Back Up a WordPress Website Before Updating

WordPress backup checklist: Protect both files and the database before updates, save an off-site copy and test that your backup can actually be restored. A ZIP of files alone may not recover a broken site.

This guide is for owners of WordPress blogs, small-business sites and online stores. It is not a guarantee against downtime: hosting, site architecture, extensions and data volume all affect the process. The safe goal is to understand what needs copying and to practice restoring it before an emergency.

What does a complete WordPress backup include?

WordPress describes two main backup components: files and database. A database export generally contains posts, pages, comments and settings. The file side includes the WordPress installation, themes, plugins, uploaded media and site configuration. If you back up only one half, you may get a site that opens but lacks its media, or files that cannot reconstruct the content.

Check for custom folders, must-use plugins, uploaded downloads and server rules such as .htaccess. For more complex setups, also document your PHP version, DNS and email configuration, redirects, scheduled jobs, and any external services that are not contained inside the WordPress files or database. A full-site backup does not automatically preserve accounts or data held by outside vendors.

Step 1: Choose a backup method you can restore

Managed hosting backups

Many hosts provide snapshots or scheduled backups. Find out exactly what they contain, how many restore points are kept, whether databases and uploads are both included, and whether an administrator can restore a copy without contacting support. Ask whether the backup is retained if the hosting account is suspended or the server becomes unavailable. A backup that disappears with the affected account is not a complete recovery plan.

WordPress backup plugins

A reputable backup plugin may automate file/database copies and send them to separate storage. Review its current maintenance record, compatibility, restore instructions, exclusions and security permissions. Do not install multiple backup tools without a reason: overlapping schedules may put load on a small hosting plan.

Manual backup

An experienced administrator may export the database and download the necessary site files over approved hosting tools. WordPress’s database backup guidance makes clear that a SQL export is different from a file copy. Record which database belongs to which site, and protect exports because they may contain user information, email addresses or order records. Never place backup files in a publicly browsable website folder.

AI-generated illustration showing WordPress backup, cloud storage and security

Step 2: Store copies away from the live website

Keep at least one backup in storage separate from the production server and restrict access to it. Encrypt sensitive archives where your method supports it, and control access to the storage account itself. Verify that retention is long enough to recover from a problem discovered days later. The familiar “3-2-1” pattern—several copies, more than one kind of storage, one copy off-site—is a planning aid, not a promise of safety.

Name backup sets by site and date, and keep the corresponding database and files together. Do not rely only on “backup succeeded” notifications: confirm that the files exist, have plausible sizes and can be downloaded or accessed through the recovery method.

Step 3: Test a restore somewhere safe

A restore test is where you discover missing uploads, incompatible PHP versions, broken permalinks, or a database export that never completed. Restore to a staging environment or an otherwise isolated copy, not over the live website. Ensure test environments do not send real customer emails, process payment transactions or get indexed by search engines.

Open the homepage, a representative article, search and navigation, image-heavy pages, contact forms and—if applicable—checkout in a non-transactional test mode. Check administrator login and database-driven functions. Record how long the restore took and what steps were manual. A successful snapshot creation is not equivalent to a successful recovery.

Step 4: Make an update checklist

Before: inventory the plugins and theme being updated, read release notes, and check known compatibility requirements.
Backup: make a new complete restore point and confirm it is accessible from outside the server.
Stage: test the change on a staging copy if the site has revenue, members, forms or important traffic.
Schedule: choose a quiet maintenance window; avoid making several major changes at once.
Update: apply changes in a controlled order and monitor errors, layout and key user journeys.
Verify: test the live homepage, several article pages, admin access, forms and any store functions.
Rollback: if critical behavior breaks, restore according to your documented recovery process rather than repeatedly changing settings.

How often should you back up WordPress?

Frequency should follow how quickly the site changes and how much loss the business can tolerate. A mostly static brochure site and a store that receives orders all day have very different recovery requirements. Ask two questions: how much recent content/data can we afford to lose? and how long can the site be unavailable? For busy stores, consider whether the host offers database-aware or near-real-time protection and ask how it handles in-progress orders.

Common WordPress backup mistakes

Only copying wp-content: valuable files may be saved, but the database and environment may be missing.
Only exporting SQL: content may survive while themes, plugins and images do not.
Keeping a single copy on the same server: a host-level failure or compromise may affect both.
Never testing restoration: incomplete archives remain undiscovered until they matter.
Forgetting external services: DNS, mailboxes, payment providers and SaaS settings may need separate recovery procedures.

Frequently asked questions

Does a WordPress export file count as a full backup?

No. WordPress’s content export is useful for migrating certain content, but it does not by itself recreate the entire site’s plugins, settings, media files and operational environment.

Should I back up just before every update?

For significant theme, plugin, core or server changes, a recent restorable point is prudent. Routine automated backups are still useful, but check that one completed close enough to the update to meet your acceptable data-loss window.

Can I restore directly over my live site?

Restores can overwrite newer content, users, orders and settings. Confirm scope and consequences first. For critical sites, involve the host or a qualified administrator and test the procedure in staging.

Once your backup is verified, review our WordPress Core Web Vitals optimization guide before changing caching, images or scripts.