What WPvivid Backup & Migration does on your site
WPvivid Backup & Migration bundles three tools into the WordPress admin: backups, migration and staging. A backup can hold the database and files, the files only or the database only. Archives are stored in wp-content/wpvividbackups by default and can be sent to Dropbox, Google Drive, Amazon S3, Microsoft OneDrive, DigitalOcean Spaces, or an FTP or SFTP server. Restoring takes one click, from a local, remote or uploaded archive.
Migration works two ways: you upload an archive to the new site, or you use “Auto-Migration,” where the destination site generates a temporary key that you paste into the source site so it can push the backup across. The plugin also creates a free staging site in a subdirectory of your live site, so you can test an update or a theme without touching production. Everything lives under the WPvivid Backup menu, with two submenus: Backup & Restore, and Settings.
The developer, WPvivid, belongs to ATOZSOFTWARE INC, a company registered in Canada. The free version is published on wordpress.org; WPvivid Backup & Migration Pro adds incremental backups, automatic backups before updates, encrypted database backups, pushing a staging site to live, multisite support and more storage targets (Wasabi, pCloud, Backblaze, WebDAV, S3-compatible storage).
Which sites WPvivid suits best
WPvivid is a good fit when you want offsite backups and migrations without paying:
- Brochure sites, blogs and small stores: a daily or weekly scheduled backup to external storage is enough to follow a 3-2-1 backup strategy.
- Moving to a new host or domain: key-based auto-migration or an uploaded archive, both included in the free version.
- Testing before updates: the free staging copy in a subdirectory lets you check an update before applying it live (see our guide to WordPress staging).
- Freelancers and agencies: Pro licenses cover 10, 50 or unlimited domains, and a free extension controls WPvivid from MainWP.
It’s not the best pick for a large WooCommerce store that needs frequent backups without copying everything each time: incremental backups are Pro only. If you mainly want the most widely used scheduled backup plugin, compare it with UpdraftPlus; for a one-off move to an empty server, Duplicator works with a standalone installer.
WPvivid Backup & Migration strengths and limitations
Strengths
- Free offsite storage. Dropbox, Google Drive, S3, OneDrive, DigitalOcean Spaces, FTP and SFTP come at no extra cost.
- Free migration. Key-based auto-migration and migration from an uploaded archive are both part of the free version.
- Staging included. A test site in a subdirectory, created by the same plugin, with no add-on needed.
- Affordable Pro licenses. $49 per year for 2 domains, with lifetime plans starting at $99.
Limitations
- No incremental backups for free. Every backup copies everything, and the free version keeps 7 backups at most.
- One-way staging. Pushing the test site back to production requires Pro.
- A long list of patched flaws. Patchstack lists more than thirty fixed vulnerabilities, including an unauthenticated file upload rated critical in 2026.
- Pro stops at expiry. According to the vendor’s FAQ, an annual license that isn’t renewed removes access to Pro features, not just to updates.
The WPvivid settings we recommend
All of these settings exist in the current free version, under the WPvivid Backup menu. Set up a storage target in the Remote Storage tab first, then the schedule.
| Setting | Recommended value | Why |
|---|---|---|
| Enable backup schedule WPvivid Backup > Backup & Restore > Schedule | On, Daily or Weekly depending on how often your site changes | Manual backups get forgotten; pick a frequency that matches how much you can afford to lose. |
| Backup content Same tab | Database + Files (WordPress Files) | A database without the media, or the reverse, isn’t enough to rebuild the site. |
| Send backups to remote storage Same tab | On | A backup left on the server disappears with it after a crash, a hack or a closed hosting account. |
| “Keep storing the backups in localhost after uploading to remote storage” WPvivid Backup > Settings > General Settings | Off (default) | Fewer archives on the web server means fewer full copies of the site exposed and less disk space used. |
| Backups retained Same screen | Between 3 (default) and 7 | Keep several restore points so you can go back to before a hack that went unnoticed for a few days. |
| Enable email report Same screen | On, with “Only send an email notification when a backup fails” | A schedule that fails silently is the most common trap; check delivery with the Test Email button. |
| The key will expire in WPvivid Backup > Backup & Restore > Auto-Migration | 2 hours, and only generate a key during a migration | While a key is valid, the site accepts a backup sent by another site; the plugin itself advises a short expiry. |
- Run a manual backup and confirm the archive actually lands in your remote storage.
- Restore that backup to a test copy or a local site: a backup you’ve never restored isn’t a verified backup.
- On an Nginx server, open
/wp-content/wpvividbackups/in a browser: the protective .htaccess file isn’t read there, so access has to be blocked in the server configuration (see exposed sensitive files). - On a low-traffic site, check that scheduled backups really run: the plugin states that a scheduled task only fires when the site gets at least one visit.
WPvivid security: frequent flaws, including a critical one in 2026
A backup plugin reads and writes the whole site, which makes its flaws serious. Most of those fixed in 2026 require an administrator account, but three cases are worth knowing:
- CVE-2026-1357, fixed in 0.9.124: unauthenticated PHP file upload through the migration’s backup receiver (
send_to_site), up to remote code execution (CVSS 9.8). Patchstack flags it as exploited. - CVE-2024-10962, fixed in 0.9.108: unauthenticated PHP object injection, triggered only when an administrator creates a staging site, with no known exploit chain in the plugin itself (CVSS 8.8).
- CVE-2024-7315, fixed in 0.9.106: archive names weren’t random enough, so an attacker could guess a backup’s address and extract information from it.
Patches ship at a steady pace: turn on automatic updates for WPvivid (see our guide to plugin auto-updates) and keep archives off the web server. WPvivid adds nothing known to your public pages; the box below shows what WP Masquerade Pro covers for it.
What WP Masquerade hides for WPvivid Backup & Migration
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to WPvivid Backup & Migration: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
Nothing more
Still visible
No known trace
WPvivid Backup & Migration FAQ
Is WPvivid’s migration really free?
Yes. Key-based auto-migration and migration from an uploaded archive are included in the free version. Pro adds migration through remote storage, selective migration and crash protection during migration.
How much does WPvivid Backup & Migration Pro cost?
The pricing page lists $49 per year for 2 domains, $69 for 10, $99 for 50 and $149 for unlimited domains. Lifetime licenses run from $99 to $299, with a 30-day refund window.
Can I run WPvivid and UpdraftPlus at the same time?
You can, but two schedules double the server load and the disk space used. Pick one plugin for scheduled backups; you can keep another for a one-off migration, then deactivate it.
Can the free staging site replace the live site?
No. The free version creates the copy in a subdirectory; pushing changes back to production, updating an existing copy or creating several copies requires Pro.