How to Backup a WordPress Site Manually: A Step-by-Step Guide

Introduction

In the digital ecosystem, data sovereignty is paramount. For website owners and developers, understanding how to backup a WordPress site manually is not just a technical skill—it is an essential insurance policy against catastrophic data loss. While the WordPress repository is flooded with automated backup plugins, relying solely on third-party software introduces dependencies that can fail when you need them most. A manual backup ensures you possess a pristine, unaltered copy of your digital asset, encompassing both the file system and the database, independent of your dashboard’s accessibility.

Imagine a scenario where a plugin update triggers a fatal error, locking you out of your WordPress admin panel (wp-admin). In such instances, backup plugins located inside the dashboard become inaccessible. A manual backup strategy, executed via File Transfer Protocol (FTP) and phpMyAdmin, guarantees that you retain total control over your restoration process. This cornerstone guide will walk you through the granular steps of securing your website’s architecture, ensuring that your hard work is preserved against hacking attempts, server failures, and human error.

The Anatomy of a WordPress Backup

To successfully perform a manual backup, one must first understand the architecture of the Content Management System (CMS). A complete WordPress backup consists of two distinct but inseparable components:

• The File System: This includes your WordPress core installation files, the wp-config.php file (which holds your database connection credentials), the .htaccess file (handling server directives and permalinks), and the critically important wp-content folder. The wp-content directory houses your themes, plugins, and media uploads.
• The MySQL/MariaDB Database: The database is the brain of your website. It contains every post, comment, user profile, site setting, and plugin configuration. Without the database, your files are merely a shell with no content.

Backing up only one of these components results in an incomplete backup. If you have the files but not the database, you have a design without words. If you have the database but not the files, you have words without a structure to display them. This guide addresses both.

Prerequisites for Manual Backup

Before initiating the backup process, ensure you have the necessary tools and access credentials. Preparation is key to a smooth workflow.

1. FTP/SFTP Client

You will need a reliable File Transfer Protocol client to access your server’s file system. FileZilla is the industry standard for this task, offering a robust interface for transferring large quantities of files securely. Alternatives include Cyberduck or WinSCP.

2. Web Hosting Control Panel Access

Access to your hosting provider’s control panel (commonly cPanel, Plesk, or a managed hosting dashboard) is required to access the database management tool, typically phpMyAdmin.

3. FTP Credentials

You must have your FTP Host (server IP), Username, Password, and Port number (usually 21 for FTP or 22 for SFTP). These are often found in the welcome email from your host or within the hosting dashboard.

4. Sufficient Local Storage

Ensure your local machine or external hard drive has enough space to accommodate the full size of your website. Large sites with high-resolution media libraries can be several gigabytes in size.

Step 1: Backing Up WordPress Files via FTP

The first phase of the manual backup involves downloading the physical files from your web server to your local computer. This process creates a mirror image of your site’s directory structure.

Connecting to the Server

Open your FTP client (e.g., FileZilla). Enter your Host, Username, and Password. If your server supports it, always use SFTP (Secure File Transfer Protocol) to encrypt the data during transfer. Click Quickconnect to establish the connection.

Once connected, you will see two main panes. The left pane represents your Local Site (your computer), and the right pane represents the Remote Site (your server).

Locating the Root Directory

On the Remote Site (right pane), navigate to the root directory of your WordPress installation. This folder is typically named public_html, www, or named after your domain. You will know you are in the correct folder when you see files like wp-admin, wp-content, and wp-includes.

Downloading the Files

1. Create a new folder on your computer (Left Pane) named with the date and site name (e.g., yoursite_backup_2023-10-27).
2. In the Remote Site pane, select all files and folders. You can do this by clicking one file and pressing Ctrl + A (Windows) or Cmd + A (Mac).
3. Right-click on the selected files and choose Download.

Note on Hidden Files: Ensure your FTP client is set to “Force showing hidden files.” The .htaccess file is a dot-file, meaning it is hidden by default in some systems. This file is crucial for your site’s permalink structure and security rules.

The download process may take time depending on your internet speed and the size of your media library. Ensure the transfer completes without any “Failed Transfers.” If any transfers fail, click the “Failed Transfers” tab and reset them to queue.

Step 2: Exporting the WordPress Database via phpMyAdmin

With the files secured, the next step is to export the database. This is where all your textual content and configurations live.

Accessing phpMyAdmin

Log in to your web hosting control panel (e.g., cPanel). Locate the Databases section and click on phpMyAdmin. This tool provides a graphical interface for managing your MySQL databases.

Selecting the Database

In the left sidebar of phpMyAdmin, you will see a list of databases. Click on the database associated with your WordPress site. If you are unsure which database is the correct one, you can check your wp-config.php file (which you just downloaded) and look for the line define( 'DB_NAME', 'database_name_here' );.

