Back up WordPress

A WordPress site is a database and a set of files. Backing up one without the other restores nothing usable: posts live in the database, media and the theme on disk. A backup only has value if you can restore it.

What to back up

Item	Content	Note
MySQL database	posts, pages, users, options, settings	export as compressed SQL
wp-content/uploads	uploaded media	often the largest part
wp-content/themes and plugins	site code	restores the exact version
wp-config.php	database connection, security keys	contains secrets
.htaccess	rewrite rules	if present

The database holds site settings, including URL and permalinks: without it, files alone are not enough.

Manual method

Export the database from the KeyHelp admin tools or phpMyAdmin, as SQL and compressed if possible. Name the file with the date: your-domain-2026-11-07-db.sql.gz.

Then download wp-content over SFTP, keeping the tree structure. An FTP client can sync a local folder with the server, so you do not re-download media already copied.

For a live site, the SQL export must be consistent. On a VPS with SSH access, mysqldump --single-transaction avoids locking tables. On web hosting, export during a quiet period and check the file is not empty.

Plugin method

A backup plugin schedules the database export and the file archive, then sends them to remote storage (S3, Drive, Dropbox). Pick a maintained one, set retention for several versions, and exclude caches so archives stay small.

Test the plugin before trusting it: run a backup, download the archive, open it. A misconfigured plugin sometimes produces a few kilobytes of files that look valid.

Keep it off site and test it

Apply the 3-2-1 rule: three copies, two media, one off site. The panel backup, if your plan offers one, does not replace a copy you control: download it regularly and keep it elsewhere.

Restore at least once a quarter on a test subdomain or locally. Check media, permalinks, admin login, forms and email sending. Write down the procedure and where credentials are stored.

Check an archive before keeping it

• The SQL file decompresses without error (gunzip -t).
• Its size is consistent with the database.
• The file archive contains wp-content/uploads.
• The date matches the last real change on the site.

Keep a backup right before every major update and before any theme or plugin change. That is the most useful rollback point.