◦ Comprehensive security
◦ 24/7 support
WordPress Guide → Security → Backup
How to backup a WordPress website (Manually + Plugins)
Imagine waking up to find your WordPress site blank – posts gone, images missing, and months of work wiped out in seconds. Server glitches, hacking attempts, or a single mis-click can make that nightmare real. The good news? A solid backup strategy turns every “what if” into a stress-free reset button. In this guide, you’ll learn two foolproof ways to safeguard your site:
- Manual backups for full control and no extra cost.
- Plugin-powered backups for set-and-forget protection with automation built in.
Whether you’re a beginner or a seasoned developer, you’ll walk away knowing exactly how to copy, store, and restore your WordPress files and database, so your content stays safe, your traffic keeps flowing, and your peace of mind never wavers.
Get fast, reliable hosting for WordPress
Power your site with the industry’s fastest, most optimized WordPress hosting
Why it’s important to back up your WordPress site
Picture your website as the digital headquarters for your brand, blog, or business. Every post, image, and line of customer data stored there is part of that headquarters. But unlike a brick-and-mortar building, your online space sits on servers that can fail without warning, or be compromised by outside forces. Backups act as a safety net, letting you hit Restore instead of starting from scratch when disaster strikes.
Key reasons you must back up:
- Security breaches. Even well-maintained sites can be hacked, leading to defaced pages or hidden malware that’s hard to spot and remove without a clean copy to roll back to.
- Human error. Accidentally deleting a critical plugin or entire folder can topple your site in seconds; a backup gives you an instant undo button.
- Server crashes or hardware failure. Hosts do experience outages and disk failures. Without your own copy, you’re at the mercy of their recovery timeline.
- Bad updates. Themes, plugins, or WordPress core updates sometimes conflict and break layouts or functionality; restoring a pre-update snapshot keeps downtime minimal.
- Malicious code and ransomware. Some attacks lock content behind a ransom demand; a fresh backup lets you restore and walk away.
- Regulatory and client trust. Losing customer information or order history can breach data-protection rules and shatter credibility overnight.
- Cost of rebuilding. Re-creating custom designs, rewritten content, and SEO gains consumes far more time and money than setting up regular backups.
What happens if you don’t? You could:
- Lose money: Without a WordPress backup, your site will have to be rebuilt from scratch every time certain errors occur. Rebuilding your site results in extra fees you must pay — plus, the more often your website is down, the more you risk losing visitors or subscribers.
- Risk lowering your SEO rankings: If an online business often faces errors, offline periods, or issues with data, you risk losing the SEO value of your domain. Search engines want to make sure the user gets the best experience, which is why high-quality websites get better positions in search results. That means a site needs to have fast page speed, excellent performance, and high uptime (the period of time your website is online) to get a better spot in search results.
- Lose followers: If your site is down for any length of time or it often faces errors, you risk losing subscribers or visitors. Modern customers have high expectations — if you can’t be there and offer them what they want, someone else will.
- Lose time: Downtime comes at a cost of something you simply can’t buy — time. Recovering your website, content, and needed files may take longer than you think, so you’re losing valuable time you could invest in other projects.
A reliable backup isn’t a “nice-to-have.” It’s an essential layer of insurance that protects your reputation, revenue, and sanity. With a solid plan in place, you can experiment, update, and grow your WordPress site knowing a clean version is always just a few clicks away.
What to back up?
A complete WordPress backup has two pillars: your files and your database. Think of them as the blueprints and the contents of a building. You need both to rebuild the site exactly as it was.
1. WordPress files – the structure and style
These live on your web server and shape how everything looks and runs:
- Core folders (wp-admin, wp-content, wp-includes). WordPress can’t function if any of these are missing.
- Themes. They control your site’s design and layout.
- Plugins. These add features like contact forms, stores, or SEO tools.
- wp-config.php. This single file holds your database login details and other vital settings.
If even one of these elements is gone or corrupted, pages can break, styles can vanish, and errors can take over.
2. WordPress database – the content and settings
Stored separately from your files, the database is where WordPress keeps everything you create or change:
- Posts and pages. All your articles, landing pages, and drafts.
- Comments. Every reader reply and any moderation data.
- Users. Account names, passwords (encrypted), and roles.
- Site settings. Menu orders, plugin configurations, and theme options.
Skip the database, and you may restore a shell of your site—nice to look at but empty on the inside.
Why you must back up both
Files and database work together. Back up only one, and a future restore will be incomplete: themes might load without content, or posts may appear with broken styling. A true safety net captures everything, letting you hit “restore” and watch your site come back exactly as visitors remember it.
How often should you back up your WordPress site?
