How to Back Up WordPress Without a Plugin (SSH + cPanel)

Plugins make WordPress backups easy, but they’re not the only option. Maybe you’re on a lean hosting plan, or you prefer full control. Maybe you’ve had a plugin fail mid-backup. Whatever the reason, backing up WordPress without a plugin is completely doable, and in some ways it’s more reliable. You just need access to your server via SSH or cPanel. This guide walks you through both methods step by step.

Why Would You Back Up Without a Plugin?

Plugins add overhead. They run on your site’s resources, can conflict with other plugins, and sometimes fail silently. A manual backup gives you a predictable, repeatable process. You know exactly what you have because you created it yourself.

Manual backups also let you control the schedule and storage. You can keep backups on your own server, cloud storage, or a local drive without depending on a plugin’s integration. And if you’re migrating a site, a clean manual backup is often the safest starting point. For more on that, check out our guide on how to back up a WordPress site before migration.

What You Need Before You Start

Before we dive into the commands, gather these essentials:

• Access to your hosting control panel (cPanel, Plesk, or similar) or SSH credentials (username, password or key, host, port).
• An FTP/SFTP client or command-line familiarity.
• Enough disk storage to hold your backup archive. On a shared host, check your quota.
• A destination for the backup: a different folder, cloud storage, or local machine.

If you don’t have SSH access, use cPanel. Most shared hosts provide it. If you have a VPS or dedicated server, SSH is the faster route.

Method 1: Backing Up via SSH (Full Control)

SSH is the quickest way to back up a WordPress site. You’ll create a compressed archive of your files and a dump of your database in one go.

Step 1: Connect to your server

Open a terminal and SSH into your server:

ssh user@your-server-ip

Navigate to your WordPress root directory, usually public_html or www:

cd /var/www/html

Step 2: Back up the files

Create a tar.gz archive of your entire WordPress directory. This example excludes common cache folders to save space:

tar -czf site-backup-$(date +%Y%m%d).tar.gz --exclude='wp-content/cache' .

That command creates a file like site-backup-20250315.tar.gz in your current directory. The --exclude flag keeps cache out of the backup.

Step 3: Back up the database

Use mysqldump to export your database. You’ll need your database credentials (find them in wp-config.php):

mysqldump -u db_user -p db_name > database-backup-$(date +%Y%m%d).sql

Enter your database password when prompted. This creates a SQL file with all your posts, pages, users, settings, and metadata.

Step 4: Download and store

Use SCP or an SFTP client to download both archives to your local machine. Then delete them from the server if you don’t want leftovers:

rm site-backup-*.tar.gz database-backup-*.sql

Method 2: Backing Up via cPanel (No Terminal Required)

If SSH isn’t available, cPanel is your friend. Every shared host offers it. The process is point-and-click but takes a few more steps.

Step 1: Export the database via phpMyAdmin

Log into cPanel, find the phpMyAdmin icon (usually under Databases). Select your WordPress database from the left sidebar. Click the Export tab, choose “Quick” method, and hit Go. A SQL file downloads to your computer.

Step 2: Download site files via File Manager

In cPanel, open File Manager. Navigate to your WordPress root directory. Select all files and folders (or just the ones you need), then click Compress. Choose Zip or Tar. Once compressed, download the archive.

Step 3: Store them off-site

Move both the SQL file and the archive to a safe location—local drive, cloud storage, or another server. Don’t keep them on the same server you’re backing up.

What to Include and What to Skip

A full WordPress backup has two parts: files and database. Here’s what each contains and what you might intentionally exclude.

Component	Includes	Can Skip?
Core files	wp-admin, wp-includes, wp-*.php	No – reinstall core, but it’s easier to include.
wp-content	themes, plugins, uploads	Exclude cache folders only.
Database	all content, settings, users	Never skip – it’s the site’s brain.
Cache files	static html, minified assets	Yes – they regenerate automatically.

Always include your database. Without it, you just have a shell of a site. For WooCommerce stores, the database also holds orders, customers, and product data. See our dedicated WooCommerce backup guide for specifics on preserving order history.

Common Mistakes and How to Avoid Them

Manual backups are simple, but easy to mess up. Here are the most frequent pitfalls and how to sidestep them.

• Forgetting the database. You back up files but skip phpMyAdmin. Result: a useless backup. Always export the SQL.
• Storing backup on same server. If the server dies, your backup dies with it. Download or copy off-server immediately.
• Not testing restoration. A backup that can’t be restored is worthless. Try restoring to a staging site at least once.
• Using outdated credentials. If you change your database password after backup, the SQL file still has the old password. Update wp-config.php when restoring.

Want to see more blunders to dodge? Read our article on 5 common WordPress backup mistakes.

Automating Manual Backups

You can schedule manual backups without a plugin by using cron jobs. On the server, set up a cron task that runs the tar and mysqldump commands weekly or daily, then scp the archives to another machine. This is more advanced but gives you full control without plugin overhead.

If you prefer a simpler path, consider a hybrid: use a plugin for automated daily backups and a manual monthly backup as a fallback. That way you get convenience and a safety net.

Whichever method you choose, test your backup restoration process regularly. It’s the only way to know your backups actually work. Start with a single manual backup today—you’ll be glad you did when something goes wrong tomorrow.

Frequently asked questions

Is it safe to back up WordPress without a plugin?

Yes, it’s perfectly safe. Manual backups via SSH or cPanel are reliable and don’t introduce plugin conflicts or performance overhead. Just be careful to export the database and copy files correctly, and always store backups off-site.

What is the fastest way to back up WordPress without a plugin?

SSH is the fastest. Use commands like tar to archive files and mysqldump to export the database. It takes a few seconds to minutes depending on site size, and you can automate it with cron later.

Can I back up only the WordPress database without files?

Yes. Use phpMyAdmin’s Export feature or run mysqldump to get just the SQL file. This backs up your content, settings, and users but not uploaded media or themes. A full site restore usually needs both.

How do I restore a WordPress backup made without a plugin?

Upload your file archive to the server and extract it, then import your SQL file via phpMyAdmin or mysql command. Update wp-config.php if the database name, user, or password changed. That should bring your site back.

Do manual backups include WordPress core updates?

They include whatever files are on your server at the time of backup. If you’ve updated WordPress core, those updated files are included. When restoring, you get the exact version you backed up, so you may need to re-update core afterward.