WordPress Backup: The Complete Guide, and How to Test Your Restore

Every WordPress site will need a backup one day: after a bad update, a hack, a hosting failure or a mistake in the editor. The sites that recover in ten minutes are not the ones with the most backup plugins. They are the ones whose backups are recent, stored somewhere else and actually restorable, because someone tested them.

This guide covers what a WordPress backup must include, the best ways to make one, how often to back up, where to keep copies, and the step most people skip: testing the restore.

What a complete WordPress backup includes#

A WordPress site is two things, and you need both:

• The database. Posts, pages, settings, users, comments, and for WooCommerce stores, orders and customers.
• The files. Everything in wp-content (uploads, themes and plugins), plus wp-config.php and .htaccess in the site root.

WordPress core files themselves can always be downloaded again, but backing up the whole site is simpler and makes restores faster. A backup with only the database loses your images. A backup with only the files loses your content.

The 3-2-1 rule for WordPress backups#

The standard rule for any important data works well for websites:

• 3 copies of your site (the live site plus two backups).
• 2 different places or types of storage, for example your host's backups and a plugin backup.
• 1 copy off-site, away from your hosting account: cloud storage such as Amazon S3, Google Drive, Dropbox or Backblaze.

Why off-site matters: if your hosting account is hacked, suspended or deleted, backups stored on the same server go with it.

How to back up a WordPress site#

Option 1: your host's backups#

Most managed WordPress hosts take automatic daily backups and offer one-click restores. Check three things in your hosting panel: how often backups run, how long they are kept, and whether you can download a copy. Host backups are a good first layer, but they live with your host, so add an off-site copy.

Option 2: a backup plugin#

A plugin can schedule backups and send them straight to off-site storage. Popular choices include UpdraftPlus, BlogVault, Jetpack VaultPress Backup, Duplicator and All-in-One WP Migration. When choosing, look for:

• Scheduled backups for files and database separately.
• Direct upload to off-site storage.
• Incremental or real-time backups for busy sites and stores.
• A restore that works even when wp-admin is down.

Option 3: a manual backup#

Useful once in a while, or before a big change:

1. Files: connect with SFTP or your host's file manager and download the whole site folder, or at least wp-content, wp-config.php and .htaccess.
2. Database: export it from phpMyAdmin (Export, Quick, SQL), or run wp db export with WP-CLI.
3. Store both together, with the date in the file names, somewhere off the server.

How often should you back up WordPress?#

Match backup frequency to how often the site changes, and to how much you can afford to lose:

For stores, every order since the last backup is an order you could lose in a restore, which is why real-time database backups are worth paying for.

Always take an extra backup right before updates, theme changes, migrations and big edits. Our WordPress maintenance checklist builds this into a routine.

How long to keep backups#

Keep at least 30 days of backups. Problems are not always found on day one: malware can sit unnoticed for weeks, and a broken page may only be reported after a few days. If your only backups are from the last three days, they may all contain the problem.

A practical retention plan: daily backups for 30 days, plus one monthly backup for a year.

Keep backups safe#

• Never leave backup files in a public folder. A zip or SQL file in wp-content can sometimes be downloaded by anyone who guesses the URL, and it contains your whole database.
• Use strong, unique passwords and two-factor login for the cloud storage that holds your backups.
• Encrypt backups if your plugin supports it, especially for stores and membership sites with customer data.
• Remove old manual backups from the server once they are stored off-site.

Test your restore (the step everyone skips)#

A backup you have never restored is a hope, not a plan. Files can be incomplete, the database export can be cut off, and the backup plugin may have stopped running months ago without anyone noticing.

Test a restore every month or two, and after changing hosts or backup tools:

1. Create a staging site or local copy. Our WordPress staging site guide shows how.
2. Restore your latest backup there, not on the live site.
3. Check the restored copy: log in, open recent posts and pages, check images, menus and forms, and for stores, check recent orders and products.
4. Time it. Note how long the restore took, so you know what to expect in a real emergency.
5. Write down the steps where your team can find them.

How to restore a WordPress backup#

When you need it for real:

1. Find the right backup. Pick the most recent backup from before the problem started. Knowing exactly when the problem appeared makes this much easier.
2. Save what is new. On a store, export orders placed since that backup, so you can re-import them.
3. Restore with your host's one-click restore or your backup plugin. If wp-admin is down, use the plugin's standalone restore or restore the files over SFTP and import the database in phpMyAdmin.
4. Clear caches and check the site in a private window.
5. Fix the cause before it happens again, for example by rolling back the plugin update behind the problem. See how to roll back a WordPress plugin.

If the site shows a white screen or a critical error, you may not need a full restore at all: see our guides to the WordPress white screen of death and the WordPress critical error.

Backups tell you how to go back. Monitoring tells you when.#

A backup only helps if you know something went wrong, and when it started. If a plugin update broke your checkout on Tuesday and you notice on Friday, you need to know which backup is from before Tuesday, and you have lost three days of sales.

The free MyKavo WordPress plugin is not a backup plugin. It works alongside one, so you notice problems early and know exactly which change caused them:

• Every update recorded and checked. Plugins, themes and core, including automatic updates at night. On paid plans, from Starter, MyKavo checks your key pages right after each update and labels any change with the update behind it, so you know the moment to restore to.
• Before-and-after screenshots. See exactly what changed on a page, and when.
• Snapshots of premium plugins (free). Right before WordPress updates a plugin, MyKavo saves a copy, so a bad update can often be rolled back in one click for seven days, without a full restore.
• "Did it crash?" check (free). About ten seconds after an update, the site checks its own home page and up to three monitored pages for server errors, the critical error page and PHP fatal errors.
• Safe Update All (free). Update plugins one at a time with a check after each, and automatically roll back any update that breaks the site.

Summary#

Back up both the database and the files. Follow the 3-2-1 rule, with at least one copy off your hosting account. Back up as often as your site changes, hourly or in real time for stores, and always right before updates. Keep 30 days or more, never leave backup files in public folders, and test a restore on staging every month or two. Then pair backups with monitoring, so you know when something broke and which backup to restore.