How to make a backup of a WordPress site and restore it

One day an update broke the theme, a plugin deleted pages or the site simply stopped opening. On that day what matters is whether you have a fresh backup of the WordPress site and whether you know how to restore it.

In this guide you see what goes into a full backup and what your host may already copy automatically. Then you make your own backup from cPanel, from WP Toolkit or with a plugin, keep one copy outside the hosting and test the backup on a copy of the site in a subdomain. At the end come the steps for a real restore and a checklist.

What goes into a WordPress site backup?

A site has two parts and you need both. The files are the themes, the plugins, the uploaded images and the files wp-config.php and .htaccess. The database holds the pages, the posts, the comments, the users and the settings. It lives separately from the site folder, so an archive of the folder does not contain it.

The WordPress core does not have to be in the backup, because you can download it again. The folder wp-content deserves the most attention, with the themes, the plugins and the uploaded images. The file wp-config.php holds the details of the connection to the database.

How often should you back up? According to the WordPress documentation, once a week for a small site with few posts and every day for a site with many changes. And always before an update or a move.

What is already copied automatically?

Many hosts copy the files and the database of the site automatically. Check the description of the service or ask your host's support how often this happens, how long the copies are kept, whether they are on another machine and whether you can restore them yourself. A copy on the same server as the site does not help if the server itself fails.

An automatic copy does not know that you are about to change the theme or update a plugin. So before such a change you make your own fresh copy as well. The WordPress documentation advises everyone to learn how to back up and restore their own site, and to check the automatic backups from time to time with a manual one, to be sure the process works.

How to make a backup from cPanel

In the Files section of cPanel there are two icons, Backup and Backup Wizard. Backup Wizard leads you step by step, so start with it.

1. Open Backup Wizard, press Back Up and choose Home Directory.
2. In the Download section press the file name to download it. This is a .tar.gz archive with everything in your account, including public_html and the mail, so it can be large.
3. Go back, press Back Up again and choose MySQL Databases. Download the backup of the site's database.
4. Keep the two files together.

If you have Terminal in cPanel, you can back up only the site, without the mail and the other folders of the account. Terminal shows up only if the hosting has turned it on, and cPanel warns that a command can break the account, so copy the commands exactly.

# cPanel > Terminal. The backup folder is outside public_html.
mkdir -p ~/backups
cd ~/public_html
wp core version
wp db export ~/backups/primer.bg-db-2026-09-24.sql --add-drop-table
cd ~
tar -czf ~/backups/primer.bg-files-2026-09-24.tar.gz \
  --exclude=public_html/wp-content/cache public_html
ls -lh ~/backups

The command wp core version only shows the WordPress version and proves that you are in the right folder. The database export uses the details from wp-config.php. The folder wp-content/cache is excluded because cache plugins create it again. If Terminal says that wp is not found, download the database from Backup Wizard.

A backup from WP Toolkit

WP Toolkit gathers your WordPress sites in one place. In cPanel open the Domains section, then WP Toolkit, find the site, press Back up / Restore and then Back up. According to the WP Toolkit documentation the backup is of the single site, not of the whole account, so it is handy right before an update. How to use WP Toolkit in general is described in the guide How to use WP Toolkit in cPanel for updates and backups.

The copies are saved as files in a folder named wordpress-backups and you can download them from File Manager. Restoring is done from the same place with the restore icon and the Restore button. WP Toolkit warns that restoring removes all the changes made after the date of the backup, and advises you to make a backup of the current state first.

A backup plugin such as UpdraftPlus

A plugin is useful when you want the backup to run by itself on a schedule and go to another place. UpdraftPlus makes backups, restores and moves a site. Its free version sends the copies to Dropbox, Google Drive, Amazon S3 or a compatible store, Rackspace Cloud, FTP, DreamObjects, OpenStack Swift or email.

Install it, open Settings, then UpdraftPlus Backups and the Settings tab. Choose a schedule in Files backup schedule and Database backup schedule. In Choose your remote storage pick a store, connect it by the instructions and press Save Changes. Then, in the Backup / Restore tab, press Backup Now.

Where to keep the copies

WordPress advises keeping at least three recent backups and storing them in different places, for example on the hosting, in cloud storage such as Google Drive or Dropbox, and on your own computer. That way one damaged or lost backup does not leave you with nothing.

Download the archives from File Manager (Download works for files) or with an FTP client, and put the date in their names. The archive contains wp-config.php with the database password, so keep it somewhere only you can reach. Do not pile up old archives on the hosting, because cPanel warns that a backup of an account close to its quota may fail.

How to test the backup on a copy in a subdomain

A backup you have not restored at least once is only an assumption. The safest test is a copy of the site in a subdomain, where the live site is not touched.

Create a subdomain and an empty database

In cPanel open Domains and press Create A New Domain. Enter test.primer.bg and do not tick Share document root, because that setting is permanent and the subdomain would show the same site as the main one. Note the folder in the Document Root field. Until a certificate is issued for the subdomain, cPanel uses a temporary self-signed one and the browser may warn you.

Then open the Databases section and there Manage My Databases (MySQL Databases in older versions). Create a new database with Create Database and a new user with Create User, and connect them in Add User To Database with ALL PRIVILEGES. cPanel may put a prefix with the account name in front of the names, and you use the full names in wp-config.php.

