How to make a WordPress backup

To make a WordPress backup regularly is the cheapest insurance policy for your website. A hack, a failed update, a human error deleting files, or a hosting failure can destroy years of work in seconds, and the only difference between a ten-minute scare and an irreversible catastrophe is having a recent and verified backup. The paradox is that almost everyone knows they should make backups, but a surprising majority of websites operate without any, or with an old copy that no one has ever verified. In this guide, we will definitively solve the problem: what exactly a complete WordPress backup contains, how to do it manually and with plugins, how often it should be scheduled, where to store it so it survives even a server disaster, and, most importantly, how to restore it when the day comes that you truly need it.

What exactly a WordPress backup includes

A WordPress website is composed of two inseparable halves, and a copy is only complete if it includes both:

• The files. The WordPress core, themes, plugins, and, above all, the folder wp-content/uploads with all your images and documents. Also the file wp-config.php (with connection credentials) and the .htaccess.
• The database. Here live the posts, pages, comments, users, settings, and the configuration of most plugins. It is a MySQL/MariaDB database with the tables wp_posts, wp_options, etc.

A classic mistake is backing up only the files and forgetting the database, or vice versa. With only the files, you would have the photos but not a single blog post; with only the database, you would have the texts but no images. Remember this: complete copy = files + database, always.

Manual method: backup via SFTP and phpMyAdmin

Knowing how to make a manual backup is not a purist's whim: it allows you to back up a website even if you can't access the dashboard (for example, in case of a fatal error) and understand what plugins do underneath. The process has two parts.

Step 1: download the files

Connect to your server with an SFTP client like FileZilla using the credentials your hosting provider gave you. Locate the installation's root folder (it's usually called public_html, httpdocs or similar, and you will recognize the folders inside wp-admin, wp-content y wp-includes). Download it completely to your computer. On websites with many media, it can take quite a while; if you're short on time, prioritize wp-content y wp-config.php, which is truly irreplaceable.

Step 2: export the database

Enter your hosting panel and open phpMyAdmin. Select your website's database (you have the exact name in wp-config.php, in the constant DB_NAME), click the tab Export, choose the quick method and SQL format, and download the file. You will get a .sql with all the website content. Save files and database together, in a folder with the date in the name:

copias/
└── miweb-2026-08-05/
    ├── archivos/        (todo el contenido descargado por SFTP)
    └── miweb.sql        (exportación de la base de datos)

You already have a complete backup. The manual method always works, but it has an obvious Achilles' heel: it depends on you remembering to do it. That's why the next step is to automate.

WordPress backup with plugins: automate and forget

Backup plugins do exactly the same thing you just did manually (packaging files and exporting the database), but scheduled, compressed, and with automatic sending to external storage. These are the most robust options:

• UpdraftPlus. The most popular by far. The free version schedules full backups and sends them to Google Drive, Dropbox, or Amazon S3, and restores with one click from the dashboard itself.
• Duplicator. Specialist in packaging the entire website into a single file, also very useful for migrations and cloning.
• All-in-One WP Migration. Extremely simple export and import; the free version limits import size, something to consider for large websites.
• Hosting's own backups. Many decent hostings make automatic daily server backups. They are an excellent complement, but don't delegate everything to them: check their frequency, how many days they are kept, and if you can restore them yourself without opening a ticket. If your provider doesn't even offer this, perhaps it's time to reconsider what hosting you need for WordPress.

Recommended configuration with UpdraftPlus

1. Install and activate the plugin from the official directory.
2. In Settings → UpdraftPlus Backups, go to the tab Settings.
3. Schedule files weekly and the database daily, keeping at least 4 copies of each.
4. Choose a remote storage (Google Drive is the most convenient) and authorize the connection.
5. Mark the inclusion of plugins, themes, uploads, and the rest of wp-content.
6. Save and launch a first manual backup with the button Back up now to verify that everything works.

Frequency and strategy: the 3-2-1 rule

How often should you back up? It depends on how much content you are willing to lose. The correct question is: if the website died right now, how much work would I lose since the last backup?

• Blog or corporate website that publishes weekly: weekly file backup and daily or weekly database backup.
• Web that publishes daily: full daily backup.
• Online store: daily backup of files and database every few hours if the volume of orders justifies it; every lost order is money and an angry customer.

