How to Back Up WordPress the Right Way (Not Just the Database)

Most people do not think seriously about backups until the day their site is gone, broken, hacked, or overwritten by a bad update. I have been there, and it is a miserable lesson to learn the hard way. The good news is that backing up WordPress the right way is not complicated once you understand what actually needs to be protected.

In this guide, I am going to keep it simple and complete. You will learn what a real WordPress backup includes, how often to run backups, the easiest plugin option, the hosted option I trust most, and how to restore everything when things go sideways. If your site matters to you, this is one of the fastest ways to reduce risk.

The goal is not to collect random backup files and hope for the best. The goal is to build a recovery path. When your site is hacked, a plugin update fails, or someone deletes something important, you want a backup that you can actually restore without guessing. That is what separates a real safety plan from a false sense of security.

Why most WordPress backup guides get it wrong

A lot of backup advice focuses only on the database. That is not enough. Yes, the database stores your posts, pages, comments, settings, and a lot of the important structure of your site. But it does not contain everything that makes your site look and work the way it does.

Your themes, plugins, uploads, custom code snippets, and media files all live outside the database. If you only back up the database, you can still lose your design, plugin settings, images, and custom changes. That is a partial backup, not a real one.

The safest mindset is simple. If you could not rebuild your site exactly as it was without touching the internet, the backup is incomplete.

What a complete WordPress backup includes

A complete WordPress backup has two parts.

• The database, which stores content and site settings.
• Your files, especially the wp-content folder, which contains themes, plugins, uploads, and customizations.

The wp-content folder matters more than people think. That is where your uploaded images live, and it is also where many custom theme edits and plugin data files are stored. If you lose it, you may not lose every post, but you can absolutely lose the site you built around those posts.

At minimum, I recommend protecting these pieces:

• Database
• Theme files
• Plugin files
• Uploads folder
• Custom scripts, snippets, and configuration files

How often should you back up WordPress?

The right schedule depends on how often your site changes. If you publish often, sell products, or receive form submissions, daily backups are the bare minimum. If your site changes less often, weekly may be enough. Either way, always take a fresh backup before updates.

If you only remember one rule, make it this one. Always back up before updates. That applies to plugins, themes, and WordPress core itself.

Option 1: Automatic backups with UpdraftPlus free

If you want a straightforward plugin option, UpdraftPlus is one of the easiest places to start. It is popular for a reason. The free version gives most site owners enough to build a real backup routine without making the process painful.

Here is the basic setup process I would follow:

1. Install and activate UpdraftPlus from your WordPress dashboard.
2. Open the backup settings and choose a schedule for files and database.
3. Set the database to back up more often than files if your site changes frequently.
4. Connect a remote storage service like Google Drive or Dropbox.
5. Run your first backup manually.
6. Download a copy locally if you want an extra layer of safety.
7. Test a restore on a staging site or a spare install before trusting it.

The most important part is not the install. It is the restore test. A backup that cannot be restored is just a file sitting in storage.

UpdraftPlus works best when you treat it like insurance, not like decoration. Set the schedule, connect off-site storage, and verify the process before you actually need it.

Option 2: Kinsta’s built-in automatic backups

If you want backups handled for you with less moving parts, Kinsta is the cleanest option I have seen. Their backups run automatically every day, and you can also create on-demand backups when you are about to make changes. If something breaks, one-click restore makes recovery fast.

That matters because the biggest backup risk is not storage. It is human delay. When backups are built into the host, there is less setup to forget and less chance of a bad plugin configuration breaking the safety net.

If you are running a site that matters commercially, I would seriously consider paying for a setup that reduces backup friction. Less friction usually means fewer mistakes.

Option 3: Manual backup via cPanel

Manual backups are slower, but they are still useful if you are on basic hosting or you want to understand the process from the ground up. This is also the option that teaches you what is actually being saved.

There are two parts to a manual backup.

1. Export the database

Log into your hosting panel, open phpMyAdmin, select your WordPress database, and export it as an SQL file. Keep the export settings simple unless you know exactly what you are changing.

2. Download the files

Use FTP with a client like FileZilla, or use your host’s file manager. Download the full WordPress directory, or at least the wp-content folder if you need a faster emergency backup.

If your host exposes a compressed archive option, use it. The goal is to get a restorable copy off the server as quickly as possible.

Manual backups are not the easiest route, but they are a useful fallback when plugins fail or when you want a clean offline copy. I like teaching this method because it removes the mystery. Once you have done it a few times, you understand exactly which part of the site is being saved and where it lives.

