PHP is an essential part of any WordPress website. For this reason, you want to make sure it’s running as smoothly as possible. But knowing the best way to navigate this process isn’t always easy.

The good news is that we’re here to help. By understanding the principles behind PHP and the process of updating it, you can maintain this core element of your site.

In this article, we’ll introduce you to PHP and explain why it’s important. Then we’ll show you how to safely check, update, and upgrade your PHP version on three different web hosts. 

An introduction to PHP

Code is the basis for every single website. The exact programming language may vary between systems, but one thing is certain: it’s absolutely critical to the proper functioning of a site. For WordPress, that essential technology is PHP.

PHP is a popular open-source scripting language used particularly for web development. This server-side code creates a lot of what you see on a site’s back and front ends. 

Here’s how PHP works: first, someone visits your website. This action causes whatever browser they’re using to launch a search for your site’s server. 

Then, PHP code accesses your main database — in the case of WordPress, this is likely MySQL — and retrieves the requested data. Finally, PHP takes the last crucial step and translates that data into an HTML format.

If this description has your head spinning, don’t worry! You probably don’t need to understand this process in detail. All you need to know is that PHP is an essential part of how your WordPress website receives and displays data. Without it, you wouldn’t be able to run WordPress at all.

Why is PHP essential to WordPress websites?

When it comes to WordPress, the process described above is required to present any content to your visitors. Additionally, the same steps occur when you use the WordPress back end. 

When you access your admin dashboard, the PHP within your files will retrieve the data you need. This principle also applies to any plugins or themes that your website is running.

If you’re in doubt about just how integrated PHP is with WordPress, just take a look at your core files. You’ll notice that there are quite a few of them, many of which you’ll need access to if you want to change your site’s fundamentals:

Given how interconnected WordPress is, any changes in your PHP version can affect how your entire website runs. Well-written PHP will make sure that everything else runs smoothly. On the other hand, a less recent version can cause a negative ripple effect for you and your visitors.

PHP might run as a core aspect of your site, but that doesn’t mean it won’t need maintenance from time to time. Like most software — including the main WordPress platform itself — you’ll need to update the code at least semi-regularly to avoid any complications.

Three reasons to keep your site’s PHP updated

Now that we’ve covered how important PHP is, let’s look at a few specific reasons why you might want to keep it maintained. Updated PHP:

1. Improves your site’s speed.
2. Allows you to stay on top of your website’s security.
3. Helps maintain your overall stability. 

Keep in mind that these reasons apply to any website that runs on WordPress. 

Here are the top reasons to update your site’s PHP version:

1. Improve your site’s speed

Unfortunately, an outdated PHP version can really slow your site down. Older versions won’t be optimized to make the most of server resources and may operate slower. Since PHP is so central to your site, this can lead to less impressive speeds across the board. 

Given that site speed is a critical part of any user experience, you could be looking at a few negative consequences. For one thing, visitors today expect lightning-fast loading times with every click. Even a small increase from one to three seconds can increase your bounce rates by 32%.

Of course, it’s not just about a smooth browsing process. A website’s speed is tied to its position in search engine rankings — the slower your speeds, the lower your ranking tends to be. This can lead to less organic traffic.

If you want to see how dramatic these speed changes can be, consider trying an experiment. If you’re running outdated PHP, use a tool like GTmetrix to measure your website’s current speed:

You might find that your site is not performing as well as it could. Then, update your PHP and retest. You may be surprised at just how big of an impact this single action can have. Updating your PHP is well worth the effort in terms of speed alone.

2. Stay on top of your security

We probably don’t have to tell you about the importance of WordPress security. Safeguarding user data can protect it against malicious actors looking for access. Doing this can be especially important if you handle sensitive information like credit card numbers.

Updating your PHP version is a simple yet effective way to maintain a strong layer of security. One reason for this is potential security weaknesses. Just like with WordPress, plugins, and themes, developers will release patches to fix any vulnerabilities.

Still, keep in mind that PHP is an open-source language. While this is often a fantastic way to encourage development within the community, it also comes with a downside: anyone can modify the code, including hackers.

When you combine that with the fact that so many websites use this language, it’s often a popular target for malicious actors. As they find new ways to infiltrate your PHP code, developers react by creating more secure versions.

You can think of your PHP version as one of many layers of security. Unfortunately, no single protection method is perfect. Even protection such as malware scans and firewalls aren’t foolproof. But if you’re properly maintaining your PHP, you can take away one more opportunity for malicious actors to access your site.

3. Maintain your overall stability 

PHP versions that don’t properly use their server resources can lead to excessive memory use. This, in turn, can cause your site to crash, damaging the user experience and potentially affecting your search engine rankings.

Updates can help correct this issue by optimizing your use of server resources. With a lower demand for memory, you’re decreasing the chance that you’ll overwork your system. You might also avoid hiccups that can happen if the version is not compatible with your plugins or theme.

By boosting that stability, you’ll be in good company. According to WordPress statistics, older PHP versions tend to get less common as time goes on.

Additionally, as we covered before, updates are crucial to security. Having to recover from an attack can mean being offline for a long time. A step towards a safer site is also a step towards a more stable one. 

How to check your PHP version

So far, we’ve talked about why updates are so important for your website’s PHP. But you can’t start the process unless you’re sure you need a new version. Here are two ways to determine what PHP version your WordPress website is currently running on.

1. Use the WordPress back end

Fortunately, WordPress is a fairly user-friendly platform. Its developers have included several measures to help you keep your website in top shape.

This includes notifications about any new PHP versions. So you might see this alert on your dashboard if you’re running an outdated version:

Near the top of a message like this, you should see your PHP version listed. In this example, it’s PHP (7.2.31). This message will also show you the minimum recommended version that you should consider switching to. 

Another option is to go to Tools → Site Health → Info. Then scroll down to the Server option. Click on it to reveal your PHP version.

Finally, if neither of the above methods works, you can also use a plugin. Plugins are probably the easiest way to add functionality to your site. In this case, you can use one to make your administrative management even simpler.

First, you’ll need to pick the plugin you want to use. We recommend looking for one that has positive reviews, high ratings, and recent updates. These are usually indicators of a quality plugin.

We’ve chosen to use Display PHP Version. It’s simple, lightweight, and easy to use. Install and activate it to get started. Then, go back to your WordPress dashboard and scroll down to the At a Glance section.

You should then see what version of PHP your site is running, right underneath your WordPress version. While you can update WordPress from here, you won’t get the option to update your PHP version.

2. Access the information via a new PHP file

If you don’t have access to your back end or simply prefer a different method, don’t worry! You can also use a slightly more technical approach to get the information you need.

You can start by opening up your text editor of choice and creating a new file. You’ll then want to enter the following code from phpinfo() File:

<?php phpinfo(); ?>

Next, name the file phpversion.php and save your work. Make sure it’s saved as php and not txt. After that, access your root directory and upload the file. You can either do this with your hosting service’s file manager or a File Transfer Protocol (FTP) client. 

From there, you’ll be able to access information about your PHP version by going to example.com/phpversion.php. Remember to replace example.com with your website’s URL. 

Once you’re done, make sure that you delete the file. Publicizing core information about your site like this opens up more opportunities for hackers. So you’ll want to delete it to keep the data secure.

Three things to do before you update your PHP version

1. Create a backup of your site

First, we recommend that you create a thorough backup of your current site. Updating your PHP is unlikely to cause any problems, but errors can happen. This is especially likely if any of your plugins or themes happen to be incompatible with the update.

Having a copy of your data can be a smart way to guard against an unlikely site crash. Plus, backups are also an important part of site maintenance in general. If you’re not already creating them on a set schedule, we strongly recommend it. 

There are several WordPress backup plugins you can use to do this, but we’ll walk you through how to do it with Jetpack Backup.

Start by making sure you have Jetpack Backup installed and activated. You should then see a setup screen that looks like this:

From here, you’ll need to connect your site to WordPress.com. This is necessary even if it’s not your hosting provider. You can then pick your pricing plan. Your first backup should start automatically. It may take a bit of time, but that’s normal. 

After that, you can view your backup by going to Jetpack Backup in the WordPress dashboard.

You’ll be able to see when the last backup was completed. You can also click See all your backups if you want to view any older copies.

2. Make sure WordPress is up to date

Before you update your PHP version, we recommend that you check your WordPress version. This is because outdated WordPress software could potentially be incompatible with your new PHP data.

This process is simple. WordPress updates are essential for any site, so the developers make the alerts obvious:

If you’re not seeing this alert, head over to Dashboard → Updates:

If there’s an update available, you should see it listed here. Then, follow the prompts to complete the process. You may also want to consider turning on automatic updates so you can skip this step in the future.

3. Check your plugins and themes for compatibility

PHP plays a role in almost every part of your site. Unfortunately, that means there are a few opportunities for it to clash with other programs. Plugins and themes can be particularly tricky.

That’s why we recommend that you check these for compatibility before you start the update process. This helps prevent any potential issues that could crash your site.

Just like with PHP, developers should update their applications to work well with the latest WordPress versions. Thus, enabling auto-updates may be the easiest way to ensure compatibility. Alternatively, you could also establish a manual update schedule.

On the other hand, complications can also crop up if your themes and plugins are updated but your PHP isn’t. Making sure all of your technology is updated is the easiest way to avoid errors on your website.

How to upgrade PHP versions with cPanel 

Once you’re finished preparing to safely upgrade, you can update your PHP version with cPanel. Here are our step-by-step walkthroughs on how to do this on three of the leading hosting services.

1. Bluehost

If you’re like most Bluehost customers, you’re probably operating on the Bluerock interface. Older customers may still be working with the Legacy setup. We’ll take a look at both, starting with Bluerock.

Begin by logging into your Bluehost control panel. Then, go to Advanced → Software → MultiPHP Manager.

From here, you’ll be able to pick the website you’d like to update. Choose the PHP version you want to use. Then, click Apply to finish the process. 

If you’re using the Legacy interface, you’ll also start at the Bluehost control panel. This time you’ll find the Hosting tab and select cPanel. 

Then, scroll down until you find the Programming section. Select PHP Config followed by the version you’d like to use. Finally, click on Save Change when you’re done.

A lot of other hosts also use this cPanel approach. These include:

• Inmotion Hosting
• Liquid Web
• MilesWeb

It means that if you’re using any of these providers, you can simply follow these instructions in their interfaces as well. Don’t worry if you get lost, as most services will offer a knowledge base that you can reference.

2. DreamHost

Next up, let’s take a look at DreamHost. Keep in mind that DreamHost has a minimum supported PHP version for security and performance reasons.

Fortunately, upgrading your PHP version is typically seamless. You can start by going to the Manage Websites page. Then, click on Manage.

Next, select Modify. You’ll then be able to pick the latest PHP version from the dropdown menu. When you’re all set, hit Change PHP Version to save your changes. 

3. A2 Hosting

Finally, let’s quickly walk through changing your PHP version on A2 Hosting. Start by logging into your cPanel account. Then, navigate to the Software section and click Select PHP Version.

Once you’ve selected that, you’ll see the current PHP version. You’ll also see a list of your other options. Click on the one you want to apply. There’s no need to save your changes — the update will happen automatically. 

How to ensure that the new PHP version is working

Once you’ve finished your setup, you probably want to make sure that the changes have actually been applied. One way to do this is to revisit the steps for checking your PHP version that we covered earlier. These should now reflect the most up-to-date software.

Nevertheless, not all updates will apply correctly. If you want to avoid any hiccups, you can always try navigating around the front end of your website. If everything went well, you shouldn’t notice any differences. 

You can also check up on your plugins. As we covered earlier, there’s always a risk that some programs will be incompatible. If you’re not seeing any errors and they seem to be working smoothly, there’s unlikely to be an issue.

On the other hand, you might notice a few glitches with your plugins. When this happens, we recommend that you uninstall the malfunctioning program. If that fixes the problem, it may not be ready to work with the new software. Alternatively, it may need an update itself.

We also recommend that you repeat this process with your themes. This includes any that you might not currently be using. Deactivated code is still somewhere on your site, which means that keeping plugins and themes you’re not using updated (or removing them entirely) can prevent these errors as well.

Stay up to date with PHP

Updates are a natural part of any software’s life cycle. Thanks to how central PHP is to your WordPress website, applying these changes is particularly important. Fortunately, staying up to date with your current PHP version can be easy if you understand the principles behind it. 

In this article, we introduced you to PHP and covered why it’s so important to keep it updated. We also showed you a few ways to check your current version. Finally, we gave you some tips to help you stay safe during updates, and showed you how to start the process with three different hosts. 

The new year comes with a shiny new Jetpack. This month, we’re shipping new features for VideoPress, as well as other under-the-hood improvements and bug fixes to create a better Jetpack experience for you and your site.

More flexibility with your video content

From now on, you have the option to make your VideoPress videos downloadable for your visitors, giving you a greater degree of flexibility and control over your video content.

Additionally, your Classic Block embeds with old flash URLs can now be properly converted to VideoPress blocks.

Under-the-hood improvements

This release also includes many style enhancements and compatibility improvements — check the changelog for more details. To use the latest version of Jetpack on your site, update your existing installation or install Jetpack.

Come join us!

Jetpack is more than the sum of its code — it is the collective work of an amazing group of designers, product experts, Happiness Engineers, and code wranglers at Automattic.

Work for us, from anywhere: https://automattic.com/work-with-us/

And More

A big thank you to everyone who contributed to this release:

Adnan Haque, Adrian Moldovan, André Kallehauge, Andrei Demian, Aneesh Devasthale, Bogdan Ungureanu, Brad Jorsch, Brandon Kraft, Bryan Elliott, Caleb Bauermeister, Chris R, Collyn Philleo, Dan Roundhill, David Lonjon, Dean Sas, Derek Smart, Dusty Reagan, Foteini Giannaropoulou, Ian Ramos, Igor Zinovyev, Ivan Ottinger, Jason Moon, Jasper Kang, Jeremy Herve, John Webb, Karthik Bhat, Kev, Kim Brown, Kristian Vitozev, Matt Gawarecki, Matthew Denton, Miguel Torres, Mustaque Ahmed, Osk, Pierre, Renato Augusto Gama dos Santos, Renzo Canepa, Richard Ortiz, Samiff, Sergey Mitroshin, Sérgio Gomes, Siddarthan Sarumathi Pandian, Steve D, Tony Arcangelini, Yaroslav Kukharuk, annemirasol, jboland88, leogermani, robertf4, thingalon

You put a lot of work into your website, creating great content, engaging with your community, and maybe even listing products. But, one day, you start to notice that it’s not showing up on Google anymore. And one of your followers or customers mentions that they see a scary red warning when they type in your URL. What’s happening?

Well, your site may have ended up on Google’s blacklist, a scenario that can definitely be confusing and stressful. But don’t panic! We have all the information you need to understand if you’re on the blacklist, why your site was flagged, how to get back to normal, and how to prevent this from ever happening again.

Note: to encourage inclusivity, Jetpack has decided to use the term “blocklist” instead of “blacklist” throughout the rest of this article. 

What is Google’s blocklist and how do you recognize it?

Google’s blocklist (also called Google Safe Browsing) is a database of all the websites that Google and other search engines think are harmful or dangerous. It helps protect more than four billion devices by notifying searchers about malicious content and webmasters about hacked sites. This impacts Google Search, Google Chrome, Android devices, Gmail, and Google Ads. 

Why does this list exist? Because Google wants to protect its users by keeping them off of malicious websites that can steal their information or cause other damage. Plus, these types of websites don’t fit into Google’s goal of serving high-quality, relevant content for every searcher.

The thing is, though, your website can end up on this list even if you’re not the “bad guy.” Here are a few indications that Google blocklisted your site.

• Your site shows a “this site contains malware” warning. Google adds this message on sites that they’ve flagged to protect their users. Visitors can get past this warning by clicking “Details”, but few will. 
• Your site shows a “deceptive site ahead” warning. This is another message from Google that essentially means the same thing. The exact warning shown can depend on what was found on your website.
• In Google search results, your site shows warnings like “this site may harm your computer” or “this site may be hacked.” This appears as a blue message right above the search result for your pages and can, of course, be a huge deterrent to site visitors.
• You get an email from Google Search Console informing you of a hack. If you have a Google Search Console account (and you should!), you’ll receive notifications about any potential security issues. 

Want more info? Learn more about Google Safe Browsing and blocklist warnings directly from Google.

How does being on Google’s blocklist affect your website and SEO?

1. It turns potential visitors away with warnings

If someone arrives on your site and sees a bright red page with a perilous warning, let’s be honest — they’re probably not going to proceed. After all, they don’t want malware on their own computers! And even if they do still want to visit your site, it’s difficult to figure out how to get past the warning.

In fact, Google found that somewhere between nine and 23 percent of users click through malware and phishing warnings on sites. That means that, if your site is flagged, you could lose up to 91% of your audience — a crippling amount for any website!

And, if you sell products, offer services, or generate revenue from display ads, that also means you’ll get fewer sales and clicks. You can’t afford that!

2. It discourages people from clicking on search results

Again, would you click on a search result that specifically says it’s dangerous? No, probably not. 

If there’s a warning in Google’s search results, then fewer people will click on your site. This, of course, reduces your click-through rate, page views, ad views, and sales.

Because Google uses engagement metrics to determine if sites are valuable to readers (and thus where to place them in the results), the negative impact of fewer clicks may also be compounded by a decrease in search rankings.

3. It damages your reputation

You’ve probably worked hard to build your reputation, whether you’re a blogger, service-based business, or eCommerce store. You’ve written quality blog posts, delivered stellar customer service, answered lots of questions, and have come to be recognized as a trusted resource in your industry. 

But if your site is labeled as dangerous, all of that hard work could be lost. Existing customers, loyal followers, and previous clients might visit your website, see the malware warning, and think that you aren’t so trustworthy after all. This can damage long-term relationships in addition to turning away potential customers and followers.

4. It negatively affects SEO rankings

In many cases, Google will remove your site from its search results entirely if they decide that it’s not safe for their users. Then, interested shoppers and visitors may not be able to find you at all. And it can be debilitating for long-term search engine rankings, which you might have been working on for months or years.

Why might my website be blocklisted?

1. One of Google’s crawlers detected malware or suspicious activity

Google uses crawlers — the most common one is called Googlebot — to explore websites across the internet and gather information. When Googlebot finds new links or new content, it makes a note to update the Google index. The more often you make changes or add new content, the more often it visits your site.

However, if your site has been hacked, it might find malware or other types of suspicious activity. This might include phishing content designed to steal visitors’ information, spam content like comments and form submissions, or malware that visitors could accidentally download to their device. 

Typically, if your site has been hacked, you’ll see other clues like suspicious links, notifications from your host or malware scanning tool, updated pages and posts, or errors on your website.

2. A display ad is driving visitors to malicious content

If you generate revenue from ads on your site, you don’t always have full control over which specific ones are shown to visitors. While ad networks do their best to prevent malicious content, nothing’s perfect. So it’s possible that one of your display ads is hostile and designed to steal visitor information or send them to a suspicious third-party site. All of this can happen without your knowledge.

3. Unsafe plugins are spreading malware 

WordPress is open source, which allows absolutely anyone to create a plugin that adds valuable, additional functionality to your site. While this is a huge benefit, it also means that not every single plugin developer is ethical. 

Unsafe plugins that may seem legitimate can spread malware on your site. This is typically common with nulled plugins — paid tools that are essentially stolen and sold for free or at reduced prices. Or, you may have been using an out-of-date plugin with a bug that allowed hackers to gain access to your site.

4. You’re using black hat SEO techniques

Black hat SEO is a list of techniques designed to increase your search engine rankings but that violate Google’s terms and conditions. 

Black hat SEO techniques include:

• Keyword stuffing: packing your pages or posts with the same keyword over and over again to try and manipulate Google’s algorithm with the intention of increasing your rankings. This creates a negative experience for your site visitors and provides little value.
• Hidden text or links: text or links that are part of your page but aren’t visible to site visitors. This might include white text on a white page, links that look the same as the rest of your content, and text hidden with CSS code or under other elements and made invisible on purpose. This is considered deceptive. 
• Link schemes: links intended to affect search results without providing value. This includes techniques like buying or selling links, automated link programs, or link exchanges that are excessive.
• Article spinning: using a program to rewrite a blog post or other piece of content using synonyms so that it appears different. This can be used to create dozens of seemingly unique pieces of content that really just say the same thing over and over.
• Sneaky redirects: links that send site visitors to a different site than they thought they were clicking on. 

And, since some of these practices used to be completely legitimate, you may not even be aware that there’s anything wrong with them. However, Google frowns upon their use and can blocklist your site because of them.

5. You have plagiarized or copyrighted content or images

If you or one of your team members adds content that’s published on someone else’s site or uses a copyrighted image, you could also end up being flagged. This could be completely innocent — maybe you’re not sure of a picture’s copyright rules or add part of an article to your site to compliment the original author. However, it could still end up hurting your website.

How to get your website removed from Google’s blocklist

1. Remove any malware or suspicious content

Your first goal should be to fix whatever problem got you blocklisted to begin with. So, depending on the issue, you might need to:

• Run a malware scan and fix any issues found. Use a WordPress malware scanning tool like Jetpack Scan to identify any problems. Then, either use Jetpack Scan to fix those issues, restore a backup from before the hack, or hire a professional to clean your site. Pro tip: If you use Jetpack Backup, you can find out when the hack happened using the activity log, then restore to a point just before that.
• Get rid of offending display ads. Report any malicious ads to your ad network. The exact process will vary depending on the network you use.
• Remove the malicious plugin. If the issue is a poorly-coded or malicious plugin, either update to the newest version, find another solution, or purchase the authentic version of a nulled tool.
• Change up your SEO strategy. Get rid of any black hat SEO techniques like spun articles, hidden text, or keyword stuffing. Something like link schemes could be more difficult to take care of, but disavowing your links on Google Search Console may help.
• Remove any plagiarized or copyrighted content. Delete anything on your site that doesn’t 100% belong to you or that you don’t own a license for.

2. Resubmit your site to Google

Once your site’s all cleaned up, you’ll need to ask Google to remove it from their blocklist:

1. Verify that you own your site in Google Search Console

If you already use Google Search Console, there’s no need to worry about this step. Otherwise, follow these instructions to verify your site ownership:

• Visit Google Search Console and click Start Now.
• Select a property type. You can choose between an entire domain, which covers all subdomains, or a URL prefix, which is everything under a specific URL. For the purposes of these instructions, let’s say that you use a URL prefix. Enter the URL and click Continue.
• Choose a verification method. There are several options, so it all depends on which you find easiest:
  • HTML file: Upload an HTML file to your website.
  • HTML tag: Add a meta tag to your site’s homepage.
  • Google Analytics: Use an existing Google Analytics account to verify ownership.
  • Google Tag Manager: Use an existing Google Tag Manager account to verify ownership.
  • Domain name provider: Add a TXT record to your DNS settings.
• Click Verify → Done.

