How to Backup Your WordPress Site

This article is part of a series created in partnership with SiteGround. Thank you for supporting the partners who make SitePoint possible.

Few people care about backups until it’s too late. The question “do we have backups?” is only raised after a catastrophic loss has occurred. Backups are essential. If you fail to prepare then prepare to fail.

Here are five steps to backup success:

1. Educate your boss/client
   If they understood the technicalities of web development, they wouldn’t need you. Explain the situation in simple monetary terms, e.g. if our server disk crashed today, we could lose everything. It would take M months to rebuild the system at a cost of $X and we could lose $Y in business. A viable backup system would cost $Z to implement and we would be back within N hours. I’m going presume you’ve terrified your boss/client and they’re willing to proceed.
2. Identify what you need to backup
   Backing up a WordPress system is a little complex because it depends on specific files and a database. A backup will only be viable if you have up-to-date copies of both.
3. Implement an appropriate backup solution
   This will depend on the technologies you’re using and the service you offer. For example, a weekly backup may be suitable for a blog receiving a few updates a month. At worst, you could lose an article or two. A WordPress-powered online shop may need continual backups to ensure customer orders are not be lost.
4. Automate!
   Backups should be taken out of human hands. Consider a system which requires a single click once a day to initiate the backup. You will start with good intentions but it will soon become a chore. What happens when you go on vacation? What if you leave the company? Computers are good at scheduling — let them handle the work.
5. Verify and test your backup
   Your system is only as good as the last successful backup. Ideally, you should automate verification of the backup’s integrity, move backup files off-site, periodically test your restore procedures, and retain previous backups for a reasonable time (three old versions is typical).

You can learn more about backing up your WordPress sites manually and easily in the SitePoint’s course How to Secure Your WordPress Site, which you can preview below. For more on WordPress, check out our comprehensive WordPress course on Building Custom WordPress Themes.

WordPress Components

WordPress components have differing backup requirements.

WordPress Installation Files

You probably downloaded the WordPress installer in an archive from wordpress.org. It includes the following files and folders:

location	description
/	root PHP, readme and licence files
/wp-admin/	the primary WordPress control panel code
/wp-includes/	libraries and third-party components
/wp-content/	themes, plugins and media files

You should never need to backup the default WordPress files. Your code (and third-party plugins) should never modify or add files to /wp-admin/ or /wp-includes/. I recommend retaining a copy of the installer but all versions of WordPress can be downloaded from the release archive. Besides, your installation will eventually receive updates so the live version will be different to the one you downloaded.

Root Configuration Files

Several root folder files must be backed-up:

• wp-config.php — this contains settings including the database connection strings
• .htaccess — the server configuration file
• webmaster tool identification files such as googleCODE.html and BingSiteAuth.xml
• any other files you’ve added

In general, you can backup these files once after your installation is complete. However, be wary of themes and plugins which make further changes to the configuration.

wp-content files

The /wp-content/ folder contains all themes, plugins and media assets such as uploaded images. This folder must be backed-up but it will depend on your development process.

If you are developing your own custom theme and plugins, it’s beneficial to use a source control system such as Git and create a central repository on GitHub, BitBucket or a similar provider. The source is replicated by these services and on all developer machines; it’s difficult to lose anything so a backup of the /wp-content/themes/ and /wp-content/plugins/ folders may not be absolutely necessary.

However, I suspect most WordPress sites use a combination of third-party themes and plugins with a few custom modifications. In addition, media files are contained in /wp-content/uploads/ or the /wp-content/blogs.dir/ folder on multi-site installations. Therefore, it’s normally easiest to backup everything in the /wp-content/ folder.

The frequency of backups will depend on your update activities. Once every few days is probably adequate for many sites but it may need to be more often when editors regularly add content and images.

The WordPress Database

The database contains all page content, historic revisions, media references, site configurations, theme options, plugin activations, user accounts and more. It’s imperative to backup the database frequently — perhaps once a day for a general blog or every hour for an ecommerce system.

Be wary that databases can become huge which slows the backup process.

