How to Back Up a WordPress Site Without a Plugin (2026)

You click “Update Now” on a plugin, the screen goes white, and your site is gone. No posts. No pages. No store. Just a blank page and a sinking feeling in your stomach.

That is the moment every WordPress owner dreads — and the moment a backup turns from a boring chore into the most valuable file you own. Learning how to backup WordPress site without plugin tools takes about 15 minutes, costs nothing, and gives you a way back.

What a Complete WordPress Backup Includes

A WordPress site lives in two places at once, and a WordPress backup without plugin tools must capture both. Your files are everything on the server: themes, plugins, uploaded images, and configuration files. Your database holds your posts, pages, comments, users, and settings.

As WordPress.org notes, downloading your files usually does not back up the database, because the database lives outside it.

Here is the rule that saves sites: files without the database give you a pretty shell with no content. A database without the files gives you content with no design or images.

How to Backup WordPress Site Without a Plugin: Step 1 — Export the Database

Start with the database. This is the phpMyAdmin export WordPress database step, and it takes about two minutes.

First, find your database name in wp-config.php (the DB_NAME line) and copy it exactly.

Then follow these steps:

1. Open phpMyAdmin from your hosting panel, usually under Databases or MySQL in cPanel.
2. Click your WordPress database name in the left-hand column.
3. Click the Export tab at the top.
4. Choose Quick export, keep the format as SQL, and click Go.
5. Save the .sql file with a dated name, for example techcoff-database-2026-11-13.sql.

Quick vs. Custom? Quick suits most sites. Use Custom only for large databases: keep all tables selected, SQL format, tick “Add DROP TABLE”, and pick gzip compression. Warning: phpMyAdmin struggles with very large databases. If the export times out, ask your host for a mysqldump export instead.

Step 2 — Download Your Files With SFTP or File Manager

With the database safe, now grab the files. Use an SFTP client such as FileZilla, or your host’s built-in File Manager.

Download these, in this order of importance:

• wp-content/ — your themes, plugins, and uploads. This is the irreplaceable heart of your site.
• wp-config.php — your database credentials and settings.
• .htaccess — your redirects, security rules, and permalink settings. It is a hidden file, so set your file manager to show hidden files.

What can you skip? The wp-admin/ and wp-includes/ folders hold core WordPress files you can re-download fresh from WordPress.org any time.

Real-world example: A food blogger’s theme update broke her recipe plugin, but her manual backup from that morning restored the site in under 20 minutes — and she lost nothing.

Step 3 — Bundle It, Label It, and Move It Offsite

A backup sitting on the same server as your live site is not a backup. If the server fails or gets hacked, both copies die together.

Bundle everything into one dated zip, then move it offsite — to your computer, an external drive, or cloud storage. Keep at least one copy somewhere your hosting account cannot touch.

The WordPress 3-2-1 Backup Rule

The WordPress 3-2-1 backup rule comes from guidance published by CISA, the US Cybersecurity and Infrastructure Security Agency:

• 3 copies of your important data — the live site plus two backups.
• 2 different storage media — for example, your computer’s drive plus cloud storage, so one hardware failure cannot take out everything.
• 1 copy offsite — stored away from your main location, so a fire, flood, theft, or server-wide failure cannot reach it.

Each copy covers a different failure.

The cPanel Backup Wizard Shortcut

If your host uses cPanel, the Backup Wizard is a fast way to backup WordPress manually without installing anything.

1. In cPanel, open Backup Wizard under Files.
2. Click Back Up, then choose Full Backup.
3. Download the archive and store it offsite, just as you would a manual backup.

Caution: cPanel full backups are for archival use and cannot always be restored through cPanel, so keep your manual backup too.

Host One-Click Backups: Hostinger, SiteGround, Kinsta, and WP Engine

Many hosts include their own backup tools — even so, keep a manual copy for yourself.

• Hostinger: weekly automatic backups (daily on higher tiers), plus one-click restore.
• SiteGround: daily backups kept 30 days, one-click restore.
• Kinsta: daily backups kept 14–30 days, plus manual backup points.
• WP Engine: daily backups, one-click restore, manual backup points.

Catch: host backups are not fully yours. Retention windows expire, and a suspended account can lock you out. Use host backups as one layer, and your manual copy as the layer you control.

How to Restore WordPress Backup Files (and Test the Restore)

Here is the full restore:

1. Create a fresh database in your hosting panel, plus a database user with full privileges.
2. Upload your files via SFTP or File Manager. Restore wp-content/, wp-config.php, and .htaccess first.
3. Update wp-config.php with the new database name, username, and password if they differ.
4. Import the database. Open phpMyAdmin, select the new (empty) database, click Import, choose your .sql file, and click Go.
5. Visit your site and test it. Check the homepage, a post, and the login page.

Test your restore before you need it on a staging site or subdomain. A backup you never restored is a hope, not a backup. A corrupt zip or half-finished export can turn it into a useless file.

Common Restore Errors and How to Fix Them

• “Table already exists” on import: Empty the target database first, or re-export with “Add DROP TABLE” ticked.
• “File too large” or import timeout: Compress the .sql file, or ask your host to import it via command line.
• White screen after restore: Rename the plugins folder via SFTP to disable all plugins, then reactivate them one by one.
• “Error establishing a database connection”: Double-check the database name, username, password, and host in wp-config.php.
• Images missing after restore: Check wp-content/uploads/ is complete, and update the site URL if you moved domains.

If a restore fails twice, get help from your host’s support team. If your site was hacked, back up first, then clean it — see our guide to removing malware from WordPress without a plugin.

Manual vs. Plugin vs. Host Backup: Which One Wins?

Use two of them: a plugin for scheduled backups, and a manual backup for control and a copy no plugin or host can lock away.

How Often Should You Back Up WordPress?

It depends on how often your site changes:

• Daily: WooCommerce stores, membership sites, and news sites.
• Weekly: Active blogs that publish once or twice a week.
• Monthly: Small brochure or portfolio sites that rarely change.
• Always, right now: Before any update, migration, or edit to wp-config.php or .htaccess.

The simplest rule: back up as often as you would hate to lose work. Pair backups with our no-plugin security checklist.

FAQ: How to Backup WordPress Site Without a Plugin

How do I back up my WordPress site without a plugin?

Export your database in phpMyAdmin (Quick, SQL), download wp-content/, wp-config.php, and .htaccess, then bundle both together and store a copy offsite. It takes about 15 minutes.

What does a WordPress backup include?

Two parts: your WordPress files and a full database export. One without the other is incomplete.

How often should I back up WordPress?

Daily for stores and busy sites, weekly for active blogs, monthly for rarely updated sites — and always before updates or migrations.

Where should I store my WordPress backups?

Three copies, on two media types, with one offsite — one on your computer or an external drive, another in cloud storage.

Your 15-Minute Backup Is Your Site’s Insurance Policy

You now know how to backup WordPress site without plugin tools — database export, file download, offsite storage, and a tested restore. Fifteen boring minutes can save you weeks of rebuilding, and the sick feeling of watching years of content vanish.

Do it today, before the next update — not after the next disaster.

Need help? See our WordPress security services or contact us.