Load the backup into the copy

The next commands put the files into the subdomain folder. If cPanel suggested another folder, use that one.

# cPanel > Terminal. Unpacks the files into the folder of the copy.
mkdir -p ~/public_html/test.primer.bg
tar -xzf ~/backups/primer.bg-files-2026-09-24.tar.gz \
  -C ~/public_html/test.primer.bg --strip-components=1

Open wp-config.php of the copy in File Manager with Edit (to see .htaccess, turn on Show Hidden Files from Settings) and put in the details of the new database. If the file has WP_HOME or WP_SITEURL, change them to the address of the copy.

// wp-config.php of the copy (not of the live site)
define( 'DB_NAME', 'ACCOUNT_test' );
define( 'DB_USER', 'ACCOUNT_test' );
define( 'DB_PASSWORD', 'THE_NEW_PASSWORD' );

# cPanel > Terminal, in the folder of the copy. Read-only, changes nothing.
cd ~/public_html/test.primer.bg
wp config get DB_NAME

The command should show the name of the new database. Only then load the backup and change the addresses.

# cPanel > Terminal, in the copy folder. Loads the data, fixes addresses.
cd ~/public_html/test.primer.bg
wp db import ~/backups/primer.bg-db-2026-09-24.sql
wp search-replace 'https://primer.bg' 'https://test.primer.bg' \
  --skip-columns=guid --dry-run
wp search-replace 'https://primer.bg' 'https://test.primer.bg' \
  --skip-columns=guid

The first replace uses --dry-run and only shows what would change. WP-CLI takes care of serialized data, and according to WordPress a plain replace in the database can break it. Without the replace, the copy would load the images from the live site and hide the missing files.

Without WP-CLI, unpack the archive with Extract in File Manager and move the contents of the inner public_html folder into the subdomain folder. Load the database through phpMyAdmin (choose the database, then Import, Browse and Go) and change the addresses with a plugin such as Better Search Replace, which WordPress recommends in its guide to moving a site. phpMyAdmin cannot handle large databases.

Lock and check the copy

The copy is a full site with the same data, so lock it. In the admin of the copy open Settings, then Reading, and tick Discourage search engines from indexing this site. This only asks search engines not to index it, and WordPress states that it does not stop access.

So also add a password through Directory Privacy in the Files section of cPanel. Choose the subdomain folder, tick Password protect this directory, give it a name and press Save, then create a user with a password.

Then log in to /wp-admin of the copy, open a few pages and check whether the images show, whether the forms work and whether the plugins are in place. If everything is fine, the backup is good. Do not send emails and do not take payments from the copy. When you finish, delete the subdomain, its folder and its database, taking care not to touch the live site.

How to restore the site from a backup

Before you restore anything, make a backup of the current state, even if it is broken, the same way as above and with a new date in the names. That way you can go back even from the restore itself if something goes wrong. WordPress advises restoring the files first and then the database.

The commands below put the files from the archive over the live site and then load the database. Run them only after a backup of the current state.

# cPanel > Terminal. Files first, then the database of the live site.
cd ~
tar -xzf ~/backups/primer.bg-files-2026-09-24.tar.gz
cd ~/public_html
wp db import ~/backups/primer.bg-db-2026-09-24.sql

After the restore, clear the cache of the cache plugin and, if you use Cloudflare, its cache as well. If inner pages return 404, open Settings, then Permalinks, because just opening that screen refreshes the address rules. If you see Error establishing a database connection, the database details in wp-config.php from the backup may differ from the current ones. Fix them in the file.

Checklist

• The backup has both the files and the database.
• Backups are not kept in public_html.
• There is at least one copy outside the hosting.
• A fresh backup is made before every update or PHP change.
• The backup has been restored at least once on a copy in a subdomain and the site came up.
• The copy in the subdomain is locked with a password and then deleted together with its database.
• The automatic backups are checked from time to time with a manual one.
• You know which method you will use to restore, and where the files are.

If you do not want to do it yourself

A small site that rarely changes does not need a manual backup every day. Start with a copy before every update and check the restore from time to time.

If you would rather not think about backups, with WordPress maintenance we set up backups outside the server, and for a site on shared hosting monthly maintenance includes backups every month, together with the updates.

Sources

• WordPress, WordPress Backups
• WordPress, Backing up your database
• WordPress, Backing up your WordPress files
• WordPress, Moving WordPress
• WordPress, FAQ My site was hacked
• WordPress, Settings Reading screen
• WordPress, Settings Permalinks screen
• WP-CLI, wp core version
• WP-CLI, wp db export
• WP-CLI, wp db import
• WP-CLI, wp search-replace
• WP-CLI, wp config get
• cPanel, Backup Wizard
• cPanel, Backup
• cPanel, Terminal
• cPanel, File Manager
• cPanel, Create a New Domain
• cPanel, MySQL Databases
• cPanel, Directory Privacy
• cPanel, WP Toolkit
• Plesk, WP Toolkit
• WordPress.org plugins, UpdraftPlus
• TeamUpdraft, How to back up with UpdraftPlus
• TeamUpdraft, Where UpdraftPlus backups are stored
• TeamUpdraft, Restore a WordPress site with UpdraftPlus
• WordPress.org plugins, Better Search Replace