2. Make sure your site is loading properly.

Load several pages throughout your site to ensure that it’s visible online. You may want to do this in an incognito window to ensure that you’re not seeing a cached version.

3. Request a review.

Visit the Security Issues Report within Google Search Console. Click Request a Review. You’ll then be prompted to describe what you did to fix the issue. For example, you might want to explain the malware removal process you went through.

4. Wait for the review to be completed.

Depending on the issue, the review process could take anywhere from one day to several weeks. Once Google decides that your site is clean, all warnings will disappear within 72 hours. If it decides that your site isn’t clean, you’ll need to repeat the steps above.

How to protect your website against future blocklists

1. Change all passwords

If your site was hacked, take the time to update all of your passwords. This goes beyond just the WordPress admin — also think about logins like your cPanel, hosting account, domain name provider, FTP account, etc. Make sure each new password is unique, long enough, and includes uppercase and lowercase letters, numbers, and symbols. If you’re worried about forgetting it, you can use a tool like LastPass to make things easier.

2. Add two-factor authentication

Two-factor authentication protects your login page so, if your site was hacked, it adds an extra layer of security. Instead of just a username and password, someone will also need a one-time code to log in. That code is sent to your phone — so unless a hacker has your device, they’re locked out!

3. Run regular malware scans

Automatic malware scans run regularly on your site, searching for malware and other suspicious activity. They’ll detect anything that’s wrong as soon as it happens, allowing you to fix things quickly before they become too big of an issue (and land you on the blocklist). 

4. Keep regular backups

WordPress backups are a critical part of any site. But in the event of a hack, they’re absolutely priceless. You can use them to restore your site to its exact state before something went wrong without having to hire someone to remove any malware. Plus, they get you back up and running faster, which may help you avoid Google’s blocklist.

5. Use white hat SEO techniques

When trying to improve your site rankings, avoid using any strategies that are deceptive or manipulative by nature, like keyword stuffing or hidden text. Instead, focus on writing valuable content, building helpful links through strong relationships in the industry, creating a seamless user experience, and other legitimate techniques. This will get you much further while helping you avoid the blocklist and establishing a positive reputation!

6. Only run legitimate ads on your site

If you’re using an ad network, you may not have full control over which ads show up on your website. But if you accept individual ads, make sure every single one is legitimate. Vet your advertisers, click on their links, and check their backgrounds. And, if you’re using an ad network and run across a suspicious ad, flag it as soon as possible.

7. Add brute force attack protection

Brute force attacks occur when hackers use bots to guess username/password combinations — sometimes thousands of guesses a second! By implementing brute force attack protection, you can stop these bots in their tracks so they can’t stumble upon the right combination and gain access to your site.

8. Choose quality plugins

Make sure you’re getting all of your plugins from legitimate sources, like the WordPress plugin library or WooCommerce extension marketplace. Check reviews of each one to ensure that no one has any complaints about malware or bugs. And never use nulled plugins — purchase any premium tools directly from the developer!

9. Regularly update your site

Developers often release plugin updates to patch security issues that might allow hackers to access your site. The same thing is true with WordPress core and themes. So, to make sure you’re not accidentally making things easy for suspicious characters, run updates as soon as they’re available. Worried about missing one? You can enable WordPress auto-updates to make things easier.

Get off and stay off Google’s blocklist

Remember: even if your site was flagged by Google, the situation is repairable. All you have to do is follow the steps above, ensure your site’s clear of things like malware, bad plugins, and poor SEO strategies, and put a few best practices in place to keep your website clean.

Looking for more information? Check out all the details about Google Safe Browsing.

Want the easiest way to protect your site from malware? Jetpack’s WordPress security tools provide everything you need in one comprehensive package that’s easy to set up and runs automatically in the background. 

It’s common practice for WordPress developers to create websites on a localhost, which is a local server hosted on their personal computer or laptop. Developing websites locally has a lot of advantages over a live server, but once site development is complete, it needs to be moved to a live website and made publicly accessible.

If you’re relatively new to website development, moving a WordPress website from localhost to a live website will require a bit of extra learning. The process can be quite involved and take some time if you do it manually. 

While a plugin is the easiest solution for migration, you may run into some issues if your site is particularly large or if there are any conflicts between the local and live environments. So, in some cases, a manual migration is still the best option.

Five reasons you should develop on a localhost

If migrating a website from a localhost is time consuming and prone to error, why shouldn’t you just develop on a live server from the start? 

Here are the advantages of developing on localhost:

1. It’s faster. Developing locally is fast as there’s no need to push files to the live server. Instead, you can work directly with the files you need.
2. It’s safer. You can easily experiment or carry out updates locally to check for any errors or incompatibilities. Because you aren’t using an internet connection to develop, you’ll be safe from hacking attempts due to any vulnerabilities in plugins or themes you may be using.
3. You don’t need to be connected to the internet. Taking a flight? Working from a location with slow or unreliable internet? Local development is perfect in this context.
4. It saves server resources. Anything you do on your local server won’t affect your live server.
5. It reduces cost. Depending on the type of website you’re building, development could take weeks or months. If you build your site on a live server, you (or your client) will be paying for hosting costs that entire time. Most local development environments are free to use, which can save hundreds or thousands of dollars over the course of development.

Important: Even when working locally, you should take backups and use version control to avoid losing your work. 

WordPress development tools for localhost

There are a few different approaches to developing locally. The easiest method is to use an application that includes all of the components needed to run WordPress (server, database, and PHP support). 

Local development tools for Linux, Mac, and Windows

• Local. This local development tool is specifically designed for WordPress. It has some great features to assist with development like support for WordPress command-line interface (WP-CLI) and multiple versions of PHP, MySQL, and Apache/NGINX. It also has the option to send a ‘live link’ to clients so they can access your local site for a brief period of time.
• DevKinsta. DevKinsta is similar to Local, but is a slightly less mature product. It’s definitely worth using if you host with Kinsta.
• Lando. Lando is less beginner-friendly, but is a highly-customizable local development environment which allows you to closely match your live server configuration.
• XAMPP. XAMPP is a long-standing, general-purpose, local PHP development stack. 

Local development tools for Mac and Windows

• ServerPress. ServerPress is designed for local WordPress website development. One of its unique features includes the ability to migrate your local site to a live server (if you use the premium version of the software).

Local development tools for Windows

• Laragon. Laragon is an extremely lightweight, general purpose local PHP development stack.

If you’re new to local development, then Local might be your best choice, as it strikes the right balance between ease of use and customization while having some great WordPress-specific features.

Moving your WordPress website from localhost to a live server

There are a few different ways to move a site from your localhost to a live server. This article addresses two of the most common methods — manual migration and using a migration plugin. 

Some of the aspects of the migration process may differ depending on the operating system, local development environment, live host, and plugin that you’re using. The steps should be broadly similar, though.

Before you start

Whichever migration process you use, there are some key things you’ll need to set up and information you’ll need to have on-hand:

• Web hosting that meets WordPress requirements. If your hosting does not meet WordPress requirements, you may still be able to migrate your site, but you may create security vulnerabilities. 
• A domain name linked to your web host. If your domain registrar is different than your hosting company, you’ll need to connect your domain to your host. You can do this by changing the domain nameserver to that of your hosting company or the DNS A record to your live server’s IP address.
• Login details for your hosting control panel. These are usually the same as the login information for your hosting account. If you’re unsure, check with your hosting provider.
• Secure file transfer protocol (SFTP) details for your hosting account. These are usually found in your hosting control panel. If you’re unsure where to find them, ask your host’s support team. These are the details you’ll need:
  • Host (your live server’s IP address)
  • Username
  • Password
  • Port number

You’ll also need an SFTP application to transfer the files from your localhost to your server. Here are some free and premium SFTP tools:

This tutorial will use Filezilla, but most SFTP clients work fundamentally in the same way.

How to manually migrate your WordPress website from localhost to a live server

The following instructions for manually moving your WordPress website from localhost to a live website are based on a host that uses cPanel. You should still be able to follow along if your host uses an alternative like Plesk or their own control panel.

1. Make a backup of your local site 

The manual method of migrating your website from localhost to a live server can be error-prone and involves using quite a few tools. Make sure to take a backup before you begin the migration process and at every step along the way, just in case anything goes wrong. 

2. Copy your files from localhost to your live server

1. Log in to your web server using your SFTP client of choice. This is where you’ll enter the SFTP credentials provided by your host.

Note: you may get a ‘host key unknown’ error. This is not unusual for some SFTP clients that use trust on first use (TOFU) authentication. Just click ‘OK’ and proceed if you’re sure the host key is correct. You can even check ‘Always trust this host, add this key to the cache’ if you plan on logging into the site via SFTP again. 

2. Navigate to your website files on your local computer. With most SFTP software, your local files appear in the left pane, and your server files in the right. From your localhost, you should have access to the files that make up your WordPress site. If you can see a wp-config.php file alongside directories like wp-content, then you’re in the right place.

3. Navigate to the public directory on your web server (right pane). This is typically a folder called ‘public_html’ or ‘www.’ This does vary from host to host, so check with them if you’re unsure. If you’re hosting your site in a subfolder, you’ll want to navigate to that subfolder.

4. Select all of the local files from the left pane and drag them to your web server in the right pane. This will take a while depending on the number of plugins, themes, and files you have, but you should be able to see the progress in your SFTP application.

3. Import the data from your local database to your live database

Even though you’ve moved your files from your local server to the live server, you’ll need to connect to a database in order to view your live site. At this point, when you open your browser and try to navigate to the public URL of your web server, you should see an error like ‘error establishing database connection.’ This tells you two things:

• The WordPress files have been uploaded.
• The site needs to be connected to a database.

Export the database from localhost

An essential part of your WordPress installation is the database. This is where all of your website data is stored, like post content, settings, and meta fields. 

Typically, you would export your database using phpMyAdmin, which is part of almost all local development environments. Some local environments, like Local, use Adminer as an alternative, but web hosts almost always use phpMyAdmin. 

In phpMyAdmin:

1. Select your database.
2. Click the ‘Export’ tab.
3. Select ‘Quick’ as the export method, choose ‘SQL’ as the file type, and click ‘Go.’

In Adminer:

1. Select your database.
2. Click ‘Export’ from the menu.
3. Select ‘SQL’ as the output, then click ‘export’

This will download a .sql file to your computer. Take a note of where this is saved, as you’ll need to import this on your web server.

Create a database on your live server

To upload your database, you’ll first need to create a new, blank database on the web server.

1. In your hosting control panel, go to the ‘Databases’ section and click ‘MySQL databases.’

2. Create a new database. In this case, the database is called ‘tutorial_mydb.’

3. Create a database user. Scroll down to the ‘MySQL Users’ section and create a new user. As always, you should have a unique and strong password.

4. Add the database to the user and assign permissions. To do this, scroll down to the ‘Add user to database’ section, select the user and database that you just created, and click ‘Add.’

5. Assign all privileges to the user account and click ‘Make Changes.’

You have now successfully created a blank database that you can import your data into.

Edit your wp-config.php file

The wp-config.php file is a core WordPress file that contains important information about your database. WordPress uses this file to connect to the database in order to retrieve and store vital information like post content, post meta, users, and various settings. You’ll need to update the localhost wp-config.php file with the live server database information so that your live site can communicate with your database.

1. On your localhost, take a copy of your wp-config.php file and open it in a text editor of your choice, like VS Code or Notepad++.

2. Go to the mySQL section of the config file and replace your localhost database details with those you just created.

// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define( 'DB_NAME', 'yournewdatabasename');

/** MySQL database username */
define( 'DB_USER', 'yournewdatabaseuser');

/** MySQL database password */
define( 'DB_PASSWORD', 'yournewdatabasepassword');

/** MySQL hostname */
define( 'DB_HOST', 'localhost' );

Despite moving the website to a live server, the DB_HOST will still usually be ‘localhost’, although this does change on some hosts, so be sure to check.

Some wp-config.php files also contain the following lines:

define(‘WP_SITEURL’, ‘http://localhost.test’);
define(‘WP_HOME’, ‘http://localhost.test’);

If these lines are present, then you’ll need to change them to your server URL, e.g. https://yourdomain.com.

3. Save this file and overwrite the one you uploaded to your web server by dragging and dropping it using your SFTP client.

Import your data

Now that you have a blank database and have pointed the wp-config.php file, it’s time to import the data that you exported earlier.

1. Head to phpMyAdmin on your web server. In cPanel, you’ll find this under ‘Databases.’
2. Select your newly created database, then click the ‘import’ tab.
3. Click ‘Choose File’ and find the sql file that you exported earlier.
4. Click ‘Go’ to begin the import process. It may take a little while depending on the size of the database. Once done, you should see all your database tables on the left, like wp_posts, wp_postmeta, and wp_options, etc.

Change the site URLs in your database

Now that your data has been imported, you’ll need to ensure the database contains the new site URL, and not that of your localhost.

1. Open phpMyAdmin and select your database.

2. Click on your WordPress options table. Tables usually appear on the left.

3. Once opened, you should see the first two options. Under the ‘option_name’ column, you’ll see ‘siteurl’ and ‘home.’

4. Double click on the option value under the ‘option_values’ column and change both of these to your new URL. Make sure you don’t include a forward slash (/) at the end.

5. Open your browser and type in your live site’s url with /wp-admin/ at the end (e.g. https://yourwebsite.com/wp-admin/). From here, you should be able to login to your WordPress dashboard. However, you may need to go through a couple more steps to make sure all pages and posts on your site are reachable. 

4. Flush your permalinks

Permalinks are the permanent links to pages and posts on your website and their underlying structure. Sometimes your post and page URLs may not work on your newly migrated site unless you flush your permalinks first. You can do it by following these steps:

1. Go to your WordPress dashboard and log in.
2. Go to Settings → Permalinks.
3. Click ‘Save Changes.’

Step 5: Search and replace localhost URLs in your database

Sometimes when creating your website, your localhost URL may also get stored in the database in a variety of places, which could cause broken links on your web server. There are two methods to resolve this problem:

1. Use an SQL query (advanced).
2. Use a plugin.

Before doing anything to your database, you should always create a backup.

Search and replace using an SQL query

This method is far more risky than using a plugin, but if you’re confident with SQL, then it’s quick, easy, and doesn’t require you to install any plugins. 

1. Log into phpMyAdmin on your web server, select your database, then click the ‘SQL’ tab.

2. Copy and paste the following query parameters into the SQL query field:

UPDATE wp_posts SET post_content = replace(post_content, 'http://localhost.test', 'https://webserver.com'); UPDATE wp_postmeta SET meta_value = replace(meta_value,'http://localhost.test','https://webserver.com');

There are some values in this query that you’ll need to modify:

• The ‘wp_posts’ and ‘wp_postmeta’ names may be different depending on what your database prefix is. You can see this in the left pane of phpMyAdmin.
  
• The URLs will need to be changed to your real values.

Once you’ve modified the query, check it to make sure the values are correct before clicking ‘Simulate query.’ ‘Simulate query’ will perform a test to see how many values will change if you actually run it. If there’s an error at this point, double-check your values.

Once you’ve run the simulation, you should see some ‘matched row’ figures. This is how many instances will be replaced. If this is zero, then you may have used an incorrect URL or there’s genuinely nothing to replace. If your URL is correct and no rows were matched, you don’t need to make any further changes. 

3. If your simulated query shows a number of matched rows, then close the ‘Simulate query’ dialogue box and click ‘Go’ to run the actual SQL query. You should now be able to navigate to your live website without errors.

Search and replace using a plugin

This method is slightly easier and less error prone if you’ve not used SQL before. This example uses the Better Search Replace plugin.

In your WordPress dashboard:

1. Go to Plugins → Add New.
2. Search for ‘Better Search Replace’.
3. Click ‘Install Now’ on the Better Search Replace plugin.
4. Click ‘Activate.’
5. In your WordPress dashboard, go to Tools → Better Search Replace.
6. Fill the ‘Search for’ field with your localhost URL (e.g. http://localhost.test).
7. Fill the ‘Replace with’ field with your web server URL (e.g. https://yourwordpresswebsite.org).
8. Select the database tables that you want to perform the search/replace on. Usually it’s only necessary to apply this to the wp_posts and wp_postmeta tables.
9. Keep ‘Case-insensitive’ and ‘Replace GUIDs’ unchecked.
10. Check ‘Run as dry run?.’
11. Click ‘Run Search/Replace.’ The dry run means that this will make no changes, but will show you the number of potential changes.
12. Check for changes. At this point, you should see a number of changes. If you don’t, then you may need to double-check your URLs. If your URLs are correct and there’s still nothing to change, then you don’t need to proceed and can delete the plugin.
13. If there’s a number of changes to make, uncheck the ‘Run as dry run?’ option and click ‘Run Search/Replace.’
14. Deactivate and uninstall Better Search Replace. Once this has completed and you’ve checked that the site is working correctly (particularly check images with your localhost turned off), then you can deactivate and uninstall the plugin.

You have now completed your manual migration!

Migrating from localhost to a live server using a plugin

When migrating your WordPress website with a plugin, if you have a large website or there are issues between server environments, the migration may fail. The plugin may not give you any feedback as to why. In those instances, manual migration may still be necessary. 

However, for the majority of websites, migrating with a plugin is a lot easier, less time consuming, and produces fewer errors. This section addresses migrating your site using the Duplicator plugin, but other options include DesktopServer and Transferito. The process should be similar, whichever plugin you use.

1. Create a package

1. In your WordPress dashboard, go to Plugins → Add New.

2. Search for ‘Duplicator.’ Click Install → Activate.

3. Find ‘Duplicator’ in your WordPress admin menu. Click on ‘Packages’ to be taken to the Packages screen.

4. Create a new package. You should be presented with a message that says ‘No packages found.’ Click ‘Create New’ in the upper right corner of the screen.

5. Check package settings. At this point, there are some options you can change, but the defaults will be fine the majority of the time. Click ‘next’.

Review the test scan and make changes if necessary. The plugin will now scan your site to make sure everything is ok before taking the backup. The checks here try to ensure that the package will be compatible with most hosting environments. Once complete, you’ll see the results of these tests.

Your test results should all be ‘good’ — the exception to this being size checks. It’s likely you may get a ‘notice’ on size checks if you have a fairly large website. Compressing larger sites on some budget hosts may cause timeouts, although this usually won’t be an issue. You can still proceed despite this notice.

If anything fails, simply click on the item to get more details as well as suggestions on how to rectify the issue before proceeding.

Build your package. Once your test results are ‘good’ (size check notice aside), hit the ‘Build’ button. This may take a while depending on the size of your site, but be patient and keep the browser window open until it completes.

Download your files. Once complete, you’ll need to download two files: a ZIP containing the website files and an installer.php file.

2. Create a database on your live server

To install your package, you’ll need to create a new, blank database on your web server. Log in to your hosting control panel, go to the ‘MySQL databases’ section, and create a new database.

Create a database on your live server

To upload your database, you’ll first need to create a new, blank database on the web server.

1. In your hosting control panel, go to the ‘Databases’ section and click ‘MySQL Databases.’

2. Create a new database. In this case, the database is called ‘tutorial_mydb.’

3. Create a user for the database. Scroll down to the ‘MySQL Users’ section and create a new user. As always, you should have a unique and strong password for your database user.

4. Add the database to the user and assign permissions. To do this, scroll down to the ‘Add user to database’ section, select the user and database that you just created, and click ‘Add.’

5. Assign all privileges to the user account and click ‘make changes.’

3. Copy your files from localhost to your live server

To copy your files over from your localhost to your live environment, you’ll need to place the Duplicator package and installer.php file on the web server.

For this part, you’ll need an SFTP client and your SFTP login details. Be sure to ask your web host if you aren’t sure what these are. Alternatively, as you’re only uploading two files, you could upload them through your hosting control panel file explorer if it has one.

1. Log in to your web server using your SFTP client of choice.

Note: you may get a ‘host key unknown’ error. This is not unusual for some SFTP clients that use trust on first use (TOFU) authentication. Just click ‘OK’ and proceed if you’re sure the host key is correct. You can even check ‘Always trust this host, add this key to the cache’ if you plan on logging into the site via SFTP again.

2. Navigate to where you saved your Duplicator package and installer.php files on your local computer. In most SFTP software, your local files appear in the left pane, and your server files in the right.

3. Navigate to the public directory on your web server (right pane). This is typically a folder called ‘public_html’ or ‘www.’ This does vary from host to host, so check with them if you’re unsure. If you’re hosting your site in a subfolder, you’ll want to navigate to that subfolder.

6. Select your duplicator package and installer.php files and drag them to your web server (moving from left to right). This may take a little time depending on the size of your Duplicator package.

4. Install your Duplicator package

1. In your browser, go to https://yoururl.com/installer.php (replacing everything before ‘installer.php’ with your real URL).

2. Step 1 of 4: Deployment. At the above URL, you should now see the first step of the deployment process. This step checks that your hosting is suitable for Duplicator to install your package. If you get any failures at this stage, speak with your web hosting provider. There are some options here, but most of the time, the defaults will be fine. If everything passes, click ‘Next’.

Your Duplicator package will now be extracted. This can take a little while depending on its size.

3. Step 2 of 4: Install Database. After the package has been extracted, you’ll be asked for your database information. Input the details from the database you created earlier. The default is to remove any information that’s already in the database, which is not a problem if you’ve created a blank database as recommended.

Your host should likely still be set to ‘localhost’ despite this being a live web server. This does sometimes change between hosting providers, so if you run into any problems, be sure to contact yours.

Once again, there are some options here, but in most cases, the defaults are going to be perfect. Click ‘Test Database.’ 

If this passes, then it means that Duplicator can connect to your database successfully. Click ‘Next.’ If you have any errors here, then double check the details you’ve entered and get in touch with your hosting provider if you’ve unable to resolve it yourself.

Your database will now be installed. This process is usually a lot quicker than extracting the package, but may still take a few minutes depending on the size of your database.

4. Step 3 of 4: Update Data. Now that your database has been installed, you will be asked for your website title, new URL, and the path to where it should be installed on the server. Duplicator attempts to automatically fill out these details, but it’s worth double-checking that they’re correct. Once you’ve checked that the information is correct, click ‘Next.’

5. Step 4 of 4: Test Site. Your website should now be live. You can click the ‘Admin Login’ link. Be sure to check ‘Auto delete installer files after login.’

