How to Back Up Your WordPress Site (and Restore It)

Wondering how to back up a WordPress site properly? Start with one question. Have you ever restored from your backup?

Here’s the uncomfortable part nobody puts in the headline: a backup that has never been restored isn’t a backup. It’s a file you’re hoping is fine.

Plenty of WordPress sites have a backup plugin, a schedule set, and a green checkmark somewhere in the dashboard. They still lose everything when it matters, because the one time anyone opened that file to check it was the day they needed it.

Don’t worry. Getting this right takes one afternoon, and you don’t need to be technical.

This guide covers what a full backup has to include, where it should live, how often to run one, and the restore process itself, since that’s the step that decides whether any of this was worth doing.

Let’s dive in.

Key Takeaways

• A real backup has two halves: your database and your files. Missing either one means you don’t actually have a working backup.
• Follow the 3-2-1 rule: 3 copies, on 2 different types of storage, with 1 of them stored somewhere other than your own server.
• Automate it. A backup you have to remember to run is a backup that eventually doesn’t happen.
• Test a restore at least once, ideally on a staging site, before you ever need to do it for real.

What a Full WordPress Backup Actually Includes

A full WordPress backup is a copy of both your database and your files, because a WordPress site is really two separate things living together.

The database holds your posts, pages, comments, users, settings, and most of your plugin configuration. This is where your actual content lives.

Lose the database and the site looks empty, even if every file is still sitting on the server.

The files are everything else: your themes, your plugins, your WordPress core installation, and your wp-content/uploads folder, which holds every image and media file you’ve ever uploaded.

Lose this and your content exists in the database with no images, no active theme, and no plugins to run it.

A surprising number of beginners find this out the hard way. They back up one half (usually just the files, via a simple FTP download) and discover during an actual emergency that the site they restored has no posts.

Any backup plugin worth using handles both halves in one job. Confirm yours does before you trust it.

The 3-2-1 Rule

The 3-2-1 rule means keeping 3 copies of your data, on 2 different types of storage, with 1 copy stored offsite. It’s a simple standard, not a WordPress-specific one, and it holds up because it accounts for the ways backups actually fail.

• 3 copies of your data: the live site, plus two backups.
• 2 different types of storage, so a single point of failure doesn’t take out everything at once. Your server’s disk and a cloud storage account count as two different types. Two folders on the same server do not.
• 1 copy stored offsite, somewhere other than the server your live site runs on.

That last point is the one people skip, and it’s the one that matters most.

A backup saved only to the same server it’s protecting isn’t protected from the thing most likely to take the server down: the server itself. A hack that wipes the filesystem takes the backup with it. A host-side failure takes the backup with it.

The backup needs to live somewhere the disaster can’t reach.

One thing to check before you go further: this whole guide assumes self-hosted WordPress, the WordPress.org version where you own the hosting account and the responsibility that comes with it. WordPress.com’s hosted plans handle a chunk of this automatically. Not sure which one you’re running? Settle that first, before you spend an afternoon on a strategy your platform might already cover.

Setting Up Automatic Backups

The manual route exists: export the database through phpMyAdmin, download files over FTP. But it depends entirely on you remembering to do it.

“Back it up right before the change” is exactly the plan that fails, because the change goes wrong first. A backup plugin removes the human from the loop.

UpdraftPlus is the standard beginner choice, and it’s worth setting up in this order:

1. Install and activate the plugin.
2. Connect a remote storage destination: Google Drive, Dropbox, or a similar cloud account, so backups land off-server automatically. This is the step that actually satisfies the 3-2-1 rule. Skipping it and leaving backups in the default local folder defeats most of the point.
3. Set a schedule for both database and files. They don’t need the same frequency (see below).
4. Run one backup manually right after setup, and confirm it actually shows up in the remote storage account. Not “the plugin said success”. Actually go and look at the files.

That’s the whole setup. Twenty minutes, once.

For what it’s worth, onylogy.com runs on the same principle with WPvivid Backup: scheduled, with a copy kept off the server. A full comparison of backup plugins, including free and paid options beyond UpdraftPlus, is in Top 6 WordPress Backup Plugins for Beginners.

How Often Should You Back Up?

This depends on how often your content changes, not on a universal rule:

• E-commerce or membership sites: daily, sometimes more often for the database specifically, since orders and user data change constantly.
• Active blogs: daily to every few days.
• Mostly static brochure or portfolio sites: weekly is usually enough, since there’s little new content to lose between runs.

