Backup WordPress FTP: Essential Blueprint 2025

Why Manual Backup WordPress FTP Control Matters for Your Business

Your WordPress website is a critical business asset, holding your content, customer data, and reputation. A single server crash, hack, or accidental deletion can wipe it all out in an instant. While many site owners rely on hosting provider backups or automated plugins, these systems can fail, leaving you with a corrupted or incomplete backup when you need it most.

Backup WordPress FTP is a manual method that gives you direct control over your website’s files and database using File Transfer Protocol. This guide provides a complete blueprint for the process.

Quick Answer: FTP WordPress Backup Process

Connect via FTP client (like FileZilla) to your server using credentials from your host.
Download all WordPress files from your server’s root directory (e.g., public_html) to your computer.
Export your database using phpMyAdmin from your hosting control panel.
Store both backups securely in multiple locations (e.g., local drive and cloud storage).

Key Point: You need both the files AND the database for a complete backup. Files alone won’t restore your posts, pages, or settings.

Manual FTP backups put you in control. You aren’t dependent on a plugin that might break or a hosting company’s limited backup schedule. You can create a backup whenever you want and know exactly what’s included. The downside is that it’s manual work, requires technical steps, and must be done regularly to be effective. This guide walks you through the entire process, from downloading files to restoring your site on a new server.

Understanding FTP and WordPress Backups

At its core, a WordPress website consists of two main components: its files and its database. Your files are the structure—themes, plugins, images, and core WordPress software. Your database holds the content—posts, pages, comments, user information, and settings. To create a complete backup, you must save both.

FTP (File Transfer Protocol) is a method for transferring files between your computer and a remote web server. For better security, we recommend using SFTP (Secure File Transfer Protocol), which encrypts the connection to protect your data during transfer. This is especially important for businesses handling sensitive information.

What You Need Before You Start

Before you begin a manual backup WordPress FTP, gather the following tools and credentials to ensure a smooth process:

FTP Host/Server address: Usually your domain name or an IP address from your host.
FTP Username: Your unique login for the FTP server.
FTP Password: The corresponding password.
Port number: Typically 21 for FTP and 22 for SFTP.
Hosting control panel access: For tools like File Manager and phpMyAdmin.
phpMyAdmin access: To export your WordPress database.
Sufficient local storage space: For your website files and database backup.
An FTP client: Software to manage the file transfer. Popular free options include:
- FileZilla: A widely used, open-source client for all major operating systems.
- Cyberduck: Another free and reliable option, popular with Mac users.
- WinSCP: A powerful, free FTP client for Windows.

FTP vs. Other Backup Methods

Choosing a backup strategy involves balancing control, convenience, and cost. Here’s how manual FTP backups compare to other common methods.

Control: Manual FTP backups offer maximum control, as you decide exactly which files and database tables to include. Automated plugins offer high control through settings, while hosting provider backups typically offer the least, with predefined schedules and retention policies.
Convenience: Manual backups are the least convenient, requiring multiple, time-consuming steps. Automated plugins are highly convenient with one-click and scheduled backups. Hosting backups are often automated but may require a manual process to restore.
Cost: The FTP method is free, but it costs you your time. Backup plugins often have free and premium tiers, while hosting backups may be included in your plan or offered as a paid add-on.
Automation: Manual FTP has no automation. This is the primary advantage of plugins and hosting solutions, which can run backups on a schedule (e.g., hourly, daily, weekly).
Security: With manual backups, security depends on your practices, such as using SFTP. Automated solutions often include built-in security features like encryption and secure remote storage options.
Complexity: The FTP method is the most complex, requiring technical knowledge. Plugins are generally user-friendly, and hosting backups are typically the simplest for the end-user.

When to Use Each Method: Manual FTP is ideal for unique migrations, troubleshooting a site without admin access, or when you need absolute control. For most businesses, the reliability and efficiency of an automated backup solution are preferable for day-to-day protection.

Note: While other methods exist, this guide focuses on the manual backup WordPress FTP process. For users who prefer automation, wpOncall offers managed backup solutions that handle these complexities for you.

More info about WordPress backup and restoration services

The Complete Guide to Backup WordPress FTP Manually

This section provides a step-by-step blueprint for performing a complete manual backup WordPress FTP. By following these instructions, you can create a full safety copy of your website’s files and content.

Step 1: Download Your WordPress Files via FTP

Your FTP client is the tool for this job. We’ll use FileZilla as an example due to its popularity, but the process is similar for other clients.

Install and Open FileZilla: If you haven’t already, download and install FileZilla.
Connect to Your Server: At the top of the FileZilla window, enter your Host, Username, Password, and Port (use 22 for SFTP for a secure connection). Click “Quickconnect.” You may see a one-time warning about an unknown host key, which is usually safe to accept.
Steer to Your Site’s Root Directory: Once connected, you’ll see your local computer files on the left and the remote server files on the right. On the remote side, steer to your WordPress root directory. This folder is commonly named public_html, www, or htdocs and contains the wp-admin, wp-content, and wp-includes folders.
Prepare a Local Backup Folder: On your computer (the left pane), create a new folder to store your backup. Use a descriptive name, like mywebsite_backup_2024-01-15_files, to stay organized.
Download All Files: In the remote pane, click on one file and press Ctrl+A (Windows) or Cmd+A (Mac) to select everything. Drag the selected files and folders from the remote pane to your local backup folder in the left pane. The transfer may take several minutes to over an hour, depending on your site’s size.

