How To Backup WordPress Site Properly in 2026?


Three methods to back up a WordPress site properly in 2026, comparing manual, plugin, and host-managed backup approaches

Get Your Free Website Audit

($3,000 Value)

  • Uncover performance issues
  • Identify SEO opportunities
  • Security gaps, and quick wins
Get Your Free Audit!

Most WordPress backups are technically running. Few of them work when it matters.

That’s the difference between a backup process that exists on paper and one that actually saves you. A plugin can fire every night for three years, and the first time someone tries to restore from it after a server crash, they find the database file is corrupted. Ongoing website maintenance catches that kind of gap before it becomes a crisis.

This guide covers three tested ways to back up your WordPress site (manual via cPanel, backup plugin, and host-managed), plus the one step most tutorials skip, which is testing the restore.

Table of Contents

What Is A Complete WordPress Backup?

A real backup covers four things. Most tutorials only mention two.

The four components of a complete backup:

  • WordPress core installation: The WordPress core files that run the site. These can be downloaded again from wordpress.org, but a snapshot saves time.
  • The database: Posts, pages, users, settings, comments, plugin data. Exported as a SQL file when you back up the database separately.
  • The /wp-content/ folder: Themes, plugins, the media library, and any data generated by your WordPress installation over time. This includes theme files, theme settings, and media uploads.
  • wp-config.php and .htaccess: The root files that connect everything. Lose these and a clean restore breaks.

Skip any one of those, and you don’t have a working backup of your site. You have part of a site.

A few things people miss:

  • Page builder data stored outside the database (some builders cache data in /wp-content/uploads/)
  • Media uploads added by editors after the last full backup
  • Plugin license keys
  • Custom code edits not committed to version control

If your backup process doesn’t account for all the files plus the database, it’s incomplete by definition.

3 Ways to Backup a WordPress Site

Each method has a place. The right choice depends on how much your site earns, how often it changes, and whether you can afford to lose a day of work.

Method 1: Manual WordPress Backup via cPanel and phpMyAdmin

This approach is useful when you want to know exactly what’s in your backup. It’s also time-consuming when you have to do it weekly.

Backing up your WordPress site’s files manually:

  1. Log into your hosting control panel (cPanel, Plesk, or your host’s custom dashboard).
  2. Open File Manager or connect via an FTP client like FileZilla. Use secure file transfer protocol (SFTP) over plain file transfer protocol every time. SFTP keeps the connection secure.
  3. Navigate to your WordPress directory (usually /public_html/ or /www/).
  4. Select all the files, including hidden files like .htaccess and the wp-config file.
  5. Compress them into a zip file and download to your local folder.

This pulls every site file, including core files, themes, plugins, media uploads, and the wp-config. The download time depends on your media library, so a site with 5GB of images is going to take a while.

Backing up the database separately:

  1. In cPanel, access phpMyAdmin from the Databases section.
  2. Select your WordPress database from the left panel. Confirm you’ve picked the correct database (sites with multiple WordPress installs share the same hosting account sometimes).
  3. Click the Export tab.
  4. Choose Quick export, format SQL.
  5. Click Go and save the SQL file alongside your zip of site files.

That gives you a clean database backup with all your database entries (posts, pages, options, plugin data) intact.

When manual backup makes sense:

  • One-off backup before a major update
  • Sites where the team controls the local development environment
  • Small static sites that rarely change
  • Pre-migration snapshots

When it doesn’t:

  • Sites with content added daily
  • Anyone who’ll forget to run the process for three months and then panic
  • Teams without a documented backup strategy

Method 2: Plugin-Based WordPress Backup

The most common approach because it works for most cases. Set the schedule, point at cloud storage, get on with your day.

Four backup plugins worth considering:

  • UpdraftPlus. The free version handles scheduled backups to Google Drive, Dropbox, and Amazon S3. It’s the most popular WordPress backup plugin by install count, and the premium tier adds incremental backups and faster restores.
  • BlogVault. This one is premium-only but designed properly. Backups go offsite by default, real-time backups are available, and the restore process is the cleanest of the lot.
  • Solid Backups (formerly BackupBuddy). This is a long-running paid option that’s strong on scheduled backups and migration tooling.
  • Jetpack VaultPress Backup. This plugin handles real-time backups for WooCommerce or any site where every order matters. It’s paid only, and Jetpack Backup is the same product under the Jetpack umbrella.

Setting up UpdraftPlus (the most common workflow):

  1. Install UpdraftPlus from the WordPress plugin directory.
  2. Go to Settings, UpdraftPlus Backups.
  3. Open plugin settings, set files to weekly backups, database to daily backups. Adjust for how often the site changes.
  4. Choose a remote storage destination. Google Drive, Dropbox, or any cloud storage service that suits your stack.
  5. Authorize the connection.
  6. Click Backup Now to create your first backup and confirm everything works.

After the first backup completes, backups run automatically on schedule. Each backup gets stored in your remote storage. You can roll back to a selected backup from the Existing Backups tab in just a few clicks. The plugin doubles as a backup manager and a restore tool.

