How to Back Up a WordPress Site: Every Method That Works

Most people learn how to back up a WordPress site the hard way: a plugin update goes wrong, a hacker gets in, or a host has a bad day, and suddenly the question is "do I have a copy?" This article is about making sure the answer is yes.

There is more than one way to do it, and none of them is difficult. Whether you are learning how to back up a WordPress site for the first time or tidying an old routine, the steps below work for you. The tricky bits are knowing what to copy, where to put it, and how to tell that your backup would really save you.

What a Full WordPress Backup Includes

A WordPress site is two things stuck together: files and a database. A real backup has both.

The database holds your words and settings. The files hold your design, your plugins and your media. Lose the database and you have a pretty empty shell. Lose the files and you have text with no site to put it in.

A few notes that save people grief:

• wp-content is the important folder. WordPress core itself can be downloaded again from wordpress.org, but your plugins, theme changes and uploads cannot.
• wp-config.php matters. It holds the database connection details and the secret keys. Keep a copy somewhere private, since it also contains credentials.
• Caches do not need backing up. They are rebuilt automatically and just make backups bigger.

A database only backup is useful too. It is smaller and quicker, so it suits the moment before you change content or settings. A full backup suits the moment before a big update or a redesign.

How to Back Up a WordPress Site by Hand

Manual methods are good to know even if you plan to use a plugin, because they are what you fall back on when everything else is broken.

Method 1: Your Host's Snapshot

Many hosts offer a backup or snapshot button in their control panel. It is the easiest option, and it is worth using as one layer of protection.

Be a little careful with it, though. Check how long the host keeps snapshots, whether you can download one, and how you get it back. A backup you can only restore by opening a support ticket is slower than one you can restore yourself. If the host's account is ever compromised or suspended, the snapshots can disappear along with the site.

Method 2: SFTP Plus a phpMyAdmin Export

This is the classic. It takes about twenty minutes the first time.

1. Copy the files. Connect with an SFTP client (a file transfer program that uses a secure connection) and download your whole WordPress folder to your computer. If space or time is short, wp-content and wp-config.php are the pieces you cannot replace.
2. Export the database. Open phpMyAdmin from your hosting panel, select your WordPress database, click Export, choose the Quick method and the SQL format, and download the file.
3. Label them. Put both in a folder named with today's date, such as mysite-2026-10-12.

The downside is that on a large site, phpMyAdmin can time out and SFTP can be painfully slow. If the export seems to finish too quickly, open the file and check that it ends properly. A truncated database dump is a classic way to end up with a backup that looks fine and isn't.

Method 3: WP-CLI

WP-CLI is a command line tool for WordPress. If your host gives you SSH access (a secure remote command line), it is the fastest way to dump the database. From your WordPress folder:

wp db export mysite-2026-10-12.sql

That writes the whole database to one .sql file. If you leave the file name out, WP-CLI makes one from the database name and the date. You can also pass extra options through to the underlying export tool, and the WP-CLI documentation for wp db export lists everything it accepts.

Then pack the files with whatever your server offers, for example:

tar -czf mysite-files-2026-10-12.tar.gz wp-content wp-config.php

Download both to somewhere that is not the server. This method is very good for scripting, which is why developers love it, and it is also easy to forget to run, which is why plenty of sites do not have a routine at all.

Backing Up With a Plugin

If you want the easiest answer to how to back up a WordPress site every time, a plugin does the same job without you needing to remember. A good one should:

• Cover both files and database.
• Work on a site that is bigger than your host's time limit allows (the job should run in small steps).
• Tell you if a backup failed.
• Let you download the result.
• Check that the backup is complete, not just that a file exists.

That last point is the one that most plugins skip. A file named backup.zip that is 40 MB looks reassuring, and tells you nothing about whether it opens.

How Stack Guard Does It

Stack Guard's backups are built around that idea. All of this is in the Free plan:

• Manual full or database-only backups. Click Back Up Now for a full backup, or Database Only for a quick one.
• Resumable steps. The backup runs in short steps in the background, so it finishes even on hosts with short time limits, and it carries on if you close the page.
• Verified before it counts. Once the copy is made, Stack Guard opens every archive again and checks every file and every database row against what it wrote. Only a backup that passes is marked Verified and offered for download and restore. One that fails is marked Failed, with the reason.
• A test restore after every backup. The database gets a test restore each time, so you find out about a problem now and not during an emergency.

Google Drive backups, schedules and retention, backup alerts and monthly automatic test restores are all coming soon for Pro. Today, backups are started by you.