One detail many people miss is that a manual backup should still be stored off-site. Downloading a copy to your laptop is better than nothing, but a local file is not enough if your computer fails at the same time as your site. Backups are strongest when they are separated from the original system.

Where to store your backups

This part is non-negotiable. Do not store your backups only on the same server as the site. If the server goes down, gets hacked, or fills up, your backup is gone with it.

Use off-site storage instead. Good options include Google Drive, Dropbox, and Amazon S3.

The rule is simple. If the backup lives in the same place as the website, it is not really a backup. It is just a second copy waiting to be lost.

How to restore WordPress from a backup

Restoring is where a backup proves its worth. The process varies by tool, but the idea is the same. Put the database back, put the files back, and confirm the site works.

Restoring with UpdraftPlus

In UpdraftPlus, you usually go to the existing backups section, choose the backup set you want, and click restore. From there, select the parts you want to recover, such as plugins, themes, uploads, and database. The plugin handles the heavy lifting.

After the restore, check your homepage, a few internal pages, login access, and your media library. If a backup restored correctly, the site should look and behave like it did before the problem. I also check the contact form, any critical plugins, and the site title and logo. Small details are often where restore problems hide.

If something looks off, do not assume it will fix itself. Compare the restored version with a known good backup, then correct the issue while you still have multiple recovery points available.

Restoring with Kinsta

With Kinsta, restore is even simpler. You choose the backup point, click restore, and let the platform roll your site back. That is one of the biggest reasons managed hosting can be worth it. When time matters, fewer steps matter.

Before you update anything, always back up first

This is the habit that saves the most pain. A plugin update that looks harmless can break a checkout flow. A theme update can wipe a custom layout. A WordPress core update can expose a compatibility issue you did not know existed.

Before you change anything important, make a fresh backup first. Then update. If something breaks (like a 500 Internal Server Error), you can restore instead of panic-troubleshooting at 2 a.m.

I treat this as a rule, not a suggestion. Update later. Backup now.

Testing your backups

A backup you have never tested is not a real backup. That sounds harsh, but it is true. The only way to know whether your process works is to restore it somewhere safe and see what happens.

Testing does not need to be complicated. You can use a staging site, a local install, or a spare subdomain. What you want to confirm is simple:

• The database restores cleanly
• The files are complete
• The site loads without errors
• Images and uploads are present
• Plugins and theme settings survived the restore

If any of those fail, fix the process before you rely on it. Backup systems are only useful when they are boring and repeatable.

I also recommend keeping at least a few generations of backups instead of only the newest copy. If a problem sits unnoticed for days, you may need a version from before the damage happened. That small bit of history can save a site from being restored to a broken state twice.

Final thoughts

WordPress backups are not exciting, but they are one of the cheapest forms of insurance you can set up for a site you care about. If you remember to protect both the database and the files, store copies off-site, and test restores before disaster strikes, you are already ahead of most site owners.

My rule is simple. Keep the process automatic where possible, keep one manual fallback available, and never trust a backup you have not restored at least once. That combination gives you speed, redundancy, and confidence when the pressure is on.

When things do go wrong, these guides can help you recover fast: How to Fix the WordPress 500 Internal Server Error, Locked Out of WordPress Admin, and WordPress Not Sending Emails.

Set it up once. Test it once. Then sleep better forever.

Frequently asked questions

Does WordPress back itself up automatically?

No. WordPress does not include automatic backups by default. Some hosts add backup tools, and plugins can automate the process, but plain WordPress does not do this on its own.

Can I back up WordPress without a plugin?

Yes. You can export the database with phpMyAdmin and download the files with FTP or a file manager. It works, but it is more manual and easier to forget.

How do I restore WordPress if my site goes down completely?

Restore the database and files from your backup, or use your host’s restore tools if they provide them. If you use a plugin like UpdraftPlus or a host like Kinsta, the restore process is usually much easier.

Is UpdraftPlus free enough or do I need the paid version?

For many small sites, the free version is enough to build a reliable backup routine. If you need advanced scheduling, extra destinations, or more control, the paid version may be worth it.

How long should I keep old backups?

Keep enough versions to recover from a problem you do not notice right away. A common approach is to keep several recent backups and a few older ones, depending on how often your site changes and how much storage you have.

This post contains affiliate links. If you buy through them, I may earn a small commission at no extra cost to you.

About The Author

Marcus Li

Marcus Li is a web designer and marketing specialist based in Vancouver, BC. After years of helping clients build their online presence, he discovered how AI tools could level the playing field for everyday entrepreneurs. He shares what actually works, no fluff, no hype.

See author's posts