Backup plugins are a tool, not a strategy. A plugin can be fully configured and still fail silently if storage fills up, the OAuth token expires, or the developer abandons the plugin. Plugin settings need ongoing monitoring, not a one-time setup.

Slow website wasting your marketing spend?

  • Uncover performance issues
  • Identify SEO opportunities
  • Security gaps, and quick wins
Grab your FREE copy now!

Method 3: Host-Managed Backups (WP Engine, Kinsta, Pressable, Cloudways)

Managed WordPress hosts run automatic backups on their own infrastructure. That’s convenient, but it’s not bulletproof.

How it works on most web hosts:

  • Daily backup of files and database
  • 14 to 30 days retention by default
  • Restore from the hosting account dashboard in just a few clicks
  • Backups stored on the hosting server or related infrastructure

Here’s the structural problem. If the backup lives on the entire server (or the same hosting company’s infrastructure that took your site down), you have a single point of failure. The host’s backup is convenience, not insurance.

Host-managed backups work best as a layer. Treat them as a rollback for editorial mistakes (someone broke the homepage, restore from yesterday’s snapshot) rather than disaster recovery. Pair them with an independent backup stored on Google Drive, Backblaze, or any remote server outside the hosting company’s control.

If you’re on shared hosting without daily backups, the host is not protecting you. Treat that setup the same way you’d treat a site with no host backup at all.

How to Verify Your WordPress Backup Actually Works

This is the section most backup tutorials skip. It’s also the only one that matters.

Around 90% of “broken” backups were never tested. The download completed, the email went out, the dashboard said success, and nobody ever tried to restore from the file. Then the site went down, the team opened the backup, and the database file wouldn’t import.

How to test a WordPress backup properly:

  1. Set up a staging site. Most managed WordPress hosts include staging environments. If yours doesn’t, use a local development environment like Local by Flywheel or a fresh test domain.
  2. Restore the most recent backup to the staging site. File system first, then import the database into the staging environment’s existing database slot.
  3. Check the database import. Confirm post counts match, user accounts exist, options table is intact.
  4. Verify media URLs. If you’ve changed domains or the database wasn’t search-replaced properly, image URLs break. Test 10 random posts and pages.
  5. Reactivate plugins one by one. Confirm plugin licenses, API keys, and scheduled tasks (wp-cron jobs) still fire.
  6. Test core functionality. Submit a form, log in as a test user, and run a checkout on a WooCommerce site.

If any of those break, you don’t have a working backup. You have files.

Run a full restore test quarterly at a minimum. Sites that earn revenue should test monthly. The first restore test for a new backup process is the most important one you’ll ever do, because it tells you whether the rest of the backups in that schedule are real or theoretical.

WordPress Backup Frequency and Storage Strategy

How Often Should You Back Up a WordPress Site

The honest answer is simple. Back up as often as you can afford to lose work.

  • Brochure sites: weekly backups for files, daily backups for the database
  • Blogs and content sites: daily backups across the board
  • WooCommerce and ecommerce stores: real-time backups or hourly
  • High-traffic membership sites: real-time backups, incremental backups wherever the plugin supports it

If you would lose more than a few hours of customer orders, content updates, or form submissions, daily is not enough.

How many backups you should keep depends on your retention strategy (covered below). The backup frequency answers a different question. Incremental backups (where only the changes since the last backup get stored) let you schedule backups more often without bloating storage. UpdraftPlus Premium, BlogVault, and Jetpack VaultPress all support incremental backups to save space.

Where to Store WordPress Backups

The offsite rule is simple. The same server is not a backup.

Pick at least one remote storage destination outside your hosting account:

  • Google Drive (cheap, easy, fine for smaller sites)
  • Dropbox
  • Amazon S3 or Backblaze B2 (better for larger backups or longer retention)
  • A separate cloud storage service entirely

Better yet, use two destinations. The 3-2-1 rule from traditional IT applies here, which means three copies of your data on two different media, with one copy stored offsite. For a WordPress site, that translates to a live site, a backup plugin storing to Google Drive, and a quarterly archive on Backblaze.

Where you store backups matters as much as the schedule. A backup strategy with daily backups, but nowhere safe to store backups, is half a strategy.

How Long to Keep WordPress Backups

30 days is the minimum. 90 days is the right answer for most production sites.

Retention matters because some issues take weeks to surface. Malware can quietly modify files for a month before anyone notices. A plugin update might break something subtle on a low-traffic page that nobody checks. A user permission change can slip past the team. Short retention means you can’t roll back far enough to fix any of that.

For WooCommerce and any site with regulatory or compliance needs, retention can stretch to years. Don’t store more than you have to, but don’t store less than you might need.

