backup wordpress manually
Kevin Gallagher

Safeguard Your Site Manually Backing Up WordPress Made Easy

/in /by

Backup WordPress Manually: 3 Essential Steps

Why Manual Backups Are a Critical Skill for Every WordPress Owner

Learning to backup wordpress manually is a fundamental and empowering skill for any site owner. While automated plugins offer convenience, they can create a false sense of security. If your site is ever hacked, if a critical update fails, or if your hosting provider experiences a catastrophic outage, having a recent, verified manual backup allows you to recover in minutes instead of facing the daunting task of rebuilding your digital presence from scratch.

Quick answer – a complete manual backup has three parts:

  1. Files – Download every file and folder in your WordPress root directory. This includes the core folders (wp-admin, wp-includes, wp-content) and crucial root files like wp-config.php.
  2. Database – Export your entire MySQL database to a single .sql file. This is typically done using the phpMyAdmin tool provided by your host.
  3. Store safely – Adhere to the industry-standard 3-2-1 rule: keep at least three copies of your backup on two different types of media, with at least one copy stored off-site (e.g., on a cloud drive or an external hard drive at home).

Unlike automated plugins that can silently fail when server disk space runs out or a scheduled cron job breaks, the manual process forces you to see exactly what is being saved and where it lives. This hands-on approach provides a deeper understanding of your site’s architecture, which pays dividends the moment something goes wrong. You’ll know precisely what you have and how the pieces fit together, making the restoration process far less intimidating.

According to WordPress.org’s official documentation, backing up your WordPress site is one of the most important maintenance tasks you can perform. The platform’s immense popularity, powering over 40% of all websites globally, unfortunately makes it a prime target for cyber attacks, automated bots, and technical failures.

Understanding What to Back Up

Your WordPress site consists of two critical and interdependent components that work together to create the complete user experience. Backing up one without the other is like saving a blueprint without the building materials; a restoration will fail completely.

WordPress Files Structure:
These are the physical files that form the skeleton and functional parts of your site. They live on your web server and can be accessed via SFTP or a file manager.

  • Core WordPress files – The fundamental code that runs the WordPress application, including the wp-admin and wp-includes folders, and root files like index.php.
  • wp-config.php file – This is one of the most critical files. It contains your database connection details (name, user, password) and security keys. Without it, your site cannot connect to its data.
  • .htaccess file – A powerful configuration file that controls server rules, including permalinks and security headers. It’s often hidden by default.
  • wp-content folder – This folder contains all of your unique content and customizations. It is the most important folder to back up regularly.
    • Themes – The files that control your site’s appearance and layout.
    • Plugins – The files that add functionality and features to your site.
    • Media uploads – Every image, video, document, and file you’ve ever uploaded through the WordPress media library.

WordPress Database Components:
This is the brain of your website, storing all of your content and settings in an organized set of tables within a MySQL database.

  • Posts and pages – All of your written content, including drafts and revisions, is stored in the wp_posts table.
  • Comments – User interactions and discussions are stored in the wp_comments table.
  • User accounts – Login credentials, roles, and user profile information reside in the wp_users and wp_usermeta tables.
  • Site settings – Your site’s title, tagline, timezone, and countless other configuration options are stored in the wp_options table.
  • Plugin and Theme data – Settings for your active theme and plugins are also stored in the wp_options table or in their own custom tables.

The files provide the structure and functionality, while the database contains all your content, user data, and configurations. A complete backup must include both.

The Critical Risks of Skipping Backups

The consequences of not having a current, reliable backup extend far beyond simple inconvenience. They can be financially and reputationally devastating.

Cyber Security Threats:

  • Malware infections – Malicious code can be injected into your theme or plugin files, creating backdoors, redirecting users, or stealing data.
  • Ransomware attacks – A rare but catastrophic attack where criminals encrypt your files and database, demanding payment for their release.
  • Database attacks – Methods like SQL injection can be used to steal sensitive user data or wipe your content tables entirely.

WordPress sites are constantly under attack from automated bots searching for vulnerabilities. Even with strong security measures, no site is 100% immune, and a clean backup is your ultimate safety net.

Technical Failures:

  • Plugin or Theme conflicts – A faulty update can cause a fatal PHP error, resulting in the infamous “White Screen of Death,” making your site completely inaccessible.
  • Server hardware failures – Web hosts use physical servers, and their hard drives can and do fail. While hosts have their own backups, you should never rely solely on them.
  • Hosting provider issues – A billing error, an account suspension, or a provider going out of business can lead to your site being deleted permanently.
  • Botched updates – A WordPress core, theme, or plugin update that gets interrupted or fails can leave your site in a broken, half-updated state.

