A dependable WooCommerce backup has two parts: a copy of the WordPress database and a copy of wp-content. The database holds products, orders, settings, posts, and pages; wp-content holds themes, extensions, and uploaded media. You need both to rebuild a working store. A WordPress XML export is useful for posts and pages, but it is not a replacement for a database export and file backup.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What a complete WooCommerce backup contains
WooCommerce stores information in separate locations. Treating only one location as a backup leaves a major part of the site unprotected.
As an Amazon Associate I earn from qualifying purchases.
The WordPress database
The database contains the transactional and configuration data that makes the store function. A database export should include WooCommerce products, variations, orders, customers, coupons, tax and shipping settings, plugin settings, WordPress users, posts, and pages. The exact table names depend on the site’s table prefix, so export the entire WordPress database rather than trying to select tables by hand.
Orders created after a backup’s timestamp exist only in the live database. If you later restore that older database, those orders may no longer appear unless you export or otherwise preserve them first.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
The wp-content directory
Download the complete wp-content directory. It contains:
- Active and inactive themes, including child themes.
- Plugins and WooCommerce extensions.
- Uploaded product images, media, documents, and other files in
uploads. - Other content generated by plugins or themes.
Copying only the uploads directory is insufficient if the site depends on custom theme code or extension files. Copying only plugins is also insufficient when products use images or downloadable files.
Why a WordPress XML export cannot stand alone
Tools > Export creates an XML file containing selected WordPress content such as posts, pages, comments, and related metadata. It does not provide the complete WooCommerce database, including orders, products, and store settings. Keep an XML export when you need a portable copy of editorial content, but pair it with a SQL database export and the full wp-content directory for disaster recovery.
Define the recovery target before making a backup
The right snapshot depends on what you are trying to recover. Write down the intended restore time in UTC and record the WordPress, WooCommerce, theme, and extension versions associated with that snapshot.
| Recovery goal | Snapshot to select | Important preparation |
|---|---|---|
| Undo a failed update | The last known-good copy immediately before the update | Reproduce the update on staging first; keep the pre-update backup untouched. |
| Recover from a security or server incident | A verified copy from before the incident | Preserve evidence if needed, scan restored files, and plan credential rotation. |
| Roll back WooCommerce | A database and file set made for the target WooCommerce version | Do not mix a database schema from one version with files from another without testing. |
| Migrate to another host | A complete database plus wp-content copy |
Record site URL, PHP and database requirements, and any environment-specific settings. |
| Recover products for reuse | A database export and the related media files | An XML export alone will not include the full product and order data. |
Version matching matters most when reverting WooCommerce. Schema changes can make a database from a newer release inconsistent with older plugin files, so use a backup set that corresponds to the version you intend to run.
How to create a complete manual backup
A manual backup is a database export plus a file copy. Perform both parts, then verify that the archives can actually be opened.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
- Freeze the plan. Note the site name, the current UTC time, the WordPress and WooCommerce versions, active theme, and major extension versions. If possible, announce a short maintenance window so no one is editing products while you copy data.
- Export optional WordPress content. In the administrator dashboard, open Tools > Export, select the content type you need, and download the XML file. Label it as an editorial-content export, not as the full store backup.
- Copy
wp-contentover FTP or SFTP. Download the entire directory, including themes, plugins, extensions, uploads, and any other subdirectories. Preserve file names, permissions where the transfer method supports them, and symbolic links only if your hosting environment uses them deliberately. - Export the database as SQL. Open the database tool supplied by your host, commonly phpMyAdmin. Select the WordPress database, choose an SQL export, and save the resulting file without filtering out WooCommerce tables. A complete export is what captures orders, products, settings, users, and other tables that XML does not contain.
- Record an inventory. Save a text note with the archive name, UTC timestamp, WordPress and WooCommerce versions, active theme, PHP version if known, and the list of files included. Generate a checksum for large archives when your operating system or storage tool supports it; the checksum can reveal a damaged transfer later.
- Open-test the files. Confirm that the SQL file is readable and that the compressed or copied
wp-contentdirectory contains expected plugin, theme, and upload files. A backup that finished with an interrupted transfer is not a recovery plan. - Store a copy away from the server. Keep at least one copy in a separate physical or cloud location with restricted access. An external hard drive can provide separate physical storage for downloaded archives, but it does not schedule backups or create cloud redundancy by itself.
Keep the database export and file copy associated with the same timestamp. Restoring a database from one point and files from a materially different point can produce missing images, incompatible extension code, or settings that do not match the installed files.
