{"id":390723,"date":"2026-10-29T12:16:02","date_gmt":"2026-10-29T12:16:02","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/afrit-backup-manager\/"},"modified":"2026-10-29T12:15:51","modified_gmt":"2026-10-29T12:15:51","slug":"eikvakt-backup-manager","status":"publish","type":"plugin","link":"https:\/\/tt.wordpress.org\/plugins\/eikvakt-backup-manager\/","author":15002685,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.4","stable_tag":"1.0.4","tested":"7.1.4","requires":"6.5","requires_php":"8.1","requires_plugins":null,"header_name":"Eikvakt Backup Manager","header_author":"Steven Glogger","header_description":"Backups, restores and migrations for the whole WordPress installation (\"Eikvakt\" is Norwegian for \"oak guard\"). Incremental file backups, selectable database tables, encryption, scheduling, retention rules and simultaneous upload to this server, FTP, SFTP, Dropbox and OneDrive. Restore files, database, plugins or themes separately, or move the site to a new domain. There is no PRO version. All free.","assets_banners_color":"687f8e","last_updated":"2026-10-29 12:15:51","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/github.com\/sglogger\/eikvakt-backup-manager","header_author_uri":"https:\/\/www.glogger.ch","rating":0,"author_block_rating":0,"active_installs":0,"downloads":33,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.4":{"tag":"1.0.4","author":"glogger","date":"2026-10-29 12:15:51","revision":3772870}},"upgrade_notice":{"1.0.4":"<p>New name and slug: Eikvakt Backup Manager. phpseclib 4 for SFTP.<\/p>","1.0.3":"<p>Packaging clean-up, no functional changes. Safe to update.<\/p>","1.0.2":"<p>Smaller admin notice improvements. Safe to update.<\/p>","1.0.1":"<p>Security hardening of restore, FTPS, migration and the backup directory. Recommended for all users.<\/p>","1.0.0":"<p>First release.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3772870,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3772870,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3772870,"resolution":false,"location":"assets","locale":false}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3772870,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3772870,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.4"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3772870,"resolution":"1","location":"assets","locale":"","width":1360,"height":900},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3772870,"resolution":"2","location":"assets","locale":"","width":1360,"height":1175},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3772870,"resolution":"3","location":"assets","locale":"","width":1360,"height":949},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3772870,"resolution":"4","location":"assets","locale":"","width":1360,"height":900},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3772870,"resolution":"5","location":"assets","locale":"","width":1360,"height":900},"screenshot-6.png":{"filename":"screenshot-6.png","revision":3772870,"resolution":"6","location":"assets","locale":"","width":1360,"height":900},"screenshot-7.png":{"filename":"screenshot-7.png","revision":3772870,"resolution":"7","location":"assets","locale":"","width":1360,"height":900},"screenshot-8.png":{"filename":"screenshot-8.png","revision":3772870,"resolution":"8","location":"assets","locale":"","width":1360,"height":1178},"screenshot-9.png":{"filename":"screenshot-9.png","revision":3772870,"resolution":"9","location":"assets","locale":"","width":1360,"height":900}},"screenshots":{"1":"Dashboard with one-click setup, status tiles and live progress.","2":"Backup list with full, incremental, database and partial backups.","3":"Restoring selected parts with search and replace for a new domain.","4":"Migration between two sites with a migration key.","5":"Reports with the complete log of every run.","6":"Storage destinations: this server, FTP, SFTP, Dropbox and OneDrive.","7":"Schedules for files and database, and backups before updates.","8":"Retention per location.","9":"Security: backup directory self-test and plugin password."