To restore a website from backup, you choose a copy taken before the problem started, save anything that has changed since, put back the files and the database, then test. Most of the time goes into choosing the right copy and checking the result, not the restore itself. The main risk is losing recent orders, enquiries or edits, so plan for those before you press the button.
Key takeaways
- A WordPress site is two parts, files and a database. A full restore needs both, from the same moment.
- Anything added after the backup was taken, such as orders, form entries and new pages, will be lost unless you save it first.
- After a hack, restoring an old copy without fixing how attackers got in usually means a second hack.
- Clear every cache and test forms and checkout before you call the job done.
What does restoring a website from backup actually do?
A restore replaces your live site with an earlier copy. For WordPress, that copy has two parts. The files hold WordPress itself, your theme, plugins and uploaded images. The database holds your pages, posts, settings, users and, on a shop, your orders.
WordPress.org says you need both parts “to be able to fully restore a typical WordPress site” (WordPress.org). Restoring only the files, or only the database, can leave a site that half works. Our guide on how to backup a WordPress site explains what a complete backup should contain.
What will I lose when I restore a backup?
Everything that changed after the backup was taken. The site goes back in time to that moment. Depending on the site, that can include:
- online orders and customer accounts
- contact form and booking entries stored in the site
- new or edited pages, posts and products
- images uploaded since the backup
- plugin and theme updates, which will need doing again
This is why backup frequency matters. A shop backed up once a day can lose most of a day’s orders. One backed up every hour loses an hour at most.
How do I choose the right restore point?
Pick the most recent backup taken before the problem started. Work out when that was first. Check when the error appeared, when an update ran or when customers first complained.
After a hack, the right point is harder to find. Attackers often get in days or weeks before anyone notices. Sucuri found at least one backdoor on 49.21% of the hacked sites it cleaned (Sucuri). A backup from yesterday may already contain that hidden way back in.
This is where how long backups are kept matters. A host that keeps only the last few days may have no clean copy left. If you’re unsure which copy is clean, get hacked website repair help before restoring anything.
How do I restore a website from backup, step by step?
- Stop and take notes. Pause edits, updates and scheduled imports. Write down when the problem started and what changed around then.
- Take a copy of the broken site. It gives you a way back if the restore goes wrong, and keeps evidence if the site was hacked.
- Choose the restore point. Use the last backup taken before the problem began. Check its date and size look normal.
- Save recent data. Export orders, form entries and any content added since that backup. Copy text from recent pages into a document.
- Restore the files, then the database. WordPress.org’s guidance is to “restore the WordPress files first”, then import the database. Use both parts from the same backup. Mixing dates causes odd errors.
- Clear every cache. Clear the caching plugin, the server cache and any CDN such as Cloudflare. Otherwise you may still see the old, broken pages.
- Test properly. Log in, then check the home page, menus, forms, checkout and any booking tool, on a phone as well as a computer.
- Put back what you saved. Re-enter orders or content from step 4, and redo any safe updates.
Step 5 is usually a restore button in your control panel or backup plugin. The steps either side are where restores go wrong.
How long does a website restore take?
It depends on the size of the site, where the backup is stored and how much checking is needed. Copying a small brochure site back is usually the quick part. Large media libraries, big shop databases and backups stored off-site take longer to download and import.
The slow parts are human. Finding a clean restore point after a hack, saving recent orders and testing every important page all take time. In our experience, rushing those steps is what turns one restore into three.
Why did my site break again after restoring?
Because a restore puts the old site back, including whatever let the problem in. If an update caused the fault, the same update will be offered again. If the site was hacked, the old plugin with the security hole is back too.
Speed matters here. Patchstack found that heavily exploited WordPress flaws were mass-exploited within a median of 5 hours (Patchstack). Update or remove the vulnerable plugin straight after the restore, change all passwords and remove any admin users you don’t recognise.
What if the backup itself won’t restore?
Backups can be incomplete, corrupted, or stored on the same server that just failed. A copy that has never been tested is a hope, not a plan.
The fix is to keep copies in more than one place. The 3-2-1 backup rule means three copies, on two kinds of storage, with one off-site (Backblaze). A server snapshot alone isn’t enough. Our explainer on website backup vs snapshot covers why.
Should I restore it myself or get help?
Do it yourself if the problem is simple, you know exactly when it started and your host or plugin has a tested restore button. Get help if the site was hacked, if it’s a shop with orders since the backup, or if the restore has already failed once.
Our website backups you can restore are taken off-site and kept for 30 days, so a clean copy is there when you need it. They’re part of all our website maintenance plans, and we do the restore for you (limited restores on Essentials, unlimited within fair use on Advantage and Elite).
Frequently asked questions
Can I restore just one page or image from a backup?
Often, yes. Images and other files can be copied back one at a time from the files part of a backup. A single page is harder because it lives in the database. Some backup tools can restore selected database tables, but the safest way is usually to restore to a staging copy and copy the content across.
Will restoring a backup fix a hacked website?
Only if the backup is from before the attacker got in, and you close the hole straight away. Otherwise you put back the backdoor or the vulnerable plugin, and the site is hacked again. After a hack, have the backup checked for malware before you restore it.
Does restoring a backup affect my email?
Usually not. Email is normally stored separately from the website, either in your hosting account’s mail system or with a provider such as Microsoft 365 or Google Workspace. A website restore puts back the site’s files and database only. Ask your host if you’re unsure where your mail lives.
Will my Google rankings drop after a restore?
Not because of the restore itself. If the restored copy is missing pages you added recently, those pages will drop out until you add them back. Being down or hacked for days does more harm than a quick restore, so it’s better to restore promptly and then rebuild what’s missing.
How often should my website be backed up?
Match it to how often the site changes. WordPress.org suggests weekly for smaller sites and daily for busy ones. Shops and booking sites that take orders all day benefit from several backups a day, so a restore loses as little as possible.
Sources
- Backups, WordPress Advanced Administration Handbook, accessed 13 November 2026
- 2023 Hacked Website and Malware Threat Report, Sucuri, June 2024
- State of WordPress Security in 2026, Patchstack, accessed 13 November 2026
- The 3-2-1 backup strategy, Backblaze