The right backup rhythm hinges on how quickly your site’s content—and visitor data—changes. A portfolio that sees only the occasional update can live comfortably on a weekly backup cycle, while a bustling blog or news site risks losing fresh posts if it waits that long. Sites with constant transactions or user interactions need an even tighter safety net.
- Static or brochure-style sites. Weekly backups usually cover the minimal changes these sites experience.
- Active blogs or business sites. Daily backups capture new posts, comments, and customer inquiries without leaving gaps.
- E-commerce or membership platforms. Real-time or hourly backups are best, ensuring orders and user data aren’t lost between scheduled runs.
Set automated schedules that match your activity level, then add an extra manual backup before and after big moves—such as core updates, theme changes, or plugin installs—so you can roll back instantly if something breaks.
WordPress backup best practices
Now let’s learn some tips for how to backup a WordPress website.
Store your files in multiple locations
Keep all your data in multiple locations. Remember, having at least two copies of your data is a must, because if the files at one location become compromised, you have a backup.
So, there are two steps you can take here:
- 1. Carefully consider what your storage options are going to be. Find proper offsite storage option(s), but also consider other alternatives like a hard drive, local server, or additional offsite storage.
- 2. Make sure to save the files across different servers. This way, you’ll always have at least one backup if the primary server crashes.
Keep in mind that it’s important to pick locations with security measures to make sure all your files are safe.
Don’t forget offsite storage
When choosing offsite storage, you get a chance to store your site’s data in a remote location — including backup files. Many businesses go for this option and include protection against issues such as data hacks, server crashes, and accidental deletion.
Offsite storage also gives you the possibility to access your files from anywhere. That way, it makes it very easy to restore your website in a short period of time after it crashes.
With offsite storage, you want to pay attention to your needs when it comes to security, space, and other features like accessibility or sharing abilities. For instance, Google Drive is great because it includes Gmail integration and automatic device syncing. Dropbox offers view-only file sharing, which simplifies the process of sharing files with others, even if they’re not Dropbox users.
Just like you have passwords for social media and site user accounts, you can secure the folders and files in much the same way. This allows you to save valuable files from hacker attacks as well as protecting backup folders from accidental deletions or changes.
Keep old backups safely stored
Keeping old backups stored ensures you have at least something if anything goes wrong with the most current files. It will help you to restore an earlier site version in the case of a buggy plugin or some other update that goes wrong.
You can choose how many backups your plugin will archive. For instance, if you select four, you’ll always have the four most recent backups saved aside. You can store the backups alongside the most current files as well.
FTP manager
If you’re a technical developer that feels comfortable with the backend development of your site, manual backups may be the best way for you. This can be done in different ways, like saving locally to your computer or to the cloud.
On the other hand, if you want to back up your files without logging into the host, you can use an FTP (File Transfer Protocol) manager — you just need to have the credentials for it. Cyberduck is an FTP client with a user interface that’s pretty simple to use. Also, it can be used on both Windows and Mac.
How to back up a WordPress site
There are two reliable paths to a complete backup: an easy-button plugin method and a hands-on manual approach.
UpdraftPlus tops the list of backup plugins because it bundles one-click scheduling, off-site storage options, and painless restores—all inside your WordPress dashboard.
If you prefer total control (or just like to know what happens under the hood), the manual route works too.
Below are step-by-step guides for both.
Option 1: Use UpdraftPlus (recommended)
UpdraftPlus streamlines the entire process, from creating backups to storing them safely in the cloud.
1. Install and activate the plugin.
Go to Plugins → Add New, search “UpdraftPlus,” click Install Now, then Activate.
2. Open the settings panel.
Navigate to Settings → UpdraftPlus Backups to see the main dashboard.
3. Choose your remote storage.
Click the Settings tab, pick a destination (Google Drive, Dropbox, Amazon S3, etc.), and follow the short authorization prompts. Off-site storage protects you if your web server fails.
4. Set an automatic schedule.
In the same tab, set how often you want Files backup schedule and Database backup schedule to run—daily or weekly is typical for most sites. Keep at least three copies.
5. Save changes.
Scroll down and click Save Changes. UpdraftPlus now works in the background.
6. Run your first backup.
Return to the Backup/Restore tab and hit Backup Now. Be sure to choose your plugins, themes, uploads, database, etc., for backup. Tick both Include your database and Include your files, then confirm. You’ll see progress bars and, once completed, links to each archive. 
7. Download a local copy (optional but smart).
Hover over the latest backup, click Database and Plugins/Themes/Uploads to download .zip files to your computer.