Manual Backup

If you don’t have a backup, do it now! I recommend taking a manual backup every so often even if you’ve implemented an automated system — you can never have too many.

Hosts such as SiteGround provide systems like cPanel which allow you to backup all files, databases and settings. Search for backup or the backup wizard and follow the steps. These generally create a file which can be restored in the same system.

If you prefer a more hands-on approach:

1. Download the root configuration and /wp-content/ files using FTP, SCP, wget or any other tool you have to hand.
2. Download a shapshot of the database which contains the SQL commands to recreate tables and populate the data.

Most hosts provide SQL tools such as phpMyAdmin or Adminer or you can install them yourself on any hosting which supports PHP. To log in, you will require:

• the host name — it’s normally localhost but check the DB_HOST setting in wp-config.php
• the database name — see DB_NAME in wp-config.php
• a database user’s name — see DB_USER in wp-config.php, and
• the database user’s password — see DB_PASSWORD in wp-config.php.

You should see many tables such as wp_posts, wp_users and wp_comments once you have connected successfully. (Note the table prefix is set by $table_prefix in wp-config.php and may not always be wp_.)

Look for an option such as dump, export or backup. Ensure every table (with drop and create) and all data is selected before downloading the SQL file.

Command line ninjas with SSH access can backup a database using the mysqldump command:

mysqldump --host=hostname --user=dbuser --password=dbpass --add-drop-table --result-file=backup.sql dbname

where hostname, dbname, dbuser and dbpass are the credentials we specified above. A full backup will be output to the backup.sql file in the current folder which can be downloaded.

Restoring your manual backup is matter of uploading the files to the correct location and importing the MySQL data using a SQL tool or the command:

mysql --host=hostname --user=dbuser --password=dbpass dbname < backup.sql

All manual backup processes can be automated using tools such as cron which can also be controlled via cPanel.

Backup Plugins

Fortunately, there are dozens of WordPress backup plugins to choose from which can automate your process and export backups to an off-site data store. The most popular include:

Jetpack

The closest option to an official plugin, Jetpack provides a range of SEO, security and site management features which include real-time backups to unlimited storage space on the professional paid plan.

UdraftPlus

One of the highest-ranking backup plugins with more than one million active installations, UdraftPlus schedules and stores backups on remote systems such as Dropbox, Google Drive, OneDrive, Amazon S3, or your own server.

BackUpWordPress

A simple plugin which backs up your database and files on a schedule to suit your requirements. The commercial edition enables off-site cloud storage backups.

BackWPup

The free edition of BackWPup allows you to backup your files and database to a variety of your own and third-party storage spaces. The commercial editon provides scheduling, differential backup and automatic updates.

Duplicator

Duplicator is often used for migration and cloning but also provides manual backup and restore facilities. The commercial edition supports scheduling and cloud backups.

XCloner

An open source plugin which provides a range of scheduling and cloud storage options.

Backup Services

Alternatively, you can choose a third-party service to manage your WordPress backups. Hosts such as SiteGround are the best place to start; they can implement backup options for all hosting plans. SiteGround even has an in-house backup service that automatically saves the latest 30 copies of your site and lets you restore the one you need on demand.

Further services include:

VaultPress

VaultPress uses Jetpack to store daily or real-time automated backups off-site as well as scanning for malicious software, spammer attacks and hosting failures. Plans start from $3.50 per month.

WP Time Capsule

WP Time Capsule takes incremental backups; only changed files and data are backed-up so the process is considerably faster than those which backup everything. An automatic backup is taken prior to every WordPress update. The Lite plan costs nothing for daily backups and 15-day restore points.

Manage WP

Manage WP has facilities to help you manage multiple WordPress installations. Premium plans start from $2 per website per month and include an incremental backup which can be scheduled to every hour. Further features include performance monitoring, security checks, analytics and reporting.

Backup Today!

WordPress backups can be more complex than other software but the range of tools, plugins and services simplify the process. If you don’t have a backup procedure, take a snapshot now and investigate the options. Every minute you delay increases the risk of catastrophic failure.