WordPress backup without plugin: Rock-Solid 2025

The Old-School Approach: Why Manual Backups Still Matter

WordPress backup without plugin is not just possible; for many, it’s the preferred method for gaining absolute control over a website’s safety and longevity. While the WordPress ecosystem offers a vast array of plugins for nearly every task, stepping outside that system for critical functions like backups provides a unique level of security and understanding. Here’s a high-level overview of the manual process:

Quick Manual Backup Process:

Back up your files: Connect to your server via a cPanel File Manager or an FTP client and download the entire WordPress directory structure.
Back up your database: Access your server’s database management tool, typically phpMyAdmin, and export your WordPress database as an SQL file.
Store securely: Consolidate the file archive and the database export, and save them in multiple secure, off-site locations (e.g., cloud storage, external hard drive).
Schedule regularly: Establish a consistent schedule for repeating this process, with the frequency determined by how often your site’s content is updated.

Imagine logging into your WordPress dashboard, ready to publish a new post, only to be greeted by a cryptic error message or, worse, a blank white screen. Without a recent, reliable backup, years of hard work, content creation, and community building could vanish in an instant. This scenario is far more common than many website owners realize. WordPress powers over 43% of all websites on the internet, making it an immense and attractive target for hackers, while also being susceptible to server failures, incompatible updates, and simple human error. While countless users default to plugins for convenience, manual backups offer something plugins inherently cannot: complete independence and granular control.

A manual backup strategy liberates you from potential plugin conflicts, which can crash your site, and reduces the performance overhead that some backup plugins place on your server. Most importantly, it ensures you know precisely what is being backed up and that you possess a complete, untethered copy of your digital assets. The process involves safeguarding two critical and distinct components: your website files (which include your themes, plugins, uploaded images, and videos) and your MySQL database (which stores your posts, pages, user comments, and site settings). You absolutely need both for a successful restoration; one without the other is an incomplete puzzle.

As Kevin Gallagher, founder of wpOncall with over 15 years of dedicated WordPress experience, I’ve witnessed firsthand how a disciplined WordPress backup without plugin approach provides the most robust foundation for website security. My team has successfully rescued countless websites where automated, plugin-based backup systems failed at the most critical moments, often due to a silent corruption or an overlooked configuration error.

WordPress backup without plugin glossary:

Why Regular Backups Are Your Website’s Lifeline

Your website is a dynamic, valuable asset, and like any significant investment, it demands robust protection. Regular backups serve as your website’s ultimate safety net, functioning as a comprehensive insurance policy against a wide spectrum of digital disasters. A well-executed backup and recovery strategy can swiftly resolve nearly any website catastrophe, turning a potential business-ending event into a manageable inconvenience.

Here are the primary threats that a disciplined, regular backup routine protects you from:

Hacking and Malware: Cybercriminals are constantly evolving their methods, targeting websites of all sizes for data theft, spam distribution, or simple vandalism. An attack can deface your site, inject malicious code, or steal sensitive user information. A clean, verified backup is the fastest and most reliable way to recover from a malicious attack, allowing you to restore a pristine version of your site and bypass a painstaking, expensive manual cleanup that could take days or even weeks.
Update Errors and Incompatibilities: The WordPress core, along with its themes and plugins, receives frequent updates to introduce new features and patch security vulnerabilities. However, these updates can sometimes conflict with each other or with custom code, leading to the infamous “White Screen of Death,” broken site features, or other critical errors. A backup taken right before an update allows you to instantly roll back your site to its stable, pre-update state, giving you a safe environment to troubleshoot the problem without prolonged downtime.
Costly Human Mistakes: We are all human, and errors are inevitable. Accidentally deleting a critical page, overwriting an important file, making a code change that breaks the layout, or installing a faulty plugin are common mishaps. A recent backup transforms these potential disasters into minor issues that can be corrected in minutes by restoring the affected component or the entire site.
Server and Hardware Failures: Even the most reputable hosting providers can experience technical issues. Server hardware can fail, data centers can suffer power outages, or network configurations can go awry. While hosts often have their own backup systems, having your own independent backups ensures you are never entirely reliant on their infrastructure. Their backups might not be as recent as you need, or in a worst-case scenario, their entire system (including your backups) could be compromised.
Ensuring Business Continuity: For any website that generates income, captures leads, or serves as a primary point of contact for customers, downtime directly translates to lost revenue and a damaged reputation. The ability to quickly restore your site from a backup is not just a technical requirement; it’s a fundamental component of professional business continuity planning.

