A WordPress backup is only valuable if it is complete, recent, and restorable. Many site owners think they are backed up because their host takes daily snapshots, only to discover those snapshots are incomplete or that the host cannot restore from them quickly enough. This guide covers what a complete backup includes, how to do it manually, and how to automate it reliably.
What a Complete WordPress Backup Includes
A WordPress site has two parts: the files and the database. You need both to restore a working site. Missing either one means an incomplete restore.
Files to back up:
wp-content/uploads/– all uploaded images and files. This is the most important folder and often the largest.wp-content/plugins/– your installed pluginswp-content/themes/– your installed themes including child themeswp-config.php– your database credentials and WordPress configuration.htaccess– server configuration rules
Database to back up: all WordPress database tables. The database contains your posts, pages, comments, users, settings, and most plugin configuration data. Without the database, the files alone cannot restore a working site.
Method 1: Manual Backup via phpMyAdmin and FTP
Database backup: Log into your hosting control panel and open phpMyAdmin. Select your WordPress database in the left sidebar. Click Export -> Quick export -> Go. This downloads a .sql file containing all your database tables. Save it somewhere safe.
Files backup: Connect to your server via FTP (FileZilla is a free FTP client). Navigate to your WordPress root directory. Download wp-content/ to your computer. Also download wp-config.php and .htaccess from the root. You can skip wp-admin/ and wp-includes/ – these are WordPress core files that can be re-downloaded; your custom content is in wp-content/.
Need help optimising your WordPress site? Describe your project and get a free estimate.
Method 2: Plugin Backup With UpdraftPlus
UpdraftPlus is the most popular WordPress backup plugin with over 3 million active installs. The free version covers most backup needs: scheduled automatic backups of files and database, storage to Dropbox, Google Drive, Amazon S3, FTP, or email, and one-click restore from the WordPress admin.
Install UpdraftPlus and go to Settings -> UpdraftPlus Backups. Configure:
- Backup schedule – files: weekly, database: daily (databases change more often than files)
- Remote storage – connect to Dropbox, Google Drive, or another storage location. Do not store backups only on your hosting server – if the server fails, you lose both the site and the backup.
- Retain – keep 3-5 backup sets (delete older ones automatically)
Click Backup Now to run an immediate backup and verify it completes successfully and uploads to your remote storage.
Method 3: Hosting-Level Backup
Many managed WordPress hosts (Kinsta, WP Engine, Cloudways) take automatic daily backups stored separately from your hosting account. These are the most reliable backups because they are managed at the infrastructure level, not dependent on a plugin working correctly. Supplement with a plugin backup to an external location for redundancy.
Testing Your Backup
A backup you have never tested is not a backup – it is a hope. Test your backup restore process on a staging environment at least once. With UpdraftPlus, install it on a fresh WordPress installation, point it to your backup storage, and run a restore. Verify the site works after restore. This test reveals restore problems before you need the backup in an emergency.
Backup Before Every Major Change
Beyond scheduled backups, take a manual backup before: updating WordPress core, bulk-updating plugins, making significant code changes, migrating to new hosting, or making database changes. UpdraftPlus’s “Backup Now” button makes this a 30-second task. The scheduled backup may not have run recently, so a manual pre-change backup ensures you can roll back exactly to the pre-change state.
Protecting Your Backup Files
If you store backups on the same server (even temporarily), prevent them from being publicly accessible. A backup zip file in public_html is downloadable by anyone who knows the URL. Add to .htaccess to block direct access to zip and sql files:
<FilesMatch ".(zip|gz|sql|tar)$">
Order allow,deny
Deny from all
</FilesMatch>Better practice: configure UpdraftPlus to send backups directly to remote storage (Dropbox, Google Drive, S3) without leaving a copy on the server. In UpdraftPlus settings, enable “Delete local backup after sending to remote storage” to ensure backup archives do not accumulate on the server.