Key Files to Verify in Your Backup:

wp-content directory: This is the most critical folder, containing your themes, plugins, and uploads (images, videos, documents). Without it, your site’s design and unique content are lost.
wp-config.php file: Located in the root directory, this file contains your database connection details (name, user, password) and security keys. Your site cannot function without it.
.htaccess file: This hidden file in your root directory manages your permalinks and can contain important security rules. Ensure your FTP client is set to show hidden files so you can back it up.

Once the file transfer is complete, you have the first half of your backup. Now, you need the database.

More info about manual backup

Step 2: Export Your WordPress Database with phpMyAdmin

Your WordPress database stores all your content, including posts, pages, users, and settings. FTP clients cannot back up databases, so you must export it separately using a tool like phpMyAdmin, which is available in most hosting control panels.

Log into Your Hosting Control Panel: Access your cPanel or other hosting dashboard and find the phpMyAdmin icon, usually under a “Databases” section.
Identify Your Database Name: If you’re unsure which database belongs to your site, open the wp-config.php file from the backup you just downloaded. Look for the line define('DB_NAME', 'your_database_name');. The value in quotes is your database name.
Select Your Database: In phpMyAdmin, click on the correct database name from the list in the left sidebar. You will see a list of tables like wp_posts and wp_users.
Export the Database: Click the “Export” tab at the top of the page. The “Quick” export method and “SQL” format are sufficient for most backups.
Download the .sql File: Click the “Go” or “Export” button. Your browser will download a .sql file (e.g., your_database_name.sql). Save this file in the same local folder where you stored your website files.

With both the files and the database .sql file saved together, you now have a complete, restorable backup WordPress FTP of your website.

More info about database optimization

How to Restore Your WordPress Site from an FTP Backup

A backup is only useful if you can successfully restore it. This section guides you through restoring your site from the manual backup WordPress FTP you created, whether you’re recovering from a disaster or migrating to a new host.

A complete guide to WordPress site recovery

Step 1: Import Your Database Backup

First, restore the content of your site by importing the database.

Access phpMyAdmin: Log into the hosting control panel of your destination server and open phpMyAdmin.
Create a New Database (If Necessary): If you’re on a new server, use the “MySQL Databases” tool in your control panel to create a new, empty database and a new database user. Grant the user full privileges for the database and write down the database name, username, and password.
Select the Database: In phpMyAdmin, click on the name of the database you want to restore into (it should be empty).
Import the .sql File: Click the “Import” tab. Click “Choose File” and select the .sql database backup file from your computer. Click “Go” to begin the import. This may take a few minutes for larger databases.

Note: Many hosts have a file upload limit (e.g., 50MB) in phpMyAdmin. If your database file is too large, you may need to contact your host’s support for assistance or use a command-line tool if you have SSH access.

Step 2: Upload Your WordPress Backup to a New Host Using FTP

With the database restored, it’s time to upload your website files.

Connect via FTP: Open your FTP client and connect to your destination server using its FTP credentials. Use SFTP (port 22) for a secure connection.
Steer to the Root Directory: On the remote server pane, steer to the web root directory, which is typically public_html or www.
Clear Existing Files: If there are any placeholder files (like index.html) from the hosting provider, delete them to ensure a clean installation.
Upload Your Backup Files: On your local computer pane, steer to your backup folder. Select all the WordPress files and folders and drag them to the remote server’s root directory. This transfer can take a significant amount of time for large sites.

More info about uploading a backup to a new host

Step 3: Reconfigure and Test Your Restored Site

This final step connects your files to your database and ensures everything works correctly.

Update wp-config.php: The wp-config.php file you uploaded contains your old database details. Open the wp-config.php file from your local backup folder in a text editor. Update the following lines with your new database credentials:
- define( 'DB_NAME', 'new_database_name' );
- define( 'DB_USER', 'new_username' );
- define( 'DB_PASSWORD', 'new_password' );
- You may also need to update DB_HOST if it’s not localhost.
Upload the Updated File: Save the changes to wp-config.php and use your FTP client to upload it to the server’s root directory, overwriting the existing file.
Flush Permalinks: Log into your WordPress admin dashboard. Go to Settings > Permalinks and simply click the “Save Changes” button. This rebuilds your site’s URL structure and fixes potential “404 Not Found” errors on pages.
Test Your Site Thoroughly: Browse your restored website. Check that the homepage, internal pages, and images load correctly. Test contact forms and any other key functionality. Verify that you can log in and that all your content appears in the WordPress admin area.