While backup plugins offer undeniable convenience, a WordPress backup without plugin approach presents several compelling advantages:

Zero Plugin Bloat or Conflict: Every plugin you install adds more code to your website, increasing its complexity and creating potential for conflicts or new security vulnerabilities. A manual backup process keeps your WordPress installation lean and mean, reducing the attack surface.
Absolute Data Control and Ownership: You have complete authority over what gets backed up, the format it’s saved in, where it’s stored, and your retention policy. You are not bound by the limitations, storage options, or terms of service of a third-party plugin or service.
Future-Proof Independence: Manual backup methods are based on universal server technologies (like FTP and SQL) that will always be available. You never have to worry about a plugin developer abandoning their product, a premium service shutting down, or an update breaking your backup process.

Of course, the trade-off for this control is a greater investment of time and the need for a disciplined, consistent process. The choice between manual and plugin-based backups often comes down to your technical comfort level, available time, and the complexity of your site.

Factor	Manual Backups	Plugin Backups
Ease of Use	Requires technical knowledge (FTP, phpMyAdmin) and multiple steps.	Often feature one-click solutions with user-friendly interfaces.
Cost	Free, aside from your time investment and data storage costs.	Free versions are often limited; premium features require subscriptions.
Control	Complete, granular control over all files, database tables, and storage.	Limited to the features and options provided by the plugin developer.
Performance	Zero impact on site performance as it runs independently of WordPress.	Can consume server resources (CPU, RAM) during operation, slowing the site.
Reliability	Highly reliable, dependent only on your correct execution and consistency.	Depends on the quality of the plugin’s code and its ongoing maintenance.
Customization	Infinitely customizable; you can script any backup logic you need.	Restricted to the settings and workflows designed by the developer.

Ultimately, understanding the manual backup process is an invaluable skill for any serious WordPress site owner, even if you choose to use an automated solution. It’s analogous to knowing how to change a flat tire—you might prefer to call for roadside assistance, but possessing the knowledge and ability to do it yourself provides an unparalleled sense of security and peace of mind. For more on protecting your site, explore our guide on WordPress Backup and Security.

The Complete WordPress Backup without Plugin: A Two-Part Process

To perform a complete and restorable WordPress backup without plugin, you must back up two distinct but equally vital components: your website’s files and its database. Thinking of them as a package deal is essential; one without the other results in an incomplete and non-functional backup. Mastering this manual process not only secures your site but also gives you a much deeper understanding of its underlying architecture.

Part 1: How to Manually Back Up Your WordPress Files

Your WordPress files constitute the entire framework, appearance, and functionality of your site. This includes the WordPress core software, the critically important wp-content directory (which contains your themes, plugins, and all uploaded media like images and documents), and essential configuration files such as wp-config.php and .htaccess. There are two common and reliable methods for downloading these files from your server.

Method 1: Using cPanel File Manager

This is often the most direct and user-friendly method if your web hosting provider uses the cPanel control panel.

Log in to your hosting account’s cPanel and navigate to the File Manager application.
Navigate to your website’s root directory. This is typically named public_html, but it could also be www or named after your domain.
Inside the root directory, click Select All to highlight all files and folders.
Find and click the Compress function in the toolbar. Choose the Zip Archive format and confirm the compression. This will create a single .zip file containing your entire site.
Select the newly created .zip file (e.g., archive.zip) and click Download. Save it to a secure folder on your local computer. It’s a good practice to rename the file with the date of the backup (e.g., my-site-backup-2023-10-27.zip).

Method 2: Using an FTP/SFTP Client

An FTP (File Transfer Protocol) client is a desktop application that allows for a direct connection to your server’s file system. For security reasons, you should always use SFTP (Secure File Transfer Protocol), which encrypts the connection.

Download and install a reliable FTP client. FileZilla is a popular, free, and cross-platform option.
Obtain your SFTP credentials from your hosting provider. You will need the Host (your domain name or server IP), Username, Password, and Port (SFTP typically uses port 22).
Open your FTP client and enter your credentials to connect to the server.
In the client’s interface, you’ll see two main panels. The “Remote Site” panel shows your server’s files. Navigate to your WordPress root directory (public_html).
The “Local Site” panel shows your computer’s files. Create and navigate to a new folder where you want to store the backup.
In the “Remote Site” panel, select all files and folders, then simply drag and drop them into the “Local Site” panel. The download will begin. This can take a significant amount of time depending on the size of your site and your internet connection speed.

For robust remote backup solutions that handle this for you, consider our Remote Backup Service.

