Quick Takeaways
- A complete WordPress backup has two parts: your files (themes, plugins, uploads, and settings) and your database (pages, posts, users, and form entries). You need both to restore the site.
- The easiest options are your host’s backup tool or a backup plugin like UpdraftPlus, set to run automatically and save copies to off-site storage like Google Drive, Dropbox, or Amazon S3.
- Most small business sites should be backed up daily, kept for at least 30 days, and backed up again right before any update.
- Don’t rely only on your host’s backups. They’re often stored on the same servers as your site and kept for only a week or two.
- A backup you’ve never restored is a backup you can’t trust. Test a restore every few months.
To back up a WordPress site, you need a copy of two things: the site’s files and its database. The simplest way is to use your web host’s backup tool or install a backup plugin such as UpdraftPlus, schedule it to run daily, and send the copies to off-site storage like Google Drive, Dropbox, or Amazon S3. You can also do it by hand, downloading the files over SFTP and exporting the database with phpMyAdmin.
Below are the three ways to back up a WordPress site step by step, how often to do it, where to keep the copies, and how to restore one when something goes wrong.
What a WordPress Backup Includes
A WordPress site is split into two parts, and a backup that skips either one can’t fully restore it:
| Part | What’s in it | Where it lives |
|---|---|---|
| Files | Themes, plugins, uploaded images and PDFs, and the wp-config.php settings file | Your hosting account, mostly in the wp-content folder |
| Database | Pages, posts, menus, users, settings, and form entries | A MySQL or MariaDB database on your host |
If you only back up the files, you lose all your content. If you only back up the database, you lose your images, theme, and plugins.
3 Ways to Back Up a WordPress Site
1. Use your web host’s backup tool
Most hosts include backups. Look for “Backups” in your hosting dashboard or cPanel. Many let you create a backup on demand and restore it with one click.
- Log in to your hosting account and find the Backups section.
- Check how often backups run and how long they’re kept.
- Create a manual backup before any big change.
- Download a copy now and then so you have one that isn’t stored with your host.
Host backups are a good start, but they shouldn’t be your only copy. See why below.
2. Use a WordPress backup plugin
A backup plugin is the most practical option for most small businesses. Popular choices include UpdraftPlus (free version available), Duplicator, BlogVault, Solid Backups, and Jetpack VaultPress Backup. The setup is similar in all of them:
- Install and activate the plugin from Plugins → Add New.
- Choose a schedule: daily for files and database is a good default.
- Connect off-site storage such as Google Drive, Dropbox, or Amazon S3.
- Set how many backups to keep (enough to cover at least 30 days).
- Run your first backup and confirm it finished without errors.
Avoid storing plugin backups only on the same server as your site. If the server fails or the site is hacked, those backups can go down with it.
3. Back up WordPress manually
A manual backup takes longer but needs no plugin, and it’s useful to know how it works:
- Files: connect to your site with an SFTP program like FileZilla (your host provides the login details) and download the whole WordPress folder, or at least
wp-contentandwp-config.php. - Database: open phpMyAdmin from your hosting control panel, select your WordPress database, click Export, and save the
.sqlfile. - Store both together in a dated folder, somewhere other than your web server.
Manual backups are easy to forget, so use them as an extra copy, not your main plan.
How Often Should You Back Up Your Website?
| Type of site | How often |
|---|---|
| Brochure site that rarely changes | Weekly, plus before every update |
| Most small business sites (blog, forms, regular edits) | Daily |
| Online store or booking site | Real-time or several times a day |
Whatever the schedule, always take a fresh backup right before updating WordPress, plugins, or your theme. Failed updates are one of the most common reasons sites need restoring. See how regular updates prevent website failure.
Keep at least 30 days of backups. Problems like hacked files or a broken page aren’t always noticed right away, and if your oldest backup is only a week old, it may already contain the problem.
Where to Store Your Backups: The 3-2-1 Rule
The 3-2-1 rule is a simple standard for backups of any kind:
- 3 copies of your site: the live site plus two backups.
- 2 different types of storage, such as your host’s backups and a cloud service.
- 1 copy off-site, stored completely separately from your hosting company.
For a small business website, that usually means your host’s backups plus a plugin sending daily copies to Google Drive, Dropbox, or Amazon S3.
Why Your Host’s Backups Aren’t Enough
Many owners assume their host has them covered. Often it does, partly, but there are gaps:
- Short retention. Many hosts keep backups for only 7–14 days. A problem that goes unnoticed longer can’t be undone.
- Same infrastructure. Host backups are often stored alongside your site. A serious server failure or account problem can affect both.
- No guarantees. Some hosting plans state that backups are provided as a courtesy and that you’re responsible for your own.
- Never tested. Until you’ve restored one, you don’t know it works.
How to Restore a WordPress Site From a Backup
- From a plugin: open the plugin’s backup list, pick a date from before the problem started, and click Restore. If you can’t log in to WordPress, install a fresh copy of WordPress and the same plugin, connect your off-site storage, and restore from there.
- From your host: use the restore option in the Backups section of your hosting dashboard, or ask support to do it.
- From a manual backup: upload the files over SFTP, then import the
.sqlfile into the database with phpMyAdmin.
Test this before you need it. Every few months, restore a backup to a staging site (many hosts offer one-click staging) and check that pages, images, and forms all work.
What Can Go Wrong Without a Backup
- A failed update breaks the layout or takes the site offline.
- A hack injects malicious code into files and the database. Restoring a clean backup is often the fastest fix.
- Accidental deletion of a page, images, or form entries.
- A hosting failure or a lapsed hosting account that takes your files with it.
Without a recent backup, any of these can mean rebuilding the site from scratch. Why websites break without ongoing management explains how small problems add up.
Frequently Asked Questions
How can I back up my WordPress site for free?
Use your host’s included backups together with a free plugin like UpdraftPlus, set to back up daily to a free Google Drive or Dropbox account. You can also back up manually with an SFTP program and phpMyAdmin.
How do I back up my entire WordPress site?
Back up both the files (the whole WordPress folder, especially wp-content and wp-config.php) and the database. A full backup in any good plugin includes both.
What is the best WordPress backup plugin?
There’s no single best one. UpdraftPlus is the most widely used free option; Duplicator is popular for moving sites; BlogVault and Jetpack VaultPress Backup offer paid, off-site backups with easy restores. Choose one that backs up automatically to off-site storage and makes restoring simple.
Do I need a backup if my host already makes them?
Yes. Host backups are a good first layer, but they’re often kept for a short time and stored with your site. A second, off-site copy protects you if anything happens to your hosting account.
How long should I keep website backups?
At least 30 days for most small business sites. Some problems take weeks to notice, and you need a clean backup from before they started.
Explore the complete website management for small business guide for everything covered in this category, or browse all topics at Cindaro Resources. For the full list of ongoing website tasks, see what website management includes and what website maintenance costs.
Cindaro builds and manages websites for small businesses as an ongoing service, so daily off-site backups, retention, and restore testing are handled for you. See how it works or view our pricing.
