{ "title": "UpdraftPlus", "seo_title": "UpdraftPlus: review, recommended settings and limits", "h1": "UpdraftPlus", "description": "UpdraftPlus free or Premium: strengths, limitations, pricing, best schedule and remote storage, vulnerabilities and the 2026 UpdraftCentral incident.", "lead": "UpdraftPlus, one of the most installed backup plugins for WordPress, sends your backups to Dropbox, Google Drive or S3 and restores them in a few clicks. Our take on the free and Premium versions, the settings to choose and the vulnerabilities worth knowing.", "language": "en", "locale": "en-US", "type": "plugin-sheet", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/updraftplus/", "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/updraftplus/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/updraftplus/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/updraftplus/index.json", "published": "2026-11-04T08:00:00+00:00", "modified": "2026-11-05T21:29:16+00:00", "site": { "name": "WP Masquerade", "url": "https://www.wp-masquerade.com/" }, "translations": [ { "language": "en", "hreflang": "en-US", "title": "UpdraftPlus", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/updraftplus/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/updraftplus/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/updraftplus/index.json" }, { "language": "fr", "hreflang": "fr-FR", "title": "UpdraftPlus", "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/updraftplus/", "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/updraftplus/index.md", "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/updraftplus/index.json" }, { "language": "es", "hreflang": "es-ES", "title": "UpdraftPlus", "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/updraftplus/", "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/updraftplus/index.md", "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/updraftplus/index.json" }, { "language": "de", "hreflang": "de-DE", "title": "UpdraftPlus", "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/updraftplus/", "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/updraftplus/index.md", "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/updraftplus/index.json" }, { "language": "it", "hreflang": "it-IT", "title": "UpdraftPlus", "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/updraftplus/", "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/updraftplus/index.md", "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/updraftplus/index.json" }, { "language": "pt", "hreflang": "pt-BR", "title": "UpdraftPlus", "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/updraftplus/", "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/updraftplus/index.md", "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/updraftplus/index.json" }, { "language": "nl", "hreflang": "nl-NL", "title": "UpdraftPlus", "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/updraftplus/", "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/updraftplus/index.md", "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/updraftplus/index.json" } ], "headings": [ { "level": 1, "text": "UpdraftPlus" }, { "level": 2, "text": "What UpdraftPlus does on your site" }, { "level": 2, "text": "Which sites UpdraftPlus suits best" }, { "level": 2, "text": "UpdraftPlus strengths and limitations" }, { "level": 3, "text": "Strengths" }, { "level": 3, "text": "Limitations" }, { "level": 2, "text": "The settings we recommend for UpdraftPlus" }, { "level": 2, "text": "UpdraftPlus security: few vulnerabilities, but on sensitive data" }, { "level": 2, "text": "UpdraftPlus FAQ", "id": "faq" } ], "body": "## The essentials\n\n- Best for blogs and business sites that want scheduled backups to Dropbox, Google Drive or S3.\n- Main caveat: incremental backups, pre-update backups and encryption require Premium.\n- Free; Premium starts at €67 per year excl. VAT for 2 sites, or €187 for unlimited sites.\n\n## What UpdraftPlus does on your site\n\nUpdraftPlus copies your WordPress site into separate archives: the database on one side, and plugins, themes, uploads and the other `wp-content` folders on the other. Backups run on a schedule (anywhere from every 2 hours to once a month) or when you click “Backup Now”, then go to remote storage. The free version already supports Dropbox, Google Drive, Amazon S3 and compatible services, FTP, email and a few other services.