How to restore a backup with UpdraftPlus
Creating backups is only half the battle—knowing how to bring your site back to life is just as important. UpdraftPlus makes restoration as close to “one-click” as WordPress gets, but preparation still matters. Always create a fresh backup of your current site state before you begin; if anything goes wrong, you’ll have a safety net. Whenever possible, test your backup on a staging site first to confirm that every post, plugin, and setting loads correctly.
1. Open the restore panel. Log in to your WordPress dashboard and navigate to UpdraftPlus → Backup / Restore.
2. Pick the right backup set. In the Existing backups list, find the date you want to roll back to and click Restore in the Actions column.
3. Choose what to bring back. UpdraftPlus lets you restore plugins, themes, uploads, the database, or any mix of these. Tick the components you need.
4. Launch the restore. Click Restore again. UpdraftPlus fetches the files from your storage location—whether that’s Dropbox, Google Drive, or UpdraftVault—and unpacks them on your server.
5. Watch for the success message. When each component finishes, UpdraftPlus shows a confirmation screen. Your site should now look and work just as it did on the backup date.
Behind the scenes, the plugin sorts out database connections, file permissions, and file paths, sparing you from manual detective work.
If you need other options, there are several other reliable WordPress backup plugins to consider.
All-in-One WP Migration offers simple site migration and backup in one package. Duplicator is excellent for site cloning and migration. Jetpack Backup provides real-time backups with easy restores. BlogVault offers reliable off-site backups with staging. BackWPup and WP Vivid are also trusted options with unique features.
Consider your specific needs, whether it’s simplicity, advanced scheduling, or cloud storage options, when choosing the right backup plugin.
Option 2: Manually backing up WordPress
Manual backups take a little more effort, but they hand you full ownership of every piece of data that powers your site. Most hosts simplify the process by offering cPanel, and its built-in Backup Wizard can package your entire WordPress installation—files and database—into a single downloadable archive. 
If you prefer a lighter download, phpMyAdmin lets you export only the database, so you can pair it with a separate copy of your site files whenever you need to restore.
For direct file access, an SFTP client such as FileZilla connects you to your server’s root directory, where you can pull down the wp-admin, wp-content, and wp-includes folders along with the vital wp-config.php file.
Many control-panel file managers can do the same job in a few clicks: simply select your WordPress folders, create a zip archive inside the browser, and download it to your computer or cloud drive.
While this approach is more technical than using a plugin, it gives you total control over where backups live, how long you keep them, and how quickly you can migrate to a new host. Once you establish a routine—weekly for most sites, daily for high-traffic ones—manual backups become a dependable safety net that’s independent of WordPress itself.
Backing up a WordPress database
Your WordPress database is the living memory of your site. It stores every post, page revision, user account, comment, and setting, so losing it would feel like wiping a hard drive clean. A proper database backup ensures that you can restore all that irreplaceable information in minutes, rather than rebuilding it from scratch.
The simplest manual method starts in your hosting control panel.
Open phpMyAdmin, a tool most hosts pre-install for managing MySQL databases. If you run several sites on the same account, double-check that you select the right database; its exact name lives in the DB_NAME line of your wp-config.php file.
Once inside phpMyAdmin, click the Export tab. For routine backups, the Quick option paired with SQL format is ideal. It captures the entire structure and content in one .sql file without forcing you to choose tables or tweak advanced settings.
Hit Go, and phpMyAdmin creates the file and prompts you to download it. Save the export to a clearly labeled folder, then copy it to cloud storage or an external drive for safe-keeping.
If your database is very large—common on busy e-commerce sites or long-running blogs—phpMyAdmin can time out mid-export. In that case, switch to a command-line approach for reliability.
Most hosts allow SSH access, which lets you run a straightforward command such asmysqldump -u username -p database_name > 2025-05-30_wp_backup.sql.
This method bypasses browser limits, streams data directly to the server’s file system, and finishes even if the export takes several minutes. You can then download the resulting .sql file via SFTP or your host’s file manager.
Whether you choose phpMyAdmin or a command line, keep your database backups on the same schedule as your file backups—weekly for typical sites, daily for high-traffic ones.
Which approach should you choose?
UpdraftPlus is perfect if you want automatic, worry-free protection and fast restores from inside WordPress. Manual backups are ideal when you need granular control, have unique server setups, or simply like owning every step.
Whichever method fits your style, schedule at least weekly backups (daily for busy sites) and keep copies in more than one location. With a dependable backup routine in place, you can update, experiment, and even troubleshoot major issues knowing you’re always a few clicks away from a full recovery.
Which approach should you choose?