Human Error Scenarios:

  • Accidental deletion – One wrong click in an SFTP client or file manager can delete a critical file like wp-config.php or the entire wp-content folder.
  • Bad code edits – A small syntax error while editing your theme’s functions.php file can take your entire site down.
  • Database mistakes – Accidentally deleting a user or running an incorrect SQL query can lead to irreversible data loss.

Business and Legal Consequences:

  • Revenue loss – For an e-commerce or lead-generation site, every minute of downtime translates directly into lost sales and opportunities.
  • SEO impact – If your site is down for an extended period, search engines like Google will de-rank or even de-index your pages, erasing years of hard work.
  • Loss of customer trust – An unavailable or hacked site severely damages your brand’s credibility and can drive customers to your competitors.
  • Regulatory compliance – Data protection laws like the General Data Protection Regulation (GDPR) in Europe require you to safeguard user data. Losing this data due to a lack of backups can lead to significant fines and legal action.
  • High recovery costs – Hiring a professional to attempt to recover a site without a backup is extremely expensive, often costing hundreds or thousands of dollars with no guarantee of success.

A comprehensive backup strategy costs virtually nothing but your time, whereas a single hour of emergency recovery work can range from $100 to $500. For any serious website owner, the choice is clear. Folding manual backups into a broader disaster recovery plan that includes security monitoring and regular updates is a hallmark of professional site management.

Step 1: Manually Back Up Your WordPress Files via SFTP

FileZilla interface showing a secure connection to a remote server - backup wordpress manually

The first half of a manual backup involves downloading a complete copy of your WordPress files. The most secure and reliable method for this is SFTP (Secure File Transfer Protocol). SFTP establishes an encrypted channel between your computer and the web server, ensuring that your login credentials and file contents are protected from interception during the transfer.

Understanding File Transfer Protocols

While several protocols exist for transferring files, SFTP is the modern standard for security and reliability.

SFTP vs FTP Comparison:

  • Security – SFTP, which runs over the SSH (Secure Shell) protocol, encrypts all data, including your username, password, and the files themselves. Standard FTP sends everything in plain text, making it highly insecure on public networks.
  • Port usage – SFTP uses a single port (typically port 22) for all communication, which is easy to manage and secure with firewalls. FTP uses a complex system of two ports (20 and 21) and can be difficult to configure with modern network security.
  • Performance – While FTP can sometimes be slightly faster due to its lack of encryption overhead, the security trade-off is not worth it. SFTP includes built-in error and integrity checking, making transfers more reliable.

Alternative Methods:

  • cPanel File Manager – A web-based interface provided by many hosts. It’s convenient for single-file edits but is slow and prone to timeouts when downloading hundreds or thousands of files for a full backup.
  • SSH command line – Using commands like zip or tar directly on the server via SSH is the fastest method, but it requires command-line experience and is best for advanced users.

For these reasons, using a dedicated SFTP client is the recommended approach for most users.

Preparing for File Transfer

Choosing the Right SFTP Client:
A desktop SFTP client provides a stable, user-friendly interface for managing file transfers. Here are three excellent, free options:

  1. FileZilla (Free, Windows/Mac/Linux)

    • The most popular and widely used SFTP client.
    • Features a dual-pane, drag-and-drop interface.
    • Includes a powerful site manager to save connection details for all your websites.
    • Maintains a transfer queue to manage large backups and retry failed files.
    • Important: Always download it from the official website to avoid bundled adware.

  2. Cyberduck (Free, Mac/Windows)

    • Known for its clean, minimalist, and intuitive single-pane interface.
    • Excellent choice for Mac users, though a Windows version is also available.
    • Integrates seamlessly with cloud storage providers like Amazon S3, Google Drive, and Dropbox, allowing you to back up directly to the cloud.

  3. WinSCP (Free, Windows only)

    • A powerful and feature-rich client designed specifically for Windows.
    • Offers a choice between a dual-pane (Norton Commander style) or single-pane (Windows Explorer style) interface.
    • Includes advanced features like scripting and a built-in text editor for quick file edits.

Gathering Your Connection Credentials:
Your hosting provider will supply the credentials needed to connect to your server. You can usually find them in your hosting control panel:

  • Hostname – Your site’s domain name (e.g., your-domain.com) or the server’s IP address.
  • Username – Your SFTP or SSH username. This is often different from your WordPress or cPanel login.
  • Password – The corresponding SFTP/SSH password.
  • Port – The port number for the connection. For SFTP, this is almost always 22.
  • Protocol – Ensure you select SFTP in your client, not FTP or FTPS.

If you cannot find these details in your cPanel (under “SSH Access”) or Plesk (under “Web Hosting Access”), contact your host’s support team. They can provide the correct credentials or help you enable SFTP access if it’s disabled by default.

Preparing Your Local Environment

Before you begin the download, create a dedicated and organized folder on your computer.

