- Updating a theme or plugin that has not been updated in a long time
- Switching to a new theme or activating a page builder for the first time
- Migrating the site to a new host or a new domain
- Making bulk changes to the database, such as a find-and-replace across posts
- Handing temporary admin access to a freelancer or contractor
These moments share one thing in common: they are exactly when something is most likely to go wrong, and exactly when you most want a fresh, known-good copy sitting ready just in case it does.
Best WordPress Backup Plugins Compared
For a personal blog or a small business brochure site, the free tier of UpdraftPlus or WPvivid is genuinely enough. Upgrade to a paid plan or a real-time option like Jetpack VaultPress mainly if you run an online store where losing even a few hours of order data would actually hurt.
How to Restore a WordPress Site from a Backup
A backup is only useful if you also know how to bring it back. Here is the process for both plugin-based and manual restores.
Restoring with a plugin
- Log in to WordPress and open your backup plugin's dashboard.
- Locate the backup you want to restore from the existing backups list, or upload a backup file if restoring on a fresh install.
- Choose to restore files, database, or both, depending on what actually broke.
- Confirm the restore and wait for the process to finish without closing the browser tab.
Restoring manually
- Upload your files ZIP through File Manager or FTP and extract it into your WordPress root directory, overwriting existing files.
- Open phpMyAdmin, select your database, and use the Import tab to upload your saved SQL file.
- Check
wp-config.phpto confirm database name, username, password, and host still match your hosting environment. - Visit your site's homepage and admin dashboard to confirm everything loads correctly, then check permalinks by visiting a few inner pages.
Common Backup Mistakes to Avoid
Most WordPress backup failures are not caused by exotic technical problems. They come from small, avoidable habits that quietly undermine an otherwise reasonable backup setup. Here are the ones worth watching for specifically, because each one can turn a routine incident into a genuine data loss event.
Pre-Publish Backup Checklist
- Backup plugin installed and connected to external cloud storage
- Database backup scheduled daily; full-site backup scheduled weekly
- At least one manual test backup completed and verified in cloud storage
- Backup retention set to keep multiple dated versions
- Test restore performed at least once on a staging or local environment
- Hosting provider's own backup policy checked and understood
- wp-config.php database credentials noted somewhere safe outside the server
Frequently Asked Questions
How often should I back up my WordPress website?
For most blogs and small business sites, a daily automated database backup plus a weekly full-site backup is enough. Online stores or very active sites should move to real-time or hourly database backups instead.
Where should I store my WordPress backups?
Never rely on backups stored only on the same server as your live site. Send at least one copy to an external destination such as Google Drive, Dropbox, or a downloaded local copy, following the 3-2-1 backup rule.
Can I back up WordPress without a plugin?
Yes. Downloading your files through cPanel File Manager or FTP and exporting your database through phpMyAdmin gives you a full manual backup that works even when the WordPress dashboard itself is not loading.
What is the difference between a full backup and a database backup?
A full backup covers your WordPress core files, themes, plugins, and uploads folder along with the database. A database backup only saves posts, pages, comments, and settings. A complete recovery plan needs both.
How do I restore a WordPress site from a backup?
Most plugins offer a one-click restore from their dashboard. For a manual restore, upload the file backup via FTP or File Manager, import the SQL file through phpMyAdmin, and confirm your wp-config.php database credentials are still correct.
Do WordPress hosting companies back up my site automatically?
Many managed WordPress hosts include daily automatic backups, but shared hosting plans often do not, or only keep them for a short retention window. Always confirm your host's policy and keep an independent backup regardless.
Setting up a real backup routine is one of those tasks that takes less than half an hour but changes how confidently you can run a website afterward. Once a plugin is scheduled, cloud storage is connected, and you have done one test restore, most of the anxiety around "what if something breaks" simply goes away — because you already know exactly what you would do next.
This guide is provided for general informational purposes. Always test backup and restore procedures on a staging or local environment before applying changes to a live production website, and consult your hosting provider's documentation for platform-specific steps.