}},"plugin_section":[],"plugin_tags":[151,10698,289461,4155,152],"plugin_category":[59],"plugin_contributors":[277624],"plugin_business_model":[],"class_list":["post-390723","plugin","type-plugin","status-publish","hentry","plugin_tags-backup","plugin_tags-cloud-backup","plugin_tags-incremental-backup","plugin_tags-migration","plugin_tags-restore","plugin_category-utilities-and-tools","plugin_contributors-glogger","plugin_committers-glogger"],"banners":{"banner":"https:\/\/ps.w.org\/eikvakt-backup-manager\/assets\/banner-772x250.png?rev=3772870","banner_2x":"https:\/\/ps.w.org\/eikvakt-backup-manager\/assets\/banner-1544x500.png?rev=3772870","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":"https:\/\/ps.w.org\/eikvakt-backup-manager\/assets\/icon.svg?rev=3772870","icon":"https:\/\/ps.w.org\/eikvakt-backup-manager\/assets\/icon.svg?rev=3772870","icon_2x":false,"generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/eikvakt-backup-manager\/assets\/screenshot-1.png?rev=3772870","caption":"Dashboard with one-click setup, status tiles and live progress."},{"src":"https:\/\/ps.w.org\/eikvakt-backup-manager\/assets\/screenshot-2.png?rev=3772870","caption":"Backup list with full, incremental, database and partial backups."},{"src":"https:\/\/ps.w.org\/eikvakt-backup-manager\/assets\/screenshot-3.png?rev=3772870","caption":"Restoring selected parts with search and replace for a new domain."},{"src":"https:\/\/ps.w.org\/eikvakt-backup-manager\/assets\/screenshot-4.png?rev=3772870","caption":"Migration between two sites with a migration key."},{"src":"https:\/\/ps.w.org\/eikvakt-backup-manager\/assets\/screenshot-5.png?rev=3772870","caption":"Reports with the complete log of every run."},{"src":"https:\/\/ps.w.org\/eikvakt-backup-manager\/assets\/screenshot-6.png?rev=3772870","caption":"Storage destinations: this server, FTP, SFTP, Dropbox and OneDrive."},{"src":"https:\/\/ps.w.org\/eikvakt-backup-manager\/assets\/screenshot-7.png?rev=3772870","caption":"Schedules for files and database, and backups before updates."},{"src":"https:\/\/ps.w.org\/eikvakt-backup-manager\/assets\/screenshot-8.png?rev=3772870","caption":"Retention per location."},{"src":"https:\/\/ps.w.org\/eikvakt-backup-manager\/assets\/screenshot-9.png?rev=3772870","caption":"Security: backup directory self-test and plugin password."}],"raw_content":"<!--section=description-->\n<p>Eikvakt Backup Manager (\"Eikvakt\" is Norwegian for \"oak guard\") backs up your complete WordPress installation \u2014 core, plugins, themes, uploads, every other file and the database \u2014 restores any part of it on its own, and moves the site to a new domain or host.<\/p>\n\n<p><strong>Every feature is included. There is no PRO version, no upsell and no account to create. All free.<\/strong><\/p>\n\n<p><strong>What makes it different<\/strong><\/p>\n\n<ul>\n<li><strong>Everything free, for good.<\/strong> Incremental backups, encryption, every storage destination, scheduling, retention rules, migration and WP-CLI are all in this plugin. No add-ons, no licence, no account, and no server of ours in between.<\/li>\n<li><strong>Security first.<\/strong> Backups are kept out of reach of the web and the plugin proves it with a daily HTTP self-test of every archive type. Restores only accept the plugin's own SQL format and swap the database in atomically. FTPS certificates are verified, the SFTP host key is pinned, and stored credentials are encrypted.<\/li>\n<li><strong>Built for shared hosting.<\/strong> Every job runs in short, resumable steps, driven by background requests, WP-Cron and the admin screen alike, so large sites back up without ever hitting a time limit.<\/li>\n<li><strong>Precise control.<\/strong> A clickable folder tree with \"most specific rule wins\", database tables one by one, retention in days per location, and \"Keep\" marks for backups that must never be deleted.<\/li>\n<\/ul>\n\n<p><strong>Set up in one click<\/strong><\/p>\n\n<p>One button applies safe defaults and runs the first backup right away: daily incremental file backups with a full backup every seventh run, a daily database backup, a backup before every update, sensible retention, and an e-mail when something goes wrong. Everything can be fine-tuned later.<\/p>\n\n<p><strong>Incremental backups<\/strong><\/p>\n\n<p>After the first full backup, only files that changed are saved. Backups finish faster, use a fraction of the storage and put far less load on the server. Restoring an incremental backup automatically combines it with the full backup and every incremental before it \u2014 you simply pick the point in time.<\/p>\n\n<p><strong>Backups before updates<\/strong><\/p>\n\n<p>Before WordPress, a plugin or a theme is updated \u2014 by hand, in bulk or automatically in the background \u2014 the part that is about to change is backed up, together with the database. A broken update is rolled back in a minute.