Learn how to back up WordPress: what a complete backup contains, host, plugin and manual methods, where to store copies, how often to run them for blogs and stores, and how to restore and test.
To back up WordPress, save two things together: the database, which holds your posts, settings and, with WooCommerce, orders and customers, and the files, which hold your themes, plugins, uploads and wp-config.php. Keep the copies away from the server that runs the site, and prove they work by restoring one to a test copy.
In short
A backup is a copy that is complete, stored away from the site and proven to restore. Complete means database and files: WordPress's backup guide says a full restore needs both, and copying files does not copy the database. Away from the site means it survives a failed server, a suspended account or an attacker who deletes what your login can reach. Proven means you have restored it once.
Common near-misses are a copy on the same server, one copy overwritten each time and a copy nobody has tried to restore. WordPress's temporary copy made while a plugin or theme updates is not a backup: it is deleted after a successful update.
| Part | What it holds |
|---|---|
| Database | Posts, pages, comments, settings, users and, with WooCommerce, products, orders and customers |
wp-content/uploads | Media, plus WooCommerce's downloadable product files in woocommerce_uploads |
wp-content/themes, wp-content/plugins | Your theme and plugins, including premium code and your own edits |
wp-config.php | Database connection details and secret keys. It may sit one folder above WordPress, so check where yours is |
.htaccess | Server rules on Apache-style hosts. Many SFTP programs hide it |
WordPress core can be downloaded again from wordpress.org, so you could skip it, but copying the whole folder is simpler and records your version.
WordPress's guide notes that hosts often back up whole servers, but that restoring from them can take time. Ask in writing what is included, how long copies are kept, whether they sit in the same data centre, whether you can download one and what a restore costs.
The WordPress.org directory has a backup tag. These three pages say plainly what the plugin does, as of October 2026. They are alphabetical, not ranked, and others exist:
Whichever you pick, check what it covers, where copies go, how a restore works when the site is down and what is paid.
Do this before a risky change, or as a second copy. With SSH access and WP-CLI, run this in the site's folder (it needs mysqldump on the server):
mkdir -p ~/backups
wp db export ~/backups/shop-2026-10-21.sqlName the file yourself: otherwise WP-CLI invents a name (reference). Without a shell, use phpMyAdmin: select the database, open Export, keep Quick and SQL, and click Go. WordPress's database guide warns that it can fail on large databases.
For files, download the whole WordPress folder with an SFTP client, including the hidden .htaccess and any wp-config.php above it. Zip it with the date in the name and keep several versions, as the files guide suggests. Never leave a .sql file in a public web folder: anyone who guesses its name could download it.
WordPress's guide suggests at least three to five recent copies in different places, such as the host, cloud storage and your own computer. Our suggestions:
wp-config.php. The hardening guide suggests encrypting backups. Keep the key apart from the copy, and lock the storage account with two-factor login.Ask how much work you could afford to redo. WordPress's handbook suggests weekly backups for smaller sites, daily for busy ones and one before every upgrade or move; our security checklist has the routine in a table.
| Site | Starting point (our suggestion) |
|---|---|
| Blog or brochure site | Daily or weekly, by how much you would redo; the database more often than the files |
| Online store | Database at least daily, more often with many orders; files after any theme or plugin change |
A restore sends a store back in time: orders placed after the backup vanish from the site, though the payment provider and your emails still record them, which is why some services offer real-time backups. Always add a copy before updates, imports, theme or plugin changes, PHP changes and moves.
Keep several generations, because some problems surface late: a hack, a bad import, a plugin writing wrong prices. Example, not a rule: a few daily copies, a few weekly, a couple of monthly. Old copies hold old personal data, so give them a maximum age.
Real restores are urgent, so rehearse once (next heading). The steps:
wp-config.php, the database name, user, password, host and table prefix must match.wp db import ~/backups/shop-2026-10-21.sql or mysql -h HOST -u USER -p DATABASE < shop-2026-10-21.sql.wp search-replace (example below). It handles serialised data, and --dry-run previews the change (documentation).Example for step 5 (preview first, then run again without --dry-run):
wp search-replace 'https://example.com' 'https://staging.example.com' --skip-columns=guid --dry-runWooCommerce's documentation describes staging as a copy made by your host or by restoring a backup to a separate WordPress installation. Restore the copy you would really use, from offsite storage, and fix the URLs. Keep it private with a password and Settings > Reading > Discourage search engines. Use the payment provider's test mode and stop outgoing mail, so the copy sends no real emails or charges. Run the step 6 checks and time the job: that is your real recovery time.
Orders and customers live in the database: in dedicated tables with High-Performance Order Storage (HPOS), in the posts tables without it (HPOS explained). Back up before updating WooCommerce, especially before Update WooCommerce Database (WooCommerce's guide, safe updates), before a bulk import (import and export) and before changing a payment, shipping or tax plugin or the theme.
A backup copies personal data. WordPress's documentation says the Erase Personal Data tool does not remove data from backups, and that when you restore an archived copy, erasure requests should be respected. Our suggestion: keep a dated log and re-apply requests made since the backup. WooCommerce's retention settings (WooCommerce > Settings > Accounts & Privacy) act on the live store only, so old copies age out when you delete them. Which privacy rules apply to your copies, such as Saudi Arabia's Personal Data Protection Law, is a question for a lawyer. This is not legal advice.
| Item | Done when |
|---|---|
| Scope | The copy holds the database, wp-content, wp-config.php and .htaccess |
| Schedule | The interval matches what you could redo, plus a copy before each change |
| Offsite | One encrypted copy sits at another provider |
| Retention | Several generations, each with a maximum age |
| Tested | A restore to staging worked and you timed it |
It is a useful layer, not a plan. Coverage, retention and restore speed vary, so keep one copy of your own, stored elsewhere.
No. WordPress's documentation points to plugins and host tools for backups.
Tools > Site Health > Info > Directories and Sizes shows the size of the database and the main folders.
Yes, if your tool keeps the parts separately. But database and files depend on each other, so restore matching pairs unless you know exactly what changed.
Put backups and a restore test on your calendar with the WordPress maintenance checklist. Changing hosts? Read how to move a WordPress site to a new host. You can also browse WordPress plugins on DevMarket.
Fix the WordPress critical error and white screen of death calmly: back up, read the logs, find the cause by elimination, then handle database, 500, memory, maintenance mode, 404 and login errors.
9 min read
Choose a WordPress theme by testing, not by demo. Compare block and classic themes, sources, speed, accessibility, RTL support, WooCommerce, builder lock-in and licence terms on a staging copy.
9 min read
Use this WordPress maintenance checklist to plan weekly, monthly and yearly tasks: updates, backups, users, plugins, security, speed, PHP, domain and SSL, plus Site Health and WooCommerce checks.
9 min read
Every item on DevMarket has a human-reviewed release, an instant licence key and clear update and support terms.