This article is part of a series created in partnership with SiteGround. Thank you for supporting the partners who make SitePoint possible.
Few people care about backups until it’s too late. The question “do we have backups?” is only raised after a catastrophic loss has occurred. Backups are essential. If you fail to prepare then prepare to fail.
Here are five steps to backup success:
- Educate your boss/client
If they understood the technicalities of web development, they wouldn’t need you. Explain the situation in simple monetary terms, e.g. if our server disk crashed today, we could lose everything. It would take M months to rebuild the system at a cost of $X and we could lose $Y in business. A viable backup system would cost $Z to implement and we would be back within N hours. I’m going presume you’ve terrified your boss/client and they’re willing to proceed.
- Identify what you need to backup
Backing up a WordPress system is a little complex because it depends on specific files and a database. A backup will only be viable if you have up-to-date copies of both.
- Implement an appropriate backup solution
This will depend on the technologies you’re using and the service you offer. For example, a weekly backup may be suitable for a blog receiving a few updates a month. At worst, you could lose an article or two. A WordPress-powered online shop may need continual backups to ensure customer orders are not be lost.
Backups should be taken out of human hands. Consider a system which requires a single click once a day to initiate the backup. You will start with good intentions but it will soon become a chore. What happens when you go on vacation? What if you leave the company? Computers are good at scheduling — let them handle the work.
- Verify and test your backup
Your system is only as good as the last successful backup. Ideally, you should automate verification of the backup’s integrity, move backup files off-site, periodically test your restore procedures, and retain previous backups for a reasonable time (three old versions is typical).
You can learn more about backing up your WordPress sites manually and easily in the SitePoint’s course How to Secure Your WordPress Site, which you can preview below. For more on WordPress, check out our comprehensive WordPress course on Building Custom WordPress Themes.
WordPress components have differing backup requirements.
WordPress Installation Files
You probably downloaded the WordPress installer in an archive from wordpress.org. It includes the following files and folders:
||root PHP, readme and licence files|
||the primary WordPress control panel code|
||libraries and third-party components|
||themes, plugins and media files|
You should never need to backup the default WordPress files. Your code (and third-party plugins) should never modify or add files to
/wp-includes/. I recommend retaining a copy of the installer but all versions of WordPress can be downloaded from the release archive. Besides, your installation will eventually receive updates so the live version will be different to the one you downloaded.
Root Configuration Files
Several root folder files must be backed-up:
wp-config.php— this contains settings including the database connection strings
.htaccess— the server configuration file
- webmaster tool identification files such as
- any other files you’ve added
In general, you can backup these files once after your installation is complete. However, be wary of themes and plugins which make further changes to the configuration.
/wp-content/ folder contains all themes, plugins and media assets such as uploaded images. This folder must be backed-up but it will depend on your development process.
If you are developing your own custom theme and plugins, it’s beneficial to use a source control system such as Git and create a central repository on GitHub, BitBucket or a similar provider. The source is replicated by these services and on all developer machines; it’s difficult to lose anything so a backup of the
/wp-content/plugins/ folders may not be absolutely necessary.
However, I suspect most WordPress sites use a combination of third-party themes and plugins with a few custom modifications. In addition, media files are contained in
/wp-content/uploads/ or the
/wp-content/blogs.dir/ folder on multi-site installations. Therefore, it’s normally easiest to backup everything in the
The frequency of backups will depend on your update activities. Once every few days is probably adequate for many sites but it may need to be more often when editors regularly add content and images.
The WordPress Database
The database contains all page content, historic revisions, media references, site configurations, theme options, plugin activations, user accounts and more. It’s imperative to backup the database frequently — perhaps once a day for a general blog or every hour for an ecommerce system.
Be wary that databases can become huge which slows the backup process.
If you don’t have a backup, do it now! I recommend taking a manual backup every so often even if you’ve implemented an automated system — you can never have too many.
Learn PHP for free!