When automation is safer than manual copying
Scheduled backups reduce the chance that someone forgets an export, particularly for stores receiving orders every day. WooCommerce documentation lists UpdraftPlus, BackupBuddy, and Duplicator as examples of established backup plugins. Evaluate any tool by what it actually backs up and how a restore works rather than by its name.
Jetpack VaultPress Backup documentation describes coverage for the database, plugins, themes, uploads, root files, and WooCommerce products and orders. Its documentation says backups occur at least daily and may also be triggered by events such as publishing or plugin or theme changes. Confirm the current schedule, retention, storage region, and restore features for the plan and location you will use.
| Approach | Database plus files | Scheduling | Off-site separation | Restore detail | Best fit |
|---|---|---|---|---|---|
| Manual SQL and SFTP/FTP copy | Yes, if both steps are completed | None unless you create your own routine | You choose the destination | Usually a whole-site replacement; granular recovery requires manual work | Small sites, one-off migrations, and a second independent copy |
| Backup plugin | Depends on selected components; verify database, wp-content, media, and root files |
Usually configurable; confirm the actual plan | Depends on the connected storage | May offer full or component restores; test before relying on it | Owners who want scheduled jobs inside WordPress |
| Host-provided backups | Depends on the host’s scope | Set by the host or plan | Not guaranteed; ask where copies are kept | May be account-, file-, or database-level | Convenient additional coverage, not a reason to skip independent copies |
| Managed backup service | Can include database, extensions, themes, uploads, root files, products, and orders; verify the service statement | May be daily and event-triggered; plan details control this | Provider-managed, subject to region and retention terms | May provide point-in-time selection, but test the process and connection requirements | Stores that need less manual handling and a documented restore path |
Compare retention depth, point-in-time selection, order protection, staging or migration support, access controls, encryption, storage ownership, and the ability to download an archive. Current prices and plan limits vary, so obtain them from the provider before committing; there is no universal backup price or retention period.
Free tools Windows power users keep installed
One-click scans. No signup required.
Test updates and restores on staging first
Production is the wrong place to discover that a payment extension conflicts with a new WooCommerce release. Create a staging site on the same or a closely matching server stack, restore a recent production copy to it, and then test the change there.
- Refresh staging. Use a recent database and
wp-contentcopy. Record the source timestamp so testers know how current the data is. - Protect real customers. Disable live payment capture and outbound transactional email, or use each provider’s sandbox and test mode. Never place a real customer order from a staging checkout.
- Apply the planned change. Update WordPress, WooCommerce, the theme, or extensions one controlled step at a time. Note the versions before and after each change.
- Exercise the store. Test product pages, variable products, coupons, cart and checkout, shipping and tax calculations, account login, order creation, refunds, stock reduction, emails, webhooks, and scheduled actions. Include a downloadable product if the store sells one.
- Inspect logs and background work. Look for PHP errors, failed scheduled actions, payment callbacks, and extension notices. A page that loads can still have a broken queue or webhook.
- Document the result. Record incompatibilities, required settings, and the exact backup to use if production must be reverted.
Take a current production backup immediately before the real update even when staging passed. Staging reduces risk; it does not eliminate changes made between the test copy and the production maintenance window.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
How to restore without losing newer orders
Restoration is a replacement operation unless the tool explicitly provides a merge. Before clicking a restore button, identify the exact event and timestamp you are undoing and preserve data created afterward.
Before starting
- Put the store in maintenance mode or otherwise stop new checkout activity during the operation.
- Export newer orders, customers, products, posts, and important settings created after the chosen restore point. Use your order-management or reporting tools for an order export, and keep the resulting files outside the site being restored.
- Take one more snapshot of the current site. It gives you a way back if the selected backup is incomplete.
- Confirm that the target backup includes both the database and the required files, and that its WordPress and WooCommerce versions are compatible.
- Check the restore service’s prerequisites. For example, the documented Jetpack restore flow requires a working WordPress site and a healthy Jetpack connection.
Understand what gets replaced
Jetpack’s restoration documentation states that the website database is completely replaced by the database from the selected backup. Files with the same names are overwritten, while unique files are not removed. This means newer database content can disappear even when a newer file remains on disk. It also means a restore is not an automatic merge of old and new orders.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Perform the restore
- Choose the verified timestamp and components. If the incident is limited to a file, do not replace the database unnecessarily; if the database is corrupt, restore the matching database and files as a set.
