Key takeaways
- A complete WordPress backup has two parts: the database (your content and settings) and the files (themes, plugins, uploads and configuration).
- Keep at least one copy away from your web server and your hosting account, so a hack or server failure can’t take it too.
- Keep several older copies, because problems such as malware can go unnoticed for weeks.
- A backup only counts once you have restored it somewhere safe and checked that the site works.
To back up a WordPress site properly, you need a copy of both the database and the files, stored somewhere other than your web server, with several older versions kept. Then you need to prove it works by restoring it to a test copy of the site. Installing a backup plugin is step one. Testing the restore is the step most people skip, and it’s the one that matters.
What does a WordPress backup need to include?
WordPress.org puts it simply: “There are two parts to backing up your WordPress site: Database and Files” (WordPress.org). Miss either one and the restore will fail or come back incomplete.
| Part | What’s in it | What you lose without it |
|---|---|---|
| Database | Pages, posts, products, orders, users, comments and most settings | All your content. The site loads, but it’s empty. |
| Uploads folder | Images, PDFs and other media in wp-content/uploads | Every image and download on the site |
| Themes and plugins | The design and features, including any custom code | Your layout and custom work, which can’t always be downloaded again |
| Configuration files | wp-config.php and .htaccess | Database connection details and server rules |
The two parts should be taken at about the same time. A database from Monday and files from Friday can leave missing images or broken links.
What are the ways to back up a WordPress site?
There are three common approaches. Most well-run sites use two of them.
Your host’s backups
Many hosts take automatic copies of your hosting account or server. They’re convenient and quick to restore. The catch is that some are server snapshots stored alongside the server itself. Our guide to website backup vs snapshot explains why that difference matters.
A backup plugin
Plugins such as UpdraftPlus, BlogVault or Jetpack VaultPress Backup can copy the database and files on a schedule and send them to cloud storage. Choose one that stores copies offsite, not just in a folder on the same server.
A manual backup
You can export the database through phpMyAdmin and download the files by SFTP. It’s slow and easy to get wrong, but WordPress.org still suggests running a manual backup “once in a while to guarantee that the process is working”.
Where should WordPress backups be stored?
Somewhere your website can’t reach. If a backup sits on the same server, a disk failure, a hack or a cancelled hosting account can take the site and its backups together.
The 3-2-1 backup rule is a good guide. Keep three copies of your data, on two different types of storage, with one copy offsite (Backblaze). For a small business website, that might mean the live site, your host’s backup, and a copy in separate cloud storage.
Use different logins for that storage. If an attacker gets your WordPress admin password, they shouldn’t be able to delete your backups too. Our guide to ransomware small business risks covers why criminals go after backups first.
How often should I back up, and how long should I keep them?
WordPress.org suggests weekly backups for small sites and daily backups for busy ones. It also says to back up “always before an upgrade”, and to keep at least three to five recent backups (WordPress.org).
Match the schedule to how much work you could stand to lose. A brochure site that changes monthly can manage with less. A shop taking orders every hour needs far more.
Keeping older copies matters just as much. Malware can sit quietly for weeks before anyone notices. If your oldest backup is from yesterday, every copy you have might already be infected.
How do I test that a WordPress backup actually restores?
A restore test means rebuilding your site from a backup, somewhere other than the live site, and checking it works. Here’s a simple way to do it.
- Pick a recent backup from your offsite storage, not the copy sitting on the server.
- Restore it to a staging site or a temporary address. Never test by overwriting your live site.
- Check the front end. Open the home page, a few inner pages and your contact page. Make sure images load.
- Check the back end. Log in, open the latest post or order, and confirm the date matches the backup.
- Test what earns money. Submit a form, add a product to the cart, or try a booking.
- Write it down. Note the date, which backup you used, how long the restore took and anything that failed.
Put the next test in your calendar, and repeat it after any big change such as a redesign, a new plugin that stores data, or a move to a new host.
What are the most common WordPress backup mistakes?
- Backups stored only on the web server. One failure takes everything.
- Database only. The content survives, but the images and design don’t.
- Uploads left out to save space, often without anyone realising.
- A plugin that stopped working months ago, with failure emails going to an old address.
- Too few old copies, so every backup already contains the problem.
- Never testing. The first restore attempt happens during an emergency.
Can a backup fix a hacked WordPress site?
Sometimes, but carefully. Restoring a clean backup removes the infected files, but it doesn’t close the gap the attacker used. Restore a backup taken after the infection and you bring the malware straight back.
In our experience, the safest path is to clean and harden the site first, then use backups to recover lost content. If you’re dealing with a hack now, our hacked website repair team can help.
If you’d rather have someone else run backups and restore tests, our website backups you can restore page explains how we handle them. You can also compare all our website maintenance plans.
Frequently asked questions
Is my web host’s backup enough?
It’s a good start, but rarely enough on its own. Check where the host stores backups, how many old copies it keeps, and whether you can restore them yourself. If those copies live on the same server or inside the same account, add a separate offsite backup you control.
What’s the best WordPress backup plugin?
The best one is the one that stores copies offsite, includes both database and files, emails you if a backup fails, and restores reliably when you test it. Popular choices include UpdraftPlus, BlogVault and Jetpack VaultPress Backup. Test any plugin’s restore before you rely on it.
How big is a WordPress backup?
It depends mostly on your uploads folder. A small brochure site might be a few hundred megabytes, while a shop with years of product photos can run to many gigabytes. The database is usually much smaller than the files. Check your storage space so large backups don’t quietly fail.
Can I restore just one page from a backup?
Not easily with most backup tools, which restore the whole database at once. The safer way is to restore the backup to a staging site, copy the page content you need, and paste it back into the live site. That way you don’t overwrite newer orders or posts.
How long does it take to restore a WordPress site?
In our experience, a small site with a good backup can often be restored within an hour. Large sites, shops and backups split across several files can take much longer. That’s exactly why restore tests matter: you learn how long it takes on a quiet afternoon rather than during an outage.
Sources
- Backups, WordPress Advanced Administration Handbook, accessed 13 November 2026
- Data Backup Strategies: Why the 3-2-1 Backup Strategy is the Best, Backblaze, accessed 13 November 2026