How to Automate Website Backups Using FTP Scripts
Learn how to automate website backups with SFTP scripts, WinSCP, curl, lftp, cron, or Task Scheduler. Copy files and databases on a schedule, protect credentials, keep dated archives, watch logs, and test a restore before you need one.
Backups
A backup job should collect website files and, for apps such as WordPress, a database dump. Then it should copy that archive off the same server. Prefer SFTP. Do not store live passwords in a plain FTP script. Automating File Transfers
Schedule
Daily or weekly so a copy exists before an update or failure.
Offsite
Keep copies on another machine or cloud target, not only in public_html.
Test restore
A backup that was never restored is unproven. Manual recovery
Prerequisites
- SSH/SFTP access, or an FTP account if you must use FTPS. Create an FTP Account
- A destination folder that is not the live site tree.
- WinSCP (Windows) or sftp/lftp plus cron (Linux/macOS/cPanel).
What the job should do
site-2026-09-19.tar.gz.Built-in ftp.exe / ftp -inv scripts send the password in clear text. Use WinSCP SFTP or OpenSSH keys instead. Using SFTP with cPanel
Schedule
Linux / cPanel cron — daily at 02:00:
0 2 * * * /path/to/backup.sh
Windows — Task Scheduler → Create Basic Task → run the WinSCP script daily.
Where to store copies
Restore check
- Download one dated archive.
- Unpack it on a staging copy, not on the live site first.
- Import the database dump if one exists.
- Confirm the site loads. Then keep that process documented. Manual Website Recovery
Frequently Asked Questions
How often should I back up a WordPress site?
Daily is a practical rhythm for a busy store or a site that changes all day. Weekly can be enough for a small brochure site that rarely updates. Also take a manual copy before plugin, theme, or core updates. Keep more than one dated copy so a bad backup does not replace the only good one. Recovery steps are in manual website recovery with FTP.
Does an FTP backup include the database?
Not by itself. FTP or SFTP copies files such as themes, plugins, uploads, and wp-config.php. WordPress posts and settings live in MySQL. Export the database in cPanel or include a dump in the same dated folder as the file archive. A files-only copy cannot rebuild the site alone. WordPress file work is covered in managing WordPress with FTP.
Can I automate backups without an FTP client window?
Yes. WinSCP scripts, cron plus sftp, or a cPanel backup tool can run unattended. Hosting backups and plugins such as UpdraftPlus are simpler if you do not want scripts. Scripts give more control over folders and destinations. General automation is in automating file transfers.
Should backup scripts use SFTP instead of FTP?
Yes when SSH is available. A scheduled job should not send the password in plain FTP. Use SFTP with a key, or FTPS for a regular extra FTP account. Do not store the secret in public_html. Protocol choices are in FTP vs SFTP vs FTPS and using SFTP with cPanel.
Where should I store the backup copies?
Keep at least one copy off the same server. Options include a local disk, another FTP/SFTP host, or cloud storage. A backup that lives only in public_html can vanish with the site. Use dated filenames and delete old copies on a retention plan so the disk does not fill. Create a limited login with an FTP account in cPanel.
What should I do if a scheduled backup fails?
Run the script by hand and read the log. Check hostname, protocol, quota, folder permissions, and whether the extra FTP user can see the path. Set a notification or review the log the next morning until the job is reliable. Do not assume silence means success. Connection checks are in FTP troubleshooting.
How do I restore from an FTP backup?
Download the dated archive, confirm it opens, then upload the files into the correct document root. Import the matching database dump if the site uses MySQL. Test on a staging folder when you can. File Explorer is a weak restore tool for large sites; use FileZilla or WinSCP. See WinSCP setup.
Is a dedicated backup FTP account safer than the main cPanel user?
Yes. Give the job its own account and, when possible, a folder that only holds backup archives. Do not put the primary cPanel password in a script. Prefer SFTP keys if SSH is on. More hosting articles are on the blog index.
Related FTP Tutorials and How To Guides
Tweet Share Pin Email
Add Comment
This policy contains information about your privacy. By posting, you are declaring that you understand this policy:
- Your name, rating, website address, town, country, state and comment will be publicly displayed if entered.
- Aside from the data entered into these form fields, other stored data about your comment will include:
- Your IP address (not displayed)
- The time/date of your submission (displayed)
- Your email address will not be shared. It is collected for only two reasons:
- Administrative purposes, should a need to contact you arise.
- To inform you of new comments, should you subscribe to receive notifications.
- A cookie may be set on your computer. This is used to remember your inputs. It will expire by itself.
This policy is subject to change at any time and without notice.
These terms and conditions contain rules about posting comments. By submitting a comment, you agree with these rules:
- Although the administrator will attempt to moderate comments, not all comments can be moderated at all times.
- You acknowledge that all comments express the opinions of the original author and not those of the administrator.
- You will not post material which is knowingly false, obscene, hateful, threatening, harassing or invasive of privacy.
- The administrator has the right to edit, move or remove any comment for any reason and without notice.
Failure to comply with these rules may result in being banned from submitting further comments.
These terms and conditions are subject to change at any time and without notice.
What Is DNS Hijacking Or Redirecting
How to Transfer or Move a Domain Name With No Downtime
What is a URL and Where is it Located
What happens If I Do Not Renew My Domain Name
Comments