Part 2: How to Manually Back Up Your WordPress Database

Your database is the lifeblood of your website’s content. It stores all your posts, pages, user accounts, comments, portfolio items, and the settings for your themes and plugins. Without it, your site would be an empty shell. The industry-standard tool for manually managing a MySQL database is phpMyAdmin.

Log in to your hosting control panel (like cPanel) and find the phpMyAdmin icon.
Once inside phpMyAdmin, you’ll see a list of databases on the left-hand sidebar. Select the one that belongs to your WordPress installation. If you’re unsure which one it is, you can find the name by looking inside your wp-config.php file for the line defining the DB_NAME constant. You can learn more about this file from the official WordPress documentation on wp-config.php.
With your database selected, click the Export tab from the top navigation menu.
You will be presented with two export methods. The Quick method is usually sufficient for most users and will export the entire database with default settings. Ensure the Format dropdown is set to SQL.
For more control, you can select the Custom method. This allows you to choose specific tables to export (though you should almost always export all of them) and select compression options like gzipped, which is highly recommended for large databases as it significantly reduces the file size.
Click the Go (or Export) button. Your browser will download the database as a .sql (or .sql.gz) file. Save this file in the same secure folder as your website files backup.

This .sql file contains all the necessary commands to perfectly recreate your site’s content and structure within a new, empty database. For advanced database needs, check out our Backup Cloud Database Service.

A Rock-Solid Backup Strategy: Storage, Security, and Scheduling

Successfully performing a WordPress backup without plugin is a fantastic first step, but the action itself is only one piece of a larger puzzle. A truly effective backup strategy is a comprehensive plan that dictates where you store your backups, how you protect them from corruption or unauthorized access, and the frequency with which you create them. Without this strategic framework, even a perfectly created backup might be unavailable or useless when you need it most.

The 3-2-1 Rule: Your Blueprint for Secure Backup Storage

The gold standard for data protection, adopted by IT professionals worldwide, is the 3-2-1 backup rule. It’s a simple, memorable, and incredibly powerful framework for ensuring data survivability.

Keep at least 3 total copies of your data. This includes your primary data (your live website) plus at least two additional backups.
Store your backups on 2 different types of media or storage devices. This prevents a single type of failure from wiping out all your copies. For example, you might store one backup on your computer’s internal hard drive and the second on a cloud storage service.
Keep at least 1 of these copies in an off-site location. This is your protection against a localized disaster like a fire, flood, or theft that could destroy both your primary computer and any local backups.

Following this rule provides powerful redundancy. If your live site goes down, you have two backups. If your local hard drive fails, you still have your live site and your off-site cloud backup. For your off-site copy, cloud storage services like Google Drive, Dropbox, or Amazon S3 are excellent and affordable choices. For local storage, an external hard drive or a high-capacity USB drive that you can physically disconnect from your computer provides an “air gap,” which is a crucial defense against ransomware that can encrypt all connected drives.

Adhering to the 3-2-1 rule elevates a simple file copy into a robust, professional-grade disaster recovery system. For more on cloud strategies, see our Cloud Backup Ultimate Guide.

How to Secure and Verify Your Manual Backups

A backup is only valuable if it is both secure and functional. An unverified backup is not a backup; it’s a hope. Take these essential steps to ensure your backups are ready for action.

Secure Your Backups: Security starts at creation. When creating your file archive in cPanel or with a command-line tool, use a compression utility that allows you to encrypt and password-protect the .zip or .tar.gz file. This adds a critical layer of protection. When transferring files, always use a secure, encrypted protocol like SFTP instead of standard FTP. Ensure your cPanel and phpMyAdmin sessions are always conducted over a secure HTTPS connection.
Verify Your Backups: This is arguably the most critical and often-skipped step. You must periodically test your backups to confirm their integrity. The best way to do this is by restoring your backup to a staging environment. A staging site is a private, non-public copy of your website where you can test changes and restorations without affecting your live version. You can create a staging site on a subdomain (e.g., staging.yourdomain.com) or by using a local server environment on your computer (like XAMPP, WAMP, or MAMP). By performing a full restoration on this test site, you can confirm that your files are complete, your database is not corrupted, and your site can be fully brought back to life.

A verified backup provides true peace of mind, transforming anxiety into confidence. For a complete guide on preparing for the worst, read our WordPress Disaster Recovery Plan.

How Often Should You Perform a WordPress Backup without Plugin?

The ideal backup frequency is not one-size-fits-all; it depends entirely on your site’s “update velocity”—how often its content and data change.