6. Delete installer files. Once you’ve logged in to your WordPress dashboard, your installer files will automatically be deleted if you checked the ‘Auto delete installer files after login’ checkbox. If you forgot to check it, you can still delete the files manually using SFTP. It’s good practice to deactivate and remove the Duplicator plugin if you aren’t planning on using it anymore in the short term. If you ever need it again, you can always reinstall it.

4. Flush your permalinks

Permalinks are the permanent links to pages and posts on your website and their underlying structure. Sometimes your post/page URLs will not work on your newly migrated site unless you flush your permalinks first. This is a simple process:

1. Go to your WordPress dashboard and log in.
2. Go to Settings → Permalinks.
3. Click ‘Save Changes.’

Test your live site for errors

Regardless of the method you use to move your website from localhost to live, you should test it to ensure that nothing has gone wrong along the way. Here are a few things to check after moving your site from localhost to live:

Front-end:

• Does the front end of the website look as expected?
• Do all links work?
• Do all interactive elements function correctly (e.g. sliders, accordions, pop-ups)?
• Can you submit any forms? Do these forms get received?

WordPress dashboard:

• Do all admin pages load correctly?
• Can you add and edit posts, pages, and any custom post types?
• Can your website be indexed by search engines? Go to Settings→ Reading and ensure ‘Discourage search engines from indexing this site’ is unchecked.
• Do your plugin and theme pages work?
• Can you install new plugins?

Backups

Now that your site is live, you should make sure to set up regular backups. You never know when something could go wrong thanks to a hack, update, or change. Jetpack Backup makes this easy. 

With Jetpack Backup, you can save all your files, including your database. Redundant copies are made on multiple servers and stored off-site, in the cloud, eliminating extra load from your server. Jetpack Backup is tested to ensure there are no conflicts with major plugins or hosts, so it’s safe to use on just about any website. Learn more about WordPress website backups.

Check your speed

You wouldn’t use a content delivery network (CDN) or caching on your localhost, but once your site is live, you’ll likely see a difference in site speed performance. Implementing some type of caching and/or a CDN is essential for speeding up load times on most websites.

Jetpack CDN can cover all of your speed needs. Best of all — it’s free. It optimizes images and static files like CSS and JavaScript and delivers them from Jetpack’s global network of servers. There’s no file limit and it also works well with Jetpack’s ad-free video hosting service, VideoPress.

Migrate from localhost to your live site with confidence

We’ve taken you through two methods of moving your WordPress website from localhost to a live server — manual migration and migration using a plugin. While the manual method can seem quite challenging, especially for new developers, the plugin method makes migration easy in comparison. 

For most people, using a migration plugin is going to be the quickest, easiest, and least error-prone way to get a website online. If the plugin method doesn’t work for you, then you always have the fall-back option of manually moving your website. Whichever migration method you choose, you should be sure to make backups every step of the way.

It’s a general rule that if something seems too good to be true, it probably is. That’s especially true when it comes to nulled themes and plugins for WordPress sites. What can seem like a great deal on software can damage your website and result in more problems and costs than any potential savings. For safety and security, it’s important to be able to identify and avoid nulled software.

What are nulled plugins and nulled themes?

Nulled plugins and themes are versions of paid software that have been hacked to allow access and use even when you haven’t purchased a valid license. They are often available for sale at greatly reduced prices from third-party websites, which advertise much cheaper versions of the software without mentioning that they’re illegitimate copies. 

These types of sales are unethical and can cause problems for your website. Nulled software can contain malware or simply use out of date, insecure code. What seems like a good option for cheap plugins and themes can turn into a broken website and stolen user data.

It can be tempting to use nulled software if you’re on a budget or if you’re wanting to test features and functionality before committing to a paid product. While you might save some money in the short term, it will cost you far more to undo the damage that a nulled plugin or theme can cause. 

What type of problems can be caused by nulled plugins?

Nulled software has been altered from the original version, which automatically means that it can no longer be trusted. In addition to simple coding errors, bugs, or conflicts, nulled plugins and themes can introduce more serious problems for your WordPress site.

1. Security issues

The biggest concern when it comes to nulled software is security issues. Nulled software can contain malicious code that might compromise sensitive data, break site functionality, or otherwise cause harm. Many of these plugins inject malware into your site that provides back-door entry. This type of access can cause your site to be taken down, altered without your knowledge, or hijacked to point to a different website address.

Even if there’s no malware injected into a nulled plugin, it’s still very likely to have out of date code. Code that’s outdated can present its own security and functionality issues. If you don’t know which version of the plugin or theme you’re using, then you won’t know when urgent updates are required. Not being able to keep your plugins and themes up to date leaves your site vulnerable to hackers exploiting security loopholes.

Detecting the problem, fixing the code, and restoring your site is expensive and time-consuming, not to mention stressful. If your site is breached by a hacker, you may need to restore a backup of your site. And if you don’t have a backup available, you’ll have to extract the malicious code from within the database, which is not easy. 

2. Privacy issues

Malware added to nulled plugins or themes can also be used to gather sensitive information from your site. Data like login IDs, customer names, and email addresses of your community members can be sent to a third-party who can sell it or use it for phishing purposes. 

Malware like this can be very hard to detect as it doesn’t interfere with the normal activity of your website. Often a major data breach can occur before you even know that there’s a problem. The only indication you may have that your site has been compromised is if you begin getting a lot of angry messages from your site’s users. Rebuilding that lost trust would be extremely difficult and time-consuming.

3. Legal trouble

One of the great things about WordPress is that it’s open source software, so there’s a huge community of developers. Whatever special functionality you’re looking for, or whatever kind of customized design you need, chances are that someone has a solution.

While the free WordPress themes and plugins in the WordPress.org library are open source, some paid plugins are sold with mixed licenses. This means that some parts of the code are protected by copyright laws and if you’re using a nulled WordPress theme or plugin, then you don’t have legal permission to do so.

Or you may even face legal problems if the use of nulled plugins causes data loss, theft, or other issues for your site visitors or customers. This can be costly and damage your reputation. 

4. Decreased search engine rankings

If your site contains malware, it can end up on Google’s blacklist, which can seriously plummet your search engine rankings, site traffic, and sales.

And, if there’s a lot of spam on your site, your core messaging is overloaded and scrambled, making it hard for Google to truly understand what you’re all about. They may not consider your website relevant for your target keywords and therefore won’t display it in search results.

5. No software support

One of the major benefits of paid plugins and themes is ongoing access to support. 

WordPress software updates typically include:

• Upgrades to fix security loopholes and bugs. Developers regularly release updates in order to fix errors in the code and address security loopholes. By not using the latest version of a plugin or theme, you have a higher likelihood of getting hacked or something breaking on your site.
  
• Continued compatibility with WordPress. WordPress regularly releases updated versions of their software and themes — and plugins usually need to be updated to stay compatible. Since nulled software can’t be updated, your site might experience functionality issues or fatal errors that break the website entirely.
  
• Access to all documentation and community forums. When you have questions or need help, community forums and developer documentation can be invaluable resources. Documentation can help you with proper settings, understanding how the software works, common issues that users encounter and how to troubleshoot them.
  
• Access to support from the original developer. No one knows a piece of software like the person or team that built it. Being able to go directly to the developer for support can get your problems solved quickly. Without a receipt of purchase or a valid license key, the developer won’t be able to help you, and you’ll be stuck trying to troubleshoot your issues by yourself or hiring another developer to do it for you.

The benefits you get from using legitimate plugins with a valid license are essential. This helps ensure that your software stays running smoothly and doesn’t cause conflicts on your website (or if it does, that the issues are swiftly resolved). With proper support, you’ll make sure your plugins and themes are installed and configured correctly, and that they continue to work in harmony with WordPress.

6. Ethical issues

Not only can using nulled software lead to immediate trouble like a broken or hacked website, data theft and legal headaches, or a drop in your search rankings, it’s also unethical and discouraging to developers.

By purchasing nulled plugins or themes, you’re failing to support the hard work and efforts of WordPress developers, who are often working on software enhancements on their own time. Developers may abandon projects that aren’t receiving enough support, and find little to spur them to answer the call for new functionality.

Purchasing directly from the developer or reputable online marketplaces also ensures that the author has the resources to keep their software up to date, improve it, and continue to add new features. Supporting high-quality plugin and theme authors not only benefits website owners but also their site visitors. Impeccable code, thoughtful user interfaces, and extended functionality are all key to improving user experience and keeping visitors coming back to your site. The only way this happens is with financial support.

How can you identify nulled software?

If you’re looking to add a plugin or theme to your website, make sure it’s not a nulled version. 

Here are warning signs of a nulled plugin:

• Multiple premium plugins or themes from different developers bundled together and sold in bulk. Note, however, that some themes include legitimate licenses for additional plugins.
• Ads on newsgroups or social media sites that advertise paid plugins or themes at a deep discount or for free
• Download sites that explicitly use “nulled” or “null” in their name or domain
• Sites that have a bunch of spammy ads for other websites — especially those that look like download buttons for the software but actually take you to another website
• Pricing that’s drastically lower than on the official developer’s site

Be sure to do your research to determine if a plugin you’re considering has a paid version or not. A paid version should come with a license key of some kind. Nulled plugins will never come with a license key. So if you’re being offered a totally free, no-license-key-required version of the software, then that’s going to be a nulled version.

What if you already have some suspicious plugins and themes installed on your site? 

You can verify that your website is safe by:

• Running a security scan using a reliable WordPress malware scanner
• Checking each plugin on the back end of your website to see if it has a license key
• Manually searching for each plugin and theme online to see if it’s a paid plugin 

If you detect a nulled plugin or theme on your existing website, you’ll need to treat your site as if it has been hacked and clean it using a backup and restore plugin or manually removing the plugin and any associated malicious code.

What’s the best way to acquire WordPress plugins for your website?

The good news is that finding safe, reliable, properly-licensed software for WordPress is quite easy. There are many free, freemium, and paid plugins available that will build out the functionality that you need in a safe and secure way. 

Free solutions

For free solutions, stick to the WordPress plugin and theme directories. Plugins in the directory are monitored and checked for injected malware or hacks. They are also marked or removed if they no longer meet GPL standards, have not been tested with the latest WordPress versions, or haven’t been upgraded in a long time. 

Installing from your WordPress dashboard is the safest, most secure way to make sure you’re adding safe extensions to your website. However, you can also download plugins and themes directly to your computer and upload them into WordPress yourself using the plugin and theme upload feature or via secure file transfer protocol (SFTP). However you choose to add them to your site, make sure your free plugins and themes come from the WordPress directories.

Freemium and paid plugins or themes

If you require the advanced functionality of a paid plugin or theme, be sure to purchase from the author’s website directly or a reputable software marketplace. Create an account to track your purchase and get notifications of and access to future updates. Make sure your license key is properly installed and configured and, if the plugin requires a subscription, ensure that your payment information is kept up to date.

If you’re afraid to purchase an expensive plugin subscription due to the upfront cost, keep in mind that most premium software includes a return policy. If your purchase doesn’t work out for your website, you can ask for a refund within a specified time frame (usually 30 days). If you’re not sure if a plugin will work with your theme or other plugins you’re using, you can always ask the developer pre-sales questions or check their FAQ for any known conflicts. Play it safe and buy from the source.

Use reliable authors

To make sure you’re working with reliable authors, search for reviews and recommendations, and stick with well-known brands. When possible, use plugins that provide a good cross-section of functionality, like Jetpack. The fewer plugins you use, the less likely you are to experience conflicts. It will also reduce the need to cobble together solutions from mixed sources, which can be cumbersome to keep track of and troubleshoot when you run into issues.

Remember, your website is an essential part of your business and the heart of your reputation and services. Keep it safe and secure by avoiding nulled plugins and themes, and sticking with the WordPress names you know and trust.

Are you trying to find the perfect backup solution for your WordPress website? Then you’ve probably already discovered that not all backups are created equal and there are many options to choose from. It’s hard not to stress about this choice when it seems like your site’s safety depends on it. 

While you can opt for backing up your site manually, this is very time consuming and can be prone to human error due to all the technical details involved. It can also be very impractical if you’re running a site with dynamic content that changes on a daily or even hourly basis. Using an automated method of backing up your WordPress site will not only save you time and money, but will likely give you more consistent, reliable backups. 

In this post, we’re going to explore why backups are so important. Then we’ll discuss the pros and cons of two automated backup options — backup plugins and hosting-level backups — and explain why using a backup plugin is almost always the best choice. Let’s get started! 

Why backups are important

There are many scenarios in which a backup of your WordPress website might save the day. While WordPress is a secure and well-optimized platform, errors and hacks can still damage your site.

Backups are especially important if your business and livelihood depend on your website. Broken features and downtime can drive away potential visitors, reducing your sales, ad revenue, and follows.

Here are just a few of the many reasons backups are essential:

• Human error. People make mistakes that can affect the safety of your website. The more people who have access, the higher the risk.
• Security. Cyber attacks and hacks are becoming more common and can erase or compromise your site’s information.
• Data loss. Access to data is crucial for your business. Losing data can affect your marketing and sales strategy, and therefore your profits.
• Hosting issues. Unfortunately, your hosting provider may sometimes fail you. This is outside of your control, but a backup can mitigate the negative effects on your website and/or business.
• Market research. If your website is linked to your eCommerce business, you may want to test different elements of your business model (like content, payment options, etc.). With a backup system in place, you can run these tests without worrying about losing your website’s content.
• Sentimental value. If your website is a hobby blog or is built for a personal event like a wedding, it could be personally devastating to lose all of the images, content, and associated memories.

In short, if you don’t back up your WordPress website, you run the risk of losing all the content and data it holds. It’s important to have an updated copy of your site in case of emergencies. That way, you can restore quickly and move on with your life (and your business).

Automated WordPress backup options

There are two ways to implement automatic backups of your WordPress website. You can rely on your hosting provider’s WordPress backup services or you can use a plugin. 

Every website needs a web host that gives it a ‘home’ online and makes it available for visitors. Most reputable hosting services will offer some type of backup feature, either as a part of their core services or as a paid add-on. 

The other option for automating your site’s backups is installing a backup plugin. If you’re just getting started with WordPress and not familiar with plugins, a plugin is software you can download to your WordPress website to enhance its capabilities. There are plugins that enable you to do just about anything, including manage backups. You can compare the best WordPress backup plugins to find the right fit for you.

Most backup plugins will make copies of your site — either manually or at a scheduled interval — and save them to your server, a third-party cloud hosting environment, or to their own proprietary storage solution. 

So how do each of these methods work and what are their advantages and disadvantages? Let’s dig more deeply and explore the pros and cons of both hosting-level backups and backup plugins.

Pros and cons of using your hosting provider’s backup service

Not only will your hosting provider display your site to the world, they usually offer a variety of other services. Some may offer email hosting, security scans, performance optimization, and more. 

Most importantly (for our purposes here), the majority of hosting providers will make some kind of backup solution available to you. Hosting-level backups are great, especially if they’re already included in your plan. But they also have some serious downsides. Below are some pros and cons of relying on your hosting company to provide your WordPress backups:

Pros:

• Simplicity. Performing backups through your hosting provider means you don’t need to locate a third-party tool for the job (whether that’s a plugin or some other platform). You can manage your backups from the same place as your hosting plan.
• Guaranteed backups and restores. Not all backup plugins offer both backups and restores. But just about any hosting-related backup service should make both of those tasks easy.
• Storage options. Some hosting providers (but not all) offer remote storage options for your backups in addition to their own storage solution.
• Off-site backups. As long as there isn’t an issue with your server or your web host’s backup system, they’ll be able to back up your site’s files if it’s completely down. 

Cons:

• Cost. While some WordPress hosting companies offer free backups, often this service will cost an extra fee. That’s particularly true if you want to perform regular backups (a web host may offer free daily backups, but require payment if you want multiple backups per day).
• Limited lifespan. Hosting providers rarely save backups forever. Often, they’ll only store copies of your website for 30 days.
• Risk. Since hosting backups are at the discretion of your provider, this creates more potential risk. If your web hosting service goes down and doesn’t offer remote storage options for your backups, you might be out of luck when it comes to trying to access them. Plus, most hosting providers offer limited guarantees when it comes to your backups. Bluehost, for example, recommends Jetpack Backup for their customers. 
• Can be compromised by hackers. If a hacker injects malware on your server and your backups are stored there as well, they could also be compromised. Restoring one of those backups, then, would not help you recover in the event of a hack.
• Lack of control. Hosting providers rarely offer much control over how your backups are performed and don’t always give you options for external storage. Instead, you have to settle for the schedule and storage location they determine.

While backing up your WordPress website with your hosting provider isn’t a bad idea, this method should be used with caution. If you’re implementing more than one backup solution, then using your hosting provider’s backup service is a great way to have some redundancy in your strategy. 

But if you’re thinking about it as the only backup solution for your WordPress site, you might want to think twice. We’d suggest carefully examining your host’s policies, weighing the risks, and thinking about whether their services can truly meet your needs.

Pros and cons of using a backup plugin

If you’re running a WordPress website, you have many plugins available to you. From affiliate marketing to search engine optimization (SEO) and two-factor authentication (2FA), you can install a WordPress plugin for almost anything you need, including managing your backups.

Let’s explore the advantages and drawbacks of choosing this method.

Pros:

• Variety. There are many backup plugins to choose from, making it more likely that you’ll find the perfect option for your needs.
• Automation. Most backup plugins enable you to schedule automatic backups on a weekly, daily, hourly, or real-time basis.
• Ease of use. If you use plugins for your other business needs, you’re likely already familiar with how they work. You can perform (and restore) backups from inside the WordPress dashboard. Additionally, most plugins offer an intuitive and user-friendly interface.
• Customization. You can decide exactly which elements of your website you want to save. You can choose to back up files, databases, configurations, or a complete copy of your site, which is often the safest option. 
• Remote storage. Instead of saving backups to just your computer or your server, most plugins offer remote storage options using popular platforms like Google Drive, Rackspace, Amazon S3, or Dropbox.
• Cost. There are many affordable backup plugins available for WordPress. Some are even free. The majority of the popular WordPress backup plugins cost somewhere between $22 and $150 per year, which should fit into most budgets.

Cons:

• Security. When a plugin backs up your website, the first step is to make a copy. Then it usually sends that copy to a remote storage location where it will be safe. But if your WordPress site is down or is experiencing problems that keep your backup plugin from working, this means your backups won’t be completed. In other words, backup plugins make a copy of your site before an emergency occurs, not during. If you don’t notice the issue right away, you might go days or weeks without a backup being performed.
• Performance. Every plugin you install on your site adds new code. The ‘weightier’ your site becomes, the more likely you are to experience performance issues. A well-optimized backup plugin shouldn’t have a noticeable impact on your loading times, but some users prefer to minimize plugin use for this reason.

Backup plugins are a practical choice. They’re simple to use and you can usually set them up in just a few minutes. If you’re already familiar with WordPress, this may be a great option for you.

How to choose the right backup solution for your website

It’s possible that the backup options offered by your hosting provider will be sufficient for your needs. You may be lucky enough to have a web host that provides frequent and flexible backups, or your site might be small and only require a free daily backup.

Still, for most users, we’d recommend opting for a dedicated backup plugin. There are many benefits to managing this key task with a plugin. It’s quick, easy, affordable, and usually automatic. You have lots of options to choose from, and you can personalize your backups to meet your precise needs.

In particular, backups for eCommerce businesses are a must-have. So if you’re running an online business or your website is monetized in any way, a plugin is likely the best option for you. Fortunately, there are plenty of WordPress backup plugins to choose from, like Jetpack.

Jetpack Backup includes real-time backups so every change, order, and comment is saved immediately. Backups are stored off-site on WordPress’ most secure servers. If anything ever happens, you can restore your site with a single click — even from the Jetpack mobile app if you’re on the go. Jetpack Backup also comes with cool features like the WordPress activity log so you can review what actions may have caused your site to go down.   

A reliable solution for every site

We know that managing your WordPress website can seem daunting. There’s a lot to worry about, especially if you run an online business. The good news is that you can automate and simplify key tasks like backups, so you have more time to focus on your passion.

Implementing a reliable, robust backup solution for your website is essential. Your hosting provider may offer this feature as part of its services, but we recommend opting for your own backup tool as well. A WordPress backup plugin like Jetpack can offer you simple, customizable backups that you can always count on.

During an internal audit of the All In One SEO plugin, we uncovered an SQL Injection vulnerability and a Privilege Escalation bug.

If exploited, the SQL Injection vulnerability could grant attackers access to privileged information from the affected site’s database (e.g., usernames and hashed passwords).

The Privilege Escalation bug we discovered may grant bad actors access to protected REST API endpoints they shouldn’t have access to. This could ultimately enable users with low-privileged accounts, like subscribers, to perform remote code execution on affected sites.

We reported the vulnerabilities to the plugin’s author via email, and they recently released version 4.1.5.3 to address them. We strongly recommend that you update to the latest plugin version and have an established security solution on your site, such as Jetpack Security.

Details

Plugin Name: All In One SEO
Plugin URI: https://wordpress.org/plugins/all-in-one-seo-pack/
Author: https://aioseo.com/

The Vulnerabilities

Authenticated Privilege Escalation

Affected versions: Every version between 4.0.0 and 4.1.5.2 inclusively.
CVE-ID: CVE-2021-25036
CVSSv3.1: 9.9
CWSS: 92.1

	/**
	 * Validates access from the routes array.
	 *
	 * @since 4.0.0
	 *
	 * @param  \WP_REST_Request $request The REST Request.
	 * @return bool                      True if validated, false if not.
	 */
	public function validateAccess( $request ) {
		$route     = str_replace( '/' . $this->namespace . '/', '', $request->get_route() );
		$routeData = isset( $this->getRoutes()[ $request->get_method() ][ $route ] ) ? $this->getRoutes()[ $request->get_method() ][ $route ] : [];

		// No direct route name, let's try the regexes.
		if ( empty( $routeData ) ) {
			foreach ( $this->getRoutes()[ $request->get_method() ] as $routeRegex => $routeInfo ) {
				$routeRegex = str_replace( '@', '\@', $routeRegex );
				if ( preg_match( "@{$routeRegex}@", $route ) ) {
					$routeData = $routeInfo;
					break;
				}
			}
		}

		if ( empty( $routeData['access'] ) ) {
			return true;
		}

		// We validate with any of the access options.
		if ( ! is_array( $routeData['access'] ) ) {
			$routeData['access'] = [ $routeData['access'] ];
		}
		foreach ( $routeData['access'] as $access ) {
			if ( current_user_can( $access ) ) {
				return true;
			}
		}

		if ( current_user_can( apply_filters( 'aioseo_manage_seo', 'aioseo_manage_seo' ) ) ) {
			return true;
		}

		return false;
	}

The privilege checks applied by All In One SEO to secure REST API endpoints contained a very subtle bug that could’ve granted users with low-privileged accounts (like subscribers) access to every single endpoint the plugin registers. 