\n\nEverything lives under Settings > UpdraftPlus Backups: the Backup / Restore tab lists your archives and restores all or part of the site, the Migrate / Clone tab prepares a move, and the Settings tab sets the schedule and destinations. Large sites are split into 400 MB archives by default, and an interrupted backup resumes where it stopped.\n\nThe vendor, Team Updraft, sells UpdraftPlus Premium as a yearly subscription. Premium adds incremental backups, a backup before every update, several destinations at once, more services (OneDrive, Azure, Backblaze B2, SFTP, WebDAV, UpdraftVault and others), database encryption, multisite and direct migration. Every copy of the plugin also ships the client for UpdraftCentral, the vendor’s remote management service, which stays idle until a connection key exists.\n\n![Diagram: UpdraftPlus works on wordpress, database and files, external services. Public traces: no known public trace.](https://www.wp-masquerade.com/media/wpm-sheets/updraftplus/diagram-en.svg?v=27fe99e1)\n\n## Which sites UpdraftPlus suits best\n\nUpdraftPlus solves a simple problem: a regular off-server copy of your site that you can restore without a command line.\n\n- **Blogs, business sites and nonprofits**: the free version is enough for a scheduled backup to Dropbox or Google Drive, with an email report.\n- **Modest shared hosting**: split archives and resumable backups avoid most failures caused by server limits.\n- **Freelancers and agencies**: the unlimited-sites Premium plan costs less than a per-site subscription multiplied by dozens of clients.\n- **Moving to a new host or domain**: the free version restores a backup onto another site and replaces the old address in the database.\n\nIt is not the best fit for a store that cannot afford to lose a single order between two backups: you then need very frequent database backups, which your host often handles better. For a one-off move, a dedicated tool such as [All-in-One WP Migration](https://www.wp-masquerade.com/features/camouflaged-plugins/all-in-one-wp-migration/) can be more direct.\n\n## UpdraftPlus strengths and limitations\n\n### Strengths\n\n- **Free remote storage.** Dropbox, Google Drive, Amazon S3, FTP and other destinations come at no cost.\n- **Built-in restore.** Full or per-component restores run from the dashboard, including in the free version.\n- **Sturdy on small servers.** Split archives, resumption after an interruption, files kept apart from the database.\n- **Fair agency pricing.** The Enterprise plan covers unlimited sites for €187 per year excluding VAT.\n\n### Limitations\n\n- **Full backups only in the free version.** Incremental backups and the pre-update backup require Premium.\n- **One destination in the free version.** Sending each backup to two services at once, or to OneDrive, Backblaze B2 or SFTP, requires Premium.\n- **No database encryption for free.** Encrypting the database is a Premium option, so the security of your storage account matters even more.\n- **License renewal.** Without renewal, Premium keeps working but stops receiving fixes, security fixes included.\n- **Exposed remote management.** UpdraftCentral was at the heart of the June 2026 vulnerability and the October 2026 incident.\n\n## The settings we recommend for UpdraftPlus\n\nUnless noted, these settings exist in the free version under Settings > UpdraftPlus Backups, Settings tab; expert settings appear after you click “Show expert settings”. Match the frequency to how often your site changes, following the logic of the [3-2-1 backup rule](https://www.wp-masquerade.com/glossary/3-2-1-backup-rule/).\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **Files backup schedule** Settings > UpdraftPlus Backups > Settings | Weekly, retaining 4 backups | Plugins, themes and media change little; a month of history is enough to spot a problem. |\n| **Database backup schedule** Same screen | Daily (every 12 hours for a store), retaining 14 backups | Orders, comments and content live in the database; the default retention of 2 backups is short. |\n| **Remote storage** Same screen, destination icons | An off-server service (Dropbox, Google Drive, Amazon S3...) | An archive left on the server disappears with it after a crash, a hack or an account closure. |\n| **Include in files backup** Same screen | Plugins, Themes, Uploads and Any other directories found inside wp-content checked (default) | WordPress core can be downloaded again; everything else must be restorable. |\n| **Email** Same