<\/p>\n\n<p><strong>Many destinations at once<\/strong><\/p>\n\n<p>Every backup is stored on this server and copied to all active destinations at the same time: FTP, FTPS (certificate verified or key-pinned), SFTP (password or key, with host-key pinning), Dropbox and Microsoft OneDrive. Dropbox connects in three clicks \u2014 no developer app needed: press Connect, allow access, paste the code. If one destination is down, the others still receive their copy. Large backups are split into parts and transferred in resumable chunks.<\/p>\n\n<p><strong>Choose exactly which folders<\/strong><\/p>\n\n<p>A clickable folder tree on the Files tab: untick a folder to leave it out, tick one to include it \u2014 even inside an excluded folder, or a cache folder that is skipped by default. The most specific choice wins. Patterns such as <code>*.log<\/code> and a maximum file size complement it.<\/p>\n\n<p><strong>Flexible scheduling<\/strong><\/p>\n\n<p>File and database backups have their own schedules: every few hours, daily, weekly or monthly, at the time you choose, in your site's timezone.<\/p>\n\n<p><strong>Retention rules<\/strong><\/p>\n\n<p>Keep a number of backups, or a daily\/weekly\/monthly rotation (grandfather-father-son). Set separately how many days backups stay on this server and on the remote destinations, with an override per destination. A full backup is never deleted while incrementals depend on it, and the newest backup is always kept.<\/p>\n\n<p>Mark any backup as <strong>Keep<\/strong> \u2014 for example the last one before a relaunch \u2014 and no automatic rule will ever delete it, on this server or on any destination. Marking an incremental backup also keeps the backups it builds on.<\/p>\n\n<p><strong>Restore exactly what you need<\/strong><\/p>\n\n<p>Restore the database, WordPress core, plugins, themes, uploads or other files separately \u2014 or just a few database tables. The database is imported into temporary tables and swapped in at once only when everything succeeded, so a failed restore leaves the site untouched. Optionally, the current state is backed up first.<\/p>\n\n<p><strong>One-click migration<\/strong><\/p>\n\n<p>Move or copy the site to a new domain or host: create a migration key on the old site, paste it on the new one, and the backup is transferred server to server. During the restore, the old address and paths are replaced with the new ones \u2014 safely, including serialised and JSON data \u2014 and a different table prefix is handled automatically. Migrate everything or only selected parts such as the uploads or the database.<\/p>\n\n<p><strong>Encryption<\/strong><\/p>\n\n<p>Encrypt the database \u2014 and optionally the file archives \u2014 with a passphrase (XChaCha20-Poly1305, key derived with PBKDF2-SHA256). Encrypted backups are unreadable without the passphrase, wherever they are stored, and any tampering is detected.<\/p>\n\n<p><strong>Secure by design<\/strong><\/p>\n\n<ul>\n<li>Backups are stored outside the web root whenever the server allows it; otherwise in a randomly named, locked-down directory with unguessable file names.<\/li>\n<li>A daily self-test requests a probe file from the backup directory over HTTP and raises an alarm on every admin screen if the web server would serve it (for example on nginx), with the fix.<\/li>\n<li>Backups can only be downloaded through the admin screen while signed in \u2014 never by URL.<\/li>\n<li>Stored credentials (FTP\/SFTP passwords, keys, cloud tokens, the passphrase) are sealed with your site's secret keys.<\/li>\n<li>An optional extra password locks the whole plugin, on top of administrator rights.<\/li>\n<\/ul>\n\n<p><strong>Detailed reports<\/strong><\/p>\n\n<p>Every backup, restore and migration is recorded: when it ran, what triggered it, what it included, its size, where it was stored and whether it succeeded \u2014 with the complete log. E-mail reports always, only on problems, or never.<\/p>\n\n<p><strong>Open source<\/strong><\/p>\n\n<p>The complete source code, the developer documentation and the issue tracker are on GitHub: https:\/\/github.com\/sglogger\/eikvakt-backup-manager. The plugin ships no minified or compiled code.<\/p>\n\n<p><strong>WP-CLI<\/strong><\/p>\n\n<pre><code>wp eikvakt backup, `restore`, `list`, `keep`, `migrate`, `prune`, `rescan` and `status`.\n<\/code><\/pre>\n\n<p><strong>About the name<\/strong><\/p>\n\n<p>\"Eikvakt\" (say \"ayk-vahkt\") joins two Norwegian words: <em>eik<\/em>, oak, and <em>vakt<\/em>, watch or guard \u2014 the oak guard. Oak for what lasts, a guard for what keeps watch. Which is fairly close to the entire job description: watch over a good copy of your site, and give it back the moment it is needed.