BackupFlow is a complete solution for creating, managing, and restoring WordPress backups directly from the admin panel.
Back up files, databases, or both , schedule them automatically, store them locally or on Amazon S3- compatible services, and restore your site with one click when you need to.
Designed with special attention to backup integrity, security during restores, and administrator control .
🚀 Complete and flexible backups
Choose exactly what you want to protect in each backup:
- ✅ Full backup of files + database .
- 📁 Backup of files only.
- 🗄️ Database only backup.
- 📦 Compression of backups in ZIP format.
- 🔐 Generation of SHA-256 checksum to verify the integrity of each backup.
- 📋 Automatic generation of a manifest.json with information about version, components, exclusions, size and metadata.
- ⚙️ Exporting the database using paginated SQL queries.
- 🌐 Compatible with installations that use an external WP_CONTENT_DIR .
🛡️ Intelligent exclusion of sensitive files
BackupFlow automatically excludes files and directories that should not normally be part of a backup:
- .git , .svn and .hg .
- node_modules .
- WordPress Logs.
- .env files.
- .htpasswd files.
- Keys and certificates .pem , .key , .p12 and .pfx .
- The backup storage directory itself.
- Temporary files generated by the plugin.
When necessary, the administrator can explicitly include sensitive files , separately allow the inclusion of wp-config.php , and define their own custom exclusions .
⏰ Automate your backups
Configure your backups once and let WordPress take care of the rest using WP-Cron .
Available frequencies:
- 🕐 Every hour.
- 🕑 Twice a day.
- 📅 Daily.
- 📆 Weekly.
- 🗓️ Monthly.
In addition, BackupFlow incorporates a complete automatic management system:
- ♻️ Rotation by maximum number of backups .
- 🧹 Removal based on maximum seniority .
- 🗑️ Automatic cleaning of old jobs and logs.
- ⚙️ Background job queue.
- 📊 Tracking backup and restore progress.
- 🔄 Recovery of blocked or abandoned jobs.
- 🔒 Exclusive blocking to prevent simultaneous incompatible operations.
- 🚫 Protection against duplicate jobs.
📧 Email notifications
Receive alerts when important events occur:
- ✅ Backup completed.
- ❌ Backup failed.
- ✅ Restoration completed.
- ❌ Failed restoration.
☁️ Local storage and S3
Save your backups locally or send them to S3 -compatible remote storage.
🔐 Secure local storage
Local backups are stored in a directory protected by various security mechanisms:
- .htaccess .
- index.php .
- index.html .
- web.config .
- Restrictive file system permissions.
Backup filesThey are not served directly from the storage directory. Downloads go through WordPress using admin-post.php and are protected by permissions and nonces.
☁️ Compatible with Amazon S3, MinIO and S3 services
- Compatible with Amazon S3 .
- Compatible with MinIO .
- Compatible with providers that implement the S3 API.
- 🔏 Authentication using AWS Signature Version 4 .
- 📦 Multipart uploads for large files.
- 🔐 Server encryption using AES256 .
- ⚙️ Configurable endpoint, bucket, region, prefix, and path-style.
Credentials can be configured from the administration panel or using WPBM_S3_* constants.
Locally stored credentials are encrypted using OpenSSL , and each backup retains information about the storage configuration with which it was generated.
♻️ Secure restoration with one click
Restore your backups directly from the WordPress dashboard and select which components you want to recover:
- 📁 Files only.
- 🗄️ Database only.
- 🔄 Files + database.
Before performing a restore, BackupFlow runs various checks to reduce the risk of using an incorrect or manipulated backup.
- 🔐 Mandatory checksum verification.
- 📋 Validation of the manifesto and its components.
- 🌐 Detection of backups originating from another domain.
- 🌐 Detecting backups belonging to another site within WordPress Multisite.
- 💾 Automatic creation of a security backup prior to restoration .
- 🚧 Activating real maintenance mode using .maintenance .
- 🛡️ Traffic protection while restoration is in progress.
- ⚙️ Preservation of options necessary for the plugin to function.
- 🔌 Preservation of active_plugins .
- 🧹 Clear cache after completing the process.
🛡️ Protections during restoration
The restoration process includes specific controls against:
- Zip Slip.
- Paths outside the allowed directory.
- Symbolic links.
- Duplicate routes.
- Manipulated files.
- Invalid paths.
- Unauthorized overwrite of wp-config.php .
The exclusions stored in the manifest are respected during the restore process. Additionally, the plugin avoids restoring to its own active directory and ignores any .maintenance files that might be present in the backup.
🔒 Safety in every operation
BackupFlow incorporates different layers of control to protect the most sensitive system functions:
- 👤 Independent capabilities to manage, restore, download and delete backups.
- 🔑 Nonces for sensitive transactions.
- 🌐 Domain validation.
- 🛡️ Protection against path traversal.
- 📦 Validation of routes contained within ZIP files.
- 🔍 Duplicate item detection.
- ✅ External input validation.
- ☁️ Validation of S3 buckets and endpoints.
- 📏 Verification of remote file size.
- 🔐 Checksum verification before downloading or restoring.
- 🚫 Backup files are not directly exposed.
- 🔏 The S3 secret is never returned via the REST API.
- 🔑 License keys are stored encrypted locally.
🩺 Preflight and system status
Before performing important operations, BackupFlow can automatically check if the server is ready.
The preflight system checks:
- 🐘 PHP version.
- 📦 ZIP extension availability.
- 🗄️ Connection to the database.
- 💽 Free space available.
- ✍️ Storage write permissions.
- 📂 Availability of local temporary storage.
- ⏰ WP-Cron Status.
- 📅 Next scheduled execution.
- 🛡️ Web protection of the storage directory.
- ☁️ Storage settings.
- ⚠️ Errors related to task scheduling.
- ⚙️ Currently active jobs.
- 🔒 Restoration lock status.
📊 Complete administration dashboard
Control the status of your backups from a centralized interface within WordPress.
- 📈 General statistics.
- ✅ Number of backups completed.
- ❌ Failed backups.
- 💽 Storage space used.
- ⏰ Next scheduled execution.
- 🩺 General system status.
- 🚦 Preflight visual.
- 📦 Full list of backups.
- ⬇️ Download backups.
- 🔍 Integrity verification.
- ♻️ Restoration.
- 🗑️ Elimination.
- ⛔ Cancellation of queued jobs.
- 📜 Activity log.
- 🔔 Status notifications.
- ⚙️ Complete configuration from the panel.
- ☁️ Integrated S3 configuration.
- 🔑 Separate screen for license management.
⌨️ Compatible with WP-CLI
Do you manage servers from the terminal? BackupFlow also includes commands for WP-CLI .
From the command line you can:
- 💾 Create backups.
- ♻️ Restore backups.
- 📋 List the available copies.
- 🩺 Run preflight checks.
- 🧹 Clean up temporary and outdated work.
✨ Everything you need to manage WordPress backups
BackupFlow combines automatic backups, selective restores, integrity checking, S3 storage, rotation, monitoring, and management tools into a single solution.
Whether you manage a single WordPress site or handle professional projects, servers, or multiple installations, you have the tools you need to keep your backups organized, verified, and ready to restore.
💾 Automate your backups.
🔐 Check its integrity.
☁️ Store them locally or in S3.
♻️ Restore when you need it.
