Off-site storage.
Clear boundaries.

What the service does

WPBackups Cloud is the optional off-site storage service for the free WPBackups plugin. It stores encrypted backup objects and backup metadata, lists completed restore points, and returns selected objects for local recovery preparation. Encrypted local backups can be made without a Cloud connection.

Free 5 GB per site

Each site has one plan and one storage quota. Usage counts distinct encrypted objects referenced by completed backups for that site; an object reused by multiple backups counts once. Temporary incomplete or unreferenced uploads are separate from this figure. A backup cannot complete if it would take the completed storage total over quota. Older restore points are not automatically deleted to make room.

All plugin features are included. Billing and paid upgrades are not active. See current and planned pricing.

How the plugin connects

api.wpbackups.com handles site authentication, backup creation and completion, transfer authorization, metadata, quota and restore-point listings. Requests use a site ID and separate site secret over HTTPS.

storage.wpbackups.com transfers encrypted file and database objects through temporary signed URLs supplied by the API. Signed URLs are credentials: do not share them. You do not need to operate storage infrastructure or provide separate storage credentials.

Site registration processes a site URL and optional site name and software versions. The plugin does not automatically register a site or include a registration screen. Public onboarding instructions will accompany the release; no self-service signup is offered here.

When data is sent

An administrator explicitly configures the Cloud connection. Once connected, opening the plugin administration page requests Cloud restore-point listings. Manual backups and separately enabled scheduled backups send requests, manifests and encrypted payloads. Explicit recovery preparation retrieves selected metadata and encrypted objects. The offline recovery runner operates on locally staged objects.

Encryption and metadata

File and database payloads are encrypted locally with AES-256-GCM before upload. The documented Cloud protocol does not send plaintext backup encryption keys. Protect your recovery material and keep it outside WordPress.

Backup payload encryption does not encrypt the manifest. Metadata can include the site URL, software versions, installation fingerprint, database prefix, file paths and names, sizes, timestamps, hashes and object references. This metadata is readable by the service and may contain personal information.

Supported v1 scope

V1 supports single-site WordPress: supported wp-content files and database tables for the current prefix. Restore targets the same site, installation and database prefix.

Recovery requires a qualified dedicated Linux/systemd host, a privileged administrator, locally prepared backup objects and the offline recovery runner. Browser restore is disabled. A Cloud restore-point listing alone does not establish that a restore can run.

WordPress core, wp-config.php and other web-root files are outside the backup scope. V1 does not support multisite, migration between installations, full-server images, remote databases or shared/distributed hosting. Unmanaged writers and unqualified persistent caches, MU plugins and drop-ins are outside the supported profile. Restore does not delete extra files to create an exact mirror.

Supported recovery requires qualified local MariaDB and prefix-scoped InnoDB tables with primary keys, plus required private staging and recovery configuration. Existing parent directories are required, and the active recovery plugin is excluded from replacement.

Retention and deletion

Completed Cloud restore points remain until explicitly deleted through the authenticated service API. The plugin has no Cloud-delete button. Removing references can reduce quota usage before physical cleanup; objects still used by another backup remain. Incomplete work becomes eligible for expiry after 24 hours of inactivity, with hourly scheduled cleanup subject to age and reference checks. This is not a promise that every copy is erased within 24 hours. Deactivating or uninstalling the plugin does not delete Cloud backups or site registration.

For privacy and site-closure questions, contact privacy@wpbackups.com. No fixed deletion deadline or single-region storage guarantee is stated here.

Before you connect

Review Privacy, Terms and recovery guidance. Confirm that your host fits the supported recovery profile before relying on Cloud backups.