How to Restore a WordPress Site From a Backup, Step by Step

A site that goes down at 3 a.m., a plugin update that breaks the whole layout, or an attack that injects malicious code — in every one of these situations, knowing how to restore a WordPress site from backup is the difference between a few minutes of downtime and days of lost work. If you have a recent backup, getting back to a clean version is far simpler than it looks.

Below is the full process, explained in plain terms: how to check your backup, which restore method to choose, and what to do the moment your site is back online.

What kind of backup you actually have

Before you restore anything, you need to know what you’re working with. A complete WordPress site is two distinct things: the files (the theme, plugins, and images in wp-content) and the database (posts, pages, settings, comments). A proper restore covers both — bring back only the files without the database and the site stays broken.

• Plugin backup — UpdraftPlus, Duplicator, or All-in-One WP Migration create a single archive with the whole package, easy to reuse.
• Hosting backup — daily or weekly snapshots taken automatically by your provider, available in cPanel.
• Manual backup — a folder of files plus a .sql export of the database that you saved yourself.

The golden rule: check the date of the backup before anything else. A copy from three weeks ago will bring your site back, but it also wipes every change you made in between.

How to restore a WordPress site from backup: the three methods

There’s no single correct path. You pick the method based on how you made the backup and what access you still have to the site.

1. From your backup plugin

If you use UpdraftPlus or something similar, open the admin panel, launch the plugin, and click “Restore” next to the copy you want. Tick the components you want back — files, database, or both — and confirm. It’s the most convenient method, as long as /wp-admin still loads.

2. From your hosting panel (cPanel)

When the site is completely inaccessible, log straight into your hosting account. Many providers offer a “Restore” button in the backup section that rolls the files and database back to an earlier snapshot without touching WordPress at all.

3. Manually, via FTP and phpMyAdmin

The fallback for when nothing else works: upload the files over FTP/SFTP, drop the compromised database, and import the .sql export in phpMyAdmin. It takes a little care, but it gives you total control.

The steps of a clean restore

Whatever the method, order matters. Skip a step and you risk overwriting the only good backup you have left. In short, a healthy restore follows this flow:

Translated into concrete actions, here’s how you go:

• Back up the current state, even if it’s broken — it may hold recent data you’ll want to recover later.
• Put the site into maintenance mode so visitors don’t hit broken pages during the process.
• Restore the files and the database from your chosen copy, in the order your method requires.
• Clear every cache — cache plugin, LiteSpeed, Cloudflare — so you don’t keep seeing the old version.

What to check right after the restore

The site is back, but the job isn’t done. Run quickly through this checklist before you relax:

• The homepage and 2-3 inner pages load without errors.
• You can log into /wp-admin.
• The contact form actually sends emails.
• Images in your posts display (the files in wp-content/uploads).
• Permalinks work — if they throw 404s, re-save the permalink settings.

If the restore was triggered by an attack, change every password immediately (admin, FTP, database) and run a security scan. Otherwise you risk restoring the very door the attacker walked through.

How to prevent the next emergency

The best restore is the one you never need. An automatic daily backup, stored off the server (not on the same hosting) and tested regularly, saves you from panic. The official WordPress documentation on backups explains well what a complete copy should contain.

Testing is the part almost everyone skips: a backup you’ve never restored is just a guess. Every few months, restore it on a test environment and confirm it truly works.

If you’d rather not handle all of this yourself, a WordPress maintenance service manages automatic backups, monitoring, and fast restores for you. And if you’re not sure how well protected your site is right now, a free audit shows you exactly where you stand and what needs fixing.

In essence, a successful restore isn’t about luck — it’s about preparation: a recent backup, the right method, and a few checks at the end. With those in hand, any failure becomes a matter of minutes, not a crisis.