Following these steps carefully should result in a fully functional, restored WordPress site. The combination of your file and database backup gives you complete control over your site’s recovery.

More info about site restoration

Security Best Practices for Your Backups

Creating a backup WordPress FTP is only half the battle; you must also keep those backups secure. A compromised or inaccessible backup is useless in an emergency. Here are essential security practices to protect your data.

Follow the 3-2-1 Backup Rule: This is the industry standard for data protection. Keep three total copies of your data, store them on two different types of media, and keep one copy off-site. For example: 1) your live site, 2) a local backup on your computer, and 3) a copy in secure cloud storage (like Amazon S3 or Google Drive).
Use SFTP for Transfers: Always use SFTP (Secure File Transfer Protocol) instead of standard FTP. SFTP encrypts the data during transfer, protecting your wp-config.php file and other sensitive information from being intercepted.
Protect Local Backups: Your backup contains everything needed to clone your site. Compress your backup files (files and database) into a single password-protected archive (e.g., a .zip file). Use a strong, unique password and store it in a password manager.
Secure Cloud Storage: If you use cloud storage for your off-site copy, protect that account with a strong password and enable two-factor authentication (2FA). A weak cloud account password can expose all your backups.
Test Your Backups Regularly: A backup is not reliable until you’ve tested it. Periodically perform a test restore on a staging site or local development environment. This confirms your backup is complete and ensures you’re familiar with the restoration process before a crisis occurs.
Encrypt Backups at Rest: For backups stored on external hard drives, use full-disk encryption like BitLocker (Windows) or FileVault (macOS). This protects your data if the physical drive is lost or stolen.
Implement a Rotation Schedule: Don’t let backups accumulate indefinitely. A good practice is to keep daily backups for a week, weekly backups for a month, and monthly backups for a year. This gives you multiple restore points without using excessive storage.

These security steps are critical for any business. While they can be managed manually, automated solutions often provide built-in encryption, off-site storage, and testing to simplify the process.

Cloud-based server backup services can help automate many of these security measures.

More info about WordPress backup and security

The Official WordPress guide on backing up files offers additional technical details on file backup best practices.

Frequently Asked Questions about WordPress FTP Backups

Here are answers to some of the most common questions we receive about manual WordPress backups.

Can I automate a manual FTP backup?

The short answer is no. The term “manual backup WordPress FTP” implies you are performing the steps by hand. While some advanced FTP clients offer file synchronization features, they are not a true, hands-off automation solution and still require manual oversight. They also do not handle the critical database backup step. For reliable, set-and-forget automation, a dedicated managed backup service is the recommended approach.

More info about automatic backups

Do I need to back up WordPress core files?

Yes, it is highly recommended. While you could technically download a fresh copy of WordPress core files from WordPress.org during a restore, backing up everything creates a complete, one-to-one snapshot of your site at a specific moment. This simplifies the restoration process and helps prevent potential version conflicts between your core files, plugins, and theme.

What are the main limitations of using FTP for backups?

While manual FTP backups provide control, they have significant drawbacks, especially for business websites:

Time-Consuming: The multi-step process for both files and the database requires a significant time investment.
Prone to Human Error: It’s easy to miss a step, forget a hidden file like .htaccess, or back up the wrong database, leading to an incomplete or failed restore.
No Automation: Backups only happen when you remember to perform them, which can lead to data loss if a problem occurs between manual backups.
Inefficient for Large Sites: Downloading every file every time is inefficient for large or frequently updated sites. Automated solutions often use incremental backups, which only save what has changed.
Separate Database Handling: FTP cannot back up the database, adding complexity and another potential point of failure to the process.
Security Risks: Standard FTP is unencrypted. While SFTP is secure, you are still responsible for managing credentials and the security of the stored backup files.

For these reasons, automated, managed backup solutions are a more reliable and efficient choice for most business-critical websites.

Conclusion

You’ve now walked through the entire process of a manual backup WordPress FTP. This knowledge gives you a deep understanding of your site’s structure and the power to take control of its safety. We’ve covered downloading your files, exporting your database, and restoring everything from scratch.

However, this manual method demands significant time and technical precision. It’s a powerful tool for specific situations like a complex migration, but for daily protection, it carries the risk of human error and can be inefficient, especially for dynamic websites. A forgotten backup or a missed step can have serious consequences.

For a small personal project, the DIY approach may be sufficient. But if you’re running a business in Santa Rosa, CA, or any site where data integrity and uptime are non-negotiable, the peace of mind that comes from a reliable, automated system is invaluable.

This is where wpOncall steps in. Our managed backup solutions remove the burden and risk of manual processes. We provide smart automation, secure off-site storage, and rapid restoration services, ensuring your website is robustly protected. This allows you to focus on growing your business, confident that your digital assets are safe.

Whether you choose the hands-on path of manual backups or the security of a managed service, the most important takeaway is this: always have a reliable backup strategy, and know how to use it. Your website’s future depends on it.

Explore our detailed guide to the best WordPress backup solutions