Make the leap into server-side programming with a comprehensive cover of PHP & MySQL.
RRP $11.95 Yours absolutely free
Hosts such as SiteGround provide systems like cPanel which allow you to backup all files, databases and settings. Search for backup or the backup wizard and follow the steps. These generally create a file which can be restored in the same system.
If you prefer a more hands-on approach:
- Download the root configuration and
/wp-content/files using FTP, SCP, wget or any other tool you have to hand.
- Download a shapshot of the database which contains the SQL commands to recreate tables and populate the data.
- the host name — it’s normally
localhostbut check the
- the database name — see
- a database user’s name — see
- the database user’s password — see
You should see many tables such as
wp_comments once you have connected successfully. (Note the table prefix is set by
wp-config.php and may not always be
Look for an option such as dump, export or backup. Ensure every table (with drop and create) and all data is selected before downloading the SQL file.
Command line ninjas with SSH access can backup a database using the mysqldump command:
mysqldump --host=hostname --user=dbuser --password=dbpass --add-drop-table --result-file=backup.sql dbname
dbpass are the credentials we specified above. A full backup will be output to the
backup.sql file in the current folder which can be downloaded.
Restoring your manual backup is matter of uploading the files to the correct location and importing the MySQL data using a SQL tool or the command:
mysql --host=hostname --user=dbuser --password=dbpass dbname < backup.sql
All manual backup processes can be automated using tools such as cron which can also be controlled via cPanel.
Fortunately, there are dozens of WordPress backup plugins to choose from which can automate your process and export backups to an off-site data store. The most popular include:
The closest option to an official plugin, Jetpack provides a range of SEO, security and site management features which include real-time backups to unlimited storage space on the professional paid plan.
One of the highest-ranking backup plugins with more than one million active installations, UdraftPlus schedules and stores backups on remote systems such as Dropbox, Google Drive, OneDrive, Amazon S3, or your own server.
A simple plugin which backs up your database and files on a schedule to suit your requirements. The commercial edition enables off-site cloud storage backups.
The free edition of BackWPup allows you to backup your files and database to a variety of your own and third-party storage spaces. The commercial editon provides scheduling, differential backup and automatic updates.
Duplicator is often used for migration and cloning but also provides manual backup and restore facilities. The commercial edition supports scheduling and cloud backups.
An open source plugin which provides a range of scheduling and cloud storage options.
Alternatively, you can choose a third-party service to manage your WordPress backups. Hosts such as SiteGround are the best place to start; they can implement backup options for all hosting plans. SiteGround even has an in-house backup service that automatically saves the latest 30 copies of your site and lets you restore the one you need on demand.
Further services include:
VaultPress uses Jetpack to store daily or real-time automated backups off-site as well as scanning for malicious software, spammer attacks and hosting failures. Plans start from $3.50 per month.
WP Time Capsule takes incremental backups; only changed files and data are backed-up so the process is considerably faster than those which backup everything. An automatic backup is taken prior to every WordPress update. The Lite plan costs nothing for daily backups and 15-day restore points.
Manage WP has facilities to help you manage multiple WordPress installations. Premium plans start from $2 per website per month and include an incremental backup which can be scheduled to every hour. Further features include performance monitoring, security checks, analytics and reporting.
WordPress backups can be more complex than other software but the range of tools, plugins and services simplify the process. If you don’t have a backup procedure, take a snapshot now and investigate the options. Every minute you delay increases the risk of catastrophic failure.
Craig is a freelance UK web consultant who built his first page for IE2.0 in 1995. Since that time he's been advocating standards, accessibility, and best-practice HTML5 techniques. He's created enterprise specifications, websites and online applications for companies and organisations including the UK Parliament, the European Parliament, the Department of Energy & Climate Change, Microsoft, and more. He's written more than 1,000 articles for SitePoint and you can find him @craigbuckler.
Jump Start Git, 2nd Edition
Visual Studio Code: End-to-End Editing and Debugging Tools for Web Developers