WordPress Backups:What to Back Up and How to Restore

A complete WordPress backup has two parts: the database (posts, pages, users, settings, orders) and the files (wp-content with uploads, themes and plugins, plus wp-config.php and any custom files in the site root). A backup is only useful if it is stored somewhere other than the hosting account, recent enough, and tested by actually restoring it.

This guide covers what to back up, the main ways to do it, and a restore routine you can rely on.

What to back up

Part	Contains	Changes
Database	Content, users, settings, comments, orders	Constantly on active sites
wp-content/uploads	Media library	Whenever media is added
wp-content/themes and plugins	Code (can be reinstalled, but customisations cannot)	On updates
wp-config.php	Database credentials, keys and settings	Rarely
.htaccess and other root files	Server rules, verification files	Rarely

WordPress core files can be re-downloaded, but including them makes restores simpler.

Ways to back up

Host backups

Many hosting plans include automatic backups. Check:

• how often they run and how long they are kept;
• whether they are stored on a different server;
• whether you can restore files, databases or the whole account yourself.

Host backups are convenient but sit with the same provider, so keep an independent copy too.

Backup plugins

A backup plugin schedules backups from inside WordPress and can send them to cloud storage or a remote server. Look for:

• separate schedules for database (frequent) and files (less frequent);
• remote storage, not just a folder on the same server;
• encryption of archives if they contain sensitive data;
• a tested restore process.

Control panel and manual backups

cPanel can create a full or partial backup you download; see how to back up your website in cPanel. Manually, you can export the database with phpMyAdmin and download wp-content by FTP.

How often to back up

Match the frequency to how much work you could afford to lose:

• Brochure site, rarely updated: weekly files and database, plus before every change.
• Active blog: daily database, weekly files.
• Online store or membership site: at least daily database, more often for busy stores, plus before every update.

Keep several versions (for example 7 daily and 4 weekly), so you can go back to a point before an infection or a mistake that was noticed late.

Where to store backups

Follow the spirit of the 3-2-1 rule: three copies, on two different kinds of storage, with one copy off-site. For a website that might mean the live site, the host's backups, and a copy in separate cloud storage. Protect backup storage with its own strong credentials and 2FA; see backup security.

How to restore

Restoring with a plugin

Most backup plugins restore from their own interface. If the dashboard is not available, many can be reinstalled on a fresh WordPress install to restore an archive.

Restoring manually

1. Files: upload wp-content and wp-config.php to the site folder (over a fresh WordPress core if needed).
2. Database: in phpMyAdmin, empty or create the database and import the SQL file.
3. Credentials: make sure wp-config.php matches the database name, user and password.
4. URLs: if restoring to a different domain, update the site URL with a search-replace tool that handles serialised data, such as WP-CLI's search-replace.
5. Check pages, logins, forms and media.

The general process is described in how to restore a website from a backup.

Example backup plan for a WooCommerce store

Component	Frequency	Retention	Storage
Database	Every 6 hours	14 days	Cloud storage (separate account), encrypted
Uploads (wp-content/uploads)	Daily (incremental)	30 days	Same cloud storage
Themes, plugins, wp-config.php	Daily	30 days	Same cloud storage
Full site	Before every update	Last 5	Host backup + cloud
Monthly archive	1st of each month	12 months	Cloud storage

Plus host backups as a second, independent layer. The store owner tests a restore to staging every quarter and after any change to the backup plugin.

What a restore test should prove

• The archive opens and contains the database and files.
• The restored site loads, and you can log in.
• Recent content and orders up to the backup time are present.
• Media files display.
• You know how long the restore took, and every step is written down.

Test your restores

Two or three times a year, restore a backup to a staging site or subdomain and check that it works. An untested backup can be incomplete, corrupted or missing the database, and you will only find out when you need it.

Frequently Asked Questions

Are host backups enough?

They are a good first layer, but not the only one. Keep an independent copy you control.

How big will my backups be?

Roughly the size of wp-content plus the database, compressed. Media libraries are usually the largest part.

Should backups include the cache folder?

No. Exclude cache folders and old backup archives to keep backups small and fast.

Related reading

Backups are part of the WordPress security checklist and the WordPress maintenance checklist. For the WordPress overview, see WordPress hosting: what it is and how to choose, and compare ServerNeed WordPress hosting.

Sources

• WordPress Documentation: WordPress Backups
• WP-CLI: wp search-replace

Featured image: “Laptop external storage” by IN 30 MINUTES Guides, licensed under CC BY 2.0.