Steadfast BackupFree WordPress backup, restore and migration plugin

What a WordPress backup includes

Each manual backup and each schedule can be a Full backup (files and database), Database only or Files only. A file backup is made of parts, and you choose which parts to include:

wp-config.php is always stored in the archive. A restore keeps the current site's wp-config.php, so a restore never changes your database credentials.

Estimate size, under Back up now, reports the size of the database and of the files your settings include, and compares it with the free space on your server. The finished archive is usually 30 to 70 percent smaller after compression.

Scheduled WordPress backups

A schedule sets what to back up, how often, where to store it, whether to store only changed files and how many of its backups to keep. Add as many schedules as you like, for example an hourly database backup and a nightly full backup.

Times follow your site's time zone, including daylight saving changes. If a schedule comes due while another job is running, it waits in a queue and starts when that job ends. Run now starts a schedule right away with all of its settings.

Recommended setups

Storing copies with two different companies, for example Google Drive and Backblaze B2, protects you if one account is closed, locked or hacked.

Incremental backups that save time and space

Turn on Back up only changed files in a schedule and each backup stores only the files that are new or changed since that schedule's previous backup. Every incremental backup still contains the complete database, so a database restore never needs more than one archive.

• Every file backup records an index of all files with their size and modification time. The next backup compares against it to find what changed.
• The index also lists files that were deleted, so a restore does not bring them back.
• Full backup every N backups (2 to 100, default 7) starts a fresh chain, so a restore never depends on a long line of archives.
• Restoring combines the chain for you: the full backup first, then each incremental backup in order. The Restore dialog shows how many backups it combines, and every archive is checked before anything changes.
• Retention never deletes a backup that a kept incremental backup builds on. If one is missing everywhere, the backup is marked Broken chain and its database can still be restored.

For a large media library, incremental backups turn a nightly multi-gigabyte upload into a few megabytes of new photos.

Back up WordPress to Google Drive, Dropbox, OneDrive, Amazon S3 and more

Every backup can go to this server, to any number of storage locations, or both. When a backup goes to remote storage only, the archive is built on the server, uploaded, and then removed from the server. Uploads are sent in chunks and resume after interruptions, and each location has a Test button that writes, reads and deletes a small file to confirm the settings.

When cloud storage is down

Each upload is tried three times during the backup. If it still fails, the backup finishes and stays on your server, and the upload is tried again every hour for 7 days. The Backups page shows the next try with a Try now link. After 7 days of failures you get an email and a webhook alert, and the server copy is kept.

Restore WordPress from a backup with one click

Select Restore on the Backups page, choose Database, Files or both, choose where to restore from if the backup is stored in several places, and confirm. The restore is built so a bad archive is rejected before your site changes:

1. A backup stored only in the cloud is downloaded and its SHA-256 checksum is compared with the one recorded at backup time.
2. Every archive is read to the end, so a damaged, incomplete or wrongly decrypted archive is rejected before anything changes.
3. The database is imported into temporary tables and each table's row count is checked. Your live tables stay in use meanwhile.
4. The site enters maintenance mode. Each file is written beside its target and swapped in only once it is complete.
5. The new tables are renamed into place in one step, maintenance mode ends, caches are cleared and permalinks are refreshed.

The restore runs through a small standalone engine, because WordPress itself is replaced while it runs. It accepts only requests that carry a one-time token and is removed when the restore ends.

Recover from common WordPress problems

Migrate WordPress to a new host or domain

Steadfast Backup moves a site with the same restore you use every day, whether you are changing hosts, changing domains or taking a site from your computer to a live server.

1. On the old site, make a Full backup and store it in the cloud, or download it.
2. On the new host, install a fresh WordPress and Steadfast Backup.
3. Bring the backup over: connect the same storage and choose Find backups in storage, upload the archive on the Backups page, or copy it by FTP and choose Rescan this server.
4. Select Restore. The dialog shows the old and new addresses. Confirm, then sign in with an administrator account from the old site.

During the restore, every old address is replaced with the new one in every table, in plain, JSON-escaped and URL-encoded forms, for http, https and protocol-relative links, along with the old server path. String lengths inside PHP serialized data are corrected, including nested arrays and objects, so page builder data and widget settings survive the move. When the new site uses a different table prefix, tables and prefix-bound keys such as wp_user_roles are renamed to match.

Upload a backup sends the archive in chunks sized to your server's upload limit, so archives of any size upload through the browser. Sites built locally with Local, XAMPP or MAMP move the same way, and http://mysite.local becomes your live https address everywhere.

Create and update a staging site

A staging site is a private copy where you try updates or a redesign before visitors see them. Restore a live backup onto a fresh WordPress on a subdomain such as staging.example.com and the address is changed for you. Each site keeps its own Steadfast Backup settings and schedules.

When pushing changes back, restore only what you changed: chosen plugins and themes as files, or only the content tables you edited, so comments, orders and new users on the live site are kept.

