# How to back up WordPress (and restore it)

> How to back up WordPress with a plugin, from your hosting or with WP-CLI, where to store it, how to restore it and what to do if your backups are infected.

URL: https://webintacta.com/en/guides/wordpress-backup
Language: English (Spanish version: see the hreflang alternate of the HTML page)
Last updated: 2026-10-24

**In short:** A WordPress backup has to include both the files and the database, and a copy must be kept off the server (the 3-2-1 rule). You can make it with a plugin, from your hosting panel or with WP-CLI and mysqldump, and it only counts once you've tested restoring it. After a hack, recent backups may be infected: pick one from before the intrusion and close the way in before restoring.


By Jose Soriano (WebIntacta) · published 2026-10-24

Almost everyone believes they have backups of their WordPress site until the day they need them. Then they find out the plugin stopped working months ago, that the backups were on the same server that just went down, or that every one of them is from after the hack. This guide is so that doesn't happen to you.

## What it has to include

A WordPress site is two separate things, and the backup needs both:

- **The database:** posts, pages, comments, users, settings and, with WooCommerce, orders and customers. Without it there's no site.
- **The files:** above all `wp-content/` (plugins, themes and the `uploads` folder with every image and document), plus `wp-config.php` and `.htaccess`. The WordPress core can be downloaded again, but copying it costs nothing and saves doubts when you restore.

The WordPress documentation recommends backing up the database first and then the files, and keeping both parts together as a single set. A backup of only the files or only the database is half a backup.

> On a WooCommerce store, the database changes with every order. A daily backup means that if you restore, you may lose that day's orders. Keep it in mind when you choose the frequency.

## With a plugin

It's the easiest option if you don't have SSH access. The most widely used is **UpdraftPlus**, whose free version already lets you schedule backups, send them to external storage (Google Drive, Dropbox, Amazon S3 or compatible services, FTP and others) and restore them from the dashboard itself. The paid version adds incremental backups, multisite support, more destinations and more direct migrations.

How to set it up properly, whichever plugin you use:

1. **Schedule files and database separately.** The database daily (or more often on a store); the files daily or weekly depending on how much they change.
2. **Send it off the server.** Without a remote destination, the backup stays in `wp-content/` and is lost along with the server.
3. **Keep several.** At least two to four weeks of daily backups, plus an older monthly one if space allows. I explain why further down.
4. **Exclude what isn't needed:** caches and other plugins' backups, which inflate the size.
5. **Check that they arrive.** Log in to the destination (Drive, Dropbox…) and look at the date of the latest backup.

Other well-known options are Duplicator (designed mainly for migrations) or Jetpack VaultPress Backup (paid, with real-time backups). Pick just one: two backup plugins at the same time double the load on the server.

## From your hosting or cPanel

Many hosts take automatic backups of the whole server. They're fine as a safety net, but don't rely on them alone: you don't know how many days they keep, restoring sometimes costs extra and, if the problem is with the host, you lose the backups too.

In cPanel, the **Backup** section lets you download separately the home directory backup (all the files) and each MySQL database. If your host has JetBackup or its own tool, it's usually in the same panel. Download them to your computer or upload them to other storage: that takes care of the "off the server" part.

## Without a plugin: WP-CLI, mysqldump and zip

If you have SSH access, this is the fastest and most reliable way. With **WP-CLI**, which reads the credentials from `wp-config.php` automatically:

```
cd /path/to/your/wordpress
wp db export ../db-backup-$(date +%F).sql
tar -czf ../files-backup-$(date +%F).tar.gz --exclude=wp-content/cache .
```

Without WP-CLI, the database is exported with `mysqldump` (the details are in `wp-config.php`: `DB_NAME`, `DB_USER`, `DB_HOST`). The `--single-transaction` option avoids locking the tables while the backup runs:

```
mysqldump --single-transaction -h localhost -u USER -p DB_NAME > db-backup.sql
```

And if you don't have SSH: download the files by FTP or SFTP (with FileZilla or WinSCP) and export the database from **phpMyAdmin → Export**. It's slow on large sites, but it works.

> Never leave .sql or .zip files in a public folder of the site. A backup.sql file at the root can be downloaded by anyone who guesses the name, and it contains users and hashed passwords. The free scan checks for exactly this kind of exposed backup.

## Where to store it: the 3-2-1 rule

It's the classic rule and it still works:

- **3 copies** of the data (the live site counts as one).
- **2 different media** (for example, the plugin's storage and your computer or an external drive).
- **1 off-site**, away from the server and the hosting provider.

