When an update goes wrong, a plugin melts down, or a site gets hacked, the fastest way out is often not to fix the break at all — it’s to restore WordPress from a backup. A good backup is an undo button for your entire website: files, content, and settings, rolled back to a moment when everything worked. This guide covers how to do it safely, what can go wrong, and how to make sure you actually have a backup worth restoring.
The catch, and it’s a big one: a backup only helps if it exists, if it’s recent, and if it’s stored somewhere the disaster can’t reach. We’ll come back to that. First, the restore itself.
What a real WordPress backup includes
Restoring only works if the backup is complete. A full WordPress backup has two halves, and you need both:
- The files — WordPress itself, your theme, plugins, and everything you’ve uploaded (images, PDFs) in
wp-content. - The database — every post, page, comment, user, and setting.
Restore the files without the matching database and you get a shell with no content. Restore the database against mismatched files and you get errors. A proper backup captures both from the same moment so they line up.
Method 1: The one-click restore (the easy way)
If your host or your backup plugin keeps managed backups, this is by far the simplest route. You open the backups panel, pick a date from before things broke, and click restore. The system swaps your files and database back to that snapshot, and a few minutes later your site is exactly as it was. No SFTP (a secure way to connect to your site’s files), no database tools, no chance of leaving the two halves out of sync.
This is the whole point of managed backups: the restore is boring, which is precisely what you want during an emergency. If your hosting offers it, use it and skip the manual steps below.
Method 2: Restoring manually
If you only have raw backup files — a zip of your site and a database export — you can restore by hand. Work carefully; this is where mismatches happen.
Step 1: Put the site in a safe state
If the site is hacked, take it offline first so you’re not restoring on top of an active infection or leaving malware serving to visitors. If you can, enable maintenance mode.
Step 2: Restore the files
Connect over SFTP or your host’s file manager. Delete the broken wp-content (especially plugins and themes) and upload the versions from your backup. Leave wp-config.php (WordPress’s main settings file) alone unless your backup’s database credentials differ.
Step 3: Restore the database
Open phpMyAdmin (or your host’s database tool), select your site’s database, drop the existing tables, and import your backup’s .sql file. This is the step people fear — but if the file is good, it’s just an import. When it finishes, your content is back.
Step 4: Reconnect the two halves
Make sure the database name, user, and password in wp-config.php still match the database you just restored into. If they don’t, you’ll see the “error establishing a database connection” message — which is a database problem, not a failed restore.
What to check after a restore
Don’t declare victory at the home page. Walk through the site the way a customer would:
- Load several pages, not just the front page.
- Test anything that matters — a contact form, a checkout, a login.
- Check it on your phone, not only your desktop.
- Log into the dashboard and confirm your plugins and settings are intact.
- If it was hacked, change all passwords and update everything before you trust it again — a restore brings back the vulnerability too. Our guide on how to fix a hacked WordPress site covers cleaning up properly so it doesn’t come back.
The uncomfortable question: do you actually have a backup?
This is where a lot of restore stories end badly. People discover, at the worst possible moment, that their “backup” was:
- Nonexistent — nobody ever set one up.
- Stale — the last one ran three months ago.
- Stored on the same server that just died or got hacked — so it’s gone too.
- Never tested — the file exists but the restore fails because the backup was incomplete or corrupt.
A backup that lives on the same box as your site isn’t really a backup — it’s a copy that shares your fate. The only backup you can count on is one taken automatically, kept off-site, and proven to restore.
How managed hosting turns a disaster into a routine restore
This is one of the quiet reasons people move to managed WordPress hosting. Every plan we run includes automatic off-site backups 3 times a day — copies kept away from your live server so a hack, a crash, or a bad update can’t take them out. When something breaks, the fix is a one-click restore to yesterday’s known-good version, not a frantic hunt for a file you hope still works. And because every update we apply is verified to confirm the site still looks and works right, you rarely need the backup in the first place — it’s the safety net under a floor that’s already solid.
The bottom line
Restoring from a backup is the single most reliable way to recover a broken WordPress site — if you have a clean, recent, off-site copy to restore from. If you’re reading this because you just found out you don’t, let that be the lesson that changes how your site is backed up going forward.
If you’re mid-emergency and unsure whether your backup is any good, don’t gamble on a manual restore under pressure. We only repair sites we host, so the offer is to move your site to us: we get it working and clean as part of the move, and your move starts as soon as you sign up. Start my move. Once you’re with us, off-site backups 3 times a day and restores on request are simply included, so the next scare is a routine restore. If you’re still triaging what actually broke, start with our emergency troubleshooting checklist.