WP File Manager Backup: How to Create and Restore One Safely

Looking to use the WP File Manager backup plugin before updating your site, editing files, or troubleshooting a security issue? A WP File Manager backup gives you a quick, on-demand copy from your WordPress dashboard, so you can make changes with greater confidence.

This guide will show you how to create a backup with WP File Manager and confirm what it includes.

You’ll also learn why a file-only backup is not a complete WordPress site backup, how to backup your database, where to store your copy away from the live server, and how to test that it can restore your site if something goes wrong.

What a WP File Manager backup includes

WP File Manager is mainly a server-file tool inside WordPress. Its current WordPress.org listing includes backup and restore for theme files, plugin files, the uploads folder, and database data stored on the server. It makes a manual backup easier to start, but it does not remove your responsibility to verify, store, and test the resulting copies.

A complete WordPress recovery point has two parts:

• Files: WordPress’s main files, themes, plugins, media, custom code, and configuration files.
• Database: Posts, pages, comments, users, settings, orders, form entries, and data added by plugins.

The database is the structured store that holds much of your site’s content and settings. A file copy without its matching database can preserve images and theme files while losing posts, settings, or orders. A database copy without the matching files has the opposite problem.

The plugin may split the result into database, plugins, themes, uploads, and other archive files. Keep every part from the same backup time; a single file shown in the dashboard is not proof that the full site is covered.

How to create a WP File Manager backup

The menu names can change between plugin versions and editions. At the time of this review, WordPress.org listed File Manager 8.0.4. Check the current listing and security notes before installing or updating it. Create the backup manually in four passes:

• Install and open the tool: From Plugins > Add New, install and activate the intended File Manager plugin. Then select WP File Manager in the sidebar and open Backup/Restore. Because the plugin can change server files, use a trusted administrator account and remove the plugin when you no longer need it.
• Confirm complete coverage: Check that the selection includes themes, plugins, uploads, custom files, and the database for this site. If the screen separates files and database data, do not leave either part unchecked unless you understand what will be missing.

• Run and record the backup: Select Backup Now, or the matching action in your version, and wait for it to finish. Large media folders can take time. Record the backup name or identifier, date, component names, file sizes, and any location shown by the plugin. An interrupted request may create an incomplete archive even if the dashboard records the attempt.

• Move and label every part: Download the backup parts or copy them to private storage separate from the WordPress server. Keep all parts from the same backup together and label them with the site name and backup time.

Where WP File Manager backups are stored

The storage path depends on the plugin version, edition, and server setup. Check the backup details in your installation instead of copying a path from another tutorial. A path on the same server is not independent protection because a server failure, hacked site, or hosting-account problem can affect both the live site and its local archive.

If you are collecting files through a hosting file tool, find the WordPress root by locating wp-admin, wp-content, and wp-includes, the folders that identify a WordPress installation. Hosts may name that folder public_html, html, www, root, or a domain-specific folder. If you keep a second copy on a computer, review the options to backup WordPress site to Computer before treating it as your only off-server copy.

If you are exporting the database separately, confirm the database name in wp-config.php, the file that stores the site’s database connection details, before starting. Exporting the wrong database can create a file that looks valid but belongs to another site. If you need a broader files-plus-database package, follow a guide to export the entire WordPress site and verify the result before deleting temporary copies.

After confirming an independent copy, remove temporary server copies when the plugin or host leaves them in a web-accessible location. Do not delete the server copy while the download is in progress. Confirm that the downloaded files open, have plausible sizes, and include every component shown in the backup details.

How to restore a WP File Manager backup safely

The plugin may show a Restore action beside a completed backup. The button alone does not prove that the archive is complete or that the restore will work on your site. Test the process on a staging copy first. Staging means a private copy of the site used for checks before changing the live site.

Use this four-part restore check:

• Protect the original: Keep an untouched copy of every archive part in private storage. Never use the only copy for an experiment.
• Restore to staging: Use a host staging feature or another isolated WordPress installation. Keep it separate from the live site so a failed restore cannot erase current content.
• Match the target and archive: Confirm that the staging site is the intended WordPress installation and that the backup contains matching files and database data. A mismatched pair can produce missing content or broken settings.
• Run and inspect the restore: Select the backup and choose Restore, if that action is available in your version. Wait for the process to finish and save any success message or error details. Then open the public site and WordPress dashboard and check posts, pages, media, links, forms, plugins, themes, settings, caches, user accounts, and store orders. A homepage that loads is not proof of a complete restore.

