How to back up a website (files, database and restore test)

Quick answer: what does a full website backup contain?

A website is made of two parts that live in different places. Missing either one means you cannot rebuild the site.

• Files: your pages, theme, plugins, images, uploads and configuration files (for example wp-config.php on WordPress).
• Database: your actual content and settings. On WordPress this includes posts, pages, users, orders and plugin settings. On a custom system it holds customers, invoices, bookings and so on.

A simple static site with no database needs only files. Anything with a login, a shop, a booking form or a blog almost certainly has a database as well. If you are unsure, ask your developer or look in cPanel for a section called MySQL Databases.

Why backups matter more than most owners think

Websites are lost in ordinary ways, not just dramatic hacks. A plugin update breaks the layout. Someone deletes the wrong folder. A hosting account expires because a renewal email went to an old address. Malware encrypts or defaces files. A developer leaves and takes the only copy with them.

In every one of these cases, a recent clean backup turns a crisis into an inconvenience. Without one, you may be rebuilding from memory, or paying to recreate content that took years to write.

Full backup vs partial backup: which do you need?

Hosting control panels offer different kinds of backup, and the names confuse people.

• Full backup: a single archive of the whole account, including files, databases, email settings and configuration. It is the best for moving to a new host or rebuilding after a disaster. In cPanel it is usually found under Backup, then Download a Full Account Backup. Note that on some hosts a full backup cannot be restored by you from the panel; it is meant to be handed to a host or technician.
• Partial backup: separate downloads of your home directory, each MySQL database and your email forwarders and filters. These are easier to restore one at a time.
• Incremental backup: saves only what changed since the last one. It is efficient for large sites and is how many hosts and backup plugins work.

For most small business sites, the sensible routine is a regular automatic backup of files and database, plus a full account backup before major changes.

How to back up a website in cPanel, step by step

This is the manual method. It works on most shared hosting that uses cPanel, and is a good habit before any big change.

Back up the files

1. Log in to your hosting cPanel (usually yourdomain.com/cpanel or the link in your host welcome email).
2. Open File Manager and go to public_html (or the folder of the site you want).
3. Select everything, right-click and choose Compress. Pick Zip Archive and confirm.
4. When the zip appears, right-click it and choose Download. Check the file size is sensible, not zero.

Back up the database

1. Back in cPanel, open phpMyAdmin.
2. Click your site database in the left list. If you are not sure which one, open wp-config.php (WordPress) and look for DB_NAME.
3. Click Export, choose Quick and format SQL, then click Export.
4. Save the .sql file next to your files zip.

Or use the Backup tool

In cPanel, open Backup. Under Partial Backups you can download Home Directory and each database in one click. Under Backups you can generate a full backup and be emailed when it is ready.

If a download keeps failing or the site is very large, ask the host to create the backup and give you a link, or use FTP or SFTP with a client such as FileZilla.

How to back up a WordPress website

WordPress has a built-in problem: the files and database are separate, and the visual editor does not save either as a backup. Use one of these:

1. A backup plugin. Reputable options include UpdraftPlus, Duplicator and BlogVault. Install one, open its settings, choose a schedule, choose a remote destination (Google Drive, Dropbox or similar) and run a first backup immediately.
2. Your host backup tool, if the plan offers one, as a second layer.
3. The manual cPanel method above before major changes.

Whichever you use, make sure the plugin backs up both the database and the wp-content folder (themes, plugins, uploads). Once it runs, check that a dated file actually arrives in your cloud storage. A plugin that reports success but fails to upload is a common trap.

The 3-2-1 rule, off-server storage and naming

The 3-2-1 rule is the standard for any data worth keeping: 3 copies of your data, on 2 different types of storage, with 1 copy off-site. For a website that could look like this:

• The live site on the hosting server (copy 1).
• A scheduled backup in cloud storage such as Google Drive or Dropbox (copy 2, off-site).
• A monthly download kept on a laptop or external drive (copy 3, different media).

Never keep your only backup inside the same hosting account. If the account is suspended, hacked or deleted, the backup goes with it.

Naming and retention

Use dates in file names so you can find the right one fast, for example mysite-files-2026-10-31.zip and mysite-db-2026-10-31.sql. Keep the last 7 daily backups, the last 4 weekly ones and the last 3 monthly ones if storage allows. Older clean copies matter because some problems, like slow malware or deleted content, are noticed weeks later.

Protect the backup too. It contains customer data, so use a strong password on the storage account and turn on two-step verification.

How often should you back up your website?

Ask one question: how much new content could I afford to lose? Then back up at least that often.

• Brochure site that rarely changes: weekly or monthly, plus before every edit.
• Blog or news site: daily.
• Online shop, booking or school system with live transactions: daily at minimum, ideally several times a day for the database, because every order is new data.

Add one non-negotiable rule: always take a fresh backup before you update WordPress, a theme, a plugin, PHP or change hosting. Most disasters happen right after an update.

How to test a restore (the step most people skip)

A backup is proven only when you have restored from it. Do this at least twice a year, and after changing hosts or backup tools.

1. Create a test location, for example a subdomain like test.yourdomain.com, or a local setup if your developer uses one.
2. Upload and unzip the files backup there.
3. Create a new empty database and import the .sql file using phpMyAdmin, then update the database details in the config file.
4. Open the test site. Check the home page, images, a login, a form and, for shops, a product page.
5. Write down how long it took and what went wrong. That note is your recovery plan.

If any step fails, you have just found a problem while it was cheap to fix. Delete the test site afterwards so a copy of your customer data is not left exposed.

Who is responsible for your website backups?

Settle this in writing, because assumptions cause disasters. Typically the owner is responsible for the content, the developer for the build, and the host for the servers. Backups sit in the gap between them.

Ask your host and your developer these questions: Are backups automatic? How often? How long are they kept? Where are they stored? Can I download one myself? Who restores it, and how fast? Keep the answers somewhere you can find them. If nobody owns backups, you own them.

Website backup checklist

1. Files and database are both included.
2. Backups run on a schedule that suits how often the site changes.
3. At least one copy is stored away from the hosting account.
4. File names carry dates, and older copies are kept for a sensible period.
5. A manual backup is taken before every update or change.
6. A restore has been tested in the last six months.
7. Backup storage is secured with a strong password and two-step verification.
8. Someone is named as responsible and checks the backup log monthly.

Frequently asked questions

Written by the ICT AccessPoint team

We repair laptops and build websites and business systems. Have a question this guide did not answer? Message us.

This guide is general advice. Every device and business is different, so if you are unsure, ask a technician before you act.