How to Back Up a WordPress Site (Free and Paid Methods)

Every WordPress site breaks eventually. A plugin update goes wrong, a theme edit whitescreens the site, an account gets hacked, or a host has a bad day. None of that is rare. What decides whether it costs you an afternoon or your whole site is one thing: whether you have a backup, and whether that backup actually works.

This guide covers the four realistic ways to back up a WordPress site — free and paid — and the part most guides skip: storing the backup somewhere safe and testing that you can restore from it.

What a WordPress backup actually needs to include

A WordPress site lives in two places, and a real backup covers both:

• Files — your themes, plugins, and everything in the uploads folder (images, PDFs, media). This is the wp-content folder plus your core files.
• Database — your posts, pages, comments, users, and settings. This is the MySQL database WordPress reads on every page load.

A files-only backup cannot bring back your content. A database-only backup cannot bring back your design or your media library. If a method backs up only one half, it is not a backup — it is half a backup. Keep that test in mind for every method below.

How often should you back up?

Match the schedule to how much you would mind losing:

• Daily — active blogs, shops, membership sites, anything updated most days. This is the right default for a site that earns money or publishes regularly.
• Weekly — a brochure site or portfolio that changes a few times a month.
• Before every change — updates, new plugins, theme edits, host moves. Take a backup first, even if the last scheduled one ran an hour ago. This single habit prevents most disasters.

Storage is cheap. Regret is not. When in doubt, back up more often.

Method 1: Your host's built-in backups (free, and the easiest start)

Most decent hosts take automatic backups of your account — the question is what they actually keep. Log in to your hosting panel and check three things: how often backups run, how many restore points are kept, and whether restoring is free or charged.

Hostinger, for example, includes automatic backups on its plans, with daily backups on the higher tiers and weekly backups on the lower ones. Check your own hPanel to see what your plan covers — do not assume. Some hosts keep backups for 7 days, some for 30; some let you restore with one click, others make you open a support ticket. Read our Hostinger review for the full picture of what its plans include.

Host backups are a safety net, not a plan. Your host can lose your backups in the same incident that takes down your site, and some hosts delete backups when a plan lapses. Use them — but never as your only copy.

Method 2: UpdraftPlus free (the best free option for most sites)

UpdraftPlus is the most-installed WordPress backup plugin for a reason: the free version does the whole job for a small site. Install it from the plugin directory, then:

1. Go to Settings → UpdraftPlus Backups and open the Settings tab.
2. Set a schedule — files weekly and database daily is a sensible start for an active site.
3. Pick a remote storage destination and connect it. Google Drive is the easiest for most people; Dropbox and Amazon S3 work too. This step is the whole point — a backup that stays on your server is not a backup.
4. Choose how many backups to keep (3–5 is plenty for most sites) and save.
5. Click Backup Now and check that a full backup appears in your remote storage.

Restoring is just as simple: the plugin lists your stored backups, and one click restores files, database, or both. The free version covers scheduled full backups and restores. The paid version adds incremental backups, faster restores, and extras like backing up to multiple destinations at once — worth it on a large or busy site, unnecessary on a small one.

Method 3: Manual backup (free, and worth knowing how to do)

Plugins fail. Knowing the manual route means you can rescue a site even when WordPress itself will not load. You need your hosting control panel (usually cPanel) and about ten minutes.

Back up the files

In cPanel, open File Manager, go to your site's root folder (usually public_html), select everything, and choose Compress to make a zip. Download that zip to your computer. That is your files backup.

Back up the database

In cPanel, open phpMyAdmin, select your WordPress database on the left, click Export, leave the format as SQL, and click Go. Save the .sql file next to your zip. That is your database backup.

Two files, done. The manual route has no schedule and no automation, so it only works if you actually do it — set a recurring reminder, or use it as a one-off before big changes and let a plugin handle the schedule.

Method 4: Paid backup tools (for sites that cannot afford downtime)

Free methods cover most sites. Paid tools earn their price when a site is large, busy, or business-critical:

• Jetpack Backup (formerly VaultPress) — real-time backups that record every change as it happens, plus one-click restores and a security scanner. Best for WooCommerce stores and sites that change constantly, where a daily backup would still lose a day of orders.
• BlogVault — off-site backups with staging built in, so you can test a restore on a copy of your site before touching the live one. Strong on migration too: it moves sites between hosts cleanly, which is why it pairs well with our guide to migrating a WordPress site without downtime.
• UpdraftPlus Premium — the paid tier of the free plugin above. Incremental backups (only changed files, so large sites back up faster), multiple storage destinations, and priority support.

Prices change and every one of these bills yearly, so check the official pricing page before buying. The question to ask is not “which is cheapest” but “how much would a day of lost orders or content cost me?” — that number decides whether paid backups pay for themselves.

Where to store your backups

Follow the basic rule: a backup is only real if it survives the thing that destroys the original. That means:

• Off-site, always. Google Drive, Dropbox, Amazon S3, or any storage your host does not control. Same-server backups fail with the server.
• More than one place for important sites. Plugin to cloud storage plus the host's own backup is a reasonable minimum for a business site.
• Keep a few generations. Three to five recent backups cover most situations, including the case where you only notice a hack a week after it happened and the newest backup is already infected.
• Watch the size. Media-heavy sites produce large backups. If your cloud storage fills up, the schedule silently stops — check it monthly.

Test your restore (the step everyone skips)

A backup you have never restored is a hope, not a plan. Test it once, on a staging site or a spare subdomain — never on your live site:

1. Restore the backup to the staging copy.
2. Click through the site: homepage, a few posts, the media library, the login page.
3. Check that images load and the database content is all there.

If anything is missing, you have found the problem on a Tuesday afternoon instead of during a crisis. Repeat the test after any big change — a host move, a redesign, a new plugin that changes how content is stored. Our beginner's guide to starting a website covers staging setups if you have never made one.

Common backup mistakes

• Backing up files but not the database (or the reverse). Both halves, every time.
• Storing backups on the same server. One incident takes both.
• Never testing a restore. Corrupt or incomplete backups are discovered at the worst possible moment.
• Keeping only the newest backup. If the newest backup already contains the hack or the bad update, you need an older one.
• Forgetting backups before updates. Update WordPress core, themes, and plugins only after a fresh backup — this is the single most common preventable disaster.
• Letting the schedule silently stop. A full cloud drive or an expired plugin licence stops backups without telling you. Check monthly.

The bottom line

For most WordPress sites, the setup is simple: turn on your host's automatic backups, install UpdraftPlus free, point it at Google Drive on a daily schedule, and test a restore once. That costs nothing and covers nearly everything that can go wrong. Paid tools make sense when the site earns real money or changes constantly — and even then, the same rules apply: both halves, off-site, tested. A backup is the cheapest insurance a website has. Set it up this week, while the site is still fine.