WordPress Export vs Backup: What Each Preserves
- Is a WordPress export the same as a backup?
- What does the built-in export actually contain?
- Which package fits which job?
- Why are media references different from media files?
- What should a recovery handoff record look like?
- What does an adequate restoration test need to establish?
- How should you handle an incomplete package?
- When can the team call the work complete?
- Sources
Is a WordPress export the same as a backup?
A WordPress content export is not a complete site backup. The built-in WXR file transfers supported content records; recovery also needs the site's files and database, with scope verified for the actual hosting setup. Protect exports as potentially sensitive data, retain the source until validation is complete, and have qualified administrators test restoration in an isolated environment before destructive changes or production cutovers.
The distinction matters when someone hands you a downloaded file and says the site is covered. Covered for what: moving selected articles, recovering after a failed update, or recreating the entire service at another host? Those are different acceptance tests.
This guide explains the built-in WordPress content export and the separate requirements of recovery. WordPress.com-specific behaviour is labelled. It is a documentation-based comparison, not a hands-on evaluation of backup products, and it does not provide production commands.
What does the built-in export actually contain?
WordPress calls its content-transfer format WordPress eXtended RSS, or WXR. It is XML: structured text representing content and associated information, rather than a packaged copy of the running application.
The Tools Export documentation lists posts, pages, custom post types, comments, custom fields, categories, tags, custom taxonomies and users. Its interface offers content selection and filters, including author, dates and status where applicable. Record the selected options; a filtered export is not evidence that omitted material was unimportant. WordPress: Tools Export screen
“All content” also has technical limits. The current core function reference says post types must have export enabled through can_export, and auto-drafts are skipped. The generated file's own introductory comments explicitly say it is not intended as a complete site backup. That warning is part of WordPress's published source, not a criticism inferred from a failed test. WordPress: export_wp reference and source
For a custom content type, ask its maintainer whether the intended export route covers its records and dependencies. A field appearing in an XML file does not, by itself, establish that the receiving system understands how the field is used.
Which package fits which job?
Choose by the result you need to demonstrate, not by file size or the word “export” in a menu.
| Package or process | Appropriate question | Evidence still required |
|---|---|---|
| Built-in WXR content export | Can the intended content move into a compatible destination? | Content scope, destination import results and dependency checks |
| Database backup | Can the saved database state be restored? | Matching files and a suitable restoration environment |
| File backup | Are the required site files preserved? | Database coverage and the recovery procedure |
| Provider or plugin backup service | What does this particular service promise to recover? | Documented inclusions, exclusions, access and a restoration test |
| Full migration plan | Can the service operate at its destination? | Content, media, configuration, access and cutover validation |
WordPress's administration handbook separates database and file backups and says both are needed to fully restore a typical site. It also recommends treating them as a related backup set rather than unrelated downloads from different moments. WordPress: Backups
A database dump is not the same thing as the WXR content file, even though both may be described casually as exports. Likewise, an archive containing a website directory is not proof that someone included the database.
Keep scope explicit when discussing a hosting backup. Ask which service and recovery point it covers, where exclusions are documented, who can request restoration and what happens if the usual account is unavailable. These are questions for that provider, not features this guide assumes every plan includes.
Why are media references different from media files?
A link to an image tells a system where the image is; it is not the image's bytes.
WordPress.com's export documentation states that its XML contains links to media rather than the actual media files. Its transfer process relies on accessing the original site to copy them, and its content export excludes theme design, customizations and plugins. Do not mistake an XML download from that service for a self-contained recovery package. WordPress.com: Export your website's content
That access requirement needs a privacy decision. Do not make a private site or protected files public just to satisfy a transfer workflow. Ask the platform's support team or a qualified administrator for an approved method that preserves access controls. Keep the original environment available under the authorized plan until transfer evidence is complete.
For self-hosted WordPress, the official WordPress Importer listing documents controls that can permit or block attachment downloading. It also displays a compatibility warning concerning recent WordPress releases at the time of this review. This guide is not a recommendation to install it on production: have the administrator check the current importer version, supported environment and media handling. WordPress Importer documentation
Separate these checks in your acceptance record:
- The article includes the intended image reference.
- The destination has an authorized, usable copy of the required file.
