{
    "title": "Backuply",
    "seo_title": "Backuply: review, recommended settings and limits",
    "h1": "Backuply",
    "description": "Backuply free or Pro: backup, restore and migration, strengths, limitations, pricing, recommended settings and patched vulnerabilities, to choose well.",
    "lead": "Backuply, the backup plugin from Softaculous, copies your files and database, restores in one click and moves a site to a new host. Our take on the free and Pro versions, the settings to choose and the patched vulnerabilities to know before trusting it with your archives.",
    "language": "en",
    "locale": "en-US",
    "type": "plugin-sheet",
    "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/backuply/",
    "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/backuply/",
    "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/backuply/index.md",
    "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/backuply/index.json",
    "published": "2026-11-04T08:00:00+00:00",
    "modified": "2026-11-05T20:59:23+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "Backuply",
            "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/backuply/",
            "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/backuply/index.md",
            "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/backuply/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "Backuply",
            "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/backuply/",
            "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/backuply/index.md",
            "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/backuply/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "Backuply",
            "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/backuply/",
            "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/backuply/index.md",
            "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/backuply/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "Backuply",
            "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/backuply/",
            "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/backuply/index.md",
            "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/backuply/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "Backuply",
            "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/backuply/",
            "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/backuply/index.md",
            "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/backuply/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "Backuply",
            "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/backuply/",
            "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/backuply/index.md",
            "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/backuply/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "Backuply",
            "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/backuply/",
            "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/backuply/index.md",
            "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/backuply/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "Backuply"
        },
        {
            "level": 2,
            "text": "What Backuply does on your site"
        },
        {
            "level": 2,
            "text": "Which sites Backuply suits best"
        },
        {
            "level": 2,
            "text": "Backuply strengths and limitations"
        },
        {
            "level": 3,
            "text": "Strengths"
        },
        {
            "level": 3,
            "text": "Limitations"
        },
        {
            "level": 2,
            "text": "The Backuply settings we recommend"
        },
        {
            "level": 2,
            "text": "Backuply vulnerabilities and the versions that fix them"
        },
        {
            "level": 2,
            "text": "Backuply FAQ",
            "id": "faq"
        }
    ],
    "body": "## The essentials\n\n- Best for business sites and blogs that want to back up, restore and migrate at no cost.\n- Main caveat: no scheduled backups without Backuply Pro or a Backuply Cloud plan.\n- Free; Pro starts at $39 per year for one site and includes 10 GB of Backuply Cloud storage.\n\n## What Backuply does on your site\n\nBackuply packs your WordPress files and database into a `.tar.gz` archive, then keeps it on the server or sends it to a remote location. Everything lives in the Backuply menu, on a single tabbed screen: “Dashboard” to start a backup, “Settings” for the options, “Backup Locations” for destinations, “Backup History” to restore or download an archive, and “Support” for self-diagnosis.\n\nLocal backups go to `wp-content/backuply/`, inside a randomly named subfolder protected by an `.htaccess` file (“deny from all”), a `web.config` and index files. Restoring takes one click from the history list. To migrate, you install WordPress and Backuply on the new server, add the remote location that holds the backup with “Sync Infos” checked, then restore the synced archive.\n\nThe developer is Softaculous Ltd, the company behind the app installer that many web hosts offer. The free version backs up on demand to the server, an FTP account or Google Drive. Backuply Pro adds automatic backups, backup rotation, backups before core updates, WP-CLI and the SFTP, FTPS, Dropbox, OneDrive, pCloud, WebDAV, Amazon S3 and S3-compatible destinations (DigitalOcean Spaces, Linode, Vultr, Cloudflare R2). Every Pro plan includes some Backuply Cloud space, the vendor’s own storage.\n\n![Diagram: Backuply works on wordpress, database and files, external services. Public traces: no known public trace.](https://www.wp-masquerade.com/media/wpm-sheets/backuply/diagram-en.svg?v=eda6c74e)\n\n## Which sites Backuply suits best\n\nBackuply fits when you want a full backup you can restore without leaving WordPress:\n\n- **Business sites and blogs that change now and then**: a manual backup to Google Drive or FTP before each round of changes is enough, and the free version handles it.\n- **Moving to a new host or domain**: migration uses the same archive as the backup, with no extra tool.\n- **Tight budgets that still want automation**: the single-site Pro plan is cheap and includes remote storage, which covers the off-server copy of a [3-2-1 backup strategy](https://www.wp-masquerade.com/wordpress-backups-3-2-1-strategy/).\n- **Sites where core updates install themselves**: with Pro, “Backup Before Auto Updates” holds the automatic WordPress update until a backup has finished.