Test a backup before you need it

A backup you have never restored is a hope, not a plan. More, Test this backup proves a backup restores without changing your site:

1. Downloads the backup if it is stored only remotely and checks its SHA-256 checksum.
2. Reads every archive to the end, including all parts and every backup of an incremental chain.
3. Checks that the database dump is complete.
4. Imports the whole dump into temporary tables and compares each table's row count with the count recorded at backup time.
5. Removes the temporary tables and shows Test passed or Test failed on the Backups page.

Optional encrypted backups and split archives

Encryption is off by default. Turn it on in Settings, Security with a password of at least 8 characters, and every new archive is encrypted in full: files, database, manifest and index.

php tools/sfb-decrypt backup.tar.gz.enc backup.tar.gz

Split archives for hosting limits

Split archives into parts of any size in megabytes when a host, cPanel File Manager, the WordPress uploader or a storage service limits file size. Each part uploads as its own file, the checksum covers all parts joined together, and Upload a backup accepts every part at once. Outside WordPress, join them with cat on Linux and macOS or copy /b on Windows.

Built for shared hosting and large sites

Web hosts limit how long one PHP request may run. Steadfast Backup splits every backup and restore into short slices, 20 seconds by default and always below your host's limit. Each step saves its position, so a slice stopped by the host resumes where it stopped.

• After each slice, the next one starts with a background request. If your host blocks those, the open admin page continues the job, and a watchdog resumes it otherwise.
• Progress is shown live while a job runs, and a running backup can be cancelled.
• With WP-CLI, jobs run in one process with no time limit.
• Requires room on the server for one compressed archive while it uploads.

Automatic backup before plugin, theme and WordPress updates

Turn on Settings, Before updates, and a backup is made before every update you start from the dashboard: Dashboard, Updates, and the Plugins and Themes screens, including one-click Update now links and bulk updates. A progress window makes the backup first, then continues with the update.

Choose Full or the faster Database only, where to store it and how many to keep. Further updates within 15 minutes in the same browser tab proceed without another backup. Automatic background updates and WP-CLI updates are covered by your schedules, or by running wp steadfast backup first.

Backup alerts by email, Slack and Discord

WooCommerce and busy sites

A database restore puts every chosen table back to the moment of the backup, which on a shop also removes orders placed since then. Steadfast Backup lets you restore only the tables you need and leave order and customer tables untouched. The built-in guide lists the WooCommerce order, customer and product tables, including High-Performance Order Storage. Restoring files is always safe for orders, since orders live only in the database.

For shops, an hourly database schedule plus a daily incremental full backup keeps the gap between backups small without large uploads.

WP-CLI commands for developers

Every action is available from the command line. Commands run in one process with no time limits, which suits system cron jobs, deployment scripts and very large sites.

wp steadfast backup --type=db --note="before import"
wp steadfast backup --to=local,<location-id> --incremental
wp steadfast restore <id> --files-only --components=uploads --yes
wp steadfast restore <id> --db-only --tables=wp_options --yes
wp steadfast test-backup <id>
wp steadfast list --format=json
wp steadfast status
wp steadfast sync <location-id>
wp steadfast cron
wp steadfast retry-uploads

Also included: decrypt, cancel, delete, storage and test. Developers can add storage drivers, exclusion patterns and actions after a backup or restore through WordPress hooks, all documented in the plugin's reference.

WordPress multisite backups

• The plugin is network activated and runs on the main site only, for super admins.
• Backups contain the tables of every site in the network and all files, including wp-content/uploads/sites.
• Restore parts of single sites by choosing their tables, for example wp_2_posts and wp_2_postmeta for site 2.
• A network database restore is accepted only on a multisite install at the same address, which protects you from mixing up networks.

Security and privacy

• Storage passwords, keys and tokens are encrypted in your own database.
• The backup folder blocks web access on Apache, LiteSpeed and IIS. On nginx, one line in the server settings does the same, and the System check reports whether the folder can be reached.
• Downloads stream only through a signed-in admin request.
• Access lock limits the plugin to chosen administrators. Others do not see its menu, notices or pages.
• Every screen and request requires an administrator and a security token. Cloud sign-ins use PKCE and a one-time state value.
• No usage statistics, no accounts and no license checks. Nothing is sent to Geek By Choice.

Read the Steadfast Backup privacy policy for exactly what is stored and where.

Open your backups with standard tools

Backups are ordinary gzip-compressed tar archives that open with tar -xzf, 7-Zip or any archive tool, so your data is never locked inside the plugin.

Switching from another backup plugin? Install Steadfast Backup while the old one is still active, make and test a first backup, add your schedules, then turn the old plugin's schedules off. Keep the old plugin while you might still need its archives, since only it can restore them.

Set up WordPress backups in a few minutes

1. In your dashboard, open Plugins, Add Plugin, search for Steadfast Backup, then install and activate it.
2. Open Steadfast Backup and select Back up now for a first backup on your server.
3. On the Storage page, add a cloud service and select Test.
4. On the Schedules page, add a schedule that sends backups to that storage.
5. Turn on Settings, Before updates.
6. On the Backups page, choose More, Test this backup, and wait for Test passed.

Requirements

Step-by-step instructions for every storage service, restore and site move are inside the plugin under Settings, Docs, with a search box.