To restore a WordPress backup, you put back two things: the site’s files (especially the wp-content folder) and its database. You can do this through your hosting control panel, with a backup plugin such as UpdraftPlus, or by hand with File Manager and phpMyAdmin. This guide covers all three methods, plus what to check before and after you restore.
What a WordPress backup contains
A complete WordPress backup has two parts. You need both for a full restore:
- Files: WordPress core files, the wp-config.php settings file and the wp-content folder, which holds your themes, plugins and uploaded media.
- Database: your posts, pages, comments, users, menus and settings, usually exported as a .sql file.
Restoring only the files gives you old themes and images with current content. Restoring only the database gives you old content with current files. Mismatches can break the site, so restore both from the same date unless you know exactly what you need.
Before you restore
- Take a backup of the site as it is now. If the restore goes wrong, you can return to the current state.
- Choose the right restore point. Pick the most recent backup taken before the problem started. If the site was hacked, the infection may be older than you think.
- Check the backup is complete. Make sure you have both files and database, and that the archive opens.
- Note any changes since the backup. New orders, form entries, comments or posts made after the backup date will be lost when the database is restored. Export them first if you need them.
Method 1: Restore from your host’s backups
Many hosts take automatic backups of your account. On cPanel hosting this is usually the quickest way to restore, because the backup includes both files and databases.
- Log in to cPanel.
- Open the backup tool your host provides. This may be JetBackup or the cPanel Backup tool.
- Choose the date to restore from.
- Restore the website’s home directory files, or just the public_html folder for the site.
- Restore the WordPress database from the same date.
- Wait for the restore to finish, then test the site.
Tremhost web hosting and managed WordPress plans include daily backups. The Help Centre has a step-by-step guide to restoring from a backup.
Method 2: Restore with UpdraftPlus
UpdraftPlus is a widely used WordPress backup plugin. If it made your backups, it can restore them from inside the WordPress dashboard.
- Log in to WordPress and go to Settings > UpdraftPlus Backups.
- Scroll to Existing backups. Backups stored on the server or in a connected remote store such as Google Drive or Dropbox appear here. If not, use Rescan remote storage, or Upload backup files to add backup files you have saved.
- Click Restore next to the backup you want.
- Choose the components to restore: plugins, themes, uploads, others and the database. For a full restore, select all of them.
- Follow the prompts. UpdraftPlus downloads the files if needed, then restores each part.
- When it finishes, log in again. You may need to use the username and password that existed at the time of the backup.
If you cannot log in to WordPress at all, install a fresh copy of WordPress, install UpdraftPlus, upload the backup files and restore from there.
Method 3: Restore manually
Use this method when you have a file archive and a .sql database export, or when a plugin cannot run.
Restore the files
- Open cPanel File Manager, or connect by SFTP.
- Rename the current site folder (for example public_html to public_html_old) so you keep a copy.
- Create a new folder with the original name and upload your backup archive into it.
- Extract the archive. Check that wp-config.php and the wp-content folder are in the right place.
Restore the database
- In cPanel, open phpMyAdmin and select the WordPress database.
- Export it first as a safety copy.
- Drop the existing tables, or create a new empty database.
- Use Import to upload the .sql file from your backup.
- Open wp-config.php and check that DB_NAME, DB_USER, DB_PASSWORD and DB_HOST match the database and user you are using.
If you restore to a different domain, you also need to update the site address in the database. Use a search-and-replace tool that handles serialised data, rather than a plain text replace.
After you restore
- Clear caches. Clear any caching plugin, server cache and CDN cache so visitors see the restored version.
- Save permalinks. Go to Settings > Permalinks and click Save to rebuild the rewrite rules if inner pages show 404 errors.
- Test the site. Check the home page, a few inner pages, forms, checkout and the admin area.
- Update everything. An old backup may contain old plugin versions. Update WordPress, themes and plugins.
- If you were hacked, close the hole. Change all passwords, including database and hosting passwords, remove unknown admin users and fix the vulnerability. Otherwise the attacker can get back in the same way.
Frequently asked questions
Will restoring a backup delete my recent changes?
Yes. Anything added after the backup was taken, such as posts, orders or comments, is replaced when you restore the database. Export what you need first.
Can I restore only one part of my site?
Yes. You can restore just the uploads folder, a single plugin folder or only the database. Make sure the parts are compatible with each other.
Does restoring a backup remove malware?
Only if the backup was taken before the infection and you also fix the cause. Restoring a backup that already contains malware, or leaving the same weakness open, will not solve the problem.
How often should I back up WordPress?
For most business sites, daily backups kept for at least a few weeks are a sensible baseline. Online stores with frequent orders may need more frequent database backups. Keep at least one copy away from the hosting server.
Next step
If you would rather not handle updates, backups and restores yourself, Tremhost Managed WordPress includes daily backups, updates tested on staging, and malware scanning and removal. If your site is already hacked, start with Armor SOS for free same-day triage.