The Api::validateAccess() method relies on the REST API route being requested to know which privilege checks to enforce on a given request. Since it didn’t account for the fact that WordPress treats REST API routes as case-insensitive strings, changing a single character to uppercase would completely bypass the privilege checks routine.

This is particularly worrying because some of the plugin’s endpoints are pretty sensitive. For example, the aioseo/v1/htaccess endpoint can rewrite a site’s .htaccess with arbitrary content. An attacker could abuse this feature to hide .htaccess backdoors and execute malicious code on the server.

Authenticated SQL Injection

Affected versions: Every version between 4.1.3.1 and 4.1.5.2 inclusively.
CVE-ID: CVE-2021-25037
CVSSv3.1: 7.7
CWSS: 80.4

/**
 * Searches for posts or terms by ID/name.
 *
 * @since 4.0.0
 *
 * @param  \WP_REST_Request  $request The REST Request
 * @return \WP_REST_Response          The response.
 */
public static function searchForObjects( $request ) {
    $body = $request->get_json_params();
 
    if ( empty( $body['query'] ) ) {
        return new \WP_REST_Response( [
            'success' => false,
            'message' => 'No search term was provided.'
        ], 400 );
    }
    if ( empty( $body['type'] ) ) {
        return new \WP_REST_Response( [
            'success' => false,
            'message' => 'No type was provided.'
        ], 400 );
    }
 
    $searchQuery = aioseo()->db->db->esc_like( $body['query'] );
 
    $objects        = [];
    $dynamicOptions = aioseo()->dynamicOptions->noConflict();
    if ( 'posts' === $body['type'] ) {
 
        $postTypes = aioseo()->helpers->getPublicPostTypes( true );
        foreach ( $postTypes as $postType ) {
            // Check if post type isn't noindexed.
            if ( $dynamicOptions->searchAppearance->postTypes->has( $postType ) && ! $dynamicOptions->searchAppearance->postTypes->$postType->show ) {
                $postTypes = aioseo()->helpers->unsetValue( $postTypes, $postType );
            }
        }
 
        $objects = aioseo()->db
            ->start( 'posts' )
            ->select( 'ID, post_type, post_title, post_name' )
            ->whereRaw( "( post_title LIKE '%{$searchQuery}%' OR post_name LIKE '%{$searchQuery}%' OR ID = '{$searchQuery}' )" )
            ->whereIn( 'post_type', $postTypes )
            ->whereIn( 'post_status', [ 'publish', 'draft', 'future', 'pending' ] )
            ->orderBy( 'post_title' )
            ->limit( 10 )
            ->run()
            ->result();

The PostsTerms::searchForObjects() method, which is accessible via the /wp-json/aioseo/v1/objects REST API route only escaped user input using wpdb::esc_like() before appending said input to an SQL query. Since this method isn’t designed to escape quotes, an attacker could still inject them and force the query to leak sensitive information from the database, like user credentials.

While this endpoint wasn’t meant to be accessible to users with low-privileged accounts, the aforementioned privilege escalation attack vector made it possible for them to abuse this vulnerability.

Timeline

2021-12-01 – Initial contact with All In One SEO
2021-12-02 – We send them details about these vulnerabilities
2021-12-08 – All In One SEO 4.1.5.3 is released

Conclusion

We recommend that you check which version of the All In One SEO plugin your site is using, and if it is within the affected range, update it as soon as possible! 

At Jetpack, we work hard to make sure your websites are protected from these types of vulnerabilities. We recommend that you have a security plan for your site that includes malicious file scanning and backups. Jetpack Security is one great WordPress security option to ensure your site and visitors are safe.

Credits

Original researcher: Marc Montpas

Thanks to the rest of the Jetpack Scan team for feedback, help, and corrections.

There are many things that can go wrong with your website, from a hack to unplanned downtime. If an incident occurs, it’s vital to have a backup of your site’s files so you can restore to an earlier version. However, it’s important to choose the right kind of backup.

The good news is that, once you understand each of the options, narrowing down your decision becomes significantly easier. Familiarizing yourself with the pros and cons of the available solutions will better position you to choose the right one for your specific needs. 

The three main types of backups

You have a variety of backup types to choose from, and there’s no one-size-fits-all solution. What works for some businesses and website owners may not be the best option for you.

There are three main types of website backups you can choose from:

• Complete
• Incremental
• Differential 

In the following sections, we’ll explore each one and discuss its pros and cons, in order to help you better understand and compare them. 

What is a complete backup?

A complete or ‘full’ backup consists of backing up all of the files and data that make up your WordPress installation and then storing them all together. This includes pages and posts, theme and plugin files, your WordPress database, WooCommerce products, and so on. As you might imagine, this is the most comprehensive type of backup you can have. 

Pros and cons of a complete backup

On the plus side, complete backups provide you with a full copy of your website so you can migrate or restore it at will. Recovery can also be a relatively simple process, as all of the necessary data is stored together. 

On the other hand, they can take up a large amount of storage space. Due to their size, the backup and restoration processes can also take a while to complete.

Therefore, many businesses only run complete backups periodically, perhaps weekly, bi-weekly, or monthly. However, it also makes sense to perform this type of backup before and after a major update to your site.

What are incremental backups?

Another popular option is incremental backups. With this method, only the files and/or database tables that have been changed since the last backup are saved.

For example, perhaps you conducted a complete backup of your site on Friday. On the following Tuesday, you could run an incremental backup that would only involve the files on your site that were modified since last Friday (such as recent reviews or comments).

Pros and cons of incremental backups

The main advantage of incremental backups is that they take up less space and less time than complete backups do. This can be particularly beneficial when you have a large or complex website that you update often.

It’s also the fastest type of backup you can make and it requires less bandwidth. Ultimately, this means minimal burden on your server. It also translates to greater control over how frequently your backups are conducted.

What’s more, the chance of something going wrong is lower with this type of backup. The files produced tend to be relatively small, leaving less room for errors.

There aren’t many disadvantages to incremental backups. However, it’s worth noting that in order to run one, you’ll first need a complete backup. Of course, by nature, they also don’t save everything on your site.

Another potential downside is that, while incremental backups are quick, the restoration process can be on the slower side. The new version of your site has to be reconstructed from a combination of previous complete and incremental backups.

What are differential backups?

Last but not least, we have differential backups, which fall somewhere in between incremental and complete backups. Differential backups save the data that was introduced or changed since the last complete backup. This is different from incremental backups, which only look for changes in your site since the last backup of any type.

Pros and cons of differential backups

There are a few benefits to using differential backups. For example, they tend to be faster to back up and restore than complete backups.

However, when compared to incremental backups, differential backups take up more storage space. A lot of this can be unnecessary, as differential backups may store duplicate files. Also, the backup won’t be able to complete if either the last differential backup or full backup failed.

Tips for choosing between the different types of backups

When choosing a backup solution for your website, it’s important to remember that there is no one-size-fits-all approach. It’s usually best to use a combination of backup types.

Things to consider when choosing a type of backup:

1. Your server resources. If you’re on a shared hosting plan, running frequent, complete backups could cause the process to time out. This could temporarily slow down your site or even cause the backup to fail.
2. The backup restoration process. If something happens to your site, you’ll want to ensure that you can quickly and easily recover your data and files in as little time as possible. 
3. How much data you’ll be backing up. If you run a complex website and make frequent changes, you’ll likely want to combine a complete backup with an incremental backup strategy. 
4. Available file storage space. If you store backups with a paid, third-party tool, or if your backup plugin limits the amount of storage space you have, you may want to choose incremental or differential backups. These take up a lot less storage space and enable you to save multiple restore points.
5. Your tolerance for time between backups. If you rarely make changes to your site, you can likely afford to take a full backup just once per day, or even less. But if you have a lot of important activities, such as online sales, you’ll want to constantly save everything that happens on your site. In this case, a full backup is impractical. An incremental backup might be the best choice because it can quickly save any new data.

A few secondary backup types

So far, we’ve discussed the three main kinds of backups that you can use for your entire website. However, in some cases, you may only want to save certain aspects. 

That’s where secondary backups come in handy. In the next sections, we’ll take a look at four secondary backup types you might consider using: 

• Database
• Plugins
• Themes
• Media

Database-only backups

Your WordPress database consists of your site’s posts, pages, and comments. However, it does not include your other files and folders, such as those for installed plugins and themes.

The database stores much of your site’s content, so it’s important to make sure you’re backing it up at regular intervals. This is especially crucial if you consistently add new content to your site.

As with most types of backups, you can create database-only backups manually or by using a plugin. Typically, you’ll back up your database via phpMyAdmin. With this method, you can export your database tables as a zipped file, and exclude any that you don’t want.

Plugin-only backups

Another secondary option is a plugins-only backup. This approach enables you to save all of the plugins on your site, both active and inactive. 

For this, you can also use a plugin or conduct the backup process manually. To handle it yourself, you can access your site via File Manager or a File Transfer Protocol (FTP) client, and then navigate to the plugin folder in your site’s root directory (typically located in the wp_content folder).

This type of backup is smart to perform when you’re about to install a new plugin on your site, or when you plan to update an existing one. Sometimes conflicts and compatibility issues can cause errors on your site. If this happens, you’ll want to have an updated, secure version of your plugin files to roll back.

Theme-only backups

True to its name, a theme-only backup involves backing up your site’s themes, both active and inactive. It makes sense to conduct this type of backup any time you plan to install a new theme on your website, or when you want to update an existing theme to a more recent version.

Again, you can do this via a plugin or manually. To do the latter, you would need to download the zipped theme folder located in the root directory of your website using an FTP client. 

Media-only backups

If you’re only interested in saving the media files on your website, you can run a media-only backup. This consists of all the files on your site that you’ve added or uploaded to the Media Library. More specifically, it includes your images, videos, audio files, and so on.

As with every other type of backup, you can conduct this task either manually or using a plugin. To do the former, you can download your uploads folder from the root directory of your website:

This requires connecting to your website via an FTP client. As with plugin and theme backups, you can locate the correct files in the wp_content folder.

The best backup solution

At this point, you’re probably ready to pick a solution to help you implement your backups. There are a wide variety of options to choose from, and narrowing them down can seem a bit overwhelming.

We recommend going for a well-rounded, robust tool such as Jetpack Backup, which offers complete, incremental, and differential backups all in one!

This premium solution will create backups of your WordPress site in real time. It also offers one-click restores to make rolling back to an earlier version as quick and easy as possible.

You can restore your site from anywhere via the Jetpack mobile app, even when your site is down. Also, because the plugin is built on WordPress’ infrastructure, you can rest assured that it is incredibly reliable and kept up to date.

Perhaps most importantly, Jetpack lets you back up every aspect of your website and stores redundant copies in multiple locations.

For these reasons, we believe it’s truly the best WordPress backup plugin. 

With Jetpack, you can access full, incremental, and differential backups, all in real time. It also stores the files offsite, meaning you don’t have to worry about placing an unnecessary burden on your server.

If you’re still not sure whether the investment is worth it, you may also want to consider the other features Jetpack offers. While you can get Jetpack Backup as a standalone plugin, the full WordPress security suite provides all-around protection for WordPress sites. It offers malware and security scans, an activity log, anti-spam functionality, downtime monitoring, and more. This makes it an excellent all-in-one solution for keeping your WordPress site safe.

Find your perfect backup solution

While there are steps you can take to safeguard your website, there’s always a risk that it will fall victim to a data breach or hack. With so much at stake, it’s imperative to implement a solid website backup strategy.

Remember, there are three main options you can choose from: complete, incremental, and differential backups. For best results, you’ll likely want to use a combination of these at different intervals. To implement a strong backup strategy and put it on auto-pilot, use a reputable real-time backup plugin like Jetpack Backup.

Jetpack is one of the easiest ways to share your site content directly to social media. This month, we’re adding some handy functionality to make it easier to re-share posts to Facebook, Twitter, Tumblr, and LinkedIn.

That’s not all. We’re adding captions and subtitles for VideoPress, and we’re making it easier to purchase and activate Jetpack even if you don’t have a website. Let’s dive in.

Bring the message back

After you’ve published a post, you’ll see the option to re-share the post in the Jetpack sidebar if you have a Jetpack Security or Complete plan, or a legacy Premium or Professional plan. This allows you to easily share your post again to all of your linked social networks, allowing you to reinforce your message.

Maximize Video Engagement

In this release, we added captions and subtitles for VideoPress. This is essential for accessibility and enables you to keep your audience’s attention in environments where they can’t turn on sound. Try our HD, ad-free video solution for free, and add subtitles while you’re at it.

Purchase Jetpack anytime

We created Jetpack licenses, giving you the freedom to purchase a license and use it on any site you want. If you manage multiple sites, you’ll have a much easier time activating and making changes to your subscriptions.

Come join us!

Jetpack is more than the sum of its code — it is the collective work of an amazing group of designers, product experts, Happiness Engineers, and code wranglers at Automattic.

Work for us, from anywhere: https://automattic.com/work-with-us/

To use the latest version of Jetpack on your site, update your existing installation or install Jetpack. Check the changelog for more details and the complete list of updates in this release.

A big thank you to everyone who contributed to this release:

Adrian Moldovan, Allison Levine, Bogdan Ungureanu, Brad Jorsch, Brandon Kraft, Brooke, Bryan Elliott, Caleb Bauermeister, Camilla Krag Jensen, Damián Suárez, Dan Roundhill, Daniel Post, David Lonjon, Dean Sas, Derek Smart, Dusty Reagan, Eric, Eru Penkman, Filipe Varela, Foteini Giannaropoulou, Ian Ramos, Ivan Ottinger, Jacopo Tomasone, Jason Moon, Jasper Kang, Jeremy Herve, John Caruso, Karthik Bhat, Kev, Kim Brown, Konstantin Obenland, Matt Gawarecki, Matt Wiebe, Matthew Denton, Matthew Reishus, Michal Zuber, Miguel Torres, Mustaque Ahmed, Omar Alshaker, Paul Bunkham, Pierre, Renzo Canepa, Rich Collier, Richard Ortiz, Sergey Mitroshin, Sérgio Gomes, Steve D, William Viana, Yaroslav Kukharuk, jboland8, arthur791004, leogermani, nunyvega, thingalon

Whether you have an eCommerce store, write about your favorite topics online, or promote services on your site, backups are absolutely critical. They provide incredible peace of mind — if your WordPress site is ever hacked or if it goes down for any reason, you can quickly and easily restore it in full.

Until now, Jetpack has offered daily backups as an option for site owners. And while this is a great step to protect your site, Jetpack’s real-time backups are the best way to get complete peace of mind. They save a copy of your site each and every time a change is made — a page is updated, a post is added, a setting is tweaked, or a product is purchased — all behind the scenes without requiring you to lift a finger. That way, you know that you’ll never lose a second of your hard work or a single customer order.

And we believe so strongly that every WordPress site should have real-time backups that we’re making them even more affordable and accessible.

That’s why we’re now including real-time backups in each of our Backup and Security plans.

Why are real-time backups important?

The work you put into your site design and content is valuable to you, your clients, your customers, or your readers. And losing that hard work? It’s unthinkable.

While daily backups are an excellent first step to protect your site, real-time backups take things one step further by saving absolutely every change that you make as it happens.

This is extra important for websites that are updated multiple times a day: eCommerce stores, news sites, blogs, and forums, for example. If your site goes down or is hacked, you still need every single customer order, blog post, and comment.

But real-time backups are also important for WordPress sites that are updated just daily, weekly, or monthly. Why? Because things tend to go wrong at the worst possible time. A plugin conflict, malware injection, or faulty line of code may happen right after you published that new landing page or made all those design changes. If your most recent backup is from yesterday or last week, you could risk losing all of that. But with real-time backups, everything’s saved.

As always, multiple copies of your backups are stored on our super-secure servers — the same ones we use for our sites. And since they’re incremental, always saving just the newest updates to your site, you won’t have to worry about timeout errors or weight on your server. It’s a win-win!

How are things changing?

We’re phasing out daily backups and will be solely offering real-time backups, but at a more affordable price point. So all Jetpack Backup and Jetpack Security plans will offer real-time backups by default.

The best part? Now, everyone can take advantage of real-time backups at a lower cost. Instead of a flat rate per month or per year, pricing will be based on the amount of storage space you need.

Backups start at $5 per month for the first year including 10 GB of storage, which is enough for most sites. We’re working on adding additional storage solutions for larger sites.

If you’re a current Jetpack Backup customer with daily backups and want to move to real-time, just let us know and we’ll migrate your account.

Superior backups, simplified

Now, comprehensive, real-time backups are available to all Jetpack Backup users. Don’t pay for storage space you don’t need — instead, pay based on the size of your site. 

You can enable backups as part of our comprehensive WordPress security suite, or add them to your site with our standalone backup plugin.

It’s time to rest easy. Know that your site is protected every single second with Jetpack Backup.

At some point, you’ll need to restore a backup of your site. Maybe your WordPress website got hacked, or something went wrong during an update. Whatever the case might be, backing up your website regularly is the best way to ensure that you never lose any important data. 

Fortunately, there’s more than one way to back up and restore a WordPress website. Knowing how each method works will enable you to decide what option to use.

In this article, we’ll take a closer look at the reasons why you need to back up your WordPress site. Then we’ll talk about the different types of backups and help you decide which method works best for you. Let’s get to work!

Why you might need to restore your website

Every website can benefit from having multiple recent backups that you’d be able to restore from. Those saved files are your safety net in case something goes wrong, which if you run a website, you know will happen sooner or later.

Here are some scenarios where you might need a backup:

• Your website gets hacked. Instead of struggling to regain control of the WordPress admin, you can simply restore a backup.
• A plugin/theme conflict crashes your site. You can spend hours troubleshooting plugin and theme conflicts or you can simply restore your website’s most recent backup.
• Adding code to a WordPress file causes an error. In many cases, adding custom code to WordPress files can result in errors if the code itself is faulty. When that happens, restoring a recent backup is a guaranteed fix.
• You’re not happy with a site update. Instead of trying to revert your website to its previous state by hand, you can restore the backup that you made before making those changes.

One common thread with backups is that they work best if they’re recent. If you only back up your site once a month, that copy might be useless if you’ve made a lot of changes since then.

Ideally, you should back up your website every time a change is made. That might seem like overkill, but it’s the best way to ensure you don’t lose anything on your site. If you’re concerned about storage, make sure you choose a backup tool that includes a lot of storage space (preferably at no extra cost!) or that can integrate with off-site storage solutions like Google Drive or Dropbox.

Overall, there are no downsides to backing up your WordPress website as often as possible. Before you get to work, though, it’s important to understand that there are multiple types of website backups. Let’s take a look at them. 

Different types of website backups and restore options

Traditionally, a website backup is an entire copy of all of its contents. When you back up a WordPress website in full, you’re creating copies of the entire site and its files, as well as its database.

We say “in full” because that’s not the only type of backup that you can create. Modern tools provide you with a lot of control over what files you can copy and restore. 

The three most common types of website backups are:

1. Full website backup. This type of backup creates a full copy of your site, including its database.
2. Partial site backup. A partial backup creates a copy of specific sections within your website. With WordPress, you might back up your database but not the site files, or simply create copies of your existing plugins and themes, among other options.
3. Incremental site backups. Some WordPress backup tools can detect changes to your site between one restore point and the previous one. That way, they can see what files and content are new or updated and simply back up those changes. 

Generally speaking, full website backups are always better than partial copies. They’re also the better option if your website breaks down or gets hacked. In those cases, restoring a full site backup means that you’re rolling back the clock to an earlier version of your website, including both its files and database. 

The downside of full site backups is that they take up more storage space. Moreover, it can take a while to create them if you’re running a site with a lot of content and files.

Partial backups are a great way to troubleshoot problems with plugins and themes. If you’re planning on switching themes or trying out new tools, you can back up your existing configuration and roll back if you run into any errors.

Finally, you have incremental, or real-time, backups. Although they’re not available with all hosts or plugins, they give you the best of both worlds. They can be much faster and reduce the potential for timeouts due to server bloat.

Five ways to create and restore WordPress backups

1. Restore a cPanel host backup

cPanel is the most popular hosting control panel among shared plans. The panel includes dozens of options and tools that enable you to do everything from installing WordPress to accessing a file manager and creating/restoring backups. 

If your web host offers you a cPanel account, go ahead and log in. You should see a broad collection of tools divided into categories. Look around for a section that says Files, which should include a Backup Manager option:

Once you open the Backup Manager, you’ll get access to one or more backup tools, depending on what cPanel setup you’re using. In most cases, there should be backup creation and restoring options, as well as a wizard if you need a bit of extra help:

If you click on the cPanel Backups tool, you’ll see the option to download a full site backup. cPanel will store those files for a few days, depending on how your web host configured their setup. 

You can use those saved copies to restore backups from this same window, by selecting the file from your computer and uploading it. cPanel also provides you with the option to restore database backup files and email server configurations: 

If any of the above sounds confusing, we recommend using cPanel’s Backup Wizard tool. This will walk you through creating or restoring full or partial backups of your website while explaining every part of the process:

It’s important to note that not every cPanel setup will look the same or contain the same tools. Each web host can configure their cPanel to limit what functionality users have access to. 

In some cases, your web host might choose to disable the option to create manual backups due to limited server resources (this is more common with shared plans). If that’s the case, you might need to opt for a manual website restoration approach instead.

2. Create a manual backup using cPanel

As we mentioned before, cPanel gives you access to a file manager tool. This enables you to access your server’s file directory and most importantly, your WordPress root folder. The root folder contains all of your site’s files, including media documents, plugins, themes, and configurations.

To access the file manager, log into your cPanel account and go to Files → File Manager. Once you select that option, you’ll see an overview of your server’s directories. Look for the folder called public_html, www, or your site’s name:

That is your WordPress website’s root folder. Feel free to open it and browse its contents, but don’t edit or delete any files unless you’re sure what they do. To back up that folder, select it and click on the Download option on the file manager’s top menu:

The root folder will download as a zipped file, which you can store anywhere you want until you’re ready to restore it. If you need to do so, return to the file manager and open the same directory where the root folder is located (the one you see above).

Before we go through with the backup, it’s worth noting you can also download individual folders instead of the entire root directory. In some cases, you might only want to back up plugins, themes, and/or media files. You can find all of those components within the public_html/wp-content directory:

Theme, plugins, and uploaded files each have their own directory, which you can see in the screenshot above. To back up any of those components individually (or together) simply download those folders and store them as you would with a regular backup.