Restoring an older database can also change the backup records shown inside the plugin. Newer entries may disappear from the list even when downloaded archive files still exist. Keep the actual archive files and their labels outside WordPress instead of relying on the backup list as your only record. Avoid editing plugin tables or deleting live directories to repair the list unless you already have a verified recovery copy and the technical expertise to recover from a mistake.

For a separate recovery walkthrough, use a detailed guide to restore WordPress from a backup.

Is WP File Manager enough for regular backups?

It can be useful for a controlled, one-time copy when you have dashboard access and need to avoid a hosting control panel such as cPanel or FTP. FTP is a file-transfer method used to move files between a computer and a server. It does not solve the main problems of ongoing recovery: remembering to run backups, keeping them outside the live server, keeping older restore points, and reaching them when WordPress is broken. If you are looking for alternative manual techniques, learning how to backup wp manually gives you full control over your server directories and SQL exports.

Before relying on WP File Manager as your main backup method, confirm that your installed edition provides what your site needs:

• scheduled or automatic backups;
• storage outside the live server;
• several older restore points, or saved copies from earlier dates;
• more frequent capture for stores, memberships, and busy publishing sites;
• access when the WordPress dashboard is unavailable; and
• a restore process you have completed successfully on staging.

The official feature listing confirms that backup and restore are available categories. It does not confirm that every edition provides scheduling, storage outside the server, encrypted files, older backups kept for a set period, or a separate restore dashboard. Check each feature for your exact edition instead of inferring it from an older article.

A hosting backup can add another recovery layer, but retention and restore access vary by host.If you manage a network installation, setting up a WordPress multisite backup requires additional configuration steps. A manual cPanel, file-transfer, and database-export workflow can also work when it is documented, stored separately, and tested. For repeated protection, a dedicated WordPress backup plugin such as BlogVault or UpdraftPlus is easier to maintain when it can automate the routine.

BlogVault is one option for that workflow. Its current product information describes automated files-plus-database backups, storage outside the server with encrypted files, incremental backups that capture changes in smaller batches, a separate backup dashboard, and restore or staging options. Confirm the features and limits for your plan, and still test the process on your site.

For a site that receives orders, bookings, form submissions, or member activity, ask how much new data you could afford to lose. A WooCommerce store may need a dedicated backup workflow. A daily copy may leave a full day of transactions outside the recovery point. Match frequency to the site’s change rate and see how often to back up a site before you set a schedule.

Security checks before relying on the backup

Use four security checks before relying on the archive:

• Limit file access: Keep File Manager updated, restrict it to trusted administrators, use strong administrator accounts, and remove it if you no longer need file-management access. A powerful file tool increases the damage an attacker could cause after an administrator account or plugin permission is compromised. That is different from claiming that the plugin alone lets any visitor take over a site.
• Check the exact version: Wordfence records a historical issue in File Manager versions through 7.2.1 where predictable backup names could expose backup data if folder access controls failed, with 7.2.2 listed as patched. The official WordPress.org page listed version 8.0.4 and security fixes in 8.0.3 at the time of this review. Match every notice to the installed free or Pro edition.
• Protect the archive: Never share a backup URL publicly. Use private access controls and encryption where the storage provider supports it. A backup containing configuration values or user data should be treated as sensitive.
• Replace exposed copies: If you suspect the site or an administrator account was compromised, treat existing backups as potentially exposed until you review and replace them. A patched version does not guarantee that an unknown or newly released issue cannot exist.

Backup verification checklist

Before calling a WP File Manager backup usable, confirm that:

• the files and database data are both present;
• the database belongs to the intended site;
• all archive parts have plausible sizes and matching timestamps;
• the independent copy is outside the live server;
• the archive cannot be downloaded by a visitor who is not signed in;
• you can reach the backup without the live WordPress dashboard;
• the backup is recent enough for the site’s change rate; and
• a staging restore passes public-site, dashboard, content, media, form, plugin, theme, settings, cache, and transaction checks.

If one item fails, you have an archive to investigate, not a confirmed recovery copy.

FAQs

Conclusion

WP File Manager can create a useful WordPress backup from the dashboard, but it becomes dependable only after you confirm the files, database data, archive parts, and timestamps. Move the completed copy off the server, protect it from public access, and test it on staging before you trust it with a live-site recovery.

For ongoing protection, use automated off-site WordPress backups with BlogVault when you need copies and access outside WordPress. Keep the workflow matched to your site’s change rate, and remember that a backup is only dependable after you have retrieved it and proved that it restores the site you need.

Written by

Shivani M

Shivani enjoys crafting guides that make every aspect of using WordPress simple and easy to follow. When she's not glued to her laptop, you can find her buried in a good book or occasionally, painting.