If you run a WordPress site without automated backups, you are not managing a website — you are managing a liability. Everything on your site, from the content you have spent months creating to the plugin configurations you have carefully tuned, exists in two places: on your server and nowhere else. A hosting failure, a failed update, a malware infection, or a simple mistake can wipe all of it. The cost of learning to properly backup WordPress site data before an incident is an hour of setup. The cost of not doing it after an incident is measured in recovered content, rebuilt configurations, and in some cases sites that are never fully restored. I have helped site owners recover from disasters with and without backups, and the gap in recovery experience is not subtle. This guide covers how to backup WordPress site files and database correctly — what a complete backup includes, the tools that automate the process reliably, and the practices that ensure your backups are actually usable when you need them. We go deeper on the whole subject in our Complete Guide to WordPress How.
What a Complete WordPress Site Backup Actually Includes
A common misunderstanding about how to backup WordPress site data is that backing up the database alone is sufficient. It is not. A complete backup WordPress site operation requires two separate components that together represent your entire site:
- The database: Contains all your posts, pages, comments, settings, user accounts, and plugin/theme option values — everything that makes your site’s content and configuration unique. Without the database, a WordPress install is empty. The database is typically a single
.sqlfile when exported. - The files: The WordPress core files (wp-admin, wp-includes), your themes (wp-content/themes), your plugins (wp-content/plugins), and most critically, your uploads (wp-content/uploads). The uploads directory contains every image, document, and media file ever uploaded to the site — this data exists only on your server and cannot be regenerated from WordPress.org.
To backup WordPress site completely, you need both components. A database backup without file backup means restoring content structure but losing every media file. A file backup without database backup means restoring the themes and plugins but losing all posts, pages, and settings. Many site owners discover this gap only when they attempt a restoration and realise their “backup” is incomplete.
Within the files component, the wp-content/uploads/ directory deserves special attention. Unlike themes and plugins — which can be re-downloaded from their original sources — the uploads directory contains files that exist only on your server. If you lose the uploads directory without a backup, every image on every post and page is broken, every downloadable document is gone, and there is typically no way to recover them from any external source. When you backup WordPress site data, the uploads directory is the irreplaceable component that makes file backup non-optional.
Automated WordPress Site Backup With UpdraftPlus
UpdraftPlus is the most widely used WordPress backup plugin with over 3 million active installations, and it is the tool I recommend for automated backup WordPress site operations on any hosting environment. The free version covers complete scheduled backups with remote storage to Google Drive, Dropbox, Amazon S3, and email — more than sufficient for most site backup needs without any cost.
- Install UpdraftPlus from the WordPress Plugin Directory — go to Plugins → Add New, search “UpdraftPlus,” install, and activate
- Navigate to Settings → UpdraftPlus Backups to access the plugin’s configuration
- Click the Settings tab within UpdraftPlus. Set the Files backup schedule — the frequency at which the plugin will backup WordPress site files automatically. For most sites, Weekly is appropriate; for actively changing sites with frequent content uploads, Daily is better
- Set the Database backup schedule separately — database backups are faster and smaller than file backups and can run more frequently. Daily database backups are recommended for any site with regular content updates
- Set the number of backup copies to retain — 3 to 5 is appropriate for most sites, giving you multiple recovery points without consuming excessive storage
- Configure remote storage: click the storage service you use (Google Drive is the most straightforward to configure), follow the authentication flow to connect your account, and specify a folder name for backup storage. This is the most critical step — a backup WordPress site stored only on the same server it came from is not a backup, it is a copy that disappears in the same hosting incident you are trying to protect against
- Click Save Changes, then click Backup Now to run an immediate manual backup and confirm the plugin can successfully backup WordPress site data and transfer it to your remote storage
- After the backup completes, verify it in your remote storage location — open Google Drive, Dropbox, or S3 and confirm the backup files are present. A backup you have not verified is a backup you cannot trust
UpdraftPlus scheduled backups run through WP-Cron — WordPress’s pseudo-cron system. On very low-traffic sites where WP-Cron is unreliable, scheduled backups may be missed. The fix is setting up a real server cron job as covered in our WordPress missed schedule guide, or using the hosting provider’s scheduled task feature to trigger the UpdraftPlus backup directly via WP-CLI or the backup URL that UpdraftPlus provides.
Manual WordPress Site Backup via cPanel and FTP
When a plugin-based automated solution is not available — on a hosting plan without plugin support, on a WordPress site that is not currently accessible, or as a supplementary manual backup before a major update — the manual approach to backup WordPress site data remains the definitive method. It requires no plugin and relies only on tools that are universally available: cPanel (or your hosting control panel) and FTP.
