How to Backup in WordPress: Step-by-Step Guide

WordPress backups are the single most important insurance policy for your website. A backup is a complete copy of your site—database, files, theme, plugins, and content—stored separately from your live server. Without backups, a hacked site, corrupted database, or failed update can destroy months of work in seconds. This step-by-step guide walks you through every backup method, from one-click plugin solutions to manual server-level backups, so you can choose what works best for your SA business.

At HostWP, we handle backups differently: every client gets daily automated backups as standard, stored on separate Johannesburg infrastructure. But whether you're on managed hosting or shared hosting elsewhere, understanding how backups work—and testing them—is non-negotiable. I've seen too many SA sites lose critical business data because their only backup was a promise, not a reality.

Understanding WordPress Backup Basics

A complete WordPress backup consists of two parts: your database and your file system. The database stores all your posts, pages, comments, settings, and user data. The file system includes your WordPress core files, themes, plugins, and uploaded media (images, PDFs, documents). You need both to fully restore your site.

Many SA sites fail at backup strategy because they only back up the database, forgetting custom theme edits or plugin configurations stored in files. Think of it like backing up your business documents but forgetting your filing system—you have the data but can't find it when you need it.

Backups also require a retention policy. Most SA sites benefit from keeping at least 7–14 days of daily backups (roughly 200 MB per backup for a typical small business site), plus one weekly backup for 4 weeks, plus one monthly for 3 months. This tiered approach balances storage costs against the risk of discovering corruption weeks later. According to WordPress security research, 74% of data loss incidents involve sites with backups less than 7 days old—meaning you need frequency, not just depth.

Automated Backups Using Backup Plugins

The fastest way to set up WordPress backups is a dedicated backup plugin. UpdraftPlus, Jetpack Backup, and Duplicator are the three most reliable choices for SA sites, each automating daily or weekly snapshots without manual work.

UpdraftPlus (Free + Premium): The most popular choice. Install it, set a daily schedule, point backups to cloud storage (Google Drive, Dropbox, Amazon S3), and forget about it. The free version backs up files and database; premium adds offsite encryption and scheduled restores. Cost: free or R250/year for premium.

Jetpack Backup: Jetpack's solution integrates with Jetpack security scanning. Automatic daily backups stored on Jetpack servers (US-based, so expect 100–150ms latency from Johannesburg during peak hours). One downside: you must use Jetpack for other features if you want backup integration. Cost: R350–500/month depending on features.

Duplicator: Excellent for creating migration snapshots or manual backup archives. Less elegant for automation than UpdraftPlus, but many developers prefer its transparency. Free version works fine for manual backups.

Faiq, Technical Support Lead at HostWP: "In my experience migrating 500+ SA WordPress sites, the most common backup failure is a plugin set to backup but never tested. I always recommend clients run a test restore within 48 hours of plugin setup—ideally to a staging environment. Too many times I've seen sites with 100 daily UpdraftPlus backups that fail to restore because credentials expired or cloud storage quota filled up."

Here's the step-by-step process for UpdraftPlus (the easiest option):

1. Log into WordPress admin. Go to Plugins → Add New.
2. Search "UpdraftPlus". Click Install Now, then Activate.
3. Click the UpdraftPlus menu (left sidebar). Go to Settings.
4. Choose backup schedule: select "Daily" under "Backup files every" and "Backup database every".
5. Under "Remote Storage", click Google Drive (or Dropbox/S3). Authorize the plugin to access your cloud account.
6. Click "Backup Now" to run an immediate backup and verify it completes.
7. Check your Google Drive—you should see an "UpdraftPlus" folder with timestamped backup files.

This entire process takes 10 minutes and costs nothing if you use free cloud storage (Google Drive gives 15 GB free).

Manual Backups via cPanel and SFTP

If you're on shared hosting without a dedicated backup plugin (or if you prefer control), manual backups via cPanel or SFTP work reliably—though they're time-intensive for regular use.

cPanel Method (Easiest for Shared Hosting): Most SA shared hosting providers (Xneelo, Afrihost, WebAfrica) offer cPanel. Log in, find "Backups" or "Full Backup", select your domain, and download a complete backup file. This single .tar.gz file contains everything. Limitations: you must do this manually every time, and backups are often slow (5–10 MB/s on Vumatel fibre, 2–3 MB/s on slower copper ADSL—common in rural SA).

SFTP Method (For Developers): More control. Use an SFTP client (FileZilla, Cyberduck, or WinSCP) to connect to your server and download your entire /home/username/public_html directory. Then export your database using phpMyAdmin (also in cPanel): go to Databases → phpMyAdmin, select your WordPress database, click Export, and download the SQL file. Store both the directory and SQL file together in a named folder like "WordPress-Backup-2025-01-15".

Manual backups should be automated via a script if you're doing them regularly. A simple cron job can download cPanel backups to cloud storage weekly—but this requires SSH access and basic Linux knowledge. For most SA small businesses, a plugin is smarter.

Storing Backups in Cloud Storage

Backups kept only on your hosting account fail if your host has a data centre fire or security breach. You must store copies offsite. Cloud storage is the cheapest way—and works globally even during South Africa's load shedding, since your backups aren't affected by local power outages.

