A broken plugin update, a hacked admin account or a hosting mistake can wipe out months of work in a few minutes. The fix is simple, but most site owners only think about it after something goes wrong. In this guide you will learn how to back up a WordPress site in three easy ways, where to keep the copies, and how to test that a restore really works.
It does not matter if you run a small portfolio, a WooCommerce store or ten client sites built with Elementor. The same rules apply, and none of them need coding skills.
What a WordPress backup actually includes
Every WordPress site has two parts, and a real backup needs both.
- The database. This holds your posts, pages, settings, users, comments and, for Elementor users, the layout data for every page you have designed.
- The files. This covers WordPress core, your themes, your plugins, your uploads folder (images, PDFs, videos) and two small but important files: wp-config.php and .htaccess.
The official WordPress documentation is clear on this point: you need the database and the files to fully restore a typical site. A copy of only your media folder, or only the database, will leave you rebuilding by hand.
How often should you back up?
WordPress.org suggests weekly backups for smaller sites and daily backups for busy ones, and always before an upgrade. A simple way to decide is to ask: how much work could I afford to lose?
| Site type | Suggested schedule | Copies to keep |
|---|---|---|
| Portfolio or brochure site that rarely changes | Weekly, plus before every update | 4 to 5 |
| Blog with new posts each week | Daily database, weekly files | 7 to 14 |
| WooCommerce store or membership site | Daily or more often (database) | 14 to 30 |
| Agency client sites | Daily, plus before every update or redesign | 7 to 14 per site |
Always run a fresh backup before you update WordPress core, your theme, Elementor or any addon. Major releases like WordPress 7.1 (August 2026) are tested heavily, but every site has its own mix of plugins, and a backup is what makes an update safe to try.
3 easy ways to back up a WordPress site
Method 1: Use a backup plugin (best for most people)
A plugin is the easiest way to back up a WordPress site on a schedule and send the copies somewhere safe. UpdraftPlus is one of the most popular free options, with more than 4 million active installs, and many other free and paid tools work in a similar way.
The basic setup takes about ten minutes:
- Install and activate your backup plugin from Plugins > Add New.
- Open its settings and choose a schedule for files and for the database.
- Pick a remote storage location, such as Google Drive, Dropbox or Amazon S3. Do not leave backups only on the same server.
- Choose how many old backups to keep (the “retention” setting).
- Click “Backup now” to create your first full copy, then check that it arrived in your remote storage.
Tip: big uploads folders can make backups slow on cheap hosting. If backups time out, split files and database into separate schedules, or exclude cache folders created by speed plugins.
Method 2: Use your hosting backups (good, but not enough on its own)
Most managed WordPress hosts and many cPanel hosts make automatic daily backups. Log in to your hosting dashboard and look for a “Backups” or “Restore points” section. Check three things:
- How long backups are kept. Some hosts keep only 7 days, which may not be enough if a hack goes unnoticed.
- Whether you can download them. A backup you cannot download is locked to that host.
- What a restore costs. A few hosts charge a fee for restores on cheaper plans.
Host backups are a great safety net. But if your hosting account is suspended, hacked or closed, those backups can disappear with it. Treat them as one copy, not the whole plan.
Method 3: Make a manual backup (useful before big changes)
A manual backup is good to know for emergencies, migrations, or when a plugin will not run.
- Export the database. Open phpMyAdmin from your hosting panel, select your site’s database, click Export and save the .sql file. Back up the database first, as WordPress.org recommends.
- Download the files. Use your host’s File Manager to compress the site folder into a .zip and download it, or use an FTP client such as FileZilla to copy the whole folder. The wp-content folder (themes, plugins, uploads) matters most.
- Label and store it. Name the files with the site and date, for example mysite-2026-10-17.zip, and keep them in at least two places.
To restore, WordPress.org says to upload the files first and then import the database. If your database name or password changed, update wp-config.php to match.
Where to keep your copies: the 3-2-1 backup rule
A backup stored on the same server as your site is not really a backup. The 3-2-1 rule is the simple standard that IT teams use:
- 3 copies of your data (the live site plus two backups)
- 2 different types of storage (for example, your host and a cloud drive)
- 1 copy kept off-site, away from your hosting account
For an extra layer against ransomware, many teams now follow 3-2-1-1-0: add one copy that cannot be changed (an offline drive or cloud storage with object lock), and aim for zero errors when you test a restore.
A practical setup for a small business looks like this: daily host backups, a plugin that sends copies to cloud storage, and a monthly download to a local drive.
Test your restore before you need it
The worst time to find out a backup is broken is the day you need it. WordPress.org also advises making a manual backup now and then to confirm that automated backups are working. Every few months, do a quick test:
- Create a staging site (many hosts offer one click staging) or a local copy.
- Restore your latest backup to it.
- Open a few key pages, the shop or contact form, and the Elementor editor.
- Check that images load, menus work and you can log in.
If anything is missing, fix your backup settings now, not during an emergency.
Extra tips for Elementor sites
Elementor stores page layouts in the database, so a files only backup will lose your designs. Keep these habits:
- Back up before updating Elementor, your theme or any addon plugin.
- Export your favourite templates from Templates > Saved Templates as a second safety copy.
- After a restore, go to Elementor > Tools and use “Regenerate CSS & Data” if styles look broken.
Well built addons also make restores smoother. Like every Elementor widget, Bright Addons widgets store their settings in your page data, so they come back with the page after a full restore. Our docs cover setup and troubleshooting for each widget.
Conclusion
Learning how to back up a WordPress site takes less time than rebuilding a single page. Pick a backup plugin, confirm what your host already keeps, follow the 3-2-1 rule and test a restore every few months. Do that, and a bad update or a hack becomes a short pause instead of a disaster.
Want to build your next page faster once your site is safe? Try the free Bright Addons plugin with 30 widgets, or see the Pro plans from $14 a year on brightaddons.com.
FAQ
How do I back up a WordPress site for free? Install a free backup plugin, set a daily or weekly schedule, and connect free cloud storage such as Google Drive. Your host’s free daily backups can act as a second copy.
Do I need to back up the database and the files? Yes. The database holds your content, settings and Elementor layouts, while the files hold your themes, plugins and media. You need both to fully restore a site.
How many backups should I keep? Keep at least 3 to 5 recent backups, as WordPress.org suggests. Busy stores and membership sites should keep two to four weeks of daily copies.
Are hosting backups enough? Not on their own. If your hosting account is hacked, suspended or closed, those backups can be lost. Keep at least one copy off-site in cloud storage or on a local drive.