\n\nIt is not the best pick if you want scheduled backups without paying: [UpdraftPlus](https://www.wp-masquerade.com/features/camouflaged-plugins/updraftplus/) and [WPvivid](https://www.wp-masquerade.com/features/camouflaged-plugins/wpvivid-backup-migration/) both schedule backups in their free versions.\n\n## Backuply strengths and limitations\n\n### Strengths\n\n- **Free restore and migration.** Restoring an archive, cloning it or migrating to another site does not require Pro.\n- **Google Drive and FTP in the free version.** You can keep a copy off the server without a subscription.\n- **Backup before automatic core updates.** In Pro, the update waits for the backup to finish and is postponed if the backup fails.\n- **Inexpensive Pro with storage included.** $39 per year for one site with 10 GB of Backuply Cloud, $249 per year for unlimited sites.\n- **Built-in troubleshooting.** The Support tab runs a self-diagnosis and adds the “noabort” rule that helps on LiteSpeed servers.\n\n### Limitations\n\n- **No scheduling in the free version.** Automatic backups and rotation require Pro or a Backuply Cloud plan.\n- **Few destinations without Pro.** Dropbox, OneDrive, Amazon S3, SFTP and WebDAV are paid features.\n- **Pre-update backups cover core only.** The options target WordPress updates, not plugin or theme updates.\n- **Serious vulnerabilities in recent years.** Including an SQL injection reachable from a plain subscriber account, fixed in October 2026.\n\n## The Backuply settings we recommend\n\nSettings live under Backuply > Dashboard, “Settings” tab, then the “Save Settings” button. Rows marked Pro only appear or unlock with Backuply Pro (or a Backuply Cloud plan for automatic backups).\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **Backup Options**  Backuply > Dashboard > Settings > Backups Settings | “Backup Directories” and “Backup Database” both checked | An archive with both files and database restores on its own, with nothing missing. |\n| **Backup Location**  Same section | A remote location (Google Drive or FTP on the free plan) rather than “Local Folder” | A copy left on the server disappears with it after a crash or a hack. |\n| **Auto Backup** (Pro) Settings > Auto Backups Settings | Daily for an active site, weekly for a brochure site | Frequency should match how often things change: orders, comments, posts. |\n| **Backup Rotation** (Pro) Same section | 7 to 14 archives, depending on available space | Keeps several restore points without filling the storage; Backuply warns above 30. |\n| **Backup Before Manual Updates** and **Backup Before Auto Updates** (Pro) Settings > Backups Settings | On | You can still roll back if a core update breaks the site. |\n| **Email**  Settings > Additional Settings | An inbox someone reads daily | A failed backup that nobody notices is the most common scenario. |\n| **Exclude Files/Folders**  Settings > Exclude Settings | The rebuildable cache folders of your caching plugin, after checking them | Lighter, faster archives with no loss of useful data. |\n| **Debug Mode**  Settings > Additional Settings | Off, except while troubleshooting | Backuply itself advises against leaving it on permanently. |\n\n- Run a backup from the Dashboard tab and check that it shows up in “Backup History” and on the remote location.\n- Restore an archive on a [staging site](https://www.wp-masquerade.com/glossary/staging-environment/) at least once: a backup that has never been restored is not a guarantee.\n- Open `/wp-content/backuply/` in a browser: access should be denied. On Nginx, which ignores `.htaccess`, add a blocking rule (see our article on exposed sensitive files).\n- On LiteSpeed hosting, use “Scan & Fix LiteSpeed noabort” in the Support tab if a backup stops halfway.\n\n## Backuply vulnerabilities and the versions that fix them\n\nA backup plugin reads and writes the whole site, so its flaws carry more weight than most. The published advisories, mostly reported by Wordfence researchers, target the restore process and archive handling:\n\n- **CVE-2026-93953, versions up to 1.5.8**: second-order SQL injection. A subscriber plants code in the “Biographical Info” field; when an administrator later restores a backup, the query changes the database and can hand the administrator role to a new account (CVSS 8.0). Fixed in 1.5.9.\n- **CVE-2025-10307, versions up to 1.4.8**: an administrator could delete any file on the server through backup deletion, `wp-config.php` included (CVSS 6.5).\n- **CVE-2024-8669, versions up to 1.3.4**: SQL injection limited to administrators, rated CVSS 9.1.\n- **CVE-2024-0842, versions up to 1.2.6**: unauthenticated denial of service through direct requests to the `restore_ins.php` file (CVSS 7.5).\n\nRun version 1.5.9 or later and turn on automatic updates for Backuply under Plugins (see our guide to automatic plugin updates). WP Masquerade Pro has nothing to remove for Backuply on your public pages (see the box below), so updating remains the real protection.\n\n## Backuply FAQ\n\n**Is the free version of Backuply enough?**\n\nFor a site that rarely changes, yes, as long as you remember to run the backup yourself and send it to Google Drive or FTP. Once you want scheduled backups you don’t have to think about, you need Pro or a Backuply Cloud plan.\n\n**How much does Backuply Pro cost?**\n\nThe official pricing page lists $39 per year for one site (Personal), $69 for five sites (Professional) and $249 for unlimited sites (Business), with 10, 25 and 100 GB of Backuply Cloud respectively. The standalone Backuply Cloud plan costs $18 per year for one site and 10 GB, without the Pro plugin.\n\n**How do I migrate a site with Backuply?**\n\nBack up the source site to a remote location, install WordPress and Backuply on the destination, add the same location with “Sync Infos” checked, then click Restore in “Backup History”. Backuply replaces the old site’s URLs with the new ones.\n\n**Where does Backuply store local backups?**\n\nIn `wp-content/backuply/`, under a `backups-` folder followed by a random string. Always keep another copy off the server: a local archive protects you from neither a disk failure nor a compromised hosting account.\n\n## Key facts\n\n- Category: Backup and site management\n- Vendor: Softaculous Ltd\n- Price: Free; Backuply Pro from $39 per year for one site, with 10 GB of Backuply Cloud\n- Active installations (wordpress.org): 600 000+\n- Version: 1.6.0\n- Official page: https://wordpress.org/plugins/backuply/\n\n## What WP Masquerade hides\n\n- Handled by WP Masquerade Pro only",
    "catalog": "backuply",
    "essentials": [
        "Best for business sites and blogs that want to back up, restore and migrate at no cost.",
        "Main caveat: no scheduled backups without Backuply Pro or a Backuply Cloud plan.",
        "Free; Pro starts at $39 per year for one site and includes 10 GB of Backuply Cloud storage."
    ],
    "format": "application/json"
}