Just as important as frequency is where you store your backups. Apply the classic 3-2-1 rule of system administrators: three copies of your data, on two different media, and at least one off-server. A copy saved on the same hosting as the website does not protect you from a server failure or a hack that deletes everything: if the ship sinks, it sinks with your life rafts inside. External storage (Google Drive, Dropbox, S3) is not optional, it is the essence of the system. And protect access to that storage with a strong password; if you need to generate one, here is our secure password generator free.

How to restore a backup

A WordPress backup you've never restored is a promise, not a guarantee. It's advisable to know the process before urgently needing it.

Restore with the plugin

If the website is still accessible, it's trivial: in UpdraftPlus, tab Existing backups, button Restore, you select which components to recover (files, database, or everything) and the plugin does the rest. In two minutes, the website returns to the state of the backup.

Restore manually

If the website is down and you cannot access the dashboard, the process is the reverse of a manual backup: you upload the files via SFTP overwriting existing ones, and in phpMyAdmin you empty the current database and import your file .sql from the tab Import. Then check that wp-config.php retains the correct server database credentials.

Verify after restoring

1. Navigate through the homepage, several posts, and key pages.
2. Log in to the dashboard and confirm that plugins and theme are active.
3. Test the contact form and, if it's a store, a test order.
4. Regenerate permalinks in Settings → Permalinks by pressing Save.

A good professional habit is to perform a restoration drill in a local or testing environment once or twice a year. Discovering that your backups were corrupted on the day you need them is a classic painful and avoidable scenario.

Backups and security: two sides of the same coin

Backup is your last line of defense, but it works much better accompanied by a decent first line. A particularly delicate case: if your website has been hacked, restoring a backup only works if the backup predates the infection; restoring an already infected backup returns the problem intact. That's why keeping several historical backups (not just the latest one) is so important, and why it's good to know detecting and cleaning your website after an attack before deciding which backup to restore.

Supplement your backup strategy with preventive measures: up-to-date updates, users with minimal permissions, and an application firewall. Our guide on tricks to strengthen your WordPress security covers the essentials in a few minutes. The better your prevention, the fewer times you'll have to rely on a backup; but when the time comes, a well-made WordPress backup will be what saves the project.

Common errors that invalidate your backups

• Saving copies only on the server itself. A disk failure or a hack takes down the website and the backups simultaneously.
• Not including the database. Copying only files leaves out all editorial content.
• Keeping a single copy. If the problem (an infection, corrupted data) predates the last backup, you have nowhere to go back to.
• Never testing restoration. Unverified backup, non-existent backup.
• Forgetting backups after a migration or hosting change. When moving the website, backup scheduling sometimes breaks or points to old credentials: always review it after major changes.
• Leaving downloadable copies in public folders. Some plugins save ZIP files in URL-accessible paths; anyone could download your entire website, credentials included. Always configure sending to external storage and purge local copies.

Frequently Asked Questions

How often should I back up WordPress?

At a minimum, with the same frequency that your content changes: weekly for quiet websites, daily for active blogs, and several times a day for online stores. The database usually needs more frequent backups than files, because it changes more often.

Are my hosting's automatic backups useful?

They serve as an extra layer, but not as the sole solution. You don't control their frequency or retention, and if the problem is with the hosting itself (serious failure, shutdown, suspended account), you could lose your website and your backups simultaneously. Always keep your own backups in external storage.

How much space does a WordPress backup take up?

The database usually takes up little space (from a few MB to a few tens). The bulk is the media from wp-content/uploads: a website with years of images can take up several GB. Plugins compress copies into ZIP files, which significantly reduces the size.

Can I back up my website if it's down?

Yes, and you should before trying to repair it. Even if the dashboard doesn't load, files are still accessible via SFTP and the database via phpMyAdmin from your hosting panel. This is exactly the scenario where the manual method proves its worth.

Conclusion

A solid WordPress backup strategy boils down to four decisions: backing up files and the database (never just one part), automating with a reliable plugin or your hosting, sending copies off-server while retaining several historical versions, and testing restoration before you need it. None of this requires advanced knowledge or a budget: free UpdraftPlus plus a Google Drive account more than cover most projects. The best investment you can make in your website today is not a premium plugin or a redesign: it's the twenty minutes it will take you to set up and verify automatic backups. Do it now; your future self, the one on disaster day, will thank you.