To restore the backup you created, delete the root folder on your server and select the Upload option on the top menu of the screen. Unzip and upload the directory you saved to your computer and wait for the process to finish. Since you’re uploading hundreds of files, it may take a while.

Alternatively, if you only backed up one or more folders, you can simply replace those within the WordPress root directory. Doing so won’t affect the rest of your site’s configuration or content — it will simply return plugins, themes, and/or media files to a previous state.

Keep in mind that downloading the WordPress root folder is only half of the process. You’ll also need to download a copy of your database for a full backup. To do so, return to the main cPanel screen and go to Databases → phpMyAdmin:

phpMyAdmin is a database management tool that you can use to access and edit tables. Once you open it, you’ll see a menu including one or more databases, depending on how many sites you have.

Access the database that you want to back up using the menu to the left, by selecting the option with your database name. You’ll see an overview of the database’s tables, as well as a menu at the top of the screen that includes an option that reads Export:

Click on Export and select the Quick option on the next screen. Set the Format: to SQL and click on Go:

This will download a copy of the database to your computer in .sql format. If you need to restore that copy of the database, you can do so through phpMyAdmin as well. Simply go to the Import tab, select the database file to upload, and click on Go:

If you restore only the database or your root folder manually, your website won’t return to its previous state. For a successful backup restore, you need both components. That makes this manual approach very time-intensive. Moreover, it requires you to store all the backup files in a safe location and organize them so that you don’t mix them up.

3. Use FTP to download a manual backup

This method works similarly to the last one in that you download your site’s files manually. The main difference is that instead of doing it through your cPanel, you’ll be using a File Transfer Protocol (FTP) client. 

The advantage of using FTP is that it’s optimized to help you download large numbers of files. Moreover, it’s less prone to errors than using the cPanel file manager.

To get started, you’ll need an FTP client and the credentials to connect to your WordPress website. Note that these FTP account credentials aren’t the same ones that you use to log into WordPress or to your hosting control panel. 

In most cases, your web host will set up a unique set of FTP credentials for you when you sign up. If you don’t know what they are, you can look them up on your hosting control panel:

Once you have your FTP credentials, you can use them to log into your server through a client like FileZilla. When you connect to the server, you’ll see all the directories that you have access to. The WordPress root folder should be among them:

Right-click on the root directory and select the Download option. That will download the entire folder and its contents to your computer, where you can store it anywhere you want until you need it.

To restore that backup, you’ll need to access your server via FTP, locate the root folder, and delete it. Then, re-upload the version you downloaded previously and you’re good to go. Keep in mind that both uploading and downloading the entire root directory will take a while as we’re talking about hundreds of files. But this could be a great option to restore and replace individual files (like a plugin or theme) without having to delete the entire root folder.

Just like with the last method, you’ll need to export your WordPress database separately. You can read about how to do that using phpMyAdmin in the previous section, where we also covered how to restore the database file.

4. Use a WordPress staging environment

Some web hosts offer a feature called “staging”. This means that they enable you to make a copy of your website that’s not available to the public. You can use staging sites for development purposes, like testing new features, before pushing those changes to “production” or a live environment.

Staging websites can double as backups of sorts. You can use them to make any changes that you would have made on the live site and if they don’t work out, you can delete the staging site without any issues whatsoever.

Whether or not you have access to staging functionality depends on what web hosting service you use. Generally speaking, most shared hosting plans don’t offer staging features, but if you use managed WordPress hosting, chances are you have access to staging functionality:

As a rule of thumb, we recommend using staging tools to test any significant changes to your website. This can help you ensure that your site never breaks due to unforeseen circumstances while updating it. Any web developer worth their salt will tell you the same thing — you should be using a staging website.

5. Use a plugin like Jetpack Backup

There is a massive range of WordPress backup plugins that you can use. These tools help you create safe copies of your website, including all of its files and the database.

However, Jetpack Backup is the best WordPress backup plugin. It offers real-time backups, so you know that every single sale, blog post, comment, and change is completely saved. Plus, they’re incremental, so you don’t have to worry about storage space. The best part? You can easily back up and restore your site in just a few clicks, even if your WordPress dashboard is completely inaccessible — no code or server management required!

After installing and activating Jetpack Backup, you’ll need to connect it to a WordPress.com account to access its features:

Once you connect your website with Jetpack, you’ll see an overview of the backups you’ve created so far, as well as the options to download or restore any of them:

You’ll also have access to the activity log, which keeps track of all changes you make on your site. So if you want to roll back to before something went wrong — like a hack or plugin update — you can simply select a backup from before that event. Super simple!

How to restore a WordPress site without a backup

There’s literally no reason not to back up your website often. However, if you end up in a situation where you haven’t set up a backup solution and you need to restore part of your website, there are some ways to recover lost content, all thanks to the magic of the internet.

You may have noticed that when you Google a website, sometimes you’ll see the option to access a cached version of that page. To access that cached copy, click on the three dots next to any entry in Google search results and a window with information about the website will pop up. If you look at the bottom of that window, you’ll see a button that says Cached:

Clicking on that button will open a cached version of the website in question. At the top of the screen you’ll see information about when that copy was made:

Keep in mind that you won’t be able to navigate the entirety of the cached copy as you would a regular website. If you want to find a specific page that you want to restore, you’ll need to Google it and cross your fingers that the search engine stored a recent copy of it.

To help find a cached version, you can type “cache:” before the page’s URL on Google searches (“cache:https://jetpack.com”). You can also search for specific pages of your site by looking up the URL directly by adding “site:” before the search (example “site:https://jetpack.com/upgrade/backup/”).

If you find a cached copy of the page that you need, you can try to recreate it using the WordPress editor. That means copying all of the text and downloading and re-uploading images to make sure the new copy is as faithful to the original as possible.

It’s important to note that Google might not have a copy of the page(s) that you’re trying to restore. In that case, your next best bet is to use the Internet Archive’s Wayback Machine. This is a website dedicated to storing copies of other sites, so it might just have one of yours:

To use the Wayback Machine, enter your site’s URL and it’ll return a timeline that includes any copies of your site on its servers. You can select which copy to access using the calendar below the timeline:

Select a date and you’ll access that copy of your site. Unlike Google, the Wayback Machine will enable you to navigate throughout the entire copy of your site as usual. That way, you’ll be able to restore as many pages as you need.

Keep in mind that the Wayback Machine might not have copies of your site depending on its popularity. If it doesn’t, then the best thing that you can do is to set up a WordPress backup solution right away so you’ll never lose content again in the future.

What to do after you restore a WordPress backup

If you ever need to restore a WordPress backup, the work isn’t done after your website is returned to normal. Depending on the reason why you restored that backup, you might also need to further secure your WordPress website.

After a hack, it can be hard to pinpoint how attackers managed to get in. However, in most cases, the cause boils down to one of the following reasons:

1. Easy-to-crack administrative credentials. If your admin account is called admin, then you need to change that right away. On that same note, you need to use secure and unique passwords for your account, and they need to change periodically.
2. Poor database security. By default, a lot of WordPress web hosts use the same prefix for your website’s database. That means attackers might be able to identify and attack it using SQL injections. You can prevent this by changing the database prefix and name.
3. An outdated version of WordPress. If you’re using an outdated version of WordPress, go ahead and update it after you restore the backup. Ideally, do so using a staging environment to make sure the update doesn’t break your site.
4. Outdated plugins and/or themes. Using outdated plugins and themes is one of the main ways that WordPress websites get hacked. The older the code is, the more likely that attackers will find security flaws.

Your main priority after restoring a backup is to ensure that you patch any security holes that enabled attackers to gain access to your site. If they did it once, chances are they might be able to do so again unless you’re more proactive when it comes to WordPress security.

Additionally, you’ll want to check that no new content is missing from your website and that all its core functionality remains intact. If you create regular backups, you shouldn’t be missing any content. If you are, you might need to recreate that content from scratch or use the Google Cache method we discussed earlier.

How to avoid needing a WordPress backup

We’d never tell you not to back up your website often, but the best type of backup is the one that you never need to use. That is to say, if you can avoid running into errors while updating your site and improve its security, you might never need to restore a WordPress backup. 

With that in mind, let’s talk about several best practices that you can follow to keep your website in top shape.

1. Update WordPress regularly

WordPress websites sometimes “break” because of outdated versions of the Content Management System (CMS), plugins, or themes. The older the software is, the more likely you are to run into errors. That applies universally, not just with WordPress. 

Ideally, you should check the WordPress dashboard often to see if there are any updates available for your website. Simply navigate to the Dashboard → Updates tab and take a quick look:

If you want to play it extra-safe, we recommend running updates using a staging version of your website. That way, you can check if anything breaks after updating, which can sometimes happen with major WordPress releases or if you’re updating a lot of plugins at once.

Some tools, like Jetpack, also enable you to turn on automatic updates for plugins and themes. Therefore, you won’t have to check manually for new updates. This can ensure that you’re always using the latest versions of the tools that your site relies on

2. Increase your website’s security

One of the primary reasons why backups are so useful is that they help you regain control of your site in the event that it gets hacked. If someone manages to take over your account, they can lock you out of the WordPress admin and you’ll be left with little recourse except to contact your hosting provider.

If you have recent backups, you can simply restore your website to a point before the attack. Since you’re also restoring the database, your account will revert to its previous credentials, which you can then update later.

If you’re using Jetpack, you can restore backups even if you lose access to your website. The plugin even enables you to restore backups from your mobile device. You can also use Jetpack to enable Two-Factor Authentication (2FA) and brute force attack prevention.

3. Use a staging site to make major changes to WordPress

Using a staging website will drastically reduce the chances of needing a WordPress backup. 

Ideally, you should use a staging website whenever you have to:

• Update WordPress versions. Major WordPress updates may not play nicely with your plugins and themes, so it’s a good idea to take them for a spin on a staging site.
• Update multiple plugins and themes. If you’re updating several tools at once, it’s in your best interest to do so on a staging site to mitigate risk.
• Make major changes to your site’s style or configuration. If you’re planning any significant content or style changes to your site, use a staging environment. That way, if you’re not happy with the results, you won’t have to revert the changes manually.

If your web host doesn’t offer staging functionality, you may want to consider switching to a different provider. 

How to set up WordPress backups

In most cases, we recommend using a WordPress plugin that gives you full control over how to back up your website. Jetpack Backup does precisely that. Depending on which plan you sign up for, the plugin can offer real-time and automated backups.

With Jetpack, your site backups are stored on WordPress.com servers, which is one of the safest places they can be. You can also restore backups directly from the WordPress.com mobile app, which is ideal if you get locked out of your site. 

We believe that Jetpack Backup is the best WordPress backup solution because it protects each and every change you make, secures backup files off-site, and makes it easy to restore, even if your site is completely down. 

Protect your site with Jetpack Backup. 

The success of your WooCommerce store is directly impacted by your site’s performance. With a fast and user-friendly site, you’ll enjoy better search rankings, happier customers, and — most importantly — increased sales.

Over 70% of consumers admit that page speed directly impacts their willingness to purchase from a retailer. Multiple studies show that many eCommerce sites are missing out on sales due to slow site speeds. We’re sure you don’t want to be one of them. 

While there are many techniques that can be used to improve site speed and performance, it can be challenging to quickly get to the root of the problem. If you’re at a loss for where to begin, a plugin like Jetpack Boost can identify areas of improvement and automatically resolve many of the major issues affecting your site’s performance. 

In this article, you’ll learn about how site performance affects your sales, what you can do to improve it, and how a tool like Jetpack Boost can help.

How slow site performance affects your business 

Long load times mean fewer sales 

Slow site speed spells disaster for any eCommerce website. Studies show that 57% of your customers will leave if they need to wait more than three seconds for the page to load. Of that number, 80% won’t be back for a second look. 

The appeal of shopping online for most people is that it’s quick and painless. If you make that process slow and painful, you can bet your entire inventory that they’ll take their hard-earned money to another online store with faster load times. 

A recent study showed that an improvement of 0.1s in load time increased the number of page views, conversion rates, and average order value. In fact, this slight change in site speed moved customers to spend nearly 10% more. While changes in your site speed don’t need to be drastic, even subtle improvements can increase revenue for your WooCommerce store. 

Slow sites lead to unhappy customers

Waiting for what seems like ages for a website to load provides users with a poor experience. The statistics we’ve mentioned back this up, but we know you’ve felt it in your own online shopping experiences. Take a second and think about all the times you’ve clicked away from a website prematurely because it took too long to load. You’ve likely done it so many times that to count them all would be impossible. 

Not only were you dissatisfied with the brand, but you likely never went back to see if their website sped up. As a result, no matter how great their products were, your experience probably led you to lose trust in that brand. 

If you’re a loyal customer of a particular site, you may have a bit more patience, but a slow site can turn away even the most faithful of repeat shoppers. If you’re browsing a large number of products, imagine the frustration of having to wait even five seconds for each additional webpage to load. 

Our friends over at Ericsson Mobility revealed that the stress users feel when waiting for a webpage to load is comparable to watching a horror movie alone or their anxiety when taking a math test.

If that’s not motivation to speed up site performance, we don’t know what is.  

Sluggish performance results in poor online rankings

There’s no getting around it; slow sites don’t rank as well on search engines. Search engines value user experience because they want to provide the most relevant, user-friendly results. 

One Google study found that bounce rates increase 32% when load times change from one to three seconds. If the load time is five seconds, you’ll see this move up to 90%. With numbers like these, it’s no wonder that better-performing websites with lower bounce rates are rewarded by search engines and receive higher rankings. 

Even if you think that your site is pretty speedy, there’s no such thing as too fast in the world of page speed. With every bit of time you shave off your site speed, you increase the likelihood of your site ranking higher in search results. 

Google Core Web Vitals prioritizes higher performing websites in search results

In 2020, Google announced updates to their ranking system that they’ve continued to roll out throughout 2021. The primary purpose of this rollout is to improve the experience of all online users, but you may be wondering how these changes will affect the standing of your website in search results. 

One of Google’s updates that may affect your search rankings is the Core Web Vitals project. These metrics identify components of a website like loading time, interactivity, and visual stability to measure the user’s experience. 

Google’s Core Web Vitals report uses three elements when evaluating a user’s experience on a webpage: 

• Largest Contentful Paint (LCP): This element is related to the visitor’s perceived load time. It measures the time it takes for a webpage to load its most prominent visible feature. Anywhere between zero seconds to 2.5 seconds is an excellent score, while anything more than four seconds means your website could use some improvement in this area. 
• First Input Delay (FID): The first input delay measures your site’s interactivity and how long it takes to respond to a visitor’s command. It looks at the delay between the visitor’s click on a button or link on your website and how long it takes your website to react. For your website to offer a good user experience, it needs to have an FID score of 100ms or less. If you score above 300ms, your FID rating is less than stellar and you’ll need to make changes. 
• Cumulative Layout Shift (CLS): CLS measures the stability of your webpages as they load. You don’t want elements on your website to shift too much while loading. If your CLS ranking is 0.1 or lower, pat yourself on the back. If it’s higher than 0.25, it’s time to go back to the drawing board. 

Learn more about how core web vitals affect SEO.

As of mid-June 2021, Google announced that it would include the scores of these Core Web Vitals as a metric in its ranking system. In August 2021, they released an additional update (currently only for mobile URLs) called Page Experience.

Websites that offer exceptional user and page experiences, according to Google’s Core Web Vitals and Page Experience reports, will now get preference in online rankings. 

If you’ve already added your site to Google Search Console, you can view your site’s metrics under Core Web Vitals and review areas of your site that need improvement.

If you’re building a new website, aim to create it with these Core Web Vitals at the forefront of your design. Look for a solid hosting plan that offers great website speed and fits your traffic requirements. Ensure it can handle traffic surges like those that happen on Black Friday and Cyber Monday to avoid slow load times. 

Avoid overly complex website themes that can cause your loading to bottleneck or result in compromised site functionality. Focus instead on keeping your theme lightweight, optimizing your images for size, and reducing the number of plugins you’re using to the minimum that your site requires. These efforts will help your Core Web Vitals reports, improve the overall speed of your website, and help you climb higher in Google’s rankings. 

If you’re feeling a bit overwhelmed about how you’re going to improve your FID score or lower your CLS numbers, you don’t need to worry too much. This is where Jetpack Boost comes in to give you improved Core Web Vital scores without needing to know all the technical jargon.  

How Jetpack Boost will improve your site’s performance 

So you’ve determined that your website could use a bit of help with its performance. While other plugins can help you improve your site speed metrics, they often require some technical knowledge to get the most out of them. Use Jetpack Boost to improve your website issues without a costly developer.

Jetpack Boost will:

1. Check your site performance: With minimal effort on your part, Jetpack Boost gives you a helpful report and makes powerful suggestions for your site speed.
2. Improve your SEO: Improvements to your site performance are directly related to your SEO. Watch your website rise in online rankings and get more traffic. 
3. Speed up your site: Faster websites equal more sales and conversions. Use Boost’s simple dashboard and tools to make your website lightning fast.  

Benefits of Jetpack Boost 

Simple interface — no developer needed

One of the most enticing features of Jetpack Boost is that it doesn’t require prior knowledge. You don’t have to be a developer to learn the ropes of the plugin or install it on your site. The interface is straightforward, and you’ll see how much faster your website is through the measurement tool. 

Easy to understand site performance reports 

With these reports, you can quickly find out how your site is performing. Jetpack Boost gives your site performance a score from A to F. You’ll get an initial score when it’s first installed and an updated score after implementing any optimizations. 

Skip the complicated configurations 

Avoid the time-consuming, complicated configurations that come with other speed plugins. These plugins can break your site, be super confusing, or even slow things down if set up incorrectly. You can just turn on Jetpack Boost, and it works without the need for any additional code or technical knowledge.

How to use Jetpack Boost

Jetpack Boost’s interface is simple and easy to use. Let’s look at a couple of sections:

Overall score — performance score

The overall performance score is the average score of your website from both desktop and mobile screens. 

To get a better idea of how the score is averaged, let’s say that your Mobile score is 54, while your Desktop score is 91. 54 + 91 = 145. 145 / 2 = 72.5. So your overall performance score would be a C. While it’s not terrible, your site’s performance on mobile could use some improvements. 

Improvement modules

There are six improvement modules you can toggle on and off:

• Critical CSS: Bundles vital styles that apply to content at the top of the page.
• Compress CSS: Compresses and combines CSS files to reduce the amount of data transferred. 
• Defer Non-Essential Javascript: Helps your site load faster by running non-essential JavaScript after the page has loaded.
• Compress Javascript: Compresses and combines JavaScript files to reduce the amount of data transferred.
• Lazy Image Loading: Loads images as they appear on the screen instead of all at once. 
• Enable Jetpack CDN: Serves images and other static files from Jetpack’s global network of servers.

That’s it! There’s nothing else for you to customize, making this plugin blissfully easy to navigate. 

Jetpack Boost key features

To get the most out of the Jetpack Boost plugin, you’ll need to activate at least three of the improvement modules. Here’s a brief overview of each module and what they accomplish on your site. 

Optimize CSS Structure with Critical CSS

Cascading style sheets, or CSS, are instructions that tell a browser how to style a webpage. CSS controls things like font colors and image sizes.

Since CSS is a render-blocking resource, a webpage can’t be displayed until it’s completely downloaded and available to the browser. 

To combat this, Jetpack Boost utilizes a technique called Critical CSS. This technique works by extracting the CSS required for displaying content to the part of the site that is visible without scrolling. As a result, the page can now load faster without needing to load the entire CSS file.

By eliminating the render-blocking resource, Jetpack Boost helps to improve user experience on your site as well as your Core Web Vitals scores. 

Defer non-essential JavaScript 

This setting in Jetpack Boost defers non-essential JavaScript until after the page loads. Boost prioritizes visual information and loads it first while leaving less critical JavaScript for later. As a visitor moves through the website, other webpage elements will load in the background. This gives visitors the feeling of faster load times, which can help in lowering bounce rates. 

Lazy image loading 

Lazy image loading enables your site’s pages to display without downloading every image on the webpage at once. Only the images visible to the user will load, and as they scroll, additional images will appear. This feature of Boost decreases bandwidth while improving your site speed.

Use a content delivery network

As part of Jetpack Boost, you gain access to Jetpack’s free CDN for WordPress. This utilizes a global network of servers so that, no matter where a visitor is located, images and other heavy pieces of content are loaded from a nearby location. It’s free, doesn’t limit the number of files you can serve, and was made for WordPress and WordPress only. The result? You get an easy-to-use, reliable CDN that speeds up your site without draining your wallet or time. 

It’s one of the most important parts of improving site performance and is included as part of Jetpack Boost.

How to install Jetpack Boost 

Setting up the Jetpack Boost plugin can be done in five easy steps:

1. Navigate to the WordPress plugin directory. 
2. Search for the Jetpack Boost plugin. 
3. Install Jetpack Boost from the plugin directory and activate it.
4. Go to the Jetpack Boost section of your website’s WordPress admin area. 
5. Turn on the features you want to try out on your website and watch your site performance change for the better.  

Performance you can count on 

The world around us moves fast, but your eCommerce site should move faster. Whether you’re looking to run a small store or begin an empire, WooCommerce makes it easy for you to get started with excellent hosting choices and themes that won’t bog down your site speed. 

To run a successful store, you’ll need to keep up with your site’s performance and speed. While there are dozens of techniques you can use to improve your WooCommerce store performance, it can be tricky to identify every issue. 

Jetpack Boost’s simple interface makes improving your Core Web Vitals simple. This easy-to-use plugin helps you improve your SEO and site rankings, speed up your site, and increase conversions.

By taking the technical jargon out of site performance, Jetpack Boost pinpoints site problems and fixes them in the time it takes you to eat lunch (maybe less!). 

Download Jetpack Boost to improve your WooCommerce site’s performance and give your business a leg up over the competition.

It’s every site owner’s worst nightmare — you visit your website and find that it’s completely down. What do you do? Where do you go from here?

There are a variety of reasons your website might be inaccessible — it was hacked, there was a theme or plugin conflict, you accidentally deleted something — but it can be crippling no matter what. If your site is down even briefly, you could lose customers, clients, or followers. If it’s down longer (especially because of a hack) you could lose your cash flow, drop in search engine rankings or suffer permanent damage to your reputation. And, of course, if you have no way to restore it, you might lose your past orders or content, and then need to hire someone to fix it for you.

That’s where backups can save the day! A good backup plugin requires very little setup on your end but saves your site automatically so that, if the unthinkable happens, you can get back up and running again quickly. It’s more than just a handy tool; it’s peace of mind.

