Every WordPress site will eventually face a bad day: a plugin update that breaks the layout, a hacked admin account, a staff member who deletes the wrong page, or a server failure. When that happens, a good backup is the difference between a five minute fix and weeks of rebuilding. This guide explains how to back up a WordPress site using three reliable methods, where to store your backups and how to make sure they actually work.
What a complete WordPress backup includes
A WordPress site has two main parts, and you need both:
- Files: WordPress core, your theme, plugins, uploaded images and documents in the wp-content folder, and configuration files such as wp-config.php.
- Database: all your posts, pages, settings, users, comments, orders and form entries.
Backing up only the files means losing your content. Backing up only the database means losing your images and design. A complete backup has both.
How often should you back up?
It depends on how often your site changes:
- Brochure websites that change monthly: weekly backups are often enough.
- Blogs and news sites updated several times a week: daily backups.
- Online shops and booking sites with orders every day: daily backups at minimum, and more frequent database backups if possible.
Always take a manual backup before major changes, such as updating WordPress, changing themes or installing a new plugin.
Method 1: Use your hosting provider's backups
Many hosting providers take automatic backups of your account. This is the easiest option and runs without you doing anything. Check:
- How often backups are taken
- How many days of backups are kept
- Whether you can restore by yourself or need to contact support
- Whether backups include email as well as website files
At Baasa Cloud, hosting plans include daily backups, so you can roll back to a recent copy if something goes wrong. Even so, it is wise to keep your own copies too, as described below.
Method 2: Use a WordPress backup plugin
Backup plugins let you schedule automatic backups and store them off the server, such as in Google Drive, Dropbox or other cloud storage. Popular options include UpdraftPlus, BackWPup and Duplicator, among others.
Step by step with a typical backup plugin
- In your WordPress dashboard, go to Plugins, then Add New.
- Search for your chosen backup plugin, install and activate it.
- Open the plugin settings.
- Set the schedule for files and database, for example files weekly and database daily.
- Choose how many backups to keep, such as the last seven to fourteen.
- Connect remote storage, such as Google Drive. Follow the authorisation steps.
- Save settings and run a manual backup immediately to test.
- Check your remote storage to confirm the backup files have arrived.
Large sites with many images can produce big backups. Make sure your cloud storage has enough space, and avoid scheduling backups during your busiest hours.
Method 3: Manual backup through cPanel
A manual backup is useful before major changes or when moving hosts. If your host uses cPanel:
Back up the files
- Log in to cPanel and open File Manager.
- Go to the folder where WordPress is installed, often public_html.
- Select all files and folders, then compress them into a zip archive.
- Download the zip file to your computer.
- Delete the zip from the server afterwards to save space.
Back up the database
- In cPanel, open phpMyAdmin.
- Select your WordPress database. If you are unsure which one, check the database name in wp-config.php.
- Click Export, choose the Quick method and SQL format.
- Click Go to download the .sql file.
Alternatively, the cPanel Backup tool may allow you to download a full or partial backup in a few clicks.
Where to store your backups
Follow the widely used 3-2-1 approach:
- 3 copies of your data: the live site plus two backups.
- 2 different storage types, for example cloud storage and an external hard drive.
- 1 copy off site, away from your hosting server and your office.
Never rely only on backups stored on the same server as your website. If the server is compromised or fails, you could lose both the site and the backups.
Test your backups
A backup you have never tested is a hope, not a plan. At least a few times a year:
- Pick a recent backup.
- Restore it to a staging site or a temporary subdomain, not your live site.
- Check that pages, images, menus and forms work.
- Note how long the restore took, so you know what to expect in an emergency.
Many hosts and plugins offer staging features that make this easier.
How to restore when something goes wrong
- Host backup: use the restore option in your control panel or contact support with the date you want to restore.
- Plugin backup: if you can still log in to WordPress, use the plugin's restore button. If not, reinstall WordPress and the plugin, then restore.
- Manual backup: upload the files, create or empty the database, import the .sql file and check wp-config.php settings.
If the site was hacked, restore from a backup taken before the attack, then change all passwords and update everything immediately.
Backup checklist
- Automatic backups scheduled for files and database
- At least one copy stored off the server
- Retention of at least one to two weeks of backups
- Manual backup taken before major updates
- Restore tested in the last few months
- Login details for backup storage kept safe
Frequently asked questions
Are free backup plugins good enough?
For many small sites, yes. Paid versions add features such as incremental backups, more storage options and easier migration.
How much storage do backups need?
Roughly the size of your site multiplied by the number of copies you keep. Check your site size in cPanel Disk Usage.
Do backups slow down my website?
They can briefly use server resources. Schedule them for quiet times, such as late at night.
Should I back up email too?
If your email is on the same hosting account, yes. Host level backups often include it, but plugins usually do not.
Conclusion
Backing up a WordPress site is simple once it is set up: use host backups, add a plugin that sends copies off site, take manual backups before big changes and test your restores. With that routine in place, a broken update or a hack becomes an inconvenience rather than a disaster.