  1. Create a main backup folder, for example, WordPress_Backups.
  2. Inside, create a new folder for this specific backup using a consistent naming convention like YYYY-MM-DD_sitename_backup. 
    WordPress_Backups/
+-- 2024-01-15_mysite_backup/
    +-- files/
    +-- database/
  3. Ensure you have enough local disk space. Check your site’s total size in your hosting panel and make sure you have at least double that amount available locally.

Step-by-Step File Download Process

Connecting to Your Server:

  1. Open your chosen SFTP client (e.g., FileZilla) and open the Site Manager.
  2. Create a new site and enter your credentials:
    • Host: your-domain.com
    • Protocol: SFTP - SSH File Transfer Protocol
    • Port: 22
    • Logon Type: Normal
    • User: your-sftp-username
    • Password: your-sftp-password
  3. Click “Connect”. If successful, you will see your server’s file system in the “Remote site” panel.

Navigating to Your WordPress Installation:

  1. The right-hand panel shows your remote server. You need to find your site’s document root, which is the folder where your WordPress files are stored. This folder is commonly named public_html, www, htdocs, or after your domain name.
  2. Once inside the document root, you should see the core WordPress folders: wp-admin, wp-content, and wp-includes.
  3. Crucially, you must enable viewing hidden files. These files, which start with a dot (.), are essential. The most important is .htaccess. In FileZilla, go to Server > Force showing hidden files.

Selecting and Downloading Files:

  1. The left-hand panel shows your local computer. Steer to the files subfolder you created earlier (e.g., 2024-01-15_mysite_backup/files/).
  2. In the right-hand remote panel, select all files and folders. You can do this by clicking one file and then pressing Ctrl+A (Windows) or Cmd+A (Mac).
  3. Right-click on the selected files and choose “Download,” or simply drag them from the remote panel to the local panel.
  4. The transfer will begin. You can monitor its progress in the queue at the bottom of the window. This may take anywhere from a few minutes to over an hour, depending on the size of your site and your internet connection speed.

Verifying Your File Backup:
Once the transfer queue is empty, you must verify the backup’s integrity.

  1. Check for failed transfers. The queue tab will show any files that failed to download. If there are any, right-click them and choose to re-queue them.
  2. Compare folder structures. Your local backup folder should mirror the structure on the server. Ensure the main wp-admin, wp-content, and wp-includes folders are present.
  3. Spot-check critical files. Verify that wp-config.php and .htaccess were downloaded and are not zero-byte files.
  4. Check file counts. Right-click the wp-content folder on both the local and remote sides and compare the number of files and subfolders. They should match exactly.

Common Transfer Issues and Solutions:

  • Timeout errors – If the connection drops during a long transfer, increase the timeout setting in your client’s connection preferences.
  • Permission denied – If you get errors for specific files, it may be a file ownership or permission issue on the server. You may need to contact your host to resolve this.
  • Incomplete transfers – A poor internet connection can cause files to be only partially downloaded. Retrying the failed files usually resolves this.

With your files securely downloaded and verified, you have completed the first half of your manual WordPress backup.

Step 2: Manually Back Up the Database with phpMyAdmin

phpMyAdmin interface highlighting the 'Export' tab - backup wordpress manually

Your WordPress database is the heart of your site, containing every post, page, comment, user, and setting. Without it, your theme and plugin files are just an empty shell. The most common and reliable tool for managing your database is phpMyAdmin, a web-based interface available in nearly every hosting control panel.

Understanding WordPress Database Structure

A standard WordPress installation creates a set of default tables to store information. Most tables use the wp_ prefix by default, though this can be customized for security.

Core WordPress Tables:

  • wp_posts and wp_postmeta – The wp_posts table stores the main content for posts, pages, and custom post types. wp_postmeta stores additional data (metadata) for each post, such as custom fields.
  • wp_users and wp_usermeta – These tables manage user accounts. wp_users holds basic information like username and password hash, while wp_usermeta stores metadata like first name, last name, and user role.
  • wp_comments and wp_commentmeta – These store all comments left on your site and their associated metadata.
  • wp_options – This is a highly critical table that stores your site’s global settings, including the site URL, title, active plugins, theme settings, and widget configurations. A corrupted wp_options table can bring down your entire site.
  • wp_terms, wp_term_taxonomy, wp_term_relationships – These three tables work together to manage your site’s taxonomies, such as categories and tags, and link them to your posts.

Plugin and Theme Tables:
Many plugins, especially complex ones for e-commerce or security, create their own custom tables to store their data. For example, WooCommerce adds numerous wp_woocommerce_* tables to manage products, orders, and customers. A complete database backup must include these custom tables to ensure full functionality upon restoration.

Accessing phpMyAdmin

You can almost always access phpMyAdmin through your hosting provider’s control panel.

