Back up a WordPress site (files and database)

What you need before step 1

Applies to: Self-hosted WordPress (WordPress.org software) on any host with SFTP or a file manager, and phpMyAdmin or SSH

8 steps

1. 1

   Connect to the site files

   Where: Your SFTP client on your PC (new site or new connection dialog)

   Set Protocol to SFTP, enter your host (for example contoso.com), port 22 and your SFTP username and password from your hosting account, then select Connect. Browse to the WordPress folder: the one containing wp-config.php, wp-content and wp-admin (often public_html).

   You should see: The remote pane lists wp-admin, wp-content, wp-includes, wp-config.php and .htaccess.
2. 2

   Download every file

   Where: Your SFTP client: remote (server) pane

   Create an empty local folder such as contoso-backup-files in the left pane. Select everything in the WordPress folder, including wp-config.php and .htaccess (turn on the client's option to show hidden files so dot-files appear), right-click and select Download. If you have no SFTP access, use your host's file manager to compress the WordPress folder into a zip and download that instead.

   You should see: The transfer queue empties with no failed transfers, and the local folder contains wp-content (themes, plugins, uploads) and wp-config.php.
3. 3

   Option A: export the database with WP-CLI

   Where: SSH session to the web server, in the WordPress folder

   Run wp db export. With no filename it names the file {dbname}-{Y-m-d}-{random-hash}.sql; giving a name makes it easier to find. Then download the .sql file with SFTP.

   cd /var/www/contoso.com/public_html
   wp db export contoso-backup.sql

   You should see: Success: Exported to 'contoso-backup.sql'.
4. 4

   Option B: export the database with mysqldump

   Where: SSH session to the web server

   Use the database host, user and name from wp-config.php. Enter the database password when prompted. The second form compresses the file with gzip.

   mysqldump --add-drop-table -h localhost -u contoso_user -p contoso_wp > contoso-backup.sql
   mysqldump --add-drop-table -h localhost -u contoso_user -p contoso_wp | gzip > contoso-backup.sql.gz

   You should see: The command returns to the prompt and the .sql (or .sql.gz) file has a non-zero size.
5. 5

   Option C: export the database with phpMyAdmin

   Where: Hosting control panel (for example cPanel > Databases > phpMyAdmin)

   Select your WordPress database in the left pane. Select the Export tab. Choose Custom, make sure the format is SQL, tick Add DROP TABLE / VIEW / PROCEDURE / FUNCTION / EVENT / TRIGGER statement, choose gzipped compression if you want a smaller file, then select Go. (Quick export with SQL format also works.) WordPress notes phpMyAdmin cannot handle large databases; use Option A or B for those.

   You should see: Your browser downloads a .sql or .sql.gz file named after the database.
6. 6

   Keep wp-config.php safe and separate

   Where: Your PC

   wp-config.php holds the database name, user and password and the security keys. You downloaded it with the files; keep a second copy with the database export, and store the backup somewhere private because of the credentials it contains.

   You should see: You have wp-config.php in both the files backup and alongside the SQL export.
7. 7

   Store copies in more than one place

   Where: Your PC, cloud storage, external disk

   Zip the files folder and the SQL export together and name the archive with the date. WordPress recommends keeping at least three backups in different locations, for example your host, cloud storage and your computer.

   You should see: The dated archive exists in at least two places besides the web server.
8. 8

   Test the backup

   Where: Your PC, then a test or local WordPress environment

   Open the archive and confirm wp-content/uploads contains your media and the SQL file opens in a text editor and contains CREATE TABLE lines for your tables (prefix wp_ or the $table_prefix in wp-config.php). Ideally restore it to a staging or local site: copy the files back, import the SQL, update wp-config.php if the database details differ, and check the site loads.

   You should see: The test site loads with your pages, media and settings.

Expert tips

How to confirm it worked

• The local files folder size is close to the size your host reports for the site, and includes wp-content/uploads, wp-content/themes and wp-content/plugins.

• The SQL file contains CREATE TABLE statements for every table in the database (compare with the table list in phpMyAdmin, or wp db tables).

• A restore to a test site loads correctly.

How to reverse it

Errors you might see

Questions

Official sources

Vendors change menus and requirements. Confirm on the source before you rely on a detail. Last checked 4 Nov 2026.