But there are a lot of good options out there. How do you know which one to choose?

We’ve examined the best WordPress backup plugins and compared them based on their features, pros and cons, ease of use, and pricing.

The best WordPress backup plugins

Jetpack Backup

Jetpack Backup was built specifically for WordPress and WooCommerce by the team behind both WordPress.com and WooCommerce. They knew exactly what WordPress sites need in a backup plugin and created a comprehensive solution that makes it one of the best WordPress backup plugins. It’s a proven option with 269 million site backups over the last ten years.

All backup plans include real-time backups, which save your site every time you make a change, ensuring that you don’t lose a single update, change, or customer order. And you can rest easy knowing that your files and database are safe — Jetpack stores multiple copies of your backups (for redundancy) on the exact same Automattic servers as all WordPress.com sites. 

Need to restore your site? Navigate to a WordPress activity log that keeps a record of everything that happened on your website. Find the exact moment you want to restore a backup from (say, before you updated that plugin or edited that line of code) and get your site back in a click. And if your website goes down while you’re away from your computer, you can restore from your phone or tablet just as easily, no code required.

What about migrating to a new host? You can use Jetpack Backup to do that as well. The WordPress cloning feature makes things super simple — there’s no need for FTP tools or complicated server connections. 

Jetpack Backup is a streamlined but feature-rich solution supported by WordPress Happiness Engineers. And that’s what makes it the best WordPress backup plugin.

Key features of Jetpack Backup:

• Automated real-time backups
• One-click restores
• Integration with the Jetpack mobile app, so you can restore from anywhere
• Backups of files and database
• Integration with the activity log, so you can restore from a specific save point based on actions taken on your site
• Site migration support 
• On-demand backups
• Incremental backups, which keep things running quickly

Pros of Jetpack Backup:

• The cost of storage is included.
• Jetpack stores multiple backup copies off-site, on WordPress’ own trusted servers. This means that if your site is compromised, your backups won’t be.
• Restore your site even if it’s completely offline through your WordPress.com account.
• Use Jetpack Backup as a standalone plugin or combine it with additional security features in the Jetpack Security package.
• There’s no coding experience needed, even to restore your site.
• Access support directly from WordPress Happiness Engineers.
• There’s no load on your server since backups are stored off-site.
• Jetpack saves all orders and customer information, so valuable eCommerce data is never lost.

Cons of Jetpack Backup:

• Jetpack doesn’t currently support WordPress Multisite.
• Jetpack doesn’t save to third-party tools like Google Drive or Dropbox automatically. However, you can download your backups and upload them yourself.
• It only offers paid plans. There is not currently a free tier. 

Ease of use:

Jetpack Backup was built with the average WordPress user in mind. That means that it’s super easy to install, set up, and restore, even if your site is completely down. There’s absolutely no need for a single line of code or complicated server management — it just works.

Don’t believe us? Give our documentation a look for all the details.

And if you do run into any issues, our support team is available to help with priority support just for you.

Pricing and plans based on storage space needed:

• 10 GB storage space, which is sufficient for most WordPress sites, is just $5 per month for the first year

UpdraftPlus

UpdraftPlus is a popular freemium WordPress backup plugin. It automatically backs up your files and database on nearly any schedule — choose between a variety of frequencies between two hours and every 30 days. Plus, you can send backup files to a number of third parties, like Google Drive and Dropbox, or store them on your server. 

Key features of UpdraftPlus:

• Backup frequency options from monthly to every two hours
• Supports both manual and automatic backups
• Integrates with third-party tools like Google Drive and Dropbox for backup storage
• Prunes the number of old backups to prevent server bloat
• Automatically backs up your site before core, theme, and plugin updates (with the premium plan)

Pros of UpdraftPlus:

• There is a free tier available that includes the majority of UpdraftPlus functionality.
• It’s compatible with WordPress multisite.
• It’s very easy to set up and turn on automatic backups.

Cons of UpdraftPlus:

• You need to pay separately for storage.
• UpdraftPlus automatically defaults to storing backup files on your server, which puts them at risk if your site is hacked.
• There are no real-time backups available.
• There are no additional security features included.
• Restoring a backup can be difficult if your site is completely down.

Ease of use:

UpdraftPlus is relatively easy to set up, but there are a number of settings to configure, like backup frequency and storage location. Restoring from a backup is also pretty straightforward, but only if your site is still functioning. To restore, log into your site, navigate to UpdraftPlus settings, select the files you want to restore, and wait for it to finish.

However, if your site is down, you have one of two options:

1. Delete your current WordPress installation (or duplicate it elsewhere), set up a new site, install UpdraftPlus, and restore using the steps above. 
2. Complete a manual restore, which involves setting up a new WordPress installation, editing core files, uploading backup files to your server via FTP, and importing your database using PHPMyAdmin. 

For beginners, this can get quite complicated.

Pricing:

• The Free plan has no cost. The free version includes automatic backups, one-click restoration if your site is working, and offsite backups to select third-party tools. 
• The Personal plan includes up to two sites and adds on features like incremental backups, migration functionality, database encryption, and additional storage destinations. It’s $70 upfront, then $42 a year. But you’ll need to pay for separate storage.
• The Business plan includes up to ten sites. It’s $95 upfront, then $57 a year.
• The Agency plan includes up to 35 sites. It’s $145 upfront, then $87 a year.
• The Enterprise plan includes unlimited sites. It’s $195 upfront, then $117 a year.

BlogVault

BlogVault is a premium all-in-one WordPress backup plugin with a 100% restore rate. They provide incremental backups on a daily, weekly, monthly, or real-time basis depending on your plan. And, since they’re the sister company of the security plugin MalCare, they can seamlessly provide additional security features as part of their medium-tier plan.

Key features of BlogVault:

• Incremental backups to reduce the load on your server
• Automatic backups that take place on a daily, weekly, or monthly basis
• Uptime monitoring, so you know instantly if your site is down
• Integration with Google Drive and Dropbox for backup storage
• Smart testing tools to preview a backup before you restore
• Real-time backups specifically designed for WooCommerce stores
• Changelogs that help you identify problems on your site

Pros of BlogVault:

• Backups are stored off-site, so they’re protected and always available.
• It supports WordPress Multisite. 
• You can restore your site even if it’s completely down.
• It integrates seamlessly with their sister plugin, Malcare, to provide additional security features.

Cons of BlogVault:

• You need to pay separately for storage.
• There is no free plan available; only paid options.
• BlogVault typically limits site backups to 5GB. If your site is larger than this, they may or may not support what you need.
• While it does integrate with Google Drive and Dropbox, it doesn’t automatically send backups to any third-party tools. You would need to tell it to send your backups there each time you want them saved.

Ease of use:

BlogVault is pretty easy to use no matter your experience level. You can restore a backup in one click and there’s an auto-setup process to make getting started simple.

Pricing:

The following plans and pricing assume that you’re using BlogVault for one site. However, there are also plans that include additional websites.

• The Basic plan includes daily backups and 90 days of storage for $89/year. You’ll also need to pay separately for storage.
• The Plus plan adds additional security features for $149/year.
• The Advanced plan includes real-time backups and 365 days of storage for $249/year.

BackupBuddy

BackupBuddy is a premium WordPress backup solution that offers a variety of automatic backups, including real-time options. You can customize exactly what’s saved each time and even restore individual files. This can be very helpful if you need to restore a specific plugin, theme, or image. However, while it’s easy to use if your site is working, it can be quite complicated if you can’t log into your WordPress dashboard.

Key features of BackupBuddy:

• Scheduled, automatic backups and real-time backups available
• Backup profiles that can be customized to save exactly what you’d like
• Integration with third-party tools like Google Drive and Dropbox
• Individual WordPress file restoration
• Database rollback, which allows you to roll back to a previous version of your database without completing a full restore
• Malware scanning, which adds additional security benefits
• Database scan and repair

Pros of BackupBuddy:

• Backups are stored off-site, so they’re protected in case of a hack.
• You can restore individual files, which is helpful if there’s a plugin conflict or if you accidentally delete an image.

Cons of BackupBuddy:

• You cannot easily restore a backup if your site is down. You must instead access your server and database. This often requires some previous knowledge and experience, or you may risk deleting or messing up your files or database. 
• Unless you purchase the Gold Plan, it only includes 1GB of free storage. More storage is an additional fee. You can, however, store your backups using third-party tools.
• It does not support WordPress multisite. 
• There is not a free plan available.

Ease of use:

If your site is still up and running when you need to restore a WordPress backup, it’s as simple as following a wizard from within the WP dashboard. 

However, if your site is down (which can happen for a huge variety of reasons), BackupBuddy is much more difficult to use for non-developers than many of the other options on this list. To restore your site, you must use your host’s cPanel or remote FTP access to load your server. You’ll also need access to your database through PHPMyAdmin. 

While BackupBuddy does provide detailed documentation on restoring a full site, if you’re not familiar with server management, it can be very confusing and easy to damage your site files. 

Pricing:

• The Blogger plan includes 1GB of storage space, allows you to back up one site, and is $80/year.
• The Freelancer plan includes 1GB of storage space, allows you to back up ten sites, and is $127/year.
• The Gold plan includes 5GB of storage space, allows you to back up unlimited sites, and is $199/year.

BackWPUp

BackWPUp is a backup plugin with a very limited free version and premium plans that include more robust features. It has relatively straightforward functionality, without unnecessary bells and whistles, but can be difficult for beginners to use effectively.

Key features of BackWpUp:

• Manual and automatic full-site backups
• Integration with third-party tools like Google Drive and Dropbox, though some of these are only available in the premium version
• An emergency restore tool you can use if your site is completely down
• Encrypted backup files

Pros of BackWpUp:

• It supports WordPress multisite.
• It connects to more third-party tools than the majority of backup plugins. While common options like Google Drive are available, it also integrates with tools like Rackspace Cloud, Amazon Glacier, and SugarSync.

Cons of BackWpUp:

• Many key features, like setup wizards and the ability to restore directly from the WordPress dashboard, are only included in the premium version.
• Documentation is relatively limited and can be confusing to navigate for beginners.
• There’s no option for real-time backups.

Ease of use:

In the free version of the plugin, the settings can be confusing for beginners, and use technical language like “script execution time” and “empty output on backup working.” The free version also doesn’t include a way to automatically restore backup files. Thus, to be able to really use this plugin without having coding experience, you must purchase a premium plan.

However, with a premium plan, the setup wizard and restore wizard are easy to use. You can get up and running or restore a backup in just a few clicks (assuming your site is working), no experience needed.

If your site is down, there is an “emergency restore” tool available. However, you have to be able to access your server via FTP to run this tool and restore your site.

Pricing:

• The Free plan includes limited features and has no cost.
• The Standard plan includes one site and is $69/year.
• The Business plan includes five sites and is $119/year.
• The Developer plan includes ten sites and is $199/year.
• The Supreme plan includes 25 sites and is $279/year.
• The Agency plan includes 100 sites and is $349/year.

WP Time Capsule

WP Time Capsule is a premium backup plugin with a 30-day free trial available. All backups are real-time and incremental, so changes (and only changes) are saved as they happen. This makes a big difference in how the plugin affects your site speed. In addition, all backups are stored using third-party tools, keeping them safe from server hacks and giving you full control.

Key features of WP Time Capsule:

• Automatic, real-time WordPress backups
• Automatic backups every time you update your site, so you can restore in the event of a plugin or theme conflict
• One-click restores from the WordPress dashboard
• The option to test changes and updates on a staging site
• Integrations with third-party tools like Google Drive and Dropbox
• The ability to restore specific files or your full site
• Restore options even if your site is completely down, no code needed

Pros of WP Time Capsule:

• Incremental WordPress backups and restores, which means that only new changes are saved and restored each time. So, your server isn’t weighed down and your site isn’t slowed down.
• It includes a staging environment, which allows you to test changes, updates, new plugins, and more to ensure they’ll work properly on your live site. You can then push those changes live with one click.
• It supports WordPress multisite.

Cons of WP Time Capsule:

• It only saves changes and backups for a 30-day time period with the Business plan.
• There is not a free plan available.
• Since all backups are stored by third-party storage service providers, you may have to pay for those tools in addition to the plugin, depending on your website (and therefore backup) size.

Ease of use:

Setting up WP Time Capsule is as easy as installing the plugin and choosing configuration options. In addition, there are instant restores and it just takes one click to push changes live from your staging environment.

Pricing:

• The Business plan includes two sites and a 30-day restore window for $49/year.
• The Freelancer plan includes ten sites and a 120-day restore window for $99/year.
• The Agency plan includes unlimited sites and a 365-day restore window for $199/year.

BoldGrid Total Upkeep

BoldGrid Total Upkeep (formerly BoldGrid Backup) is a WordPress plugin that offers automated and manual backups, along with additional security features that help you avoid needing to restore a backup in the first place.

Key features of BoldGrid Total Upkeep:

• Automated and manual remote backups.
• The ability to restore your site even if it’s down.
• The ability to automatically roll back failed updates.
• Integration with Amazon S3 and Google Drive to store backups.
• Additional security features like downtime monitoring and automatic WordPress updates.
• Single-file restores.
• A log of all file changes that happen on your site.

Pros of BoldGrid Total Upkeep:

• There are no size limitations on backups.
• The premium plan includes unlimited websites, which ends up being a very affordable solution for multiple WordPress sites.
• It integrates with, and can be purchased alongside, a suite of WordPress tools that include a page builder, staging environment, and caching feature.

Cons of BoldGrid Total Upkeep:

• There are only two third-party storage tools supported: Amazon S3 and Google Drive. A lot of other plugins include more storage options.
• Restoring a backup if your site is down requires using a script from the command line, an advanced process.

Ease of use:

Installing and setting up BoldGrid is very straightforward and simple. Just install and activate the WordPress plugin, then configure a few settings like backup days/times and storage locations.

If your site is running, restoring a backup is just as easy — select the backup you want to load from the WordPress dashboard and click “Restore.” However, if your site is down, that’s where things get tricky. You’ll need to restore your files using SSH and a specific command line. If you’re not familiar with this process, it can be confusing and difficult.

Pricing:

• There’s a free version, which includes all the basic backup functionality.
• The Premium version, which adds features like single file restoration and a log of all file changes, costs $2.50/month billed annually.

What makes a good WordPress backup plugin?

Now that we’ve compared the best WordPress backup plugins, let’s take a step back and look at what really makes a plugin “good.” 

Here are features of a good WordPress backup plugin:

1. Automated backups

Having to manually back up your site every day is, of course, incredibly time-consuming. And it also leaves a ton of room for error — it’s so easy to forget! 

That’s why automated backups are critical. You can just turn them on and not worry about them. If anything goes wrong, you have everything you need already in place.

2. Real-time backups

Real-time backups are life-changing if you update your website regularly. They save a copy of your files and database every time something changes, so you know that everything is up-to-date. 

While these are great to have for any site, they’re especially important if you post multiple blog posts a day, run forums, or have an eCommerce store. Imagine losing your latest order information!

3. Storage separate from your host

Some plugins store backups on your server, which can be convenient. But you want to avoid this if at all possible. If a hacker gains access to your site, they may also be able to access your server. In this case, your backups would be compromised or infected with malware, too.

4. An activity log

An activity log keeps track of everything that happens on your site. What does this have to do with backups?

If you know when a plugin was deleted, when someone logged in from an unfamiliar location, or when a page was changed, you can also identify when a hack occurred or an issue arose. This allows you to restore a backup from right before the problem.

5. A super easy restore process

If your site goes down or is hacked, you want to get it back up as quickly as possible. Every second that it’s down means lost orders, site visitors, followers, or ad clicks. And, on top of that, you might be frazzled.

The last thing you want to worry about is a complicated, long restore process or having to reach out to your developer and ask them to restore a backup (whenever they’re available.) So, look for a one-click restore that makes it easy for you to return to normal.

6. The ability to restore from anywhere

Sites don’t go down based on your schedule. Anything could happen at any time — when you’re commuting to or from the office, in the middle of the night, or when you’re traveling. Choose a backup plugin that includes an app so you can restore your site no matter where you are, right from your mobile device.

7. Incremental backups

Incremental backups only save the most recent changes, rather than backing up the full site every single time. While this still ensures that a copy of everything is saved, it dramatically reduces the amount of storage needed because fewer files are backed up each time. This also means less server bloat, which can save you expensive resources and prevent your site from loading slowly while backups are running. 

Which WordPress backup plugin is best?

When it comes down to it, Jetpack Backup is the clear choice for the majority of WordPress sites. It offers robust features, an easy-to-use interface, reliable, secure backup storage, and support from Automattic Happiness Engineers that know WordPress better than anyone else. But there are a few scenarios in which another plugin might be a better fit.

Running WordPress Multisite? Give BlogVault a go — it fully supports multisite backups.

Looking to restore individual files? BackupBuddy lets you select the files you want to restore.

Want to set up a staging site? If your hosting plan doesn’t already include a staging environment, WP Time Capsule might be a good fit. You’ll get both backups and staging in one paid plan, with the ability to test changes and push them live with one click.

But, if you’re like most WordPress site owners, Jetpack will provide everything you need, and then some. Get started with Jetpack Backup.

WordPress backup FAQs

How often do plugins back up a WordPress website?

It depends on the plugin you choose. The most common frequency is daily, but there are also options for weekly, monthly, every couple of hours, or in real-time.

Jetpack Backup, for example, offers real-time backups, which save everything whenever a change occurs. This can be extremely valuable if your site is regularly updated, like in the case of a news blog, eCommerce store, or online forum.

How long are WordPress backups kept? 

Again, it depends on the backup plugin. However, a 30-day archive is pretty typical, while some plugins allow you to choose the number of backups to save. 

How do I know if my plugin is backing up my WordPress website?

There are several ways you can confirm if your plugin is saving your site. The plugin you choose should keep a record of when backups were made. Others may send you an email or notification after a successful backup. You can also download a backup file from remote storage or your server to double-check that your files and database are there.

With Jetpack, you can check the activity log to see when the last backup was completed and whether or not it was successful. 

Where are my backups stored?

This depends on the plugin that you choose. Many plugins save backup files to your server, which leaves them vulnerable to hacks and takes up valuable storage space (that you pay for!). Others integrate with third-party tools like Google Drive or Dropbox, which keeps them separate from your hosting plan.

Jetpack Backup stores multiple copies of each backup on WordPress.com’s super-secure servers — the same ones their own website lives on! That means that you benefit from protected files without having to manage any third-party tools. Plus, you can also restore with just a few clicks, even if your site is completely down.

Does a backup plugin still work if my website is down?

In most cases, you can still restore a backup if your site is down. However, this process typically involves accessing your server via FTP and PHPMyAdmin or running a script using SSH. These steps can be confusing and complicated for many website owners and are relatively easy to mess things up.

Jetpack Backup, on the other hand, makes it super easy to restore a backup even if you have no access to your WordPress dashboard. All you have to do is select the backup you want to load from the activity log, choose the files you want, and click a single button. That’s all it takes!

A picture is worth a thousand words, so when it comes to your website, you want the best images possible. The visuals on your site can create an emotional response in your visitors, communicate your message quickly, cross language barriers, and increase engagement. 

Images help tell your story, but some sites might be especially photo-heavy. In fact, no matter what type of site you have, on average, images will make up the majority of your page weight. This can be problematic for some because, while their success might rely on high-quality photos, the more images a site has, the slower it will load. 

Large page size is bad news for page speed — an important metric when it comes to search engine optimization (SEO). Finding ways to speed up your image load times without sacrificing quality or overall impact will help you achieve the best of both worlds — images that look great and load fast.

What is a CDN?

A content delivery network (CDN) is a service that speeds up your website by optimizing how images and other files are stored and delivered to your visitors.

Images and other static files are copied to a network of international servers. These servers can respond quickly to visitors by delivering files from the closest physical location, and by evaluating the visitor’s hardware and software to make sure they receive the best possible image size and format, every time. 

For instance, when viewing the same website, someone using a laptop in North Carolina will receive different files from different servers than someone using a cell phone in Alaska. But both will get the fastest, best user experience possible, as those files will be served by whatever server is closest to them and in the format and size that is optimal for their device.

Image CDN functions:

• Caching image files and serving them quickly from high-speed, dedicated data centers across the globe
• Delivering image file formats and sizes dynamically based on the visitor’s platform and device capabilities
• Automatically compressing and saving images in various sizes for quick delivery
• Allowing multiple files to be downloaded simultaneously by the visitor’s browser

A good CDN service will also introduce lazy loading to your site automatically. Lazy loading means that images aren’t rendered until they’re actually visible; content at the top of the screen can load quickly, and images farther down will continue loading in the background. Giving your visitors visible content as fast as possible means they’re less likely to surf away in frustration.

Sound like magic? It kind of is. But it’s not a quick fix that will solve all your image speed problems. Before you get started with a CDN, you’ll want to do a few things server-side: test your image load times, address image sizes and compression, and make sure you’re using the most efficient file formats. A CDN will help your site speed regardless, but it will do a better job if you’ve performed these optimizations on your site first.

Test your image load times

The first thing you should do is find out how your site performs on a page speed test, and how images might be affecting your load times.

Start by running your homepage through a site speed test website. Just enter your URL, wait a few moments, and a full report of your site’s performance will be generated. 

A few of our favorites include:

• Google PageSpeed Insights. Google’s PageSpeed Insights tool provides an in-depth look at all potential sources of speed problems on your website and suggests ways to improve your scores. Look down the list of reported problems for items specifically related to images.
• GTMetrix. GTMetrix will give your website an overall score that will provide a good feel for how quickly your visitors see your site. Try the Structure tab to look for image-specific warnings that you can remediate.
• Pingdom. Pingdom is especially useful for websites with international audiences, as you can set the location of your testing server and evaluate performance from different parts of the world. It also provides a handy content percentage chart; scroll down to see what percentage of the page images currently account for.

Attack the issues

Problems with images affecting load times often come down to three factors:

• Inefficient file formats. Always save large photos as JPG files, or even better, Google’s relatively new WebP format for extra file size savings. Lossless formats like PNG are best for logos and specialized graphics where a clear background is required, and GIF should be used sparingly when animation is absolutely required.
• Improper sizing. Even if you display an image in a small area on your webpage, the browser must download the full file before shrinking it to fit the allotted space. Don’t carelessly include large images on your site and rely on the browser to resize them for you. Instead, resize them first to match the maximum display size for your pages. 
• Lack of compression. Images can be compressed before uploading with very little loss of quality. Unless you’re running a photography-based site, visitors are unlikely to see any difference and the size savings can be great.