  • Through cPanel: Log into cPanel, find the “Databases” section, and click the “phpMyAdmin” icon. You will be logged in automatically.
  • Through Plesk: Steer to the “Databases” section, click on your database’s name, and then click the “phpMyAdmin” or “Webadmin” button.
  • Through other panels: Look for a section labeled “MySQL Management” or “Databases.” The process is generally similar across different control panels.

Finding Your WordPress Database

If you host multiple sites on one account, you may see several databases listed in phpMyAdmin. It is essential to back up the correct one. The definitive way to identify your site’s database is by checking its configuration file.

  1. Open wp-config.php from the file backup you just downloaded.

  2. Locate the database settings near the top of the file:

    define('DB_NAME', 'your_database_name');
define('DB_USER', 'your_db_username');
define('DB_PASSWORD', 'your_db_password');
define('DB_HOST', 'localhost');
$table_prefix = 'wp_';

  3. The value of DB_NAME is the exact name of the database you need to select in phpMyAdmin.

Comprehensive Database Export Process

Selecting and Configuring the Export:

  1. Once inside phpMyAdmin, click on your database name in the left-hand sidebar. The main panel will now show a list of all the tables within that database.
  2. Click the “Export” tab at the top of the page.
  3. On the Export screen, choose the “Custom – display all possible options” export method. The “Quick” method often works, but the Custom method gives you critical control for ensuring a reliable backup.

Configuring Export Options:

  • Tables: Ensure all tables are selected. By default, they should all be highlighted. This is crucial for a complete backup.
  • Output:
    • Format: Keep this set to SQL.
    • Compression: Select gzipped. This will significantly reduce the file size of your backup (often by 80-90%) and make it faster to download.
  • Format-specific options:
    • Structure: Check the box for Add DROP TABLE / VIEW / PROCEDURE / FUNCTION / EVENT statement. This is extremely important. It ensures that when you restore, any existing tables are removed first, preventing data conflicts and errors.
    • Check the box for Add CREATE DATABASE / USE statement. This makes restoration slightly easier by including the command to create and select the database.
  • Object creation options:
    • Check Add IF NOT EXISTS. This is a safety measure that prevents errors if you are restoring a table that somehow already exists.
    • Check Enclose table and column names with backticks. This is another safety measure that prevents conflicts with reserved SQL keywords.
  • Data creation options:
    • Select Complete inserts. This creates a more verbose but more reliable insert statement for each row of data.
    • Check Use hexadecimal for BLOB. This ensures that any binary data stored in your database is preserved correctly.

Executing the Export:

  1. Double-check your settings one last time.
  2. Scroll to the bottom of the page and click the “Go” button.
  3. phpMyAdmin will process the database. For large sites, this may take a minute or two. Be patient and do not steer away from the page.
  4. Your browser will automatically prompt you to download the backup file. It will be named something like your_database_name.sql.gz.
  5. Save this file into the database subfolder you created earlier.

Validating Your Database Backup

An unverified backup is not a real backup. Take a moment to ensure the file is valid.

  1. Check the file size. A 0 KB file indicates the export failed. A typical blog’s database might be 5-20 MB compressed, while a large e-commerce site could be over 100 MB.
  2. Decompress the file. Use a tool like 7-Zip (Windows) or The Unarchiver (Mac) to extract the .gz file. This should produce a .sql file. If it extracts without errors, the file is likely not corrupt.
  3. Inspect the SQL file. Open the .sql file in a plain text editor (like Notepad++, VS Code, or Sublime Text, not Microsoft Word).
    • It should begin with comments like -- phpMyAdmin SQL Dump.
    • It should contain CREATE TABLE statements for your WordPress tables (e.g., CREATE TABLEwp_posts“).
    • It should contain INSERT INTO statements with your site’s data. Search for your site’s URL or the title of a recent blog post to confirm your content is present.
    • It should end with a comment like -- Dump completed on ....

Alternative Method: Using SSH and mysqldump

For advanced users with SSH access, using the mysqldump command-line utility is a faster and scriptable alternative to phpMyAdmin.

  1. Connect to your server via SSH.

  2. Run the following command, replacing the placeholders with your actual database credentials from wp-config.php:

    mysqldump -u DB_USER -p DB_NAME > manual_backup_$(date +%F).sql

  3. The system will prompt you for your DB_PASSWORD. After entering it, the command will create a complete SQL backup file in your current directory.

Pros: Extremely fast, can be automated with shell scripts, not subject to web server timeouts.
Cons: Requires command-line access and knowledge, less user-friendly than phpMyAdmin.

Your complete manual backup, consisting of the verified files and the verified database export, is now ready. Store it safely according to the 3-2-1 rule, and you can rest assured that you have full control over your site’s destiny.