<\/p>\n\n<h3>External services<\/h3>\n\n<p>This plugin connects to the following third-party services <strong>only for storage destinations that an administrator has added and connected<\/strong>. Nothing is sent anywhere until then.<\/p>\n\n<p><strong>Dropbox<\/strong> (Dropbox, Inc.) \u2014 to store backup files in the administrator's Dropbox, in the app folder Apps\/Eikvakt Backup Manager only. By default the connection uses the plugin's Dropbox app (listed in Dropbox under \"Connected apps\"); administrators can use their own Dropbox app instead. Data sent: the backup files (encrypted if encryption is enabled), their file names, and OAuth requests to authorise and refresh access. Access tokens are stored only on the site; the plugin author receives nothing and runs no server in between. Endpoints: www.dropbox.com, api.dropboxapi.com, content.dropboxapi.com.\nTerms of service: https:\/\/www.dropbox.com\/terms \u2014 Privacy policy: https:\/\/www.dropbox.com\/privacy<\/p>\n\n<p><strong>Microsoft OneDrive \/ Microsoft Graph<\/strong> (Microsoft Corporation) \u2014 to store backup files in the app folder of the administrator's own OneDrive, using the administrator's own Microsoft Entra app registration. Data sent: the backup files (encrypted if encryption is enabled), their file names, and OAuth requests to authorise and refresh access. Endpoints: login.microsoftonline.com, graph.microsoft.com and the upload\/download URLs Graph returns.\nTerms of use: https:\/\/www.microsoft.com\/servicesagreement \u2014 Privacy statement: https:\/\/privacy.microsoft.com\/privacystatement<\/p>\n\n<p><strong>FTP, FTPS and SFTP servers<\/strong> \u2014 backup files are sent to the server, folder and account the administrator enters. These are the administrator's own servers, not a service of the plugin author.<\/p>\n\n<p><strong>Migration between two sites<\/strong> \u2014 when an administrator imports a migration key, the target site downloads the backup directly from the source site that created the key. No third party is involved.<\/p>\n\n<p>The plugin also sends requests to its own site (loopback requests) to run backups in the background and to test that the backup directory cannot be downloaded over the web.<\/p>\n\n<p>The plugin author collects no data and operates no server for this plugin. Privacy policy: https:\/\/github.com\/sglogger\/eikvakt-backup-manager\/blob\/main\/PRIVACY.md<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Install the plugin through Plugins \u2192 Add New, or upload the ZIP.<\/li>\n<li>Activate it.<\/li>\n<li>Open <strong>Backup Manager<\/strong> in the admin menu and press <strong>Set up and run the first backup<\/strong>.<\/li>\n<li>Optional: add an off-site destination under Backup Manager \u2192 Settings \u2192 Storage.<\/li>\n<\/ol>\n\n<p>Requirements: PHP 8.1+ with the zip extension (standard on virtually every host). The FTP\/FTPS destination uses cURL (standard as well); SFTP, Dropbox and OneDrive need no extra extensions.<\/p>\n\n<!--section=faq-->\n<dl>\n<dt id=\"is%20there%20a%20paid%20version%3F\"><h3>Is there a paid version?<\/h3><\/dt>\n<dd><p>No. Every feature described here is in this plugin, free, and will stay that way.<\/p><\/dd>\n<dt id=\"can%20someone%20download%20my%20backups%20from%20the%20internet%3F\"><h3>Can someone download my backups from the internet?<\/h3><\/dt>\n<dd><p>Not by URL. Backups are kept outside the web root where possible, otherwise in a protected directory with random names, and the plugin tests daily that the web server refuses to serve them. Downloads go only through the admin screen, for signed-in administrators (and the plugin password, if set).<\/p><\/dd>\n<dt id=\"my%20backup%20is%20large.%20will%20it%20time%20out%3F\"><h3>My backup is large. Will it time out?<\/h3><\/dt>\n<dd><p>No. Backups and restores run in short steps (20 seconds by default) that continue in the background, so they never hit the server's time limit. Large archives are split into parts, and uploads resume where they stopped.<\/p><\/dd>\n<dt id=\"i%20forgot%20the%20plugin%20password.\"><h3>I forgot the plugin password.<\/h3><\/dt>\n<dd><p>Add <code>define( 'EKBM_DISABLE_PASSWORD', true );<\/code> to wp-config.php, set a new password under Settings \u2192 Security, then remove the line again.<\/p><\/dd>\n<dt id=\"how%20do%20i%20make%20sure%20a%20particular%20backup%20is%20never%20deleted%3F\"><h3>How do I make sure a particular backup is never deleted?