What Duplicator does on your site
Duplicator packs a WordPress site into a “backup” made of two files: an archive (database, media library, themes, plugins and core files) and an installer, installer.php. You start a build under Duplicator > Backups > Add New; the plugin first scans the server, flags problems and offers a fix when it knows one. To migrate, you upload both files to the new host, open the installer in your browser and it rebuilds the site, URLs included, without WordPress being installed there first.
By default, backups stay in the wp-content/backups-dup-lite folder, with retention of the most recent ones. The free version can also restore a backup in one click from the dashboard, encrypt the archive with AES-256 and a password when the server supports it, and send backups to Duplicator Cloud, the vendor’s own online storage, sold separately from $29 per year for 2 GB.
Duplicator is published by Snap Creek LLC, which Awesome Motive (WPForms, MonsterInsights) acquired in January 2023. Duplicator Pro, a separate plugin, adds scheduled backups, Dropbox, Google Drive, OneDrive, Amazon S3, FTP/SFTP and S3-compatible storage, drag-and-drop and server-to-server import, staging sites and multisite support.
Which sites Duplicator is a good fit for
Duplicator is first a migration and cloning tool that can also make manual backups:
- Moving to a new host or domain: the installer rebuilds the site on an empty server and replaces the old URLs.
- Large sites on shared hosting: the engine splits the work into small steps and offers several archive formats (DupArchive, ZipArchive, the server’s zip) to stay under execution limits.
- Freelancers who build sites locally: a single backup is enough to put the finished install online.
- A safety copy before a big update, with one-click restore if something breaks.
It is not the right pick for free automatic backups to your own storage: scheduling and third-party storage are Pro-only, while UpdraftPlus includes them in its free version. The free version also does not support multisite networks.
Duplicator strengths and limitations
Strengths
- Migrates to an empty server. The installer rebuilds the site without installing WordPress first.
- No size cap. The step-by-step engine handles large sites, even with strict server timeouts.
- Free encryption and restore. AES-256 archive encryption and one-click restore are in the free version.
- An installer protected by default. Its file name includes a random ID, and an automatic cleanup can delete it.
Limitations
- No scheduling in the free version. Every backup is started by hand; scheduled backups require Pro.
- One external storage, and it’s paid. Off the server, the free version only offers Duplicator Cloud, billed separately.
- Manual migration in the free version. You upload the archive and installer over FTP; drag-and-drop import is Pro-only.
- No multisite, no staging. Both require the Pro plan of Duplicator Pro, $399 per year at full price.
- Sensitive files on the server. Forgotten archives and installers were at the heart of several past vulnerabilities.
The Duplicator settings we recommend
All these settings exist in the current free version, under the labels of the English interface.
| Setting | Recommended value | Why |
|---|---|---|
| Security mode Duplicator > Backups > Add New, Security section | “Archive encryption”, with a long password kept off the site | The archive holds the whole database. “Installer password” only protects the installer; the archive contents stay readable. |
| Installer Settings > Name Duplicator > Settings > Backups | [name]_[hash]_[date]_installer.php (default) | A name with a random ID is far harder to guess than installer.php. |
| Installer Cleanup > Mode Same screen | “Auto Cleanup”, every 24 hours | Cleanup is off by default, and an installer left on the destination site is an open door. |
| Max Backups Duplicator > Storage, default local storage | 3 to 5 depending on disk space (10 by default) | Each archive is a full copy of the site; the fewer you keep on the server, the less there is to protect. |
| Disable .htaccess File In Storage Directory Duplicator > Settings > Storage | Off (default) | Only tick it if archive downloads fail, then untick it after testing. |
| Enable settings encryption Duplicator > Settings > General | On (default) | Passwords, storage data and license data are then stored encrypted in the database. |
| Delete Installation Files Duplicator > Tools > General | After every migration, on the destination site | Removes the installer and its working files without waiting for the automatic cleanup. |
| Automatic updates Plugins > Installed Plugins | Enabled | Duplicator’s past vulnerabilities were fixed in successive plugin releases. |
- Download at least one backup off the server and store it following the 3-2-1 backup strategy.
- Open
/wp-content/backups-dup-lite/in a private window: no file list should appear (see our guide to exposed sensitive files). - After a migration, request the installer’s URL on the new site: you should get a 404 error.
- Test a restore on a local or staging copy: a backup you’ve never restored is only an assumption.
Duplicator security: the installer and archives in the crosshairs
Almost all of Duplicator’s published vulnerabilities revolve around the files it leaves on the server:
- CVE-2018-25095, fixed in 1.3.0: an installer left on the site after use could be abused to run code on the server, with no account.
- CVE-2020-11738, fixed in 1.3.28: directory traversal that allowed downloading arbitrary files from the server (CVSS 7.5).
- CVE-2022-2551, fixed in 1.4.7: once the installer had been run, an unauthenticated visitor could get the backup’s URL and download it.
- CVE-2023-6114, fixed in 1.5.7.1: on servers with directory listing enabled, the temporary
backups-dup-lite/tmpfolder exposed files containing sensitive data.
The useful move is twofold: turn on automatic updates (see our guide to plugin auto-updates) and never leave an installer or an unneeded archive on a live server. Duplicator adds nothing known to your public pages; the box below shows what WP Masquerade covers for it.
What WP Masquerade hides for Duplicator
Free version Handled by the free version of WP Masquerade
Duplicator is one of the 50 most used plugins known to the free version. Pro goes further by renaming its files.
Free version
Nothing to remove
With Pro
Nothing more
Still visible
No known trace
Duplicator FAQ
Is free Duplicator enough to migrate a site?
Yes: build the backup, download the archive and the installer, upload them to the new host, then open the installer in your browser. Have an empty database and its credentials ready. Pro only spares you the manual upload with drag-and-drop or server-to-server import.
Can I schedule backups with the free version?
No, scheduling is Duplicator Pro only, from the Basic plan; hourly backups need the Plus plan. For free automatic backups, UpdraftPlus is a better fit.
How much does Duplicator Pro cost?
The pricing page lists the Basic plan at $99 per year for 2 sites, with a first-year discount ($69.30 at the time of writing); renewals are at full price. Plus (5 sites), Pro (20 sites) and Elite (100 sites) add, among other things, unlimited storage destinations, staging and multisite.
Duplicator or All-in-One WP Migration?
Both migrate a whole site. All-in-One WP Migration imports a single file into an existing WordPress install but, in its free version, runs into the host’s upload limit; Duplicator goes through FTP and an installer, which sidesteps that limit.