- The rendered destination page uses the intended copy.
- Captions, alternative text and relevant associations are correct.
An image visible in a preview can still be served from a source that is due to be retired. Review the resolved resource location as well as the appearance. Do not delete the source to test what breaks.
What should a recovery handoff record look like?
Use the existing CMS migration content inventory to identify what is moving. Add a separate package record to explain what has actually been preserved.
The following is a fictional example, not a report from a real website or a set of files you should execute.
A small publication plans to move twelve articles. Its editor supplies a WXR file; its administrator separately prepares a database backup and a site-file archive. The project owner has not yet approved removal of the source.
| Example item | Recorded scope | Evidence still outstanding |
|---|---|---|
| Content export | Twelve intended articles; selection recorded | Compare each imported article with its source |
| Database backup | Named source and recorded recovery point | Authorized isolated restoration test |
| Site-file archive | File scope documented by administrator | Confirm required uploads, theme and plugin files are present |
| Media check | Each required asset mapped to its destination | Verify the intended destination copies, not old-host references |
| Recovery note | Responsible administrator and documented procedure | Record test result and unresolved exclusions |
Nothing in the first row completes the other rows. Twelve imported articles might satisfy a content-count check while leaving media or functionality unresolved.
Give each package an owner, creation time with time zone, source environment, scope description, approved storage location, retention decision and validation status. Use “not checked” when evidence is absent. A file's existence and a successful recovery are different facts.
Do not put passwords, private access links or full configuration contents in this handoff table. The record should identify the authorized storage and access process without reproducing secrets.
What does an adequate restoration test need to establish?
The administrator should agree on a test objective before restoring anything. A demonstration that a backup archive opens is narrower than a demonstration that the site can run from its saved state.
For a typical file-based WordPress installation, the official file-backup guide identifies themes, plugins, uploads and other site files as part of the file side of recovery. It also points out that wp-config.php contains connection details. Handle such material as sensitive; this article does not ask you to open or share it. WordPress: Backing Up Your WordPress Files
Our editorial recommendation is to give the test these explicit boundaries:
- The administrator identifies an isolated, authorized destination and verifies that restoration will not overwrite production.
- The data owner approves what information may enter that environment and who may access it.
- The administrator follows current provider and WordPress documentation for the actual recovery method.
- The team checks the agreed content, files and essential functions, using approved test data and controls.
- The administrator records the recovery point used, what passed, what failed and what remains outside the test's scope.
Before testing, ask the administrator to control outbound effects such as real email, payment actions and integrations. Do not assume a staging label prevents them.
Use the CMS pre-publish checklist for rendered-page checks after an authorized test. It complements recovery evidence; it cannot establish that a backup includes every required component.
How should you handle an incomplete package?
First identify which job is incomplete. If only selected content needs moving, a missing theme archive may be outside that transfer's scope. If the promise was complete recovery, the same omission needs an explicit recovery decision.
Ask for the missing evidence by name: media copy verification, export filters, database coverage, file exclusions or a recorded restoration result. Avoid a broad instruction to “export everything again” until the owner understands what was missing.
Do not upload an export to an unapproved online converter or public troubleshooting service. It may include unpublished content, comments or other information that was not intended for public release. Obtain an approved handling method from the organization's data owner or administrator.
If imports time out or produce unclear results, stop before repeatedly importing into the same destination. Preserve the error record with sensitive information removed and have the administrator determine the next attempt. The importer documentation specifically routes shared-hosting resource problems to hosting support; it is not a reason to change server limits without review. WordPress Importer FAQ
When can the team call the work complete?
Write a completion sentence that matches the evidence. “Selected articles imported and checked” is useful and bounded. “Site recoverable from the approved backup set” requires the separate restoration evidence.
Our suggested sign-off has three parts: the intended outcome, the evidence supporting it and the remaining exclusions. Assign an owner to each unresolved dependency rather than hiding it behind a single complete status.
More site-maintenance workflows can help organize the wider change. Keep this decision narrow: use content exports for validated content transfer, establish recovery separately, and retain the source until the responsible owners approve its retirement. Database restoration, deletion, DNS changes and production cutovers remain administrator-controlled operations with tested backups and an approved rollback path.