screen | Checked (basic report sent to the admin address) | A report for each backup quickly reveals a schedule that has stopped running. |\n| **Delete local backup** Same screen, expert settings | Checked (default) | Archives sent elsewhere do not linger on the server, where they take up space and could leak. |\n| **Split archives every** Same screen, expert settings | 400 MB (default), lower if backups fail | The vendor advises reducing this size when the host cuts off large files. |\n| **Database encryption phrase** Same screen (Premium) | A long phrase, stored away from the site | A stolen archive stays unreadable; without the phrase, you cannot restore it either. |\n| **Manage existing keys** Settings > UpdraftPlus Backups > Advanced Tools > UpdraftCentral | No keys unless you manage the site remotely | An unused connection key is one more remote way in, as October 2026 showed. |\n\n- Run a first backup with “Backup Now” and check that the archives reach your remote storage.\n- Restore a backup on a [staging site](https://www.wp-masquerade.com/glossary/staging-environment/) at least once: an untested backup is only an assumption.\n- Check under Plugins that the installed version is at least 1.26.13 (2.26.13 for Premium).\n- Protect the Dropbox, Google Drive or S3 account with two-factor authentication: it holds a full copy of your site.\n\n## UpdraftPlus security: few vulnerabilities, but on sensitive data\n\nA backup plugin handles the entire database and the credentials of your storage accounts, so its rare vulnerabilities carry real weight.\n\n- **CVE-2022-0633, fixed in 1.22.3 (Premium 2.22.3)**: any logged-in user, even a subscriber, could download the latest site and database backup.\n- **CVE-2026-10795, fixed in 1.26.5**: unauthenticated authentication bypass through UpdraftCentral, on sites with an active UpdraftCentral or Migrator key (CVSS 8.1).\n- **CVE-2026-82841, fixed in 1.26.8**: on some migrated sites, a subscriber could read saved remote storage credentials.\n\nIn October 2026, it was the vendor’s own website that was breached: stolen UpdraftCentral Cloud keys were used to install backdoored plugins. Version 1.26.13 revokes the old keys (1.26.12 failed to), and 1.26.14 no longer adds the site to UpdraftCentral by default; no update removes what was already installed. Details and checks: our article on the [TeamUpdraft breach](https://www.wp-masquerade.com/teamupdraft-updraftplus-hack-backdoors/) and the history of [UpdraftPlus vulnerabilities](https://www.wp-masquerade.com/updraftplus-security-vulnerabilities/). Turn on automatic updates for the plugin. UpdraftPlus leaves no known public trace in your page code, so WP Masquerade has nothing to hide for it, and protection here comes down to updates and deleting unused keys.\n\n## UpdraftPlus FAQ\n\n**Is the free version of UpdraftPlus enough?**\n\nFor a blog or a business site, yes. Premium pays off for incremental backups, the pre-update backup, several destinations or database encryption.\n\n**How much does UpdraftPlus Premium cost?**\n\nThe official pricing page lists €67 per year excluding VAT for 2 sites (Personal), €91 for 10 sites, €139 for 35 sites and €187 for unlimited sites. The Gold plan, at €387 excluding VAT, adds 50 GB of storage and central management with UpdraftCentral.\n\n**Can I move a site with the free version?**\n\nYes: install UpdraftPlus on the new site, upload the archives there and restore them; the search-and-replace engine updates the old address. Premium sends the backup straight from the original site.\n\n**Should I keep UpdraftCentral connected?**\n\nOnly if you actually manage the site remotely. Otherwise, delete the keys under Advanced Tools > UpdraftCentral: backups keep working without them.\n\n## Key facts\n\n- Category: Backup and site management\n- Vendor: Team Updraft\n- Price: Free; Premium from €67 per year excluding VAT for 2 sites\n- Active installations (wordpress.org): 4 000 000+\n- Version: 1.26.14\n- Official page: https://wordpress.org/plugins/updraftplus/\n\n## What WP Masquerade hides\n\n- Handled by the free version of WP Masquerade", "catalog": "updraftplus", "essentials": [ "Best for blogs and business sites that want scheduled backups to Dropbox, Google Drive or S3.", "Main caveat: incremental backups, pre-update backups and encryption require Premium.", "Free; Premium starts at €67 per year excl. VAT for 2 sites, or €187 for unlimited sites." ], "format": "application/json" }