Dynamic Sites (E-commerce, Membership, Active Blogs): These sites generate new data constantly through sales, new user registrations, posts, and comments. For these sites, daily backups are the absolute minimum. Losing even a single day’s worth of orders or user activity could be catastrophic.
Moderately Active Sites (Business/Corporate Sites, Portfolios): If you update your site with a new blog post or portfolio piece once or twice a week, then weekly backups are likely sufficient.
Static or Brochure Sites: If your site’s content rarely changes (e.g., a simple informational site), monthly backups may be adequate.

The golden rule is to answer this question: “How much data can I afford to lose without it causing a major problem?” If the answer is “one day’s worth of work,” then you need to back up daily. Furthermore, it is crucial to always perform a fresh, manual backup immediately before making any significant changes, such as updating the WordPress core, changing themes, or installing a major new plugin.

Alternative Plugin-Free Backup Methods

Beyond the foundational manual methods using cPanel and FTP, a few other plugin-free options exist that can augment your backup strategy. These methods range from convenient but limited tools provided by your host to highly advanced, automated solutions designed for technically proficient users.

Using Your Hosting Provider’s Backup Tools (as a Supplement)

Nearly all reputable web hosting providers offer some form of built-in backup tool, typically accessible from your main hosting dashboard or cPanel. These tools are often marketed as a primary feature, offering convenience and, in some cases, automatic daily backups that require zero effort on your part. They can be a lifesaver in a pinch.

However, it is critical to understand the significant limitations and risks of relying solely on these host-level backups. You typically have little to no control over the backup schedule, what specific data is included, or, most importantly, the retention policy. Many hosts overwrite their daily backups every 24 hours and may only keep one weekly or monthly copy. If you discover a problem with your site that was introduced a week ago, the clean version you need may have already been permanently deleted. Furthermore, these backups are stored on the same server infrastructure as your website. In the event of a major server-wide outage, a security breach of the hosting company, or even a billing dispute that locks you out of your account, you could lose access to both your live site and all your backups simultaneously.

For these reasons, host-provided backups should only ever be considered a secondary or tertiary safety net, not your primary backup solution. They are a helpful fallback, but your primary strategy should always involve independent backups that you control and store off-site.

For more reliable server-side strategies, explore our Cloud-based Server Backup Services.

For Advanced Users: Automating Backups with WP-CLI and Cron Jobs

If you are comfortable working with the command line, you can achieve the best of both worlds—the control of a manual backup and the convenience of automation—by using a combination of WP-CLI (the WordPress Command-Line Interface) and Cron Jobs.

This powerful, professional-grade approach allows you to execute backup commands directly on your server via an SSH (Secure Shell) connection. Instead of clicking through graphical interfaces, you use command-line tools to perform the backup. WP-CLI simplifies exporting the database, while standard Linux commands can archive your files.

Here’s a conceptual overview:

Connect via SSH: Use a terminal to securely connect to your server.
Create a Backup Script: Write a simple shell script (.sh file) that contains the necessary commands. For example:
- To back up the database: wp db export /path/to/backups/database-backup.sql
- To back up the files: tar -czf /path/to/backups/files-backup.tar.gz /path/to/public_html/
- Your script could also include commands to upload the backups to a remote cloud storage location.
Schedule with a Cron Job: A Cron Job is a time-based job scheduler in Unix-like operating systems. You can create a cron job that automatically executes your backup script at a specific interval. For example, to run the script every night at 2:30 AM, the cron entry might look something like this:
30 2 * * * /usr/bin/sh /path/to/your/backup-script.sh

This method requires solid technical skills, including familiarity with the Linux command line, shell scripting, and SSH. It is not recommended for beginners. However, for developers and system administrators, it offers an incredibly robust and customizable way to automate backups without adding any plugin overhead to WordPress. To learn more, you can explore the official WP-CLI documentation. For those who want this level of automation without the complexity, our Automatic Backup WordPress services offer a professionally managed solution.

Frequently Asked Questions about Manual WordPress Backups

Here are detailed answers to the most common questions that arise when undertaking a WordPress backup without plugin.

How do I restore my site from a manual backup?

Restoring your site is essentially the backup process performed in reverse. It requires careful execution to ensure a smooth recovery. The process involves restoring both your files and your database.