Automated backups run on a schedule—daily, weekly, or even hourly—without you lifting a finger. Plugins such as UpdraftPlus or built-in hosting tools handle the timing, the file transfers, and even remote storage. Busy site owners appreciate this “set and forget” convenience because it removes the risk of forgetting to save recent work.
Manual backups, on the other hand, give you the steering wheel. You decide exactly when to copy files, where to store them, and which components to include. This control is perfect before major site changes, theme swaps, or risky plugin updates. The trade-off is time and discipline: you must remember to run the backup and double-check that every file and the full database made it into the archive.
Quick comparison
| Pros | Cons | |
| Automated backups | Consistent scheduling, minimal effort, easy restores. | Relies on plugins or host tools; limited control over how and where each backup is stored. |
| Manual backups | Complete control over timing, contents, and storage location. | Time-consuming and prone to human error if you forget or skip steps. |
Best practice? Use both. Let automated backups capture routine changes while you create an on-demand manual backup whenever you plan a big edit, migration, or update. This layered approach keeps your site protected under all circumstances.
Backup security
A backup is only valuable if it stays safe. Because each archive contains posts, user data, and configuration files, treat it with the same care you give live site credentials.
Key safeguards:
- Encrypt your archives. Use tools such as AES-256 zip encryption or cloud-provider encryption options so that, even if a file is intercepted, the contents remain unreadable.
- Protect storage with strong passwords. Apply unique, complex passwords (and enable two-factor authentication where possible) for any cloud drives, SFTP servers, or vault services holding your backups.
- Follow the 3-2-1 rule. Keep at least three copies of every backup, store them on two different types of media (for example, cloud storage and an external hard drive), and keep one copy off-site.
- Rotate storage locations. Periodically move older backups to cold storage or a second cloud provider to reduce the impact of any single-service outage.
- Audit access. Review who can reach your backup folders and vaults, removing accounts that no longer need permission and logging all access attempts for accountability.
Regularly reviewing these measures ensures your backups remain both available and secure—ready to rescue your site without exposing sensitive data to prying eyes.
Many WordPress hosting providers now bundle automated backups, so it’s smart to compare what’s included before you decide.
SiteGround supplies daily backups with easy restore points inside its Site Tools dashboard.Bluehost offers backup and restore options through its enhanced cPanel interface, while Cloudways gives you flexible, on-demand or scheduled backups at the server or application level.
As you evaluate hosts, look closely at backup frequency, retention period, and whether copies are stored offsite. Some providers include backups in every plan, whereas others charge an extra fee or only protect certain tiers, so double-check the fine print before you commit.
Keep calm and back up: trust the pros at Liquid Web
There’s never a wrong moment to safeguard your WordPress site. Cloud-based backups capture every change—big or small—and let you reverse any update that misfires. Yet even with the best plugin or manual routine, backups still demand vigilance: setting schedules, checking storage limits, and verifying that each archive can restore cleanly. That constant upkeep is why many site owners hand the job to a managed host.
A reputable hosting provider automates the entire cycle. Their infrastructure runs backups on clockwork schedules, stores copies off-site, and monitors restore logs for errors you might miss. Instead of juggling plugins or downloading large files, you gain extra hours to craft content, serve customers, and grow your brand.
Liquid Web has led the WordPress hosting space for decades, and backup management is built into every Managed WordPress plan we offer. Our experts:
- Configure daily, nightly, or real-time backups tailored to your site’s activity level.
- Keep multiple copies in secure, geographically separate cloud locations.
- Test restores regularly, ensuring every snapshot is complete and ready to use.
- Handle server security, performance tuning, and core updates, so you aren’t left troubleshooting in the middle of a launch.
With Liquid Web on watch, you never have to ask, “Did I remember to back up?”—the answer is always yes.
Ready to shift the technical weight off your shoulders? Explore our Managed WordPress hosting plans or start a live chat with a Liquid Web specialist now.
Getting started with backing up WordPress site
Additional resources
Comprehensive guide to securing WordPress with ModSecurity
→
This guide provides a comprehensive overview of how to use ModSecurity to enhance the security of your WordPress site.
Best WordPress backup plugins [2025] →
There are dozens of backup plugins available. So which do you choose? We’ve done the heavy lifting and analyzed the top contenders to bring you this comprehensive guide to the 11 best WordPress backup plugins.
Why security matters for WordPress enterprise hosting
→
Use the blog as your guide to attacks to watch out for, security best practices, and steps to improve the WordPress protection you already have.
Aaron Binders works as a Linux Support Technician at Liquid Web and focuses on resolving server-side customer issues. When not spending time with his family, he has a passion for sports such as football and boxing, as well as reading the latest ICT magazines.