For a small site, in practice: automatic daily backups to cloud storage that isn't your host's, plus a full backup downloaded every so often (and always before a big change). Protect access to that storage with two-factor authentication: if someone gets in, they can delete the backups.

## How to restore

With a plugin like UpdraftPlus, you restore from its screen by picking the date and which parts to recover. If WordPress won't start, install a clean WordPress, the same plugin, and upload the backup to it. By hand, with WP-CLI:

```
# 1. Files: extract over the site's folder
tar -xzf files-backup-2026-10-01.tar.gz -C /path/to/your/wordpress

# 2. Database
wp db import db-backup-2026-10-01.sql

# 3. If the domain changes, replace the URL (dry run first)
wp search-replace 'https://old.com' 'https://new.com' --dry-run
```

Then check that `wp-config.php` has the right database details, clear the caches and test the site in a private window: home page, a post, the contact form and, if it's a store, a purchase.

And most important of all: **do a test restore before you need it**, on a subdomain or on your computer. A backup that has never been restored is an assumption. Doing it once every few months and noting how long it took is enough: when a real emergency comes, you'll know which steps to take and in what order.

## Infected backups after a hack

This is the case I run into most: the site is hacked and so are all the available backups, because the infection got in weeks ago and backups were only kept for seven days. That's why it matters to keep backups longer than seems necessary.

1. **Back up the site as it is**, infected, before touching anything. It's useful for the investigation and as a way back.
2. **Find out when they got in.** The modification dates of the suspicious files and the server logs help.
3. **Restore a backup from before that date**, if you have one. If not, the site has to be cleaned by hand.
4. **Fix the way in before reopening:** update the vulnerable plugin, change every password and regenerate the keys in `wp-config.php`. Restoring without doing this just leaves the door open again.
5. **Verify the restore** with `wp core verify-checksums` and `wp plugin verify-checksums --all`, which compare the files against the originals.

If you don't know how long it's been infected, I explain how to find out in the guide [how to tell if your WordPress site is hacked](https://webintacta.com/en/guides/how-to-tell-if-wordpress-is-hacked). And if you'd rather I did it, the [WordPress malware removal](https://webintacta.com/en/wordpress-malware-removal) costs €219 with a 90-day guarantee.

## If you'd rather not deal with it

The [WordPress maintenance](https://webintacta.com/en/wordpress-maintenance) plan (€35/month) includes a daily backup stored off your server and a backup before every update. Before you decide anything, the [free scan](https://webintacta.com/en/free-website-security-scan) tells you whether you have backups or configuration files exposed on the site.

## Sources

- [WordPress: backups (official documentation)](https://developer.wordpress.org/advanced-administration/security/backup/)
- [WP-CLI: wp db export](https://developer.wordpress.org/cli/commands/db/export/) and [wp db import](https://developer.wordpress.org/cli/commands/db/import/)
- [UpdraftPlus on WordPress.org](https://wordpress.org/plugins/updraftplus/)

## Frequently asked questions

### How do I make a full backup of WordPress?

By backing up the database and the files (above all wp-content, wp-config.php and .htaccess). With a plugin like UpdraftPlus, from your hosting panel or, with SSH, with wp db export and a compressed archive of the site's folder.

### How often should I back up WordPress?

On a site that rarely changes, daily or weekly. On a store, the database at least daily, because every order changes it. And always before an update or a big change.

### Is my host's backup enough?

It's fine as a safety net, but it isn't enough: you don't control how many days it keeps, restoring may cost extra and, if the problem is with the host, you lose the site and the backups at the same time. Always keep a copy somewhere else.

### How do I restore a WordPress backup?

With the same plugin that made it, picking the date. By hand, by uploading the files and then importing the database (wp db import or phpMyAdmin), and checking that wp-config.php has the right details.

### What do I do if all my backups are infected?

Don't restore blindly. Find out when the infection got in, look for an older backup and, if there isn't one, clean the site and fix the way in before reopening. Keeping backups for several weeks avoids this situation.

## About the author

[Jose Soriano](https://webintacta.com/en/about): Full-stack developer specialized in PrestaShop, WordPress and WooCommerce, who has passed the official PrestaShop course and exam. He has been building online stores and modules since 2023 and is the founder of WebIntacta, the website security service through which he scans, cleans and maintains small-business websites and online stores himself, remotely from Ibi (Alicante, Spain). WebIntacta facts: https://webintacta.com/en/about#datos