How to Back Up WordPress Before a PHP Update

Key takeaways

• A backup has two halves. WordPress.org says the files and the database are stored separately, so saving one does not save the other. You need both.
• Take it before the change, every time. WordPress.org's PHP page says to make a backup before updating PHP, so you can return the site to its current state if something goes wrong.
• Keep copies in more than one place. WordPress.org advises at least three copies, in different places and on different media, and keeping three to five recent ones.
• A host backup is a start, not the whole plan. Hosts often give you backup tools, but WordPress.org says it is better to back up your own files as well.
• An untested backup is a hope. WordPress.org's upgrade guide calls it essential to check that the backups exist and can be used, before you start.
• The PHP version rolls back separately. If you must restore, ask your host to put the old PHP version back first, then restore the backup.

This guide supports our main page on the PHP vulnerability of October 2026, where two critical flaws were fixed on 21 October 2026. The usual cure is a newer PHP on the server, and that change is the one you want a safety net for.

What a real backup contains

WordPress.org's Backups page (checked 22 October 2026) describes a WordPress site as two separate things.

WordPress.org's file backup page (checked 22 October 2026) adds some detail. Look hardest at the wp-content folder, which holds your themes, plugins and uploads. Keep wp-config.php, which holds your database connection details, and your .htaccess file. It says WordPress core files can be left out of a backup, because you can get them again from a fresh download.

The database page says the same thing from the other side. A database export means your posts and comments are safe, but images and other files still need a separate backup. So a backup that only came from a database export, or only from a folder copy, cannot rebuild your site on its own.

Two more details from the WordPress.org Backups page:

1. Back up the database first, then the files, and keep both in one backup set.
2. When you restore, put the files back first, then import the database, and update wp-config.php if the database details changed.

Where backups should live

Keeping a backup on the same server as the site is the most common mistake. If the server has a problem, you lose the site and its backup together.

WordPress.org's advice is to keep at least three copies in different places and on different media. Its examples are hosting servers, cloud storage, a local computer, and discs or external drives.

Keep the last three to five backups, not only the newest, in case a problem is noticed late.

Host backup or plugin backup

WordPress.org's Backups page mentions both. Hosts often provide their own backup software, though it says restoring from a full-server backup can be slow. It also says automatic backup plugins can schedule backups, and that you can find them in the WordPress Plugin Directory.

We do not name or rate backup plugins here. What you can compare is how each kind works.

The sensible answer for most small sites is both: the host's backup as the quick one, plus a second copy you hold elsewhere.

WordPress.org also suggests making a manual backup now and then, to confirm that the automated ones are working. If a plugin reports "backup complete" and you have never opened the file, you do not yet know it worked.

How to know it can be restored

WordPress.org's upgrade guide says to verify that the backups exist and can be used, and calls that step essential. It also warns that without a full site and database backup made before an upgrade, a rollback is near impossible. Here is a restore test you can run in about an hour.

1. Open the files. Download the file backup and open the zip. Check that wp-content is there, with the uploads folder and your active theme and plugins, and that wp-config.php and .htaccess are there too.
2. Open the database export. It should be a file of SQL commands, not an empty file. Check the size is more than a few kilobytes and that it is not far smaller than last month's.
3. Restore it somewhere safe. Use a staging site or a test copy, never the live site. WordPress.org's database page notes that a quick phpMyAdmin export should be restored into a database with no existing tables, and its upgrade guide says to check the character encoding when you restore, since backups may not be UTF-8.
4. Click through the copy. Open the home page, a post, an image, the contact form and the login. If the images are missing, the files half is incomplete. If the posts are missing, the database half is.

If you cannot do step 3 yourself, ask your host or a developer.

The minute before a PHP change

Our guide to checking and updating your PHP version on WordPress covers the change itself. This is the short list for the moment just before it.

1. Take a fresh backup now. Not last night's. Database first, then files, as one set.
2. Update WordPress, themes and plugins first. WordPress.org's PHP page lists this before the PHP change, and it says to click around the site afterwards to check it still works. Then take the backup, so it holds the updated state.
3. Download one copy off the server. Put it on your computer or in your own cloud storage.
4. Open the backup file. Check the size and the contents, as in the restore test above.
5. Write down the current PHP version. You will need the exact number if you have to ask the host to go back. Site Health shows it on the Info tab, in the Server block. Our guide on checking your PHP version shows other ways to find it.
6. Save your host's support contact. A phone number or live chat link, so you are not hunting for it during an outage.
7. Pick a quiet hour. Shop owners can read our advice on WooCommerce stores and the PHP flaw first.

If something breaks, WordPress.org's PHP page says you can change the PHP version back yourself, or ask your host or a developer. If you need your backup, ask the host to restore the previous PHP version first, then restore the backup.

What is still unclear

• Host backup contents. We cannot tell what your host includes. Some plans may leave out the database, large uploads or certain folders. Ask in your host's support and get the answer in writing. Our list of questions to ask your host is a starting point.
• Backup plugins. We did not read any plugin maker's page for this guide, so we make no claim about which is best, how fast it restores or what it costs.
• Very large sites. WordPress.org says phpMyAdmin is not suitable for large databases, so a big shop or a membership site may need command line tools or a developer.
• When this advice does not apply. If your site is on Webflow, Shopify, Wix, Squarespace or Framer, there is no WordPress PHP version for you to change, and the steps above do not apply. Our guide on Webflow and PHP explains the Webflow side.
• Backups are not a security fix. A backup lets you recover, it does not close the PHP flaws. If your site may already be hacked, a new backup could contain the problem, so see how to check if your WordPress site is hacked.

How we help at Amariq

A backup you have never restored is only a hope, so our PHP jobs open with a full copy and a check that it is usable. We moved WordPress sites to a newer PHP in the first day after the advisory, and every one of them started this way. The WordPress PHP update gig on Fiverr includes that step in each package, and the package depends on your site's size. Our WordPress development page describes the wider support we give. You can read what clients have said on Fiverr and Upwork, and see how we work on our YouTube channel, before you decide to trust us with your files.

Frequently asked questions

What should a WordPress backup include?

Both the files and the database. WordPress.org says they are stored separately, so backing up one does not back up the other. The files part should include wp-content, wp-config.php and .htaccess.

Is my host's backup enough before a PHP update?

It is a good first copy, but not the only one. WordPress.org says hosts often provide backup software, and that it is better to back up your own files too. Ask the host what its backup holds, then keep a second copy somewhere else.

How many backups should I keep?

WordPress.org advises at least three copies in different places and three to five recent backups. That way a problem you spot a few days late does not leave you with only a bad copy.

How do I know my backup works?

Open it, then restore it to a test copy and click through the pages. WordPress.org's upgrade guide calls checking that backups exist and can be used essential. A file that has never been opened is not proof.

Can I roll back a PHP update?

Often yes, if you have a backup and your host can set the old PHP version again. WordPress.org says to ask the host to restore the previous PHP version first, then restore your backup.

Does a backup protect me from the October 2026 PHP flaws?

No. A backup helps you recover from a failed change or an attack, but only the PHP update closes the flaws, according to php.net's advisory. Read our main guide to the PHP vulnerability for the order of work.

Sources

All read on 22 October 2026: WordPress.org, Backups, Database backup, Files backup, Upgrading WordPress and Update PHP.