Google Drive: Free 15 GB tier, reliable, accessible from anywhere. UpdraftPlus integrates seamlessly. One concern for POPIA compliance: Google processes your data in the US, so if you handle sensitive customer data (medical records, financial info), you'll need a POPIA Data Processing Agreement with Google. Cost: free or R199/month for 100 GB.

Dropbox: Similar to Drive. Slightly faster uploads from South Africa. Cost: free or R249/month for 2 TB.

AWS S3 or Backblaze B2: For larger sites (1+ GB backups). S3 is industry-standard but pricier (roughly R0.50 per GB stored monthly). Backblaze B2 is cheaper (R0.05 per GB) and has a Johannesburg-adjacent data centre option. Both require technical setup—not for beginners.

A typical SA small business site (20–50 GB) backing up daily to Google Drive costs nothing (backups are ~200–500 MB each, well under the 15 GB free quota). Premium options become necessary only for large ecommerce sites or agencies managing multiple client backups.

Testing and Restoring Your Backups

A backup that's never been tested is not a backup—it's a hope. I've seen SA sites with 90 days of backups that couldn't restore because the database SQL file was corrupted, or because the plugin lost cloud storage credentials.

How to Test a Backup (Without Affecting Your Live Site):

1. Create a staging environment. Most managed WordPress hosts offer free staging; shared hosts require a temporary subdomain. HostWP staging is built-in and takes 60 seconds to spin up.
2. In UpdraftPlus, go to Existing Backups → select a backup older than 3 days → click "Restore".
3. Choose to restore files and database. Let it run (5–15 minutes depending on size).
4. Check the staging site: Can you log in? Do your posts display? Does your homepage load fast?
5. If restore succeeds, delete the staging clone. Document the test in a spreadsheet (backup date, tested date, result).

Do this annually at minimum, quarterly if you run a business where downtime costs money.

Restoring a Live Site (If Disaster Strikes): If your live site is hacked or corrupted, contact your hosting provider first. If they can't help, use UpdraftPlus: Existing Backups → select a backup from before the incident occurred → Restore to Files and Database. The site should come back online within 15 minutes. If your host deleted the database, you'll need to restore database-only backups via phpMyAdmin manually.

Building Your Backup Strategy

Different sites need different backup frequencies. A personal blog might be fine with weekly backups; an ecommerce site taking orders daily needs hourly backups.

For Most SA Small Businesses: Daily backups kept for 14 days, plus weekly backups for 4 weeks, plus monthly backups for 3 months. This protects against accidental deletion (caught within 24 hours), gradual corruption (discovered within 2 weeks), and ransomware (detected before month-end). Cost: near-zero if using UpdraftPlus + Google Drive free tier.

For Ecommerce or Agency Sites: Daily backups kept for 30 days. Test restores monthly. Consider redundancy: one backup to cloud (Google Drive), one to local storage downloaded weekly via SFTP to your office computer. Cost: R250–500/month for enterprise plugins + storage.

For POPIA Compliance: If you handle customer personal data (email addresses, phone numbers, payment details), South African data protection law requires you to protect that data. Backups are part of your security control. Document your backup strategy in writing—retention period, offsite storage location, restoration SLA (how fast you'll restore if needed). Many SA companies pair backups with a DPA (Data Processing Agreement) if they use US-based cloud storage like Google Drive.

Load shedding is a real threat for SA sites. If your internet is down due to Eskom outages, you can't back up in real-time. This is one reason managed WordPress hosts matter: HostWP's Johannesburg data centre has backup power and redundant ISP connections, so backups continue even during Stage 6 load shedding. On cheaper shared hosting, you'll experience gaps.

Action: Start Today Install UpdraftPlus right now (5 minutes), authorize it to Google Drive, and run one backup. That single action protects your site more than reading 100 articles. Set a calendar reminder for next month to test the restore. Done.

Frequently Asked Questions

Q: How much storage do WordPress backups need?
A: A typical small business WordPress site with 50–100 posts, custom theme, 10–15 plugins, and 500 MB of media uses 1–2 GB per backup. Keeping 14 daily backups = 14–28 GB. Google Drive free tier (15 GB) works for weekly backups; larger sites need paid cloud storage.

Q: Can I restore a backup to a different domain?
A: Yes, but it requires extra steps. After restore, you must update wp-config.php and the WordPress database settings to point to the new domain, or the URLs will still point to the old site. UpdraftPlus Premium includes a migration tool to handle this automatically.

Q: What happens if my hosting provider deletes my backups?
A: Shared hosts aren't legally obligated to keep your backups indefinitely—they're your responsibility. This is why offsite backup (Google Drive, Dropbox, AWS) is essential. Your host's backups are for their disaster recovery, not yours.

Q: How long does it take to restore a WordPress backup?
A: For a 5 GB site on managed hosting with SSD and LiteSpeed, 10–15 minutes. On slow shared hosting, 30–45 minutes. Database restores are usually the bottleneck, not file restores. Test your specific setup to know.

Q: Can I backup just my WordPress database without files?
A: Technically yes, but don't. Database-only backups miss theme customizations, plugin settings, and uploaded files. Always backup both, or you'll lose critical data.

Sources

• WordPress Backup Best Practices – Google Search
• Backing Up Your Database – WordPress.org
• Reliable Web App Patterns – Web.dev