how to back up a WordPress site

how to back up a WordPress site

Backing up a WordPress site is a practical routine that protects your content, customisations and configuration from data loss due to updates, hacks or accidental errors. A good backup strategy combines regular copies of your site files and its database, off-site storage, and a tested restore process, so you can be confident you can recover quickly when needed. This guide walks you step by step through the preparation, the two main backup methods, and how to verify your backups so you can minimise downtime and avoid surprises.

Start by understanding what to back up: the WordPress files and the MySQL or MariaDB database. The files include core, theme and plugin code, plus the uploads folder which holds images and media. The database contains posts, pages, comments, users and most site settings. Decide on backup frequency and retention based on how often the site changes; for a blog that updates daily, consider daily backups, while a brochure site might only need weekly copies. Also choose where to store backups, ideally in at least two locations such as cloud storage and an external drive for redundancy.

Step 1: prepare your environment before taking the first backup. Confirm you have FTP or SFTP access and correct credentials for your hosting account, and that you can log in to phpMyAdmin or use WP‑CLI for database exports. Make a simple checklist to avoid missing anything during the process, such as access to control panel, file permissions, and sufficient disk space for temporary archive files.

• Hosting control panel login and account details.
• FTP/SFTP username, password and server address.
• Database name, username and password for phpMyAdmin or WP‑CLI access.
• Local storage or cloud account to receive the backup files.

Step 2: back up the site files using your hosting file manager or FTP/SFTP client. Connect to the server, navigate to the WordPress installation folder and download the entire directory or at least the wp-content folder plus wp-config.php and any custom scripts. For efficiency compress the files into a single archive such as a zip or tar.gz with a date in the filename to keep versions organised. Verify the archive completes without errors and check the size to ensure the uploads folder was included. Remember to record where the archive is saved locally and then copy it to off-site storage if you plan to retain multiple copies.

Step 3: export the database safely using phpMyAdmin or WP‑CLI. In phpMyAdmin select the database, use the Export tab and choose SQL format with the default options unless you need custom settings, then download the SQL file. If you have command line access and prefer WP‑CLI, run the database export command and redirect the output to a dated filename, then compress the SQL file. Keep the database file alongside the file archive and store both copies together for convenience during a restore. Double-check the SQL file opens in a text editor to confirm it contains CREATE and INSERT statements, which indicates a successful export.

Step 4: consider automated plugins and hosting-level backups to reduce manual work and add scheduling options. Many reputable backup plugins provide scheduled backups, incremental changes, and automatic uploads to cloud providers, which makes routine maintenance simpler for non-technical users. If your host offers daily snapshots or automated backups, verify the retention and restore process the host uses and supplement with off-site copies if the provider retains backups for a short time only. For additional reading on practical guides and related how-to topics, see this collection of How-To Guides on the blog.

Step 5: test restoring from a backup and refine your process. Create a local or staging site and perform a full restore using the file archive and database export to ensure everything works as expected, including media and theme customisations. Establish a rotation and retention policy so you do not keep excessive backups indefinitely but retain enough points to recover from recent errors or compromises. Secure your backups by restricting access, using strong passwords and, where appropriate, encrypting archives before sending them to cloud storage. Finally, document the steps and schedule for backups so you or a team member can execute and verify the process consistently. For more builds and experiments, visit my main RC projects page.