If you already have a website full of photos and aren’t keen on replacing every one, don’t worry — a plugin may be able to help. Plugins can convert your images to smaller formats like WebP, and even serve them to visitors without having to replace links in your existing pages and posts. Plugins can also resize images in your media gallery to more efficient sizes, and make sure that they’re fully compressed. 

There are some plugins that attempt to detect unattached images or unused image sizes and give you the option of removing them, but be careful — these plugins don’t always accurately identify used and unused images. You may accidentally delete an image or a size variation that is attached to a page or post. Always make a backup of your WordPress site before resizing or deleting anything.

Is an image CDN right for your website?

Now that you’ve made some changes to the images on your server, do you still need to install an image CDN on your website? If your site speed check indicates that images are no longer causing a problem with your page load times, then you may not need a CDN. But any site that uses a lot of images might find that just optimizing files on the server is not enough to significantly improve page speed. 

What types of websites would a CDN be beneficial for?

1. Sites with many high-quality images

Lossy file formats and compression are fine for most sites, but when images are what you’re selling, you need to keep quality high. Sites that are about photography or artwork are usually packed with high-resolution images, and compromising on quality isn’t an option.

Other sites might not feature photographs for sale, but may use a lot of images to enhance the user experience. Images can boost your SEO, make your content more friendly to social media shares, clarify your messaging, and make your site more interesting and engaging. The benefits of high-quality images are valuable for SAAS, eCommerce, magazines, and many other types of sites. But many images on a page — even when optimized — can quickly add up, pushing your page size into problem territory

2. Sites with photo galleries

Sites that sell based on visuals often feature photo galleries on every page. If your website has real estate listings, graphic design portfolios, travel packages, interior design makeovers, or how-to projects, then you’re likely to have very image-heavy pages and blog posts that are slow to load and would benefit from an image CDN.

3. Sites that use hero images or sliders

Popular with many different types of sites, hero images in header areas are always eye-catching, but can add a lot of weight to a page. Sliders on homepages, especially at the top, can have a huge impact on page load speed, as many large images are loading at once and preventing the remainder of your content from rendering. In both situations, lazy loading provided by an image CDN is a must.

4. Sites with an international audience

Digital storefronts that target an international customer base will serve their clients best with an image CDN. Large images of products are served from data centers around the world, with the closest physical location to the visitor delivering the actual content. This makes your site speedy for all shoppers — a key element in reducing abandonment rates and boosting sales.

5. Sites that attract a large mobile audience

By 2025, it’s estimated that at least three-quarters of the world will use the internet through a mobile device exclusively. Is your site ready to serve the majority of your future audience? A good image CDN will serve image sizes designed for each visitor’s screen. Mobile users will only download images in the small size they need, increasing site speed and saving on data charges, too.

Choosing the best image CDN for WordPress

If your website runs on WordPress, choosing an image CDN is simple. Jetpack’s content delivery network provides comprehensive optimization while blending smoothly with the WordPress CMS and keeping code weight to a minimum with a shared library. 

Why choose Jetpack CDN?

It’s easy. It only takes a few clicks to add the plugin to your website, and since it’s built by the team behind WordPress itself, you can trust it to be stable, secure, and seamless. Once installed, turning on the image CDN takes just one click — look under the Settings → Performance tab and toggle the option for “Enable site accelerator.” After a few minutes of processing, your image CDN is active and working to improve your website.

It’s powerful. All the features you need to speed up your site and deliver images in an intelligent, optimized way are automatically included. 

• Your images will be stored offsite on WordPress servers, where they can be delivered quickly from locations worldwide. 
• Each image will be dynamically served in the right format and size for the visitor’s device and platform. 
• Lazy loading is included.

The end result? A faster site that fits your users like a glove — meaning better SEO, a smaller bounce rate and better engagement.

It’s free. Literally, free. The CDN feature is included at no cost; anyone who installs the plugin can turn on the functionality immediately. Even better, since images are loaded from offsite servers, your own website server won’t require as much bandwidth on a monthly basis. Depending on how your hosting is set up, you may see a cost savings, too.

Finding the best balance

Images are so important for engagement, communication, and interaction on your website.   Don’t let speed issues force you to compromise on design; instead, create a website that’s both fast and beautiful with the power of Jetpack’s image CDN functionality. 

FAQs about image CDNs

Got questions? We’ve got answers!

Does an image CDN negatively affect photo quality?

Visually, there is no noticeable difference between images served in their original format and those delivered by an image CDN like Jetpack. Jetpack uses the WebP format whenever possible, which compresses images with no loss of quality. If you’re using a modern, WebP enabled browser, try this side-by-side comparison and see if you can spot the difference!

Will an image CDN improve my site speed?

Absolutely! While the impacts will be most dramatic on image-heavy websites with lots of images, galleries, or sliders, you’ll see measurable improvement regardless. Plus, international visitors, people on mobile devices, and those visiting during peak times will notice an additional speed improvement.

Does an image CDN help with SEO? 

Yes! Although images are delivered from Jetpack’s specialty servers, the original URL of each image is included with the page. Images can still be properly indexed by search engines. In addition, search engines like Google consider speed, engagement, and bounce rates when determining your SEO ranking, all of which will improve once an image CDN is added to your site.

Is there a free WordPress image CDN?

You bet. Jetpack’s CDN for WordPress. All image CDN features are part of the free level of Jetpack services.

How easy is it to set up an image CDN?

Installing and configuring an image CDN varies in complexity depending on the solution you choose. But the easiest way to install an image CDN on your WordPress site is with Jetpack. Just install the free plugin, then turn on the site accelerator functionality with a click under Settings → Performance. It’s that easy!

How do I make sure my WordPress website has the best image sizes?

Your image CDN will deliver files to your audience in a size that fits both your layout and their device capabilities in a responsive way, so don’t worry about having to upload an image in multiple sizes on your own. It’s always best not to upload your raw images in a huge format, though. Image CDNs can time out while trying to download or process an oversized image. Even for hero or slider images, keep upload file sizes as small as possible while retaining the desired quality. 

Can I compress images manually?

You can and you should. Images can be compressed manually before upload, or even with a supplemental plugin. A good image CDN will also compress your files, convert them to optimized formats like WebP, and create a variety of sizes suitable for different viewports before delivering them to a visitor — all automatically, behind the scenes.

What is lossless image compression and how can it help my WordPress website?

Since image files often make up the bulk of a page’s size, it pays to compress your images as much as possible. Formats like JPG and GIF use lossy compression, meaning that some quality is lost in the conversion. Lossless compression means that you don’t compromise on quality at all, but still gain the benefits of smaller image file sizes. A good image CDN like Jetpack will convert your files to a modern format like WebP — a lossless format that has excellent compression rates and makes a noticeable difference to your website’s load times.

If you’ve ever experienced a broken website, you know just how devastating it can be to try to recover or rebuild if you don’t have a copy to restore from. It can cost hours, days, or even months of downtime; leading to revenue loss, increased expenses, and emotional distress for you and anyone who relies on your site. Being able to restore your files and database if anything goes wrong can prevent this kind of painful situation. This is why making backups of your WordPress site, with a tool like Jetpack Backup, is absolutely critical. 

In this article we’ll walk you through:

• What is a WordPress backup?
• Why do you need a backup of your site?
• Methods for creating a WordPress backup
  • Automatic backups from your web host
  • Manual backups
  • Backups using plugins
• Which manual backup method is the best?
• How often should I back up my WordPress site?
• Where should I store my WordPress backups?
• How do I know that I haven’t missed any files when performing a manual backup of my WordPress site?
• What makes WordPress backup with a plugin better than manual?
• How many backups should I keep?

What is a WordPress backup?

A WordPress backup is a complete copy of everything that makes up your site. It can be used to restore your website to a previous state if it becomes corrupted or damaged and to migrate from one host to another. Your backup should include:

• WordPress core files. These are all the files included when you install WordPress on your server. The main folders include wp-admin, wp-content, and wp-includes and a number of files in the root folder of your server like wp-config.php, .htaccess, user.ini or php.ini, and index.php.

• Your database. Your database is a system of tables, columns, relationships and permissions that stores dynamic and searchable information displayed on your website. Some of the information stored includes user account data, page and post content, customer orders, form entries and other user inputs, and data generated by plugins.

• Theme files. WordPress uses theme files to create the layout and aesthetic of a website. A theme may also have components that influence functionality. 

• Plugins. Think of plugins as apps you install on your WordPress site to provide added functions beyond what WordPress core or your theme provides. Plugins contain specific programmed functions that can add new features to your site and extend its capabilities without any additional code. 

• Uploaded files. Images, videos, documents, and other files that you or other site users uploaded to the WordPress media library or wp-content folder.

It’s critical that all these elements are included in each backup you create so that your website can be properly restored if something goes wrong.

Why do you need a backup of your site?

The number one reason you need to keep backups of your WordPress site is to prevent data loss. Whether you’re running a complex eCommerce store or maintaining a simple landing page, you don’t want to lose the work that you’ve put forth and have to start over from scratch if your site experiences a serious problem. 

You’ll want to restore your WordPress site from a backup if:

1. Your website was hacked

If your website gets hacked, you’ll want to restore your site to a version before it was compromised. Don’t forget to change all your passwords and make sure you’ve installed a WordPress security plugin to help prevent future attacks.

2. A plugin, theme, or WordPress core update caused an issue on your site

When updating to the newest version of a plugin, a theme, or WordPress core, you may occasionally get scary fatal errors. These errors might result in the dreaded white screen of death, but sometimes you might experience less obvious problems. Your site may still load, but display a fatal error script that appears on the front or back end. Or you might experience subtle functionality issues that could take longer to discover. 

By restoring from a backup, you can roll your site back to its most recent working version. You can also use it to create a staging site so that you, a plugin or theme author, your host, or another developer can troubleshoot the problem. If your hosting company provides a one-click staging option, it will make the process that much easier.

3. You added a malicious or badly-coded plugin to your site

There are thousands of WordPress plugins available and it can be difficult to know if the one you’re installing is well-built or even legitimate. Using plugins from reputable sources like WordPress.org and widely-used paid online marketplaces will at least prevent you from installing plugins that contain malware. Why? Because there are review processes the plugins must go through before they are approved and made available to the public. However, poorly coded plugins can still make it past the review process, and installing them on your site can cause major havoc. 

In a case where you can’t fix the issue by simply uninstalling the offending plugin, you’ll want to be able to restore your site.

4. Your host made an error

If your host accidentally deleted an important directory or made other problematic changes to your server, your site may go down or experience functionality issues. You’ll need to restore your site from a backup made before your host caused the problem. 

5. You’re migrating your site from one host to another or changing your domain name

If you need to move hosts or you’ve decided to change your domain name, you’ll want to make a backup of your site. A lot can happen during the migration process or when making changes to your website’s root URL, so make sure you have a backup before starting either process. 

6. You’re making major design changes to your site or implementing a new theme

While it’s best to make big design changes or switch themes on a staging site instead of your live site, you’ll want to keep a backup either way. Your staging environment may be different than your live environment, so your staging site might work well but your live site might experience problems. Being able to roll back to a previous version will reduce any downtime or problems visitors might experience while you troubleshoot the issue.

7. You made a mistake while making changes to your site

Let’s say you want to work on your website’s page speed and decide to remove unused images that are hogging space on your server. Whether you do this manually or use a plugin, you run the risk of accidentally deleting important images from your website. Back your site up before you start deleting anything so that you don’t lose potentially critical images and other files forever. 

8. You regularly delete certain data to save space

If you run a site that has a lot of users, you might find yourself needing to delete some data periodically to prevent it from slowing down. eCommerce stores, forums, and websites where users can submit their own posts or media can quickly grow large and cumbersome. You may delete inactive users or customers, old orders, or other information to keep your site’s performance optimized. 

At some point, you may need to retrieve that deleted information, though. Perhaps a customer wants to order a product again and they can’t remember what size or color they purchased. If you deleted that order, you may need to look in a backup of your database to find that information. Or maybe an inactive forum member wants access to their comment history, but you deleted their account. Being able to retrieve that information from a backup will allow you to restore it for the user.

Methods for creating a WordPress backup

1. Automatic backups through your hosting service provider

Many hosting companies offer daily site backup plans for their customers — often included for free with your hosting service. Sounds like a sweet deal, right? Not necessarily. 

Here are four good reasons not to rely on your host for WordPress backups:

• It has short, inflexible archive windows. Most web hosts keep your backups for 15-30 days with no options for extending that archive period. 
• If your host goes down, your backups are inaccessible. If your hosting provider experiences an outage, your server is down, or — worse yet — they suddenly go out of business, you may lose access to all your backups. 
• Technically, backups aren’t their responsibility. Make sure you read the fine print in your service agreement. Many hosts include disclaimers that state they will make good faith efforts to back up your data regularly, but that these backups are intended for internal use only. They cannot guarantee that any given backup will be available upon request or that restored backups will work correctly. Most hosts’ terms explicitly state that it is ultimately your responsibility to back up your own site.
• If your site is compromised, your backups could be too. If someone hacks your site, they may also gain access to your server. If your backups are stored there, they could also be compromised.

When signing up for your hosting service, you’re agreeing to these terms. While your web host may offer great backup and restore services, others may not — and one way or the other you shouldn’t rely solely on your host for WordPress backups.

2. Manual WordPress backups 

WordPress sites are built using a database, WordPress core files, themes, plugins, and any other files you choose to upload. Not only will you need to back up all these WordPress-related files, but you’ll also need to back up the database. The most common ways of backing up these components of your site include:

Back up your site with cPanel

cPanel is a widely-used graphical user interface (GUI) that simplifies server management. From cPanel, you can set up websites, manage your file structure, change your domain settings, create backups of your site, and more.

1. Log into your hosting account and then open cPanel

If you’re not sure how to find cPanel in your hosting account, you can contact your host or look through their knowledge base for help.

2. Create your site backup

Under the Files section, click the Backup Manager link.

In Backup Manager, click on cPanel Backups. If you want a guided version, you can use the cPanel Backup Wizard. 

In the cPanel Backups screen, under Full Backup, click “Download or Generate a Full Website Backup”. 

If you want to download your files and database separately, you can choose those options under “Partial Backups”. Make sure you select the correct database from the Databases field if you’re downloading the database separately. 

Once you’ve selected the download option you prefer, you’ll be taken to a screen letting you know that your backup is in progress. You can go ahead and click the Go Back link to be taken to your available downloads.

Your backups will be listed with a little blue checkmark next to them on the Backups Available for Download page. Click your backup to download it to your computer and you’re all set!

Not every web host offers cPanel access for their customers, so making a backup this way may not be an option for you. For instance, managed WordPress hosts don’t use cPanel. 

If you’re using managed WordPress hosting and you want to access your site’s file directory to make a backup, you will need to use secure file transfer protocol (SFTP), secure shell protocol (SSH), or a plugin that grants folder-based access to your site’s files. While your managed WordPress portal will not include a cPanel-like file tree, it should include a link to phpMyAdmin for database access. 

Back up your files using FTP/SFTP

You can manually back up your WordPress site’s files using a file transfer protocol (FTP) client. An FTP client is a program that connects your computer to your website’s server so you can upload, download, and manage files. There are several different FTP clients available for free, like FileZilla, CyberDuck, and ClassicFTP. A quick Google search for “free FTP client” should help you find the one that is right for you. 

For this walkthrough, we’ll use FileZilla:

1. Find your FTP credentials in your hosting control panel. 

The location of your FTP credentials may vary from site to site, so if you have trouble finding them, reach out to your host for help. You’ll need the following information:

Host address. This is usually the server IP address or might be a URL.

Username. This is your FTP username. It’s specific to your FTP connection and should not be the same as your hosting account username. 

Password. You may be asked to generate a new FTP password when attempting to access your credentials. If so, you’ll want to write this password down somewhere. Some hosts don’t save FTP passwords on your account, so if you try to retrieve it later, it will prompt you to generate a new one. This can get annoying if you have FTP settings for a website saved on multiple installations of your FTP client — laptop, desktop, co-worker’s laptop, etc.

Port number. You’ll want to connect to your server via SFTP (secure) vs FTP (insecure). SFTP ports are usually 22 or 2222. If your account credentials don’t mention the port number, you can always check your host’s help documentation for this information.

2. Log into your FTP client using the above credentials and click Quickconnect.

3. Select a folder to save your backup to

The left side of your screen will show the files on your computer. The right side of your screen shows the files on your web host’s server. Navigate to the folder on your computer where you want to save your backup and click on it. You’ll see its contents in the bottom left window. 

Optionally, you can right click to create a new directory.

If you’re creating a new directory, enter its name and click OK.

Your new folder named Backups will be visible in the bottom left window. Double-click the folder to open it.

4. Navigate to your site’s root directory on the right-hand side of the screen

It’s usually called html or public_html. It may have another name, depending on your host, but the important thing is that you’ll know you’ve found the right directory if it contains the wp-admin, wp-content, and wp-includes folders.

5. Download your site’s files from the root directory

Select all the files and folders in your site’s root directory. 

Right-click and select Download. You can also select all the files and folders and just click and drag them to the open folder window on the left-hand side of your screen.

Your files will now be downloaded to your local machine. Make sure to upload them to cloud storage like Google Drive or DropBox and save another copy on an external hard drive.

Don’t forget! This process only backs up your site’s files. It does NOT back up your database. You’ll also need to back up your database, which you can do via phpMyAdmin or SSH.

Create a WordPress database backup with phpMyAdmin

phpMyAdmin is an online software used for the administration of MySQL and MariaDB databases (the database types used by WordPress). It has a GUI that makes navigating and managing your database much easier than trying to do it all from the command line. 

It can still be a bit scary to poke around in your database if you don’t know what you’re doing. Fortunately, exporting a backup of your database in phpMyAdmin is fairly straightforward:

1. Log into cPanel or your managed WordPress portal in your hosting account

If you’re in cPanel, you’ll see phpMyAdmin listed under Databases. If you’re using a managed WordPress host, there should be a link to phpMyAdmin in your portal. If you can’t find it, contact your host or search their documentation for help.

2. Click on the phpMyAdmin icon to launch the phpMyAdmin window in your browser

3. Select your database

If your database name isn’t selected already, click on the database you want to export. Once your database is selected, you’ll see a list of all the tables included. 

3. Click on the Export tab

4. Select export method and format

You can then choose from a Quick or Custom export. The Quick export will export your entire database. If you want to review the tables being exported and exclude some, select the Custom export option. 

Quick export method selected.

Custom export selected, excluding wp_comments and wp_commentmeta tables.

phpMyAdmin should show the database output option as ‘SQL’ by default. If for some reason ‘text’ or some other option is selected, switch it to ‘SQL’.

5. Click ‘Go’

That’s it! phpMyAdmin will export the database as a ZIP or GZIP file and prompt you to download it to your computer to use as your database backup. 

Make a site backup using SSH

SSH (Secure Shell or Secure Socket Shell) is a network protocol that provides secure access from one computer to another over an unsecured network. Mac OS and Linux include the SSH client Terminal. Windows 10 includes an SSH client option, but it is not installed automatically and must be downloaded and enabled separately. Other Windows versions don’t include an SSH client, so you’ll need to download one from a third party, like PuTTY. 

Most SSH clients don’t have a GUI and rely on text-based commands to connect to and perform functions like uploads, downloads, deletions, file name changes, and more on a remote host. Unlike SFTP, you can back up both your site files and your database using SSH. Here’s how:

1. Find or create SSH credentials in your host’s control panel. 

Where your SSH credentials are located and exactly how you’ll generate them if they do not exist already might vary depending on your host, so if you aren’t sure where to find it, reach out to your provider or search their FAQs for help.

Sometimes your SSH and SFTP credentials are the same, so check under your FTP settings area to see if this is the case.

You’ll need the following information:

• Host IP address
• Username
• Password
• Port number

You may also need to generate an SSH key, depending on your host’s requirements. For this example, we’ll just use host, username, password, and port number.

2. Find your SSH application and open it.

On Mac OS, you’ll go to Applications → Utilities → Terminal. On Linux you can press CTL + ALT + T. If you’re using Windows, you’ll use whichever SSH client you installed. 

3. Type this command: ssh  username@remotehost  -p 2222

Replace ‘username’ with your username, ‘remotehost’ with your host’s IP address, and ‘2222’ with your host’s port, then press Enter. 

If this is your first time connecting to the server, you’ll be asked if you want to continue connecting. Type ‘yes’ and press Enter. You’ll receive a warning that your server’s IP address has been permanently added to the list of known hosts. You won’t see this message again if you’re connecting from the same machine. 

4. Type your password and press Enter. 

You’ll be prompted for your password. Copy and paste it at the command prompt. You will not see the password or any other feedback displayed. This is normal. Press Enter.

You’re connected to the remote server — time to back up your site.

5. Type the following at the command prompt:  cd ~

6. Type this command to make a backup of your site files: tar   -zcf    backup.tar.gz    directory_name

Replace ‘directory_name’ with the name of the directory you want to back up. This should be the directory that the WordPress folders wp-admin, wp-content, and wp-config are in. If your site’s root directory is ‘public_html’, then your command will look like this:

tar   -zcf    backup.tar.gz    public_html

Your backup is complete but is still sitting on your server. You’ll need to download it from your server so you can keep your backup stored safely off-site.

7. Download the backup of your site files.

Type the following at the command prompt: 

scp -p 2222 username@remotehost:/directory_name/backup.tar.gz  directory_name

Replace ‘2222’ with your port number, ‘username’ with your username, ‘remotehost’ with your server’s IP address, ‘directory_name’ with the directory name your site’s files are in, and the second ‘directory_name’ with the directory on your computer that you want to download your backup to. Then hit Enter.

Your files should now download from your server to your computer.

8. Download your database.

Oh, you thought you were done? No. You still need to download your database. You’ll need the following information:

Database username. This is different from your SFTP or SSH username and is assigned only to your database.

Database name. The name of your database.

Password. Your database password, which should be different than your SFTP or SSH password.

You can find this information in your hosting account. If you have trouble finding it, contact your host for assistance or browse their help documentation. 

If you’re still logged into your server via SSH after downloading your site files, you’ll enter the following command at the prompt:

mysqldump -u USERNAME -p DATABASE > database_backup.sql

Replace ‘username’ with your database username and ‘database’ with your database name.

You’ll then be prompted to enter your database password. Type in your password and press Enter.

Your database will be exported as ‘database_backup.sql’ in your current directory. To download it to your local machine, enter the following command:

scp -p 2222 username@remotehost:/directory_name/database_backup.sql  /directory_name

Replace ‘2222’ with your port number, ‘username’ with your username, ‘remotehost’ with your server’s IP address, ‘directory_name’ with the directory name your site’s files are in, and ‘/local/dir’ with the directory on your computer that you want to download your database to. Then hit Enter.

