How to Back Up Your Website (Before You Need the Backup)
CodexFuse Team · 2026-10-26T15:59:15.482Z · 10 min read
A complete website backup means files plus database, stored offsite, and proven by a restore test. The 3-2-1 rule, the method picker, and the schedule that fits your site.
Learning how to back up a website is one of those jobs that feels optional until the day it is not. A plugin update goes wrong, a host has a bad day, or a hacked file wipes your homepage — and suddenly the only question that matters is whether you have a copy you can restore. This guide gives you a complete backup system: what a real backup includes, the 3-2-1 rule for storing it, the method that fits your site, and the restore test that proves the whole thing works. The steps below use a free WordPress plugin, but the same rules apply to any site — only the buttons change.
If you are on managed WordPress hosting, your host already keeps automatic backups. That is a good start, but it is only one layer. A backup that lives inside the same hosting account can disappear along with the site, which is why this guide builds you a second, independent copy too.
What does a complete website backup include?
A complete backup includes two things: your website files and your database. Miss either one and you cannot rebuild the site. Your files hold your themes, plugins, uploaded images, and documents. Your database holds your posts, pages, users, settings, and comments. A database export alone has no media, themes, or plugins, and a copy of your files alone has no posts, users, or settings.
| Part of the backup | What lives there | What happens if you skip it |
|---|---|---|
| Website files | WordPress core, themes, plugins, uploads, documents | You lose your design, media library, and plugin setup |
| Database | Posts, pages, users, settings, comments, orders | You lose your content, accounts, and configuration |
| Both together | The whole site, as it was at backup time | A full restore is possible |
How to back up a website in 5 steps
Backing up a website means making a complete, recent, reachable copy — files plus database — and proving it restores. These five steps work for WordPress and for any other site; only the tool names change.
- Choose your method. A backup plugin is easiest for WordPress; your host's backup tool or a manual export works for everything else.
- Include files AND database. Check the backup set lists both before you call it complete.
- Send one copy offsite. Google Drive, Dropbox, or Amazon S3 — somewhere outside your hosting account.
- Put it on a schedule. Match the frequency to how often your site changes, and keep several recent restore points.
- Test a full restore. Restore the whole set on a staging copy and check the site actually works.
The website backup 3-2-1 rule, explained
The 3-2-1 rule is simple: keep at least three copies of your data, stored in two different locations, with one copy offsite. It exists because one copy is one accident away from being no copy at all. TeamUpdraft's backup guide states the rule exactly this way, and it is the standard every other part of this guide is built around.
Here is what 3-2-1 looks like for a typical small site. Copy one is your host's automatic backup, the fast rollback you reach from your hosting dashboard. Copy two is a scheduled plugin backup sent to Google Drive or Dropbox, independent of the hosting account. Copy three is a monthly download kept on an external drive or a second cloud account. If the host goes down, copy two still exists. If the cloud account has a problem, copy three still exists. No single failure takes your site with it.
Host backups vs plugin backups vs manual backups
You do not have to pick one method forever. The strongest beginner setup uses two automatic methods and keeps the manual option for special situations. Host backups give you fast whole-site rollback, but the copy usually shares the hosting account. A plugin backup sent offsite gives you a copy you control even when the hosting account itself is unavailable.
| Method | Best for | Automatic schedule | Independent copy | Main risk |
|---|---|---|---|---|
| Backup plugin (e.g. UpdraftPlus) | Most WordPress sites | Yes | Yes, with remote storage | Setup or storage connection can be wrong |
| Host backup | Fast whole-site rollback | Usually | Not by itself | Copy may share the hosting account |
| Managed backup service | Busy stores and memberships | Yes | Usually | Ongoing subscription cost |
| Manual export | Pre-change copy or emergency access | No | Yes, if downloaded elsewhere | Easy to forget or miss a component |
Keep your host's backups as one layer and add a plugin backup as the second. Either method can fail on its own, and the two together cover each other's weak spots. If repeated backup failures come from storage limits, timeouts, or an unreliable host, compare the providers in our best cheap web hosting guide — but know that better hosting does not replace your independent backup.
How to back up a WordPress site with a free plugin
A WordPress backup plugin is the easiest way to get a complete, scheduled, offsite backup without touching your server. The free version of UpdraftPlus does the whole job for a typical blog, portfolio, or small-business site: it backs up files and database, schedules the runs, and sends them to remote storage.
Install UpdraftPlus from the WordPress plugin directory, then open Settings, then UpdraftPlus Backups, then the Settings tab. Choose a remote destination that is separate from your hosting account — Google Drive or Dropbox is an easy place to start — and complete its authorization steps. After saving, confirm the plugin reports a successful connection; selecting a storage provider is not enough, the connection has to authorize, save, and receive a real backup.
Set the files and database schedules to match how often your site changes. The database may change more often than the files, so it can run more frequently on an active site. Then click Backup Now, keep both the database and files selected, and wait for the job to finish. When it is done, open the remote storage account and confirm the files actually arrived there. That check is part of the backup, not an optional extra.
How often should I back up my website?