The database (which changes constantly on any site with comments, orders, or frequent posts) generally deserves a tighter schedule than your files (theme and plugin files barely change week to week).

How to Restore a WordPress Site from Backup

This is the part that turns “a backup exists” into “a working safety net.”

1. Put the site in maintenance mode if it’s still partially online, so visitors aren’t hitting a half-broken site mid-restore.
2. Restore the database first. Most backup plugins handle this from inside WordPress directly. For a fully broken site, this means importing the SQL file through phpMyAdmin or your host’s database tool instead.
3. Restore the files: themes, plugins, uploads, and WordPress core, back to their backed-up state.
4. Check the site loads and functions before taking it out of maintenance mode. Log in, check a few pages, check that recent content is actually there.
5. Confirm the restore point. If your backup is from three days ago, anything published since then is gone unless you can recover it separately. Know what you’re restoring to before you commit.

The single best time to practice this is never during an actual emergency.

Restore a backup to a staging site (many hosts offer one-click staging environments) at least once, just to see the process end to end while nothing is on fire.

It’s the only way to know your backup plugin’s restore flow actually works. It’s also how you discover a broken backup while it’s still just an exercise instead of a crisis.

Common Backup Mistakes

• Storing the only copy on the same server. Covered above, and worth repeating: this is the single most common way a backup strategy fails silently.
• Backing up files but not the database, or the reverse. Both halves, every time.
• Never testing a restore. A schedule and a green checkmark tell you the backup ran. They don’t tell you it works.
• Skipping a manual backup before a big change. Automated schedules are great for routine coverage. A major theme switch, a big plugin update, or a WordPress core update is exactly when to trigger one manually first, on top of the schedule.
• Relying entirely on host-level backups. Many hosts include their own backup system, and it’s a genuinely useful extra layer. It isn’t a full substitute for your own plugin-based, offsite backup. If something goes wrong with the host itself, host-side backups can be affected too. Redundancy is the entire point of the 3-2-1 rule.

Which Setup Should You Actually Use?

For most beginner sites: UpdraftPlus, scheduled daily for the database and weekly for files, with Google Drive or Dropbox as the remote destination.

That’s a real 3-2-1 setup with almost no ongoing effort once it’s configured.

Running an online store? Tighten the database schedule, and consider a second, independent backup method as a genuine second copy rather than two schedules of the same tool.

Your host offers solid built-in backups, like the ones covered in Top 6 Hosting Providers for WordPress? Treat that as a bonus layer stacked on top of your own setup, not a replacement for it.

Final Thoughts

Backups are boring right up until the exact moment they’re the only thing standing between you and starting over from nothing.

Set the schedule. Pick an offsite destination. Then do the one thing most people skip: restore it once, on purpose, before you ever have to.

Pair this with the rest of your security checklist and the basics are covered. A hack or a mistake ends the same way: a quick restore instead of a rebuild.

That’s the whole safety net. Plain and simple.

Over to you: when did you last test a restore? Let me know in the comments, and if the answer is “never,” today’s a good day.

Frequently Asked Questions

How often should I back up my WordPress site?

It depends on how often content changes. Daily for e-commerce or active blogs, weekly is often enough for mostly static sites. The database usually needs a tighter schedule than your files.

Do I need to back up both the database and the files?

Yes. The database holds your content and settings; the files hold your theme, plugins, and media. A backup missing either half isn’t a complete backup.

Where should I store my WordPress backups?

Follow the 3-2-1 rule: at least one copy stored offsite, away from the server your live site runs on. Cloud storage like Google Drive or Dropbox is the standard beginner option.

Is my host’s built-in backup enough on its own?

It’s a useful extra layer, but not a full substitute for your own offsite backup. If something affects the host itself, host-side backups can be affected too.

How do I actually restore a WordPress backup?

Restore the database first, then the files, then verify the site loads and functions correctly before taking it out of maintenance mode. Most backup plugins can walk you through this from inside WordPress.

What’s the biggest backup mistake beginners make?

Never testing a restore. A schedule that runs successfully tells you the backup exists, not that it actually works when you need it.

Should I manually back up before a big update?

Yes. Automated schedules cover routine changes, but trigger a manual backup first before a major theme switch, plugin update, or WordPress core update.