9. Delete backups from your server (optional)

Keep in mind that the backups you made are still on your server. If you don’t want to keep them there, you can remove them using the following commands:

Site files:

rm  database_backup.sql

Database:

rm  database_backup.sql

3. Backup Plugins

There are a variety of plugins that allow you to back up your WordPress site either on-demand or at scheduled times. However, some of these plugins involve complicated setup or they store the backups on your own server, which can weigh your site down and cause slow load times. Jetpack Backup is an excellent option for hassle-free, automatic WordPress backups that don’t bog down your site.

The advantages of Jetpack Backup include:

• Easy setup. Just install Jetpack, purchase a backup plan, and you’re all set. 
• Real-time backups. Many backup plugins only offer daily backups. But if you regularly change your site or run an online store, real-time backups may be crucial in preventing data loss. Jetpack saves a copy of your website whenever a major change is made. 
• Off-site storage. Storing backups on your server can slow your website down. Worse yet, if your server goes down, you won’t be able to access your backups at all! Or they may be compromised in the event of a hack. Jetpack securely stores your backups off-site so you always have access to them, whether you can get into your site or not. 
• Simple migration. Jetpack Backup is also a migration plugin. Easily migrate your site to any host without installing additional plugins or hiring a developer.
• Manual downloads. While Jetpack stores your backups on their servers, you can also download them to your hard drive and upload them to cloud storage platforms like Google Drive, Dropbox, or Amazon S3 — a little redundancy is never a bad thing with backups as long as you have the storage space.
• No limits on backup sizes or frequencies. A lot of backup plugins limit the size of your backups or how often you can save your site. Not Jetpack! Easily back up a large website as often as you’d like.
• Superior customer support. The Jetpack team is made up of WordPress experts. Rest assured that your website and backups are in good hands.

Which manual backup method is the best?

Making your WordPress backup through cPanel is the easiest way to perform a manual backup, but not all web hosts use cPanel. If you don’t have access to cPanel through your host, your next best bet for a relatively painless manual backup would be to download all your site files using SFTP and back up your database through phpMyAdmin.

Make backing up your site a priority

No matter what method you choose or the frequency of the schedule — make backups a priority. Don’t risk your hard work and important data by procrastinating this aspect of running your site. If you’re putting off backups because it seems like a chore, Jetpack Backup makes the process easy and painless. Keep your data safe in less time than it takes to submit a ticket to your host’s tech support team. In the long run, you’ll save money, time, and file recovery headaches if and when something goes wrong.

WordPress backup FAQs

How often should I back up my WordPress site?

The short answer is: regularly. But depending on how often your site is updated with new content, you may want to back it up monthly, weekly, daily, or in real-time. A static website that isn’t updated with new content very often may only need daily backups. A busy eCommerce site, on the other hand, may need real-time backups to minimize loss of customer or product data.

Where should I store my WordPress backups?

Keep your backups off-site and in at least two places — preferably three. If you keep your backups on your own server, it can seriously slow down your website. Each backup is a complete duplication of all your site’s content, so if you keep a month of daily backups on your server, that’s 30 full websites taking up space. Yikes! Also, if your server goes down, you may lose access to all your backups — which defeats the purpose of making them in the first place, right?

Jetpack Backup keeps your backups off-site on WordPress.com’s own servers, and you can periodically download your site archives to your local machine. From there, you can copy them to an external hard drive and upload another copy to a cloud storage service like Google Drive, Amazon S3, or Dropbox.

Even though your hosting company can’t necessarily be relied upon for backups, it doesn’t hurt to choose a plan that includes at least 30 days of daily backups. In addition to your own due diligence, this should ensure that you have the best possibility of restoring your site.

How do I know that I haven’t missed any files when performing a manual backup of my WordPress site?

As long as you’ve backed up your database and your entire site directory on your webhost, you can be pretty sure that you’ve backed up everything you need. However, with manual backups, you may not get any error messages if a resource fails to download or becomes corrupted during the process. So there’s always the chance your backup may be missing a file or might include a damaged file.

When manually backing up all your site’s files, you’ll want to download the full contents of your site’s root folder. 

If you aren’t sure what folder on your server is your site’s root folder, it’s usually called html or public_html, but it may have another name. You can either ask your host or click around in the file directory until you find the folder that contains wp-admin, wp-content, and wp-includes — that’s your root folder. 

If you host any of your site’s content — like images or video — on another server, you’ll want to make sure to make backups of those, too.

If you want to be certain that your backup worked, you can install it on a staging site and test it to make sure everything is there and that the site backup is functioning correctly.

How many backups should I keep?

If you have a website with a lot of dynamic content, you should keep at least a year’s worth of backups. If your site is fairly static, you may be safe just keeping 30-90 days worth.  

The number of backups you keep really just depends on how likely you think it is that you’ll need to access data from a certain date, or at what point you feel that content is not worth holding onto. Additionally, you may be subject to legal requirements that dictate that website data must be retained for a certain number of days or years, or destroyed after a specific period. 

What makes WordPress backup with a plugin better than manual?

Using a plugin to back up your site is easier, safer, and saves you time. By automating your backups with a plugin like Jetpack, you can focus on design, functionality, content, or marketing. Or maybe just relax and take a nice walk! 

Creating a website or blog to share your passion for fashion and your unique take on style has never been easier. But, with so many different platforms and options available, it can be difficult to decide on the right tools to turn your hobby into an authoritative source for fashion inspiration.

Here are eight steps to create a fashion blog that will help you express your creativity, have fun, and even turn a profit:

1. Find your voice.
2. Name your blog.
3. Choose your host.
4. Pick a theme.
5. Install security and performance plugins.
6. Create a posting schedule and stick to it.
7. Use high-quality photography and draw from your social media accounts.
8. Monetize your fashion blog.

1. Find your voice

A fashion blog gives you the ability to establish a personal brand and focus on subjects that you’re particularly passionate about. You may be tempted to write only about things you think might be popular, but if you write about topics that you connect with, you’ll have a better chance of drawing a devoted readership.

2. Name your blog

Choosing a name can be one of the most difficult parts of starting any business. You’ll want to pick a name for your fashion blog that reflects what you write about and who you are. Do a few searches online to make sure someone else hasn’t already created a website with the same name. 

Once you’ve decided on one, purchase a domain name to match. If you find that the .com domain you really want is already owned by someone else, check to see if other spellings or extensions are available. You may be familiar with .com, .net, and .org domains, but there are also .style, .tips, .reviews, and many others to choose from. But, keep in mind that people, in general, are more familiar with the .com domain and, as a result, might not trust a site that uses a unique domain (like .style) instead. 

3. Choose your host

WordPress is one of the most popular blogging platforms in the world, powering over 41% of all websites. Because it’s so widely used, it’s also incredibly well-supported with thousands of free and professional themes and plugins. This means that you can create a blog that’s as simple or complex as you’d like. 

It also means that when it comes to hosting — the service that stores and displays your website files — there are many great choices. If you’re new to blogging or have never created a website, hosts like BlueHost, DreamHost, Pressable, and LiquidWeb all have one-click WordPress installation options so you can get your site set up in a jiffy. Here are a few of our recommended hosts to get you started.

4. Pick a theme

Before you can start posting to your blog, you’ll need to choose a theme. Think of a theme as your blog’s “outfit,” designed to reflect your brand. Themes are pre-designed with a particular aesthetic or purpose in mind but can be customized with your brand’s colors, typography, and logo.

5. Install security and performance plugins

Don’t let all your hard work go to waste by ignoring the importance of site security and performance. Not only does Jetpack offer tons of themes to choose from, it also offers a comprehensive suite of security and performance features. Automatically back up your site, prevent spam and hacking attempts, and speed up page load time with Jetpack’s affordable Security Daily plan.

6. Create a posting schedule and stick to it

Post on a regular basis. It can be a challenge to get up and write every day when you aren’t feeling inspired or your plans unexpectedly change. It’s hard work and you won’t attract a million followers overnight, but the only way to get there is by being consistent, dedicated, and authentic.

Even if you can’t make the time to post every day, you don’t have to let disruptions or an unpredictable week cause you to lose connection with your readers. Schedule your posts in advance and automate sharing them to social media. WordPress natively allows you to schedule your posts’ publication date and Jetpack’s social media tools help you automatically share them to your social media accounts when they’re published. 

7. Use high-quality photography and draw from your social media accounts

Fashion is a visual art form, so photographs are naturally the best way to convey the beauty, emotion, and fine detail that is integral to style. Whether it’s photos of runway-ready ensembles worn by celebrities, or everyday street fashion, don’t be shy when it comes to uploading images. 

If you find uploading images tedious, there are a variety of plugins you can use to import image feeds from your social media accounts to your website.

Jetpack blocks offer a suite of features available to increase your blog’s visual appeal using uploaded photos as well as social media feeds. Make an aesthetic impact by creating stunning photo galleries, sliders, and even Instagram Stories-like slideshows to showcase video, photo, and blog post content.

Here’s a list of a few of the Jetpack blocks that will help you create a visually-arresting experience for your readers:

• The Image Compare block. Display and compare the differences between two images side by side (e.g. “Who wore it best?”) using a slider.
• The Latest Instagram Posts block. Automatically feed your latest Instagram photos to your site.
• The Pinterest block. Embed Pinterest boards, profiles, and Pins.
• The Story block. Combine photos and videos to create an engaging, tappable full-screen slideshow. Unlike Instagram, stories published using the Story block won’t disappear after 24 hours and you can edit or add to stories after they’re published.

8. Monetize your fashion blog

Once you’ve created your blog and started writing articles, it’s time to decide how you want to monetize (or if you want to — not all hobbies have to be commercialized). 

Here are ways to monetize your fashion blog:

1. Become an affiliate marketer

Affiliate marketing is an extremely popular way for bloggers and influencers to make money online. It’s also responsible for about 16% of online sales. By becoming a brand affiliate, you’ll be positioned to earn money every time a fan clicks on your link to buy a product you recommend.

For example, Kaylah Stroup (of the popular fashion and lifestyle blog The Dainty Squid) built her fashion and lifestyle blog using WordPress and monetizes her efforts with affiliate links to some of her favorite brands. Not sure where to start on your journey to becoming an affiliate? Start here for some popular fashion affiliate resources.

2. Sell your own style

If you knit hats, design jewelry, or create fabric patterns, your fashion website might be the right place to sell your unique crafts. While WordPress does offer robust eCommerce solutions like WooCommerce, the fastest way to get started (especially if you’d like to test the waters first) is by using the Simple Payment Button. This enables visitors to submit online payments through PayPal. 

You can embed these handy buttons directly from the WordPress editor — just create a Simple Payments block with a few clicks and you’ll be set up in no time.

There is a small processing fee associated with using PayPal, but it enables you to secure all transactions and keep more of what you earn. Customers can save time by using their existing PayPal accounts, credit card, or debit card. 

3. Display third-party ads on your site

Use Jetpack to display WordAds on your blog. WordAds places advertisements on pages and posts and has more than 50 partners — including Google AdSense, AppNexus, Amazon A9, AOL Marketplace, Yahoo, and Criteo. 

Each marketer bids to display their promotion in WordAds spots. High competition for exposure ensures that your blog will get ads that generate the highest revenue. It’s super simple — all you have to do is publish WordAds on your site and collect payouts.

Now that you’ve been outfitted with the knowledge needed to create a fashion blog, accessorize it with your own unique style, content, and features. When you’re ready, jump into monetizing your efforts and walk down the runway to a profitable new career.

Jetpack is acquiring WPScan, a WordPress vulnerability database. WPScan is used across the WordPress ecosystem to learn about new vulnerabilities to WordPress core, themes, and plugins. 

WPScan started as a simple Ruby script in 2011 to help identify vulnerabilities in self-hosted WordPress websites. The simple script matured into a large software project and gained popularity amongst the security and WordPress communities.

Vulnerabilities are sourced from around the web, as well as security researchers from both the community and WPScan. In 2021, WPScan was able to double the amount of vulnerabilities added to the database compared to 2020. In total, it has cataloged more than 23,000 WordPress vulnerabilities over the last 10 years. 

“Automattic has sponsored WPScan for years,” says Steve Seear, Jetpack Product Engineering Lead at Automattic. “Not only are we big fans of their work — we actually use it to help power Jetpack Scan.

Besides creating an outstanding security offering, our goal for this acquisition is to make malware data and APIs more open source. We want to ensure that WPScan continues to be a high-quality security resource for the entire WordPress community. To that effect, we’ll be exploring ways to make the API completely free for non-commercial sites.”

As part of the acquisition, two of the WPScan founders, Ryan Dewhurst and Erwan Le Rousseau, will be joining Automattic to continue their work improving security for the WordPress ecosystem. WPScan will continue to operate independently in the near term and may be integrated into Jetpack Scan in the future.

“We’re extremely proud of building WPScan over the last ten years. Automattic has always been a great partner, and we can’t wait to start working more closely together so we can take WPScan to the next level. I’m really excited about working on making our WordPress vulnerability database more open and accessible to the community,“ said Ryan Dewhurst, WPScan founder.

Current WPScan customers won’t be impacted by the acquisition in the near-term and will receive the same high-quality WordPress security service they’ve come to expect.

This month, we’re shipping several under-the-hood improvements and bug fixes to make Jetpack work even better for you and your website. Here are the highlights:

• Since the re-launch of Jetpack VideoPress last month we have made some bug fixes to ensure that the video block experience is fully optimised.
• This release also includes many other bug fixes and improvements — check the changelog for more details.

To use the latest version of Jetpack on your site, update your existing installation or install Jetpack.

Jetpack is more than the sum of its code — it is the collective work of an amazing group of designers, product experts, Happiness Engineers, and code wranglers at Automattic. Does distributed work sound interesting to you? Check out our CEO Matt Mullenweg’s Distributed podcast.

A big thank you to everyone who contributed to this release:

Adrian Moldovan, Allison Levine, André Kallehauge, Atanas Angelov, Biser Perchinkov, Brad Jorsch, Brandon Kraft, Camilla Krag Jensen, Carlos Garcia, Caroline Moore, Chris R, Christopher Finke, Christopher Stevers, Collyn Philleo, Damián Suárez, Daniel, David Lonjon, Dusty Reagan, Eru Penkman, Filipe Varela, Foteini Giannaropoulou, Harris Papazolgou, Ian Ramos, Igor Zinovyev, Ivan Ottinger, Jason Moon, Jasper Kang, Jeremy Herve, John Caruso, John Webb, Karthik Bhat, Kim Brown, Konstantin Obenland, Leo Germani, Louis Laugesen, Luis Felipe Zaguini, Mark Byrne, Mark George, Matthew Denton, Matthew Reishus, Miguel Xavier Penha Neto, Mohaimenul Adnan, Omar Alshaker, Paul Bunkham, Pierre, Robert Franklin, Sami Falah, Sergey Mitroshin, Simon Keating, Steve D, Terence Eden, Tony Arcangelini, Weston Ruter, Yaroslav Kukharuk.

During an internal audit of the Smash Balloon Social Post Feed plugin (also known as Custom Facebook Feed), we discovered several sensitive AJAX endpoints were accessible to any users with an account on the vulnerable site, like subscribers. Some of these endpoints could enable Stored Cross-Site Scripting (XSS) attacks to occur. 

A successful Stored XSS attack could enable bad actors to store malicious scripts on every post and page of the affected site. If a logged-in administrator visits one of the affected URLs, the script may run on their browser and execute administrative actions on their behalf, like creating new administrators and installing rogue plugins.

We reported the vulnerabilities to this plugin’s author via email, and they recently released version 4.0.1 to address them. We strongly recommend that you update to the latest version of the Smash Balloon Social Post Feed plugin and have an established security solution on your site, such as Jetpack Security.

Details

Plugin Name: Smash Balloon Social Post Feed
Plugin URI: https://wordpress.org/plugins/custom-facebook-feed/
Author: Smash Balloon
Author URI: https://smashballoon.com/

The Vulnerabilities

Stored Cross-Site Scripting via Arbitrary Setting Update

Affected versions: < 4.0.1
CVE-ID: TBD
CVSSv3.1: 7.3
CWSS: 80.6

        public function cff_save_settings() {
                $data = $_POST;
                $model = isset( $data[ 'model' ] ) ? $data['model'] : null;
                // return if the model is null
                if ( null === $model ) {
                        return;
                }
                
                // (...)

                $model = (array) \json_decode( \stripslashes( $model ) );
                $general = (array) $model['general'];
                $feeds = (array) $model['feeds'];
                $translation = (array) $model['translation'];
                $advanced = (array) $model['advanced'];
                // Get the values and sanitize
                $cff_locale                                                     = sanitize_text_field( $feeds['selectedLocale'] );
                $cff_style_settings                                     = get_option( 'cff_style_settings' );
                $cff_style_settings[ 'cff_timezone' ]   = sanitize_text_field( $feeds['selectedTimezone'] );
                $cff_style_settings[ 'cff_custom_css' ] = $feeds['customCSS'];
                $cff_style_settings[ 'cff_custom_js' ]  = $feeds['customJS'];
                $cff_style_settings[ 'gdpr' ]                   = sanitize_text_field( $feeds['gdpr'] );
                $cachingType                                                    = sanitize_text_field( $feeds['cachingType'] );
                $cronInterval                                                   = sanitize_text_field( $feeds['cronInterval'] );
                $cronTime                                                               = sanitize_text_field( $feeds['cronTime'] );
                $cronAmPm                                                               = sanitize_text_field( $feeds['cronAmPm'] );
                $cacheTime                                                              = sanitize_text_field( $feeds['cacheTime'] );
                $cacheTimeUnit                                                  = sanitize_text_field( $feeds['cacheTimeUnit'] );
                // Save general settings data
                update_option( 'cff_preserve_settings', $general['preserveSettings'] );
                // Save feeds settings data
                update_option( 'cff_locale', $cff_locale );

                // (...)

                // Save translation settings data
                foreach( $translation as $key => $val ) {
                        $cff_style_settings[ $key ] = $val;
                }
                // Save advanced settings data
                $cff_ajax = sanitize_text_field( $advanced['cff_ajax'] );
                foreach( $advanced as $key => $val ) {
                        if ( $key == 'cff_disable_resize' || $key == 'disable_admin_notice' ) {
                                $cff_style_settings[ $key ] = !$val;
                        } else {
                                $cff_style_settings[ $key ] = $val;
                        }
                }

                // (...)

                update_option( 'cff_ajax', $cff_ajax );
                // Update the cff_style_settings option that contains data for translation and advanced tabs
                update_option( 'cff_style_settings', $cff_style_settings );
                // clear cron caches
                $this->cff_clear_cache();
                new CFF_Response( true, array(
                        'cronNextCheck' => $this->get_cron_next_check()
                ) );
        }

The wp_ajax_cff_save_settings AJAX action, which is responsible for updating the plugin’s inner settings, did not perform any privilege or nonce checks before doing so. This made it possible for any logged-in users to call this action and update any of the plugin’s settings.

Unfortunately, one of these settings, customJS, enables administrators to store custom JavaScript on their site’s posts and pages. Updating this setting is all it would’ve taken for a bad actor to store malicious scripts on the site.

Timeline

2021-10-14 – Initial contact with Smash Balloon
2021-10-18 – We send them details about these vulnerabilities
2021-10-21 – Smash Balloon Social Post Feed 4.0.1 is released

Conclusion

We recommend that you check which version of the Smash Balloon Social Post Feed plugin your site is using, and if it is less than 4.0.1, update it as soon as possible! 

At Jetpack, we work hard to make sure your websites are protected from these types of vulnerabilities. We recommend that you have a security plan for your site that includes malicious file scanning and backups. Jetpack Security is one great WordPress security option to ensure your site and visitors are safe.

Credits

Original researcher: Marc Montpas

Thanks to the rest of the Jetpack Scan team for feedback, help, and corrections.

Today, we are excited to announce a new way to distribute Jetpack products to your clients. We designed an all-new licensing portal to address the needs of agencies, implementers, and other web professionals. If you manage multiple WordPress websites, we think this program will be perfect for your needs. 

We know you have a business to run, and you’re tired of being bogged down with copious invoices, tedious product setup, and multiple accounts. To help solve these issues, we worked with a beta group of web professionals to better understand what Jetpack can do to help their businesses grow and run more efficiently. 

After a lot of collaboration and a great deal of feedback, we built an all-new Jetpack licensing platform. 

Be a part of an exciting future.

Thousands of web professionals already rely on Jetpack to run their businesses, like Lara Prado – CEO & Cofundadora of Lanzadera Online. 

Discovering Jetpack has been a game-changer for our online marketing agency. Website maintenance meant a headache and countless underpaid hours making backups and analyzing the source of website problems. Now, we keep everything centralized in our Jetpack portal, we issue new licenses easily, our websites are backed up daily, thanks to the activity log we see every move made on a website and we restore if needed within a click! Our agency programmers are able to focus on their priorities, our clients are happier, and as the agency owner, these old management headaches have been replaced with bliss.

We’re proud that Jetpack is a vital component of Lara’s business, and we want to help WordPress professionals do even more. We are eager to learn from you, specifically how to make your businesses more efficient and profitable. The more we can automate and build tools that turn ten tasks into one, the more clarity and value we can help you deliver to your clients.

By using our licensing portal, you’ll be a part of our expanded group of early adopters. You’ll have an opportunity to see early concepts, give us feedback on ideas, and we can even meet to learn about ways we can improve the management of your client’s sites. 

Get started today!

Our licensing portal is now open to all agencies and web professionals. When you sign up, you’ll gain access to our easy-to-use license management tools and receive 25% off all of our products. You’ll get:

• One convenient dashboard where you can manage licenses and monitor all of your clients’ backups, scans, and activity logs
• One automated monthly bill
• Quick-start product configuration
• 25% discount on all Jetpack products 
• Early access to the newest site management features

On the Jetpack Agency Sign-up page, you can learn more about what we are offering. You’ll also see a simple sign-up form at the bottom. Once you sign up, we’ll be in contact to grant you access to the Licensing Portal and talk to you about any plan migration you’ll need. That’s right; Jetpack Happiness Engineers will automatically migrate your existing plans.  

Additionally, we will increase your total discount from 25% to 35% if you issue 10 licenses by December 31st, 2021! Take advantage of this opportunity and sign up now.

The only requirement for the program is that you issue 5 licenses within 90 days. This is just the beginning of the agency tools we plan to build, so let us know if there’s something you’d like to see on our roadmap by filling out this feature request form.