WordPress ·
How to Back Up a WordPress Site and Test It
By Manu Mathew, Technical Lead Engineer · Published 3 November 2026 · Last updated 3 November 2026
Most site owners know they should back up a WordPress site. Many have a plugin or a hosting setting that says backups are running, and they leave it there.
The trouble usually shows up on a bad day: an update breaks the site, or it gets hacked, and the backup turns out to be missing the database, stored on the same server, or months old. A backup only counts if you can restore it.
Quick answer
To back up a WordPress site properly, save both the files and the database together, on a schedule that matches how often the site changes. Keep several recent copies in more than one place, away from the web server. Then restore one to a test copy now and then, so you know it works before you need it.
What should a WordPress backup include?
A complete WordPress backup has two parts, the files and the database, and you need both to restore a typical site.
The official WordPress backup guide explains that downloading the site’s folder doesn’t copy the database, because the database lives in a separate system.
| Part | What it holds |
|---|---|
| Database | Posts, pages, comments, settings, users and orders |
| Uploads folder | Images, PDFs and other media you’ve added |
| Themes and plugins | The design and features of the site |
| wp-config.php | Database connection details and key settings |
| .htaccess and other files | Redirects, rules and any custom files |
WordPress core itself can be downloaded again, but it does no harm to include it. Treat the files and the database from the same moment as one set, so they match when you restore them.
How often should you back up a WordPress site?
Back up as often as you’d hate to lose the changes, and always before an update.
The WordPress guide suggests weekly backups for smaller sites with few changes, and daily backups for busier sites. In practice:
- A brochure site that changes rarely: weekly is usually enough, plus a backup before any change.
- A site with a blog, bookings or enquiries: daily, so you never lose more than a day of content.
- A shop taking orders: at least daily, and more often if orders come in all day. Orders placed after the last backup are lost if you restore.
- Before updates, plugin changes or a redesign: always take a fresh backup first, whatever the schedule.
Where should you keep WordPress backups?
Keep backups in more than one place, and at least one copy away from your hosting account.
A backup stored only on the same server as the site can disappear with it. If the server fails, the account is suspended, or someone gets into it, those copies may be gone or tampered with.
The WordPress guide recommends keeping at least three to five recent backups in different locations, such as one with your host, one in cloud storage and one on your own computer. A few points help:
- Keep older copies too. If a problem went unnoticed for a week, yesterday’s backup may already include it.
- Make sure you own the storage. The cloud account holding your backups should be in your business’s name, not only a developer’s.
- Protect the files. Backups contain customer details and your database password, so store them somewhere private and, ideally, encrypted.
Are host backups or a plugin enough?
Host backups are a good safety net, but it’s wise to have a copy you control as well.
Many hosts back up their servers, which helps. But you may not know how long copies are kept, how quickly you can get one, or whether it covers a single file or only the whole account. The WordPress guide notes that getting a copy from a host’s backups can take time, when a quick recovery is what you need.
A backup plugin, or a backup set up on the server, can send copies to storage you own on a schedule. Whichever you use, check three things: that it includes the database, that it runs on its own without you remembering, and that it tells you when a backup fails.
How do you test that a WordPress backup works?
Restore it to a separate test copy of the site and check that everything is there.
A test restore is the step most people skip, and it’s the one that matters. The WordPress guide itself recommends checking automatic backups now and then to be sure the process is working. A simple routine:
- Pick a recent backup from your off-site storage, not the copy on the server.
- Restore it somewhere safe, such as a staging site or a test copy on a temporary address, never over the live site.
- Restore the files first, then the database, which is the order the WordPress guide suggests.
- Check the pages that matter: the home page, contact form, any shop or booking pages, and the dashboard login.
- Look for recent content, such as your latest post or order, to confirm the backup is as new as you think.
- Note how long it took and anything that went wrong, so a real restore goes faster.
Doing this every few months, and after changing hosts or backup tools, is a reasonable habit for most small business sites.
How do I set up backups for a client’s site?
I agree the backup plan with the owner in writing, set it up, and then prove it works with a test restore.
My usual steps:
- Ask how much the business can afford to lose, such as a day of orders or a week of blog posts, and set the schedule from that.
- Choose where copies go, with at least one off-site location the owner controls.
- Write down the trade-offs, such as more frequent backups using more storage, so the owner can decide.
- Run a first test restore on a staging copy and share what I checked.
- Leave a short restore note covering where the backups are, who has access and the steps to bring the site back.
Backup checks are also part of my monthly WordPress care checklist.
Frequently asked questions
Does my hosting company back up my WordPress site?
Many hosts do, but the details vary. Check how often they back up, how long copies are kept, how you request a restore and whether it costs anything. Even with host backups, keeping your own off-site copy means you aren’t depending on a single company if something goes wrong.
How many WordPress backups should I keep?
The WordPress documentation suggests keeping at least three to five recent backups, stored in different places. Keeping a few older copies as well helps if a problem, such as malware or a broken page, went unnoticed for a while and has already reached the newest backups.
Can I back up a WordPress site without a plugin?
Yes. You can copy the files over SFTP or your hosting file manager and export the database with a tool such as phpMyAdmin. It takes more effort and is easy to forget, so most owners use a plugin or a scheduled server backup.
Should I back up before updating WordPress or plugins?
Yes. Take a fresh backup of the files and database before any update. Most updates go smoothly, but if one breaks the site, a recent backup lets you return to a working version quickly instead of fixing things under pressure.
How long does it take to restore a WordPress site?
It depends on the size of the site, where the backup is stored and how it was made. A small site can come back fairly quickly, while a large shop takes longer. A test restore tells you roughly how long your own site needs.
Want a hand checking your backups?
Whether you’d like your backups set up properly or just checked with a test restore, I’m happy to talk it through. The WordPress websites page covers the kinds of work I take on.
You can reach me through the contact section or email me at manu@manu.co.in. Tell me a little about your business and the site, and we’ll go from there.