The details of how each part works are in the backups documentation, and you can try it with the free download.

Where to Keep Your WordPress Backups

This is the part that separates a backup from a false sense of security.

Do not leave your only copy on the same server as the site. If someone breaks into the site, they can reach the backups. If the server fails or the host account is closed, both go together. A backup folder on the server is better than nothing, and nowhere near enough.

Good places for the copy:

• Your own computer (and an external drive if the site matters).
• Cloud storage you control.
• A second host or storage provider.

In Stack Guard, each part of a backup can be downloaded from the Backups tab, and every download sends an email to the people who receive Stack Guard alerts, so a download you did not expect does not go unnoticed. Download links work only for you, while you are signed in, for one hour.

Treat the backup like the site itself. It holds your customer data and, in wp-config.php, your database password. Do not email it around or leave it in a shared folder anyone can open.

Pro tip: name every backup with the site and the date, such as mysite-2026-10-12. At 2am, "backup-final-2" will not help you.

The 3-2-1 Idea

You will hear about the 3-2-1 rule in backup circles. It is simple:

• 3 copies of your data (the live site plus two backups).
• 2 different kinds of storage (for example your computer and cloud storage).
• 1 copy somewhere else, away from the main location.

You do not need to be rigid about it. The point is that no single failure, whether it is a hack, a dead disk, a closed account or a clumsy click, should take everything.

For a small business site, a practical version looks like this: your host's snapshot, plus a verified backup you download to your own machine, plus a copy in cloud storage. For deeper thinking about frequency, retention and what to do for shops or agencies, see our WordPress backup strategy guide.

Why an Untested Backup Is Not a Backup

Imagine a fire drill where nobody ever walks outside. Everyone feels prepared, right up until the day it matters.

Backups fail in quiet ways:

• The database export stopped halfway and nobody noticed.
• The archive is corrupt and will not open.
• The backup includes the files but not the database, or the other way round.
• The backup is perfectly fine, but nobody knows how to put it back.
• The backup is from after the site was hacked, so it brings the hack back.

Key takeaway: a backup you have never restored is a hope, not a plan.

The cure is boring and effective: restore it, at least sometimes, somewhere safe. A staging copy or a local development environment is ideal, and a fresh hosting account will do. If the site comes up with its pages, images and settings, you have a backup. If it does not, you have just found a problem for free.

This is where built-in checks save time. Stack Guard checks every backup after it is made and test restores the database after each one. That does not replace a full practice restore now and then, but it catches the commonest failures immediately.

When the day does come to bring a site back, the process is covered in how to restore WordPress from a backup.

When to Back Up

A schedule is good, and a few moments deserve a backup on their own:

• Before updating WordPress, a plugin or a theme.
• Before editing theme files or database settings.
• Before installing something new.
• Before a big content change.
• Straight after you launch or finish a major piece of work.
• Before cleaning up a hacked site, so you keep evidence of what happened (see the signs your WordPress site has been hacked).

If your site takes orders or comments around the clock, a backup from last week is a week of lost orders. Decide how much work you can afford to lose, and back up at least that often. Scheduled backups are coming soon to Pro, and until then a calendar reminder and a manual backup is a perfectly respectable routine.

Common Mistakes When You Back Up a WordPress Site

A few traps catch people again and again:

• Backing up only the database. It feels like the important part, and it is, but your theme settings, uploads and plugins live in files.
• Backing up only the files. Your posts, pages and orders are in the database. Files alone give you an empty site.
• Keeping backups in the same account as the site. One hack or one suspended account, and both vanish.
• Never opening the backup. The first time you look inside should not be during an emergency.
• Forgetting the database size. Large databases can time out in phpMyAdmin. If the export looks suspiciously small, check it.
• Backing up after the damage. A backup made after a hack or a bad update just saves the problem. Take it before.

None of these is hard to avoid once you know them. Knowing how to back up a WordPress site properly is mostly a matter of doing the dull steps in order, every time.

A Simple Plan You Can Start Today

1. Make a full backup now, and a database-only one before every content change.
2. Download a copy off the server.
3. Keep at least one more copy somewhere different.
4. Check it: confirm it opens, or let your backup tool verify it.
5. Practise a restore on a spare site once, so you know the steps.

That is the lot. It takes an afternoon to set up and it is the cheapest insurance your site will ever have.

If you run several sites, or look after sites for clients, the same plan applies to each one, and it is worth writing down who is responsible for the copies and where they live. A backup nobody owns is a backup nobody checks. Start with your most important site, get that routine solid, and then repeat it for the rest.