- Start the restore and wait for the tool to report completion. Do not interrupt a long database import or file transfer.
- Clear caches only after the restore has finished. Purge page, object, CDN, and browser caches as applicable so visitors do not receive pages generated from the previous state.
- Use the post-restore checklist below before reopening checkout.
- Reconcile newer data. Re-enter or import legitimate orders and edits preserved from the pre-restore export, checking order numbers, payment status, stock, taxes, and customer notifications before sending anything.
Post-restore verification checklist
Work through the site as an administrator and as a customer. Record each check and its result rather than assuming a successful restore message proves the store is ready.
- Site address: Confirm the WordPress URL and site URL use the intended domain and HTTPS scheme. Check for mixed-content warnings.
- Permalinks: Open Settings > Permalinks and save the existing structure if front-end routes return errors. Verify product, category, cart, checkout, and account URLs.
- Catalog: Open simple and variable products, inspect prices, attributes, images, downloadable files, visibility, and inventory quantities.
- Orders and customers: Confirm recent orders, statuses, refunds, customer accounts, and notes. Compare counts with the preserved post-restore export.
- Scheduled actions: Review WooCommerce scheduled actions for failed, pending, or unusually old jobs. Queues may need to catch up after downtime.
- Payments and shipping: Recheck gateway credentials, webhook endpoints, shipping zones, tax rules, currency, and fraud or capture settings. Use sandbox mode for a controlled test where available.
- Emails: Send a test order email and verify the sender address, templates, and delivery path. Do not send duplicate customer notifications while reconciling imported orders.
- Webhooks and integrations: Confirm that callbacks to fulfillment, accounting, analytics, and inventory systems are enabled and point to the production endpoint.
- Media and theme: Load representative product images, CSS, JavaScript, and custom templates. A database can be healthy while a missing file breaks the storefront.
- Security: If the incident involved compromise, rotate administrator, hosting, database, FTP/SFTP, API, payment, and integration credentials. Remove temporary staging copies or restrict them with authentication and no-index controls.
Backup retention, security, and operating habits
Keep more than one recovery point. A single copy can be corrupted, encrypted by an attacker, or created after the problem began. Store at least one copy outside the production hosting account and limit who can download or delete it. Use separate credentials and multi-factor authentication where the storage service supports them.
There is no universal schedule that fits every store. Set the interval according to order volume, how often catalog or content changes, and the amount of data the business can afford to recreate. A high-volume store may need more frequent database points than a brochure-style site, while media files may change less often. Whatever interval you select, create a fresh backup immediately before updates, migrations, bulk imports, and major configuration changes.
Keep written recovery instructions with the archive inventory. Include the hosting account, database name, table prefix, domain, version numbers, storage location, encryption key location if used, and the person authorized to approve a restore. Documentation turns a backup from an unknown file into an operational recovery tool.
Recommended Free Tools
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Common failure modes and fixes
The restored site has no recent orders
The selected database predates those orders, so the restore replaced them with the older snapshot. Retrieve the order export made before restoration, compare payment and fulfillment status, and reconcile records carefully. Do not blindly re-import orders that may already have been captured or shipped.
Products appear but images are broken
The database restored successfully, but the corresponding files were not copied or the upload paths do not match. Restore the matching wp-content/uploads content, check file permissions, and clear image or CDN caches.
The site shows a fatal error after rollback
Database and files may come from incompatible WordPress, WooCommerce, PHP, theme, or extension versions. Return to the current snapshot, test a version-matched set on staging, and roll back the complete set rather than swapping only one component.
Checkout loads but payment confirmation fails
Inspect gateway credentials, webhook URLs, HTTPS, scheduled actions, and server logs. Use a sandbox transaction and verify that the callback reaches the restored site before enabling live capture.
A restore button is unavailable
Check the service prerequisites and connection status. A documented managed restore may require a functioning WordPress installation and an active, healthy connection before it can access the selected backup. If the original site is inaccessible, use the provider’s documented recovery or migration route instead of repeatedly retrying from a broken installation.
A practical decision rule
Use a manual SQL and wp-content copy whenever you need an independent, downloadable archive or a migration source. Add scheduled automation when missing one backup window would materially affect the business. Keep an off-site copy regardless of method, test a restore on staging before relying on it, and preserve newer orders before replacing an older database. Those four controls address the main ways WooCommerce recovery plans fail: incomplete coverage, no usable copy, untested procedures, and accidental loss of newer transactions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