To backup WordPress site database manually: log in to cPanel and open phpMyAdmin. Select your WordPress database from the left sidebar — the one named in wp-config.php as DB_NAME. Click the Export tab. Choose Quick export method and SQL format. Click Go. phpMyAdmin exports the entire database as a .sql file and downloads it to your computer. This file contains all your posts, settings, and configuration as SQL insert statements — it is the complete database portion of your backup WordPress site operation.
To backup WordPress site files manually: connect via FTP using FileZilla or equivalent. Navigate to the WordPress root directory. Download the following directories and files to your local computer: the wp-content folder (which includes uploads, themes, and plugins), and the wp-config.php file. You do not need to download wp-admin or wp-includes — these are WordPress core files that can always be re-downloaded from wordpress.org at the correct version. The unique files that require backup are in wp-content and wp-config.php specifically.
How Often to Backup Your WordPress Site
The right backup frequency for a backup WordPress site schedule is determined by the answer to one question: how much data can you afford to lose? The maximum acceptable data loss determines the minimum backup frequency. If losing a week of posts and customer orders is catastrophic, daily backups are the minimum viable schedule. If losing a day of changes is acceptable, weekly backups may be sufficient.
| Site Type | Database Backup Frequency | Files Backup Frequency |
|---|---|---|
| Static brochure site (rarely updated) | Weekly | After each content update only |
| Active blog (new posts several times weekly) | Daily | Weekly |
| WooCommerce store (orders, inventory updates) | Hourly or real-time | Daily |
| Membership site (user registrations, purchases) | Daily minimum | Daily |
| News or high-volume content site | Multiple times daily | Daily |
WooCommerce sites deserve special consideration in the backup WordPress site schedule because order data is created continuously during business hours. A daily database backup means that in the worst case — a site failure at 11:59pm — you lose an entire day of orders with no recovery path. For any site where financial transactions are recorded in the database, a more frequent backup schedule — every four to six hours, or transaction-log-based backups if the hosting plan supports them — reduces the maximum potential data loss to an acceptable window.
Where to Store Your WordPress Site Backups
The location of backup storage is as important as the backup itself when you backup WordPress site data. The fundamental rule: backups must exist in at least one location that is independent of the server the site runs on. A backup stored only on the same server is not protected against the most common disaster scenarios — the server failing, being compromised, or the hosting account being suspended. The backup fails at exactly the same time as the site it is supposed to protect.
The recommended storage locations for a reliable backup WordPress site strategy are cloud storage services — Google Drive, Dropbox, Amazon S3, Backblaze B2 — that are accessible from any location independent of the hosting server. Google Drive is the most accessible option for most site owners: 15GB free storage, easy UpdraftPlus integration, and browser-accessible for restoring without any desktop software. For sites with large media libraries where backup files are very large, Backblaze B2 offers substantially cheaper storage than Google Drive or Amazon S3 for high-volume backup needs.
Remote email backup — where UpdraftPlus sends the backup files as email attachments — is suitable only for very small sites where the combined backup file fits within email size limits. For most sites, cloud storage is the only practical remote backup destination for a backup WordPress site operation. Consider maintaining two separate remote storage locations for critical sites — a primary backup in Google Drive and a secondary in Dropbox, for example — so that a problem with one cloud service does not eliminate all off-site copies.
Testing WordPress Site Backups — The Step Most People Skip
Creating backups is necessary but not sufficient — a backup that cannot be restored is not a backup, it is a false sense of security. Testing the restoration process is the final step that validates the entire backup WordPress site setup, and it is the step that most site owners skip because it seems unnecessary until the moment they need it. I have seen sites where the automated backup ran faithfully for months but the UpdraftPlus remote storage authentication had silently expired — the backups were not being transferred, only the local copies remained, and those copies were on the same server that subsequently failed.
Test your backup WordPress site restoration process at least twice per year on a staging environment. In UpdraftPlus, this means: install UpdraftPlus on a staging site, configure it to connect to the same remote storage location as the live site’s backups, use the Existing Backups tab to retrieve a backup, and run a test restoration. Confirm that the restored staging site is fully functional — posts are present, media loads, plugins are active, settings are correct. A successful test restoration confirms that the backup files are complete, accessible, and restorable.
Our guide on how to restore a WordPress website from backup covers the full restoration process — the complementary procedure to the backup process covered here. Our guide on how to create a staging site in WordPress covers setting up the test environment where backup restoration tests can be performed safely without affecting the live site. The UpdraftPlus support documentation covers remote storage configuration for every supported provider, backup scheduling options, and the restoration process in detail — the most comprehensive resource for the plugin used in the automated backup WordPress site workflow in this guide.