<\/h3><\/dt>\n<dd><p>Press <strong>Keep<\/strong> next to it on the Backups screen (or run <code>wp eikvakt keep &lt;id&gt;<\/code>). Kept backups are exempt from every retention rule and do not count towards the limits. To delete a kept backup, remove the mark first.<\/p><\/dd>\n<dt id=\"i%20lost%20the%20encryption%20passphrase.\"><h3>I lost the encryption passphrase.<\/h3><\/dt>\n<dd><p>Then the encrypted backups cannot be restored \u2014 by anyone. That is the purpose of encryption. Keep the passphrase in a password manager.<\/p><\/dd>\n<dt id=\"does%20a%20restore%20overwrite%20wp-config.php%3F\"><h3>Does a restore overwrite wp-config.php?<\/h3><\/dt>\n<dd><p>Not unless you tick the option. wp-config.php holds the database credentials of the server it is on. The plugin's own files and settings are never overwritten by a restore either.<\/p><\/dd>\n<dt id=\"does%20it%20work%20in%20wordpress%20playground%3F\"><h3>Does it work in WordPress Playground?<\/h3><\/dt>\n<dd><p>Backups and restores on the site itself do. Uploads to Dropbox, OneDrive, FTP or SFTP do not: Playground's browser sandbox cannot send binary data such as backup archives, and has no FTP\/SSH connections. The plugin detects Playground, says so on the Storage tab and keeps the backups on the site. Test remote destinations on a real server.<\/p><\/dd>\n<dt id=\"does%20it%20work%20on%20multisite%3F\"><h3>Does it work on multisite?<\/h3><\/dt>\n<dd><p>Backups cover the whole network installation. Restoring individual sites of a network is not supported.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.4<\/h4>\n\n<ul>\n<li>Changed: the plugin is now called Eikvakt Backup Manager (slug eikvakt-backup-manager). Settings, backups and migration keys of the earlier name are not carried over.<\/li>\n<li>Changed: SFTP uses phpseclib 4.<\/li>\n<li>Security: submitted settings forms are sanitised as a whole before any handler sees them.<\/li>\n<\/ul>\n\n<h4>1.0.3<\/h4>\n\n<ul>\n<li>Changed: smaller, cleaner package \u2014 an unused PHP 5 compatibility library and build files of bundled libraries are no longer included.<\/li>\n<\/ul>\n\n<h4>1.0.2<\/h4>\n\n<ul>\n<li>Changed: the warning about web-accessible backups can be dismissed until the next self-test and disappears once the problem is fixed.<\/li>\n<li>Changed: readme explains what sets the plugin apart and where the source code lives.<\/li>\n<\/ul>\n\n<h4>1.0.1<\/h4>\n\n<ul>\n<li>Security: restores accept only the plugin's own SQL statement format; manipulated dumps abort before the live database is touched.<\/li>\n<li>Security: custom backup directories are validated and protection files never overwrite existing files.<\/li>\n<li>Security: FTPS verifies the server certificate (or a pinned key) and never falls back to plain FTP.<\/li>\n<li>Security: migration keys only reach public HTTPS sources unless a private network is explicitly allowed.<\/li>\n<li>Security: limits on key-derivation cost from encrypted files; stricter backup-directory self-test across file types.<\/li>\n<li>New: Files tab with a clickable folder tree to include or exclude any folder.<\/li>\n<li>New: privacy policy; WordPress Playground is detected and explained.<\/li>\n<li>Changed: FTP\/FTPS uses cURL; delete actions are proper buttons.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>First release.<\/li>\n<\/ul>","raw_excerpt":"Incremental backups, restores and migrations of the whole WordPress installation, to this server, FTP, SFTP, Dropbox and OneDrive at once.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/tt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/390723","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/tt.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/tt.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=390723"}],"author":[{"embeddable":true,"href":"https:\/\/tt.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/glogger"}],"wp:attachment":[{"href":"https:\/\/tt.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=390723"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/tt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=390723"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/tt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=390723"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/tt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=390723"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/tt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=390723"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/tt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=390723"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}