Quick answer: A complete WordPress backup includes both your files (especially wp-content and wp-config.php) and your database. The easiest ways to back up are your host’s automatic backups or a backup plugin that saves copies to cloud storage such as Google Drive, Dropbox or Amazon S3. Back up daily for active sites, keep copies off your server, and test a restore at least once — a backup you can’t restore isn’t a backup.
What a WordPress backup must include
| Part | What’s inside | Why it matters |
|---|---|---|
| Database | Posts, pages, comments, settings, users | Your content lives here |
| wp-content folder | Themes, plugins, uploaded media | Your design and images |
| wp-config.php | Database connection and key settings | Needed to reconnect the site |
| .htaccess (Apache) | Redirects and permalink rules | Prevents broken links after restore |
| WordPress core files | wp-admin, wp-includes | Optional — can be re-downloaded |
Three ways to back up WordPress
1. Your hosting provider
Many hosts make automatic daily backups and let you restore with one click. Check how many days are kept, whether restores cost extra and whether backups are stored on a separate server. Host backups are convenient, but don’t rely on them alone: if your hosting account has a problem, your backups may be affected too.
2. A backup plugin
Backup plugins schedule automatic backups and send them to cloud storage. Popular choices include UpdraftPlus, BlogVault, Jetpack VaultPress Backup, Duplicator and BackWPup. Look for: scheduled backups, off-site storage, incremental backups for large sites, easy one-click restore and migration support.
3. Manual backup
For full control, back up manually: download your files over SFTP (or zip them in your host’s file manager) and export the database from phpMyAdmin (Export → Quick → SQL). It’s useful before big changes or moving hosts, but too easy to forget as a routine.
Comparison of backup methods
| Method | Effort | Off-site? | Best for |
|---|---|---|---|
| Host backups | None | Sometimes | Quick restores |
| Backup plugin to cloud | Low (set once) | Yes | Most sites |
| Manual | High | If you store it elsewhere | Before big changes, migrations |
How often should you back up?
| Site type | Recommended frequency |
|---|---|
| Brochure site that rarely changes | Weekly + before updates |
| Blog publishing weekly | Daily |
| Online store or membership site | Real-time or several times a day |
| Before any big update or change | Always, manually |
The 3-2-1 backup rule
A simple rule professionals use: keep 3 copies of your data, on 2 different types of storage, with 1 copy off-site. For WordPress, that might mean your host’s backups, a plugin sending copies to cloud storage and an occasional download to your own computer.
How to set up automatic backups with a plugin
- Install your chosen backup plugin from Plugins → Add New.
- Connect a cloud storage account (Google Drive, Dropbox, S3 or similar).
- Set a schedule: database daily, files daily or weekly.
- Set how many copies to keep (for example 14–30).
- Run a first backup manually and check the files appear in your cloud storage.
- Turn on email notifications so you know when a backup fails.
How to restore a WordPress backup
If you can log in
Open your backup plugin, choose the backup you want and click Restore. Select database, plugins, themes and uploads. Wait for it to finish and check the site.
If the site is broken
- Use your host’s restore tool if it has one — the fastest option.
- Or upload your backed-up files with SFTP, overwriting the broken ones.
- Import your database backup with phpMyAdmin (drop the old tables first, after taking a copy).
- Check
wp-config.phphas the correct database details. - Clear caches and log in to test.
Test your backups
Many people discover their backups are incomplete only when they need them. Once a quarter, restore a recent backup to a staging site or local install and check that pages, images and logins work. It takes half an hour and could save your business.
Common backup mistakes
- Storing backups only on the same server as the site.
- Backing up the database but not the files (or the other way round).
- Never checking whether scheduled backups are actually running.
- Keeping too few copies, so a hack that went unnoticed for weeks is in every backup.
- Not backing up before updates.
Frequently asked questions
Does my host back up my WordPress site?
Many do, but check frequency, retention and restore costs, and keep your own off-site copy too.
What is the best free backup plugin?
Free versions of well-known plugins handle scheduled backups to cloud storage well for most small sites.
How big is a WordPress backup?
Mostly your media library. Text content and the database are usually small.
Can I use a backup to move my site?
Yes — many backup plugins double as migration tools. See how to move WordPress.
Final thoughts
Set up automatic off-site backups today, then test a restore. It’s the single most important thing you can do for your site’s safety — more in our security guide and the official WordPress backup documentation.
The 3-2-1 backup rule, explained simply
Professionals follow a simple rule: keep three copies of your data, on two different types of storage, with one copy off-site. For a WordPress site, that might mean the live site itself, your host’s daily backups and a copy sent automatically to cloud storage like Google Drive, Dropbox or Amazon S3. If your host has an outage, is hacked or closes your account, you still have a copy elsewhere. Most backup plugins can send copies to cloud storage automatically, so following the rule takes only a few minutes to set up.
How long should you keep backups?
Keep at least 30 days of daily backups. Many hacks aren’t noticed straight away, and you need a clean copy from before the infection. Stores and busy sites may want hourly or real-time database backups so recent orders aren’t lost. For important sites, also keep a monthly backup for six to twelve months.
Backups during security emergencies
Good backups turn a disaster into an inconvenience. In October 2026, the PHP2Shell vulnerabilities were exploited before many servers were patched. Site owners with clean, off-site backups from before 20 October could restore quickly if they found signs of compromise. Those without backups faced a much harder clean-up. Treat backups as insurance: you hope never to use them, but you’ll be very glad when you need them.
Test your restore
A backup you’ve never restored is a backup you can’t fully trust. Twice a year, restore a backup to a staging site and check that pages, images, forms and logins work. It takes less than an hour and gives you real confidence.
A real-world example
A photographer updated a gallery plugin late one evening, and the update broke her homepage layout. Because her backup plugin had taken an automatic copy just before the update, she restored the previous version in five minutes and went to bed. The next day she tested the update on staging, found the setting that caused the problem and updated safely. Without that backup, she would have spent the night trying to fix a broken site.
WordPressPrime.com is an independent guide and is not affiliated with the WordPress Foundation, WordPress.org or Automattic. Always back up your website before making changes, and check official sources for the latest details.