Prepare the Server: Before you begin, it’s best to delete the old, broken WordPress files from your server to ensure a clean slate. You can do this via FTP or cPanel File Manager.
Restore Files: Using your FTP client or cPanel’s File Manager, upload your .zip file archive to the now-empty WordPress root directory. Once uploaded, use the Extract function in File Manager to decompress the archive. This will restore your core files, themes, plugins, and uploads.
Restore Database: Open phpMyAdmin and select your WordPress database. It’s a good practice to first drop all existing tables from the broken database to avoid conflicts. Then, click the Import tab. Use the file chooser to select your .sql backup file from your computer and click Go. This will execute the commands in the file, recreating all your tables and restoring your content.
Update wp-config.php (If Necessary): This step is crucial if you are restoring to a new hosting environment or have created a new database. You must open the wp-config.php file and update the DB_NAME, DB_USER, DB_PASSWORD, and possibly the DB_HOST constants to match the new database credentials.
Test and Verify: After restoration, clear all server-side and browser caches. Thoroughly browse your website, checking the front-end and back-end to ensure that pages load correctly, images are present, and all functionality is working as expected.

For a more detailed walkthrough, see our guide on how to Restore a Website from Backup.

What are the biggest risks of not backing up my WordPress site?

Failing to maintain regular, verified backups is one of the most significant and avoidable risks a website owner can take. The consequences can be severe and far-reaching:

Permanent and Irrecoverable Data Loss: A catastrophic server crash, a sophisticated hacking incident, or a simple human error could permanently delete your entire website—all your content, customer data, product information, and years of work—in an instant.
Extended and Costly Downtime: Without a clean backup for a quick restore, recovering from a hack or a critical software failure becomes a slow, manual, and expensive process. This can take your site offline for days or even weeks, requiring you to hire specialists for forensic analysis and repair.
Severe Business Consequences: For any commercial website, prolonged downtime translates directly to lost revenue, a halt in lead generation, and frustrated customers. Beyond the immediate financial impact, it can cause long-term damage to your brand’s reputation, erode customer trust, and severely harm your search engine rankings as search engines de-index your offline pages.

The small, consistent investment of time required for regular backups is infinitesimal compared to the potentially devastating losses from a single site disaster.

Can I only back up my database and not the files?

No, this is a common and critical misunderstanding. A partial backup is an incomplete and non-functional backup. A WordPress site requires both its files and its database to function. They are two halves of a whole and work together as a team:

The Files provide the structure, logic, and appearance: your theme’s design, your plugins’ functionality, and your entire media library of images and documents.
The Database provides the content and configuration: all your written text (posts, pages), user data, comments, and the specific settings that tell the files how to behave.

A backup containing only files would restore to an empty, non-functional shell with no content. A backup of only the database would result in a mess of unstyled text with broken images and no theme or plugin functionality. For a successful restoration that brings your site back online exactly as it was, you must always back up both components together.

How large will my backup files be?

The size of your backup will vary greatly depending on your site. The file backup’s size is primarily determined by the wp-content/uploads folder, which contains all your media. A photography portfolio will have a much larger file backup than a simple text-based blog. You can check its size in cPanel’s File Manager. The database backup is usually much smaller, but for large e-commerce or membership sites, it can also grow to hundreds of megabytes. You can see the database size in phpMyAdmin. A typical small business site might have a 500MB file backup and a 20MB database backup.

What is the difference between a backup and a migration?

While the technical process is very similar, their purpose is different. A backup is a copy of your site created for insurance and disaster recovery purposes. Its primary goal is to restore the site to the same location in case of a problem. A migration is the process of moving a website from one server environment to another (e.g., changing hosts or moving from a development server to a live server). A migration uses a backup as the vehicle for the move, but often requires additional steps, such as changing the site’s URL in the database.

Conclusion

Embracing the process of creating a WordPress backup without plugin empowers you with ultimate control and true independence over the security of your digital assets. By diligently and manually backing up your core files and database, and by implementing a robust storage strategy like the 3-2-1 rule, you construct a genuinely reliable safety net that is not dependent on third-party code, subscriptions, or services that could fail or be abandoned.

This level of granular control is incredibly powerful, but it comes with the responsibility of discipline and consistency. The manual backup process must be performed regularly to be effective, which can be a significant challenge for busy entrepreneurs and business owners. That crucial 30-minute routine needs to become a non-negotiable habit, and the verification process must never be skipped.

We understand that not everyone has the time, technical expertise, or desire to manage their own backup infrastructure. For those who value their time and prefer a hands-off, expert-managed approach, professional services offer guaranteed peace of mind and enterprise-grade security. At wpOncall, we have been protecting and maintaining WordPress websites for over 15 years. Our dedicated team handles the daily backups, vigilant security monitoring, off-site storage, and all the technical heavy lifting, freeing you to focus on what you do best: creating content, serving your customers, and growing your business.

Your website is far too valuable to be left to chance. Whether you choose the empowered DIY route or entrust its safety to seasoned professionals, the most important thing is to take decisive action today. Get professional WordPress Backup Services and gain the confidence that comes from knowing your digital investment is truly secure.