Exporting the Data

Once the database is selected and the table list appears:

1. Click the Export tab in the top menu bar.
2. You will see two export methods: Quick and Custom.
3. Quick Method: This is sufficient for most users. It exports the entire database in SQL format.
4. Custom Method (Recommended for Advanced Users): Select this if you need to compress the output (e.g., gzipped) or if you want to exclude specific tables (like plugin logs or transient data) to reduce size.
5. Ensure the format is set to SQL.
6. Click Go.

Your browser will download a file ending in .sql. This is your database dump. Save this file into the same local folder where you stored your WordPress files. For added security, you might want to create a subfolder named database inside your main backup folder.

Step 3: Compressing and Securing Your Backup

Now that you have the raw files and the SQL database on your local machine, it is best practice to archive them. Select the folder containing both the site files and the SQL file, and compress them into a ZIP or RAR archive. This encapsulates your backup into a single, portable file.

Redundancy: The 3-2-1 Strategy

A backup stored only on your laptop is a single point of failure. Follow the 3-2-1 Backup Rule:

• 3 total copies of your data (The live site, the local backup, and an offsite copy).
• 2 different types of media (e.g., your computer’s SSD and an external hard drive).
• 1 copy stored offsite (e.g., Cloud storage like Google Drive, Dropbox, or a dedicated storage server).

Upload your compressed backup archive to a secure cloud storage provider immediately after creation. This ensures that even if your computer is damaged and your server is hacked simultaneously, your digital asset survives.

Why Manual Backups Beat Automated Plugins

While plugins like UpdraftPlus or BackupBuddy are convenient, relying exclusively on them has downsides. Understanding how to backup a WordPress site manually gives you independence.

1. Server Resource Usage

Backup plugins run scripts on your server to zip files and dump the database. On shared hosting environments, this intense resource usage can lead to timeouts (PHP execution time limits), resulting in corrupt or incomplete backups without your knowledge.

2. Security Vulnerabilities

Plugins themselves can be vectors for security breaches. A manual backup requires no additional software on your WordPress installation, reducing your attack surface.

3. Recovery from Critical Failures

If a hack compromises your file permissions or deletes your plugin folders, your automated backup system might be disabled. A manual backup sits safely on your local device, completely immune to the chaos happening on the live server.

How to Restore Your Manual Backup

A backup is only as good as your ability to restore it. While this guide focuses on the backup process, the restoration is essentially the reverse operation.

Restoring Files

To restore files, connect via FTP, navigate to the public directory, and upload the files from your local backup folder, overwriting the existing content on the server.

Restoring the Database

To restore the database, access phpMyAdmin, select your database (or create a new empty one), click the Import tab, choose your saved .sql file, and click Go. This will populate the empty database with your saved tables and data.

Common Pitfalls to Avoid

Even with manual backups, errors can occur. Here are common mistakes to watch out for:

• Ignoring the .htaccess file: Failing to backup this file can break your site’s URL structure upon restoration.
• Incomplete Transfers: Always verify that the file count on your local drive matches the remote server.
• Database Character Sets: When exporting, ensure the character set is compatible (usually UTF-8) to avoid garbled text upon restoration, especially for non-English sites.
• Forgetting Media Files: Sometimes users only backup the theme folder, forgetting that the uploads folder contains years of images and documents. Always backup the entire wp-content directory at a minimum.

Frequently Asked Questions

1. How often should I perform a manual backup?

The frequency depends on how often your site is updated. For a static brochure site, once a month may suffice. For a high-traffic e-commerce store or a news blog, daily or even real-time backups are recommended. However, for manual backups, a weekly schedule is a good baseline for active sites.

2. Can I use cPanel File Manager instead of an FTP client?

Yes, you can. The cPanel File Manager allows you to select files, compress them into a zip archive on the server, and then download that single zip file. This is often faster than downloading thousands of small files via FTP. However, FTP is more reliable for very large transfers that might time out via a browser download.

3. Does a manual backup include my emails?

No. A manual WordPress backup strictly covers the website files and the database. Email accounts and messages are usually stored in a different directory on the server (often /mail) and are not part of the WordPress installation. You need to backup your email directories separately if you want to save them.

4. What happens if my database is too large to import via phpMyAdmin?

phpMyAdmin often has upload limits (e.g., 50MB). If your SQL file exceeds this, you may need to increase the PHP upload limits in your server settings, use the command line (SSH) to import the database, or use a tool like BigDump which staggers the import process to avoid timeouts.

5. Is it necessary to put the site in Maintenance Mode during backup?

While not strictly necessary, it is highly recommended. If a user comments or makes a purchase while you are downloading the database, that new data might not be included in the backup, leading to data inconsistency. Using a maintenance mode plugin ensures the database state remains static during the export process.

Conclusion

Mastering how to backup a WordPress site manually is a rite of passage for every serious website owner. It demystifies the technology behind your content and provides the ultimate safety net. By taking the time to download your core files via FTP and export your MySQL database via phpMyAdmin, you ensure that your digital presence is resilient, portable, and secure. Do not wait for a server crash or a malicious attack to test your preparedness. Implement a routine manual backup strategy today, and gain the peace of mind that comes with knowing you have full control over your data.