A WordPress backup consists of two things: your files (wp-content folder, including uploads, themes, and plugins) and your database (all your content, settings, and user data). You need both to restore a site. Here's how to back up both reliably, where to store the backups, and how to verify they'll actually work when you need them.
Files: The /wp-content/ folder contains your uploads (images, PDFs, videos), your active theme and child theme, and all installed plugins. This is the content that's unique to your site and can't be redownloaded. WordPress core files (wp-admin and wp-includes) can be redownloaded from wordpress.org, so they're lower priority, but backing up the entire installation is simpler and leaves nothing to chance.
Database: The MySQL database contains all your posts, pages, comments, settings, user accounts, widget configurations, and plugin data. Without this, you have no content. The database is typically exported as a .sql file from phpMyAdmin or via WP-CLI. It's usually much smaller than the files backup, often just a few megabytes, so it's easy to back up frequently.
Don't confuse "backup" with "sync." A synced copy that mirrors your live site in real time also mirrors an infection or accidental deletion in real time. You need point-in-time snapshots with a retention window long enough to catch problems you didn't notice immediately.
The most reliable and lowest-friction option. Your host takes daily snapshots of your files and database automatically, at the server level, without any plugin overhead. Good hosts provide one-click restore from the hosting control panel without requiring a support ticket. This removes the dependency on remembering to run a backup manually.
Before relying on host-level backups, verify three things: how many days of backups are retained (7 is a minimum, 30 is better), whether restore is self-service or requires a ticket, and whether the backups are stored off the primary server. A backup stored on the same physical hardware as your site is only useful for software-level problems, not hardware failures. Ask your host explicitly where backup copies are stored.
If your host charges extra for backups or doesn't include them at all, this should factor into your hosting choice. Backups are not an optional add-on, they're infrastructure.
UpdraftPlus is the most widely installed WordPress backup plugin. The free version handles the core use case well: scheduled backups sent to remote storage. Setup steps:
Storing backups on the same server you're backing up defeats the purpose. If the server fails, the backup fails with it. Always configure a remote destination. The free version supports Google Drive, Dropbox, Amazon S3, Rackspace, FTP, and email, there is no reason not to use one of them.
UpdraftPlus Premium adds incremental backups (faster, uses less bandwidth), multisite support, automatic backup before updates, and additional remote destinations. For most single-site installations, the free tier is sufficient.
Manual backups require more effort but produce the most predictable, self-contained result. They're also useful as a one-off pre-migration backup or before a major update.
Files: Connect via FTP (FileZilla is free and works well). Navigate to your public_html or www root directory. Download the entire wp-content folder to your local computer. For a full backup, download the entire WordPress installation directory. Be aware that large sites with extensive media libraries can take significant time to transfer.
Database: Log into phpMyAdmin (accessible from cPanel > Databases). Select your WordPress database from the left panel. Click the Export tab. Choose Quick export format and select SQL. Click Export and save the .sql file to your computer. For large databases (>50MB), use the Custom export option and enable compression (gzip).
Label your manual backups with the date and what was happening (e.g., backup-2025-11-05-pre-woocommerce-update). Store them somewhere you'll find them, not buried in Downloads.
If you have SSH access to your server, WP-CLI is the fastest and most scriptable way to manage backups. Export the database with: wp db export backup-$(date +%F).sql. This creates a timestamped SQL file in the current directory. Combine it with a tar command to archive wp-content, and you have a complete backup in two commands that can be scripted into a cron job.
WP-CLI backup scripts can push directly to S3 via the AWS CLI or to any remote destination over rsync or SCP. For developers managing multiple WordPress sites, this approach scales better than plugin-per-site management.
Keep 3 copies of your data, on 2 different storage types, with 1 copy off-site. For a typical WordPress site: host-level backups (copy 1, on-server or host infrastructure), UpdraftPlus sending to Google Drive (copy 2, off-server cloud), and a periodic manual download to your local computer (copy 3, on a separate device). This means a server-level disaster, a host account issue, or a Google account problem doesn't take all copies with it simultaneously.
A backup you've never tested is a backup of unknown value. Plugins silently fail, cloud authorisation tokens expire, file permission issues prevent archives from completing. The only way to know your backup actually works is to restore it and confirm you get a functional site.
Set up a staging or local environment (Local by Flywheel is free for local testing). Restore your most recent UpdraftPlus backup to it: go to UpdraftPlus > Existing Backups, click Restore on the latest backup, and walk through the process. Confirm the restored site loads correctly with all content and settings intact. Do this once when you first set up backups, and again after any major change to your backup configuration.
After a restore test, verify that incremental changes made after the backup date are indeed absent in the restored version, this confirms you're restoring the correct snapshot, not a cached or stale version.
HostBible takes daily automated backups of your files and database with offsite storage. One-click restore from the control panel, no support ticket required.
View Hosting Plans