Choose the schedule based on how much recent work you could afford to lose. A weekly backup is not enough for a store that takes orders every hour, but it may be fine for a brochure site that changes once a month. TeamUpdraft's guide puts it the same way: daily backups for sites that change regularly, weekly for less active sites, and always a fresh backup before any major change.
| Website type | Practical starting schedule | What you could lose |
|---|---|---|
| Mostly static business or portfolio site | Weekly full backup, plus one before every major change | Recent edits, form setup, or uploads |
| Active blog | Daily database and weekly files, or a daily full backup | New posts, comments, settings, and media |
| Store, membership, or course site | Daily at minimum; real-time or incremental when activity is frequent | Orders, accounts, access changes, and customer activity |
How to test a restore (the step everyone skips)
A backup you have never test-restored is a hope, not a backup. A green "backup complete" message only says the files were copied; it does not say your particular site will come back cleanly. The safest place to test is a staging site or another non-public copy.
Restore the full set there, then check the homepage, a post, the login screen, images, menus, forms, and any store or membership functions. If everything works, you have proven the backup. If something is missing, you have found the gap while the live site is still fine — which is exactly when you want to find it. Repeat the test after any big change to your backup setup, and whenever you switch storage destinations.
Back up before you update, migrate, or change themes
Make a restore point before risky work. Run a manual files-and-database backup before updating WordPress, changing themes, installing a major plugin, editing code, or moving the site. Keep more than one recent restore point, because if malware or a bad edit sits unnoticed for several days, the newest backup may already contain the problem.
That is also why the newest backup is not always the right restore point. When something breaks, choose a restore point from before the problem started, not automatically the latest one. A backup taken after the damage is just a copy of the damage.
How to restore a website from backup
Restoring normally replaces current data with the state from the backup, so posts, orders, comments, uploads, and other changes made afterward can be lost. Work through the restore in order rather than clicking the button and hoping.
- Record the current problem. Note when it started and what changed just before it.
- Download the current state if possible. Even a broken copy may contain recent files or data you need later.
- Choose a restore point from before the problem. Do not automatically choose the newest backup.
- Restore both files and database when the whole site is affected; restore only a specific component when you understand exactly what changed.
- Check the site after restoration. Test login, pages, images, forms, navigation, and critical transactions.
- Make a fresh clean backup. Once the site is stable, create a new restore point.
If WordPress still loads, a plugin can restore from its existing backup list. If the dashboard is unavailable, your host's restore tool may be the faster route. Hosting dashboards differ, so use your provider's current documentation and contact support before overwriting a live store or membership site.
What if your site is already hacked or broken?
Do not restore blindly. A backup taken after the hack contains the hack, and a restore point from before the hack may be days old. First, find out what happened: run a website malware scanner check to see whether malicious files are present, and note when the problem started. Then pick a restore point from before that date, restore it to staging first, and confirm the clean copy actually works before it goes live.
After the restore, change your passwords, update everything, and make a fresh clean backup. A hacked site is also a reminder to check that your backup schedule is actually running — many owners discover their backups stopped months ago only when they need one.
Backing up a site that is not WordPress
The rules do not change for other platforms; only the tools do. A static site is mostly files, so a file copy plus your version control history is usually enough. Any site with a database — a custom CMS, a forum, a store — needs the database export alongside the files, exactly like WordPress.
On shared hosting, cPanel's Backup Wizard can download your home directory and your database in a few clicks; choose a full backup, or download the files and database separately for more flexibility when restoring. If your host does not use cPanel, an FTP client such as FileZilla downloads the files, and phpMyAdmin exports the database — but remember that FTP alone backs up files only, so the database export is a separate, required step. If you run your own server, that responsibility is yours entirely; see what is VPS hosting for what self-managed hosting actually involves, including the backup duty that comes with it.
Sources
- TeamUpdraft — "How to back up your WordPress site (step-by-step guide)": the 3-2-1 backup rule, the files-plus-database requirement, the five backup methods (plugin, cPanel, FTP, phpMyAdmin, host), and backup frequency guidance. https://teamupdraft.com/blog/how-to-backup-a-wordpress-site/ (fetched 26 October 2026)
- CreateAProWebsite — "How to Back Up a WordPress Site (And Know It Will Restore)": the complete-backup definition, the one-server-one-point-of-failure warning, the method comparison and schedule tables, the staging restore test, and the restore-point rules. https://createaprowebsite.com/how-to-backup-a-wordpress-site/ (fetched 26 October 2026)
Frequently Asked Questions
How often should I back up my website?
As often as you can afford to lose new data. A static site is usually fine with a weekly full backup, an active blog needs daily coverage, and a store or membership site needs daily backups at minimum — plus a fresh backup before every major change.
Does a WordPress backup include the database?
A complete one must. The database holds your posts, pages, users, settings, and comments, while the files hold your themes, plugins, and media. A backup with files only cannot restore your content, and a database export alone cannot restore your design or media library.
Are hosting backups enough?
No. Hosting backups are useful for fast restores, but they should not be your only copy. Keep an independent backup in remote storage, so a hosting-account problem does not remove both the website and its only backup.
Can I back up WordPress for free?
Yes. The free version of UpdraftPlus can schedule files and database backups and send them to supported remote storage, and your host may also include automatic backups. Paid tools become useful when you need advanced scheduling, incremental or real-time coverage, more storage options, or hands-on support.
How do I know whether my backup works?
Confirm that the backup completed, verify the files exist in remote storage, and restore the full set to a staging site. Check the homepage, login, images, forms, and navigation. A successful test restore is stronger proof than a success message.