How to Restore a WordPress Website from a Backup Safely

A backup only matters if you can restore it. Whether you're recovering from a failed update, malware, or a hosting problem, the goal isn't just to upload old files. You need a complete recovery point and a plan for anything created after it.

Before You Restore: Stop and Define the Recovery Point

Write down when the problem started. List your available backups. Pick the newest clean one from before the incident.

If the site still takes orders, registrations, comments, or form submissions, put it in maintenance mode or disable those functions. Otherwise, new data will arrive while you overwrite the database.

For WooCommerce or membership sites, export recent orders or user records first. A database restore rolls the site back to an earlier moment. Anything created after that point is lost.

A client once restored a backup from the previous day and lost 14 orders because they didn't export them first. Don't make that mistake.

Confirm What the Backup Contains

A complete WordPress restore needs:

• The database
• wp-content/uploads
• Themes and plugins
• wp-config.php
• Any custom files outside the standard folders

A database-only backup has posts, settings, and users. It doesn't have uploaded images or plugin files. The official WordPress database backup guide separates database backups from full-site file backups.

Check that the archive opens. Check the date and file size. Don't discover a corrupt backup after deleting the live copy.

Prefer a Staging Restore First

If you have time, restore to a staging URL first. That confirms the backup works without touching the live site.

Protect staging from public access and search indexing. Don't let staging send real customer emails or process live payments.

Restore Through Your Hosting Tool

Managed hosts usually offer the safest one-click restore because the tool understands the platform's files, database, cache, and configuration. Read whether the restore affects the full site or only selected parts.

Create a snapshot of the current broken site before proceeding. It may contain recent uploads, logs, or orders you'll need later.

Restore Files and Database Manually

For a manual restore, upload the backed-up WordPress files to the correct document root. Import the matching database through your host, phpMyAdmin, or WP-CLI.

With WP-CLI:

wp db import backup.sql
wp search-replace 'old-domain.com' 'new-domain.com' --all-tables --precise

Verify that wp-config.php has the right database name, user, password, and host for the destination environment. A domain or directory change may also need a safe URL replacement.

Manual database imports overwrite tables. If you're not confident about the target database, ask the host to perform or supervise the restore.

Clear Caches and Test the Website

After restoration, purge page, object, server, and CDN caches. Then test:

• Homepage and several internal pages
• WordPress admin and user login
• Images and downloads
• Forms and outgoing email
• Scheduled tasks
• Cart, checkout, payment, and order emails (if WooCommerce)

Check the PHP error log and Tools → Site Health for warnings.

Close the Original Vulnerability

If you restored after malware or unauthorized access, don't assume the backup alone fixed the cause. Update WordPress and trusted extensions. Remove unknown users. Rotate passwords and security keys. Scan the restored files. Review access logs.

After the Restore

A safe restore combines the right backup with careful timing and complete testing. Preserve the current state. Verify the archive. Restore files and database as a matched set. Account for new data created since the recovery point.

Then keep a backup from before the next update. That's the one you'll want if something breaks again.