A complete WordPress backup has two parts: the website files and the MySQL database. Files contain WordPress core, themes, plugins, media uploads, and configuration. The database stores posts, pages, users, settings, orders, and other changing site data. Without both parts, a restoration may be incomplete.
This guide shows how to create and restore both backups with cPanel. It is useful before a WordPress update, theme change, plugin installation, or major troubleshooting session. If you manage several client websites, documenting the process can also support a professional WordPress maintenance service.
What to check before creating a backup
First, confirm that you are working on the correct hosting account and WordPress installation. A single cPanel account may contain several domains, subdomains, or staging sites.
- Confirm the site’s document root, such as
public_htmlor a domain-specific folder. - Check the database name and username in
wp-config.php. - Make sure your computer has enough free space for the files archive and SQL export.
- Store downloaded backups somewhere secure, not in a publicly accessible web directory.
For an online store, consider using suitable maintenance mode if the backup needs to represent a precise point in time. This reduces the chance of new orders or customer changes occurring between the file and database backups.
Back up WordPress files in cPanel
1. Open File Manager
Log in to cPanel and open File Manager. Go to the WordPress document root. In many installations this is public_html, but the correct location may be a subfolder.
The backup should include the main WordPress directories, including wp-admin, wp-includes, and wp-content, along with files such as wp-config.php and .htaccess. Pay particular attention to wp-content, which normally contains your themes, plugins, uploads, and custom code.
2. Compress and download the files
Select the WordPress files and folders, click Compress, choose ZIP format, and create the archive. If cPanel allows it, save the archive outside the public web directory. A name such as example-site-files-2025-03-08.zip makes it easier to identify later.
Download the ZIP file to your computer and confirm that the transfer completed. Do not delete the live website files after creating the archive; the archive is a copy, not a replacement.
Export the WordPress MySQL database
1. Find the database name
In File Manager, locate wp-config.php and choose View or Edit. You will find entries similar to these:
define( 'DB_NAME', 'account_wordpress' );
define( 'DB_USER', 'account_dbuser' );
define( 'DB_PASSWORD', 'your-password' );
define( 'DB_HOST', 'localhost' );Record the value of DB_NAME. Do not publish or share the database password. The table prefix, often wp_, is also useful when confirming that you selected the correct database.
2. Export the database with phpMyAdmin
Return to cPanel and open phpMyAdmin. Select the database named in wp-config.php, open the Export tab, choose the Quick method and SQL format, then click Export.
Save the download with a clear name, such as example-site-database-2025-03-08.sql, and keep it with the matching files archive. For larger databases, the export may take longer or run into hosting limits. You may need to use phpMyAdmin’s custom export options, export tables in groups, or ask the hosting provider which method it supports.
Restore WordPress files with cPanel
A restoration can overwrite current content. Whenever possible, create a fresh backup of the existing site first. If the site still loads, record its database details and copy the current wp-config.php before replacing anything.
1. Upload and extract the archive
Open File Manager and go to the correct document root. Upload the ZIP archive, select it, and click Extract. Check the folder structure after extraction. A frequent mistake is creating an extra level, such as public_html/backup/public_html/. The WordPress files should sit directly inside the site’s document root.
If the archive contains a top-level folder, move its contents into the correct document root. Avoid deleting current files, including wp-content/uploads, until you have confirmed that the archive is the version you intend to use.
2. Check configuration and permissions
Open wp-config.php and confirm the database name, user, password, host, and table prefix. These values must match the database you plan to restore.
File permissions depend on the server, but WordPress files generally need to be readable by the web server and directories need the appropriate access for traversal. Do not apply broad, insecure permissions just to bypass an error. If ownership or permissions are incorrect, ask the hosting provider for assistance.
Restore the WordPress MySQL database
1. Create or select the destination database
In cPanel, open MySQL Databases. You can reuse the original database if it is being fully replaced. Creating a new database is often safer when you want to preserve the current site for a possible rollback.
Create the database and user if necessary, then add the user to the database with the required privileges. Update wp-config.php only if the database name, username, password, or host has changed.
2. Import the SQL file in phpMyAdmin
Open phpMyAdmin, select the destination database, and choose the Import tab. Select the matching .sql file and start the import.
If the destination already contains tables, remove or rename them only after confirming that you have a usable backup and selected the right database. Duplicate-table errors commonly occur when an import is attempted into a database that was not emptied first.
After the import, confirm that the WordPress tables exist and that their prefix matches the $table_prefix value in wp-config.php. A prefix mismatch can make WordPress appear to have no posts, pages, or settings.
Check the site after restoration
Open the site in a private browser window and test the homepage, several pages, the WordPress login, media files, forms, and important plugin features. For WooCommerce, check products, the cart, checkout, payment settings, customer accounts, and recent orders before returning the site to normal operation. These checks are particularly important when troubleshooting WooCommerce checkout problems.
- Open Settings > Permalinks and click Save Changes once to refresh rewrite rules.
- Clear page, object, CDN, and browser caches.
- Confirm that the site URL and home URL are correct.
- Check the dashboard for missing plugins, themes, or media.
- Review PHP and server error logs if the site fails to load.
If the restoration causes a critical error, temporarily disable the suspected plugin by renaming its folder in wp-content/plugins. Then review the server error log. You can also follow this guide to fix a WordPress critical error.
Secure and maintain your backups
Keep multiple backup copies, store at least one copy away from the hosting account, and protect the archives. They may contain customer data, authentication salts, and database credentials. Delete temporary ZIP and SQL files from public directories when they are no longer needed.
Do not assume that a successful download is a usable backup. Test restoration periodically, preferably on a staging site or separate environment. For recurring backups, a server cron job can automate scheduled tasks; see the guide on how to set up a real WordPress cron job in cPanel. Automation should still include retention rules and occasional manual restore tests.
Frequently asked questions
Is copying the WordPress files enough?
No. Files do not contain posts, pages, users, settings, orders, or many plugin records. A complete backup requires both the file archive and the MySQL database export.
Can I restore only the database?
Yes, provided that the existing files are compatible with the database. Restoring only the database will not recover deleted uploads, plugins, themes, or custom files.
Why does the restored site show a database connection error?
Check the database name, username, password, host, and user privileges in wp-config.php. Also confirm that the database exists in the current cPanel account.
Should I edit URLs directly in the SQL file?
Use caution. WordPress and plugins may store serialized data, so a basic search-and-replace can corrupt values. Use a compatible migration tool or another method that understands serialized data.
Conclusion
A dependable cPanel backup consists of two matching components: a complete WordPress file archive and a MySQL SQL export. Restore them carefully, verify the configuration and table prefix, and test the site’s important functions before considering the job complete. Secure storage and regular restore tests make cPanel a practical recovery option when an update, plugin, or server change causes problems.