What Backuply does on your site
Backuply packs your WordPress files and database into a .tar.gz archive, then keeps it on the server or sends it to a remote location. Everything lives in the Backuply menu, on a single tabbed screen: “Dashboard” to start a backup, “Settings” for the options, “Backup Locations” for destinations, “Backup History” to restore or download an archive, and “Support” for self-diagnosis.
Local backups go to wp-content/backuply/, inside a randomly named subfolder protected by an .htaccess file (“deny from all”), a web.config and index files. Restoring takes one click from the history list. To migrate, you install WordPress and Backuply on the new server, add the remote location that holds the backup with “Sync Infos” checked, then restore the synced archive.
The developer is Softaculous Ltd, the company behind the app installer that many web hosts offer. The free version backs up on demand to the server, an FTP account or Google Drive. Backuply Pro adds automatic backups, backup rotation, backups before core updates, WP-CLI and the SFTP, FTPS, Dropbox, OneDrive, pCloud, WebDAV, Amazon S3 and S3-compatible destinations (DigitalOcean Spaces, Linode, Vultr, Cloudflare R2). Every Pro plan includes some Backuply Cloud space, the vendor’s own storage.
Which sites Backuply suits best
Backuply fits when you want a full backup you can restore without leaving WordPress:
- Business sites and blogs that change now and then: a manual backup to Google Drive or FTP before each round of changes is enough, and the free version handles it.
- Moving to a new host or domain: migration uses the same archive as the backup, with no extra tool.
- Tight budgets that still want automation: the single-site Pro plan is cheap and includes remote storage, which covers the off-server copy of a 3-2-1 backup strategy.
- Sites where core updates install themselves: with Pro, “Backup Before Auto Updates” holds the automatic WordPress update until a backup has finished.
It is not the best pick if you want scheduled backups without paying: UpdraftPlus and WPvivid both schedule backups in their free versions.
Backuply strengths and limitations
Strengths
- Free restore and migration. Restoring an archive, cloning it or migrating to another site does not require Pro.
- Google Drive and FTP in the free version. You can keep a copy off the server without a subscription.
- Backup before automatic core updates. In Pro, the update waits for the backup to finish and is postponed if the backup fails.
- Inexpensive Pro with storage included. $39 per year for one site with 10 GB of Backuply Cloud, $249 per year for unlimited sites.
- Built-in troubleshooting. The Support tab runs a self-diagnosis and adds the “noabort” rule that helps on LiteSpeed servers.
Limitations
- No scheduling in the free version. Automatic backups and rotation require Pro or a Backuply Cloud plan.
- Few destinations without Pro. Dropbox, OneDrive, Amazon S3, SFTP and WebDAV are paid features.
- Pre-update backups cover core only. The options target WordPress updates, not plugin or theme updates.
- Serious vulnerabilities in recent years. Including an SQL injection reachable from a plain subscriber account, fixed in October 2026.
The Backuply settings we recommend
Settings live under Backuply > Dashboard, “Settings” tab, then the “Save Settings” button. Rows marked Pro only appear or unlock with Backuply Pro (or a Backuply Cloud plan for automatic backups).
| Setting | Recommended value | Why |
|---|---|---|
| Backup Options Backuply > Dashboard > Settings > Backups Settings | “Backup Directories” and “Backup Database” both checked | An archive with both files and database restores on its own, with nothing missing. |
| Backup Location Same section | A remote location (Google Drive or FTP on the free plan) rather than “Local Folder” | A copy left on the server disappears with it after a crash or a hack. |
| Auto Backup Pro Settings > Auto Backups Settings | Daily for an active site, weekly for a brochure site | Frequency should match how often things change: orders, comments, posts. |
| Backup Rotation Pro Same section | 7 to 14 archives, depending on available space | Keeps several restore points without filling the storage; Backuply warns above 30. |
| Backup Before Manual Updates and Backup Before Auto Updates Pro Settings > Backups Settings | On | You can still roll back if a core update breaks the site. |
| Email Settings > Additional Settings | An inbox someone reads daily | A failed backup that nobody notices is the most common scenario. |
| Exclude Files/Folders Settings > Exclude Settings | The rebuildable cache folders of your caching plugin, after checking them | Lighter, faster archives with no loss of useful data. |
| Debug Mode Settings > Additional Settings | Off, except while troubleshooting | Backuply itself advises against leaving it on permanently. |
- Run a backup from the Dashboard tab and check that it shows up in “Backup History” and on the remote location.
- Restore an archive on a staging site at least once: a backup that has never been restored is not a guarantee.
- Open
/wp-content/backuply/in a browser: access should be denied. On Nginx, which ignores.htaccess, add a blocking rule (see our article on exposed sensitive files). - On LiteSpeed hosting, use “Scan & Fix LiteSpeed noabort” in the Support tab if a backup stops halfway.
Backuply vulnerabilities and the versions that fix them
A backup plugin reads and writes the whole site, so its flaws carry more weight than most. The published advisories, mostly reported by Wordfence researchers, target the restore process and archive handling:
- CVE-2026-93953, versions up to 1.5.8: second-order SQL injection. A subscriber plants code in the “Biographical Info” field; when an administrator later restores a backup, the query changes the database and can hand the administrator role to a new account (CVSS 8.0). Fixed in 1.5.9.
- CVE-2025-10307, versions up to 1.4.8: an administrator could delete any file on the server through backup deletion,
wp-config.phpincluded (CVSS 6.5). - CVE-2024-8669, versions up to 1.3.4: SQL injection limited to administrators, rated CVSS 9.1.
- CVE-2024-0842, versions up to 1.2.6: unauthenticated denial of service through direct requests to the
restore_ins.phpfile (CVSS 7.5).
Run version 1.5.9 or later and turn on automatic updates for Backuply under Plugins (see our guide to automatic plugin updates). WP Masquerade Pro has nothing to remove for Backuply on your public pages (see the box below), so updating remains the real protection.
What WP Masquerade hides for Backuply
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to Backuply: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
Nothing more
Still visible
No known trace
Backuply FAQ
Is the free version of Backuply enough?
For a site that rarely changes, yes, as long as you remember to run the backup yourself and send it to Google Drive or FTP. Once you want scheduled backups you don’t have to think about, you need Pro or a Backuply Cloud plan.
How much does Backuply Pro cost?
The official pricing page lists $39 per year for one site (Personal), $69 for five sites (Professional) and $249 for unlimited sites (Business), with 10, 25 and 100 GB of Backuply Cloud respectively. The standalone Backuply Cloud plan costs $18 per year for one site and 10 GB, without the Pro plugin.
How do I migrate a site with Backuply?
Back up the source site to a remote location, install WordPress and Backuply on the destination, add the same location with “Sync Infos” checked, then click Restore in “Backup History”. Backuply replaces the old site’s URLs with the new ones.
Where does Backuply store local backups?
In wp-content/backuply/, under a backups- folder followed by a random string. Always keep another copy off the server: a local archive protects you from neither a disk failure nor a compromised hosting account.