WordPress Backup Mistakes That Cost Sites

The patterns we see when a backup fails on the day it’s needed:

  • Same-server storage. When the host goes down, the backup goes down with it.
  • Missing database. Files alone don’t restore a working WordPress site, because the content lives in the database.
  • Untested backups. The first restore attempt happens during the actual emergency, which is the worst possible time to find out a backup is broken.
  • Manual-only schedules. Someone meant to run it weekly, but then life happened and the backups stopped.
  • Sole reliance on host backups. This is convenience, not insurance, and treating it as insurance creates false confidence.
  • Abandoned plugins. The backup plugin hasn’t been updated in two years and silently fails on the latest WordPress version.
  • No restore documentation. The person who set up the backup left the team, and nobody else knows the process.

Each of those is a survivable problem on its own. Combined with a server crash or a malware incident that takes the entire site offline, they’re not. Data loss in those moments is rarely just files. It’s customer trust, search rankings, and weeks of recovery work.

When DIY WordPress Backups Stop Making Sense

The DIY backup model works fine for a personal blog. It breaks down when the site is generating revenue, holding customer data, or being managed by a team where ownership is unclear.

Signs you’ve outgrown DIY backups:

  • The site generates revenue and every hour of downtime has a price tag
  • You can’t name the person responsible for verifying backups this month
  • The backup plugin is set and forget, and nobody’s checked it in 12 months
  • Your hosting service is your only backup
  • You can’t answer “when was the last successful restore test” in under 10 seconds
  • The site runs WooCommerce or a membership program, where data loss equals customer loss
  • The team that built it is no longer around
  • You manage multiple sites and each one has a different backup setup

At that point, a backup strategy isn’t a side task. It’s part of how the site stays alive.

WPC handles WordPress backups, scheduled restore testing, and recovery documentation as part of every WordPress maintenance service engagement. Most clients move to managed backups after the first close call.

What a Professional WordPress Backup Service Should Include

If you’re evaluating a WordPress maintenance service or a backup retainer, the checklist:

  • Real-time backups or incremental backups for content sites and ecommerce stores
  • Off-site remote storage outside the web hosting provider’s infrastructure
  • Quarterly tested restores with documented results
  • Backup monitoring with alerts when a backup fails or storage runs low
  • Documented restore SLA so the team knows how fast a full restore will happen
  • Retention longer than the host default (90 days minimum for most production sites)
  • Multi-site support if you run multiple sites or a network
  • Versioned restore so you can pick a previous version of the database, not just the most recent backup
  • A documented process for restoring your site that any team member can follow

If a service can’t tick those boxes, it’s a snapshot tool, not a backup service.

That checklist is the spec for every WordPress maintenance service we run at WPC. We don’t sell backup as a feature. We sell the certainty that comes from tested restores.

WordPress Backup FAQ

Does WordPress have a built-in backup feature?

No. WordPress core does not include a built-in backup feature. You need either a backup plugin, a manual backup process, or a host that runs backups for you.

Can I back up a WordPress site without a plugin?

Yes. Use cPanel File Manager or an FTP client to copy your site files, and phpMyAdmin to export your database separately. Save both to your local folder or cloud storage. This is the most reliable manual method, and it’s the same approach most professionals use for a pre-migration full backup.

Are WordPress sites backed up automatically?

WordPress (the hosted platform, not self-hosted WordPress) runs automatic backups on its infrastructure. The catch is that you can only restore through their support process. For self-hosted WordPress sites, you need to set up your own backup.

What’s the best free WordPress backup plugin?

UpdraftPlus is the most widely used free option, with strong scheduled backup and cloud storage support out of the box. Other free options exist but UpdraftPlus has the largest install base and most active support.

How long does a WordPress backup take?

Depends on site size. A 500MB site might back up in 10 minutes. A 50GB WooCommerce store with a large media library can take hours. Incremental backups after the first full backup are much faster because only the changes get stored.

How long does it take to restore a WordPress site from backup?

For most sites, 15 to 60 minutes if the backup is intact and the team knows the process. For sites with large databases or media libraries, expect 1 to 4 hours. Untested backups can take days because the team has to troubleshoot the restore.

Do I still need backups on managed hosting like WP Engine or Kinsta?

Yes. Host backups are stored on the hosting company’s infrastructure and are bound by its retention rules. Always run an independent backup to remote storage outside the host.

Backup Properly, Restore Confidently

A solid WordPress backup process protects three things: revenue, reputation, and the team’s sanity at 2 am when something breaks.

The methods in this guide work. The question is whether they get set up properly, tested quarterly, and treated like the insurance policy they are.

If that sounds like more work than your team has bandwidth for, that’s the gap WPC fills. Real-time backups, monitored restore testing, and documented recovery plans are part of every WordPress maintenance service we run.

Want us to audit your current backup setup? Book a free site review, and we’ll tell you exactly where it would fail.

Get Your Free Website Audit

($3,000 Value)

  • Uncover performance issues
  • Identify SEO opportunities
  • Security gaps, and quick wins
Get Your Free Audit!

Updated on: 25 May 2026 |

WordPress

Nirmal Gyanwali, Director of WP Creative

Nirmal Gyanwali

With over 16 years of experience in the web industry, Nirmal has built websites for a wide variety of businesses; from mom n’ pop shops to some of Australia’s leading brands. Nirmal brings his wealth of experience in managing teams to WP Creative along with his wife, Saba.