Guide to installing and using Backup Restore Verifier Pro for WordPress.
backup-restore-verifier-pro folder to /wp-content/plugins/, or install the zip with Plugins → Add New → Upload Plugin.DISABLE_WP_CRON is true, set up a real system cron that requests wp-cron.php, otherwise scheduled backups do not run.Requirements: WordPress 6.3 or newer, PHP 7.4 or newer with the ZipArchive extension. Encryption needs libsodium with Argon2id; FTP needs the PHP ftp extension. Multisite is not supported.
A backup is one zip with a manifest and SHA-256 checksums. Choose which components to include: database, plugins, themes, uploads.
Backups are stored in wp-content/brverify-working/, which is protected by deny rules. On Nginx, add a rule that denies direct access to that folder.
Local protected storage is always used. You can add: S3-compatible storage (Amazon S3 and others), Backblaze B2, SFTP, FTP/FTPS, Dropbox, Google Drive, OneDrive and WebDAV. With several destinations selected, one backup goes to every one of them. A failing remote destination does not remove the finished local copy. Credentials are entered under Advanced; see External Services and Privacy below for what is sent and stored.
In incremental mode only files changed since the previous backup are packed. The database dump is a full dump on every run. A restore needs the complete chain of backups; retention keeps a parent backup as long as a kept child needs it.
Under Migrate: choose a backup, enter the target URL, then plan, dry run, confirm and run. URLs and paths are rewritten, including serialized and JSON data, and the table prefix can change. The existing site is snapshotted first and rolled back if the run fails. Migration packages (zip with manifest and checksums) can be exported and imported.
When switched on, the database dump inside each new backup is encrypted with libsodium (Argon2id key derivation, XChaCha20-Poly1305 stream).
wp-config.php, so anyone who can read that file can decrypt that host's backups.Optional. Takes a backup right before plugin, theme and WordPress core updates, with its own rules (update types, skip window, optional remote upload, optional block of the update when the backup fails) and its own retention.
The plugin contacts a service only for the feature you switch on. It sets no cookies and collects no usage statistics.
Data flows from your site to the destination (the backup archive, a file name, and requests to list or delete archives) and back to your site when you restore, check or migrate from a stored archive. An archive is a copy of your database and the files you chose, so it can contain personal data of your users and visitors. The credentials you enter are saved in the WordPress options table without extra encryption and are included in the database part of every archive.
| Service | Data sent |
|---|---|
| S3-compatible storage (for example Amazon S3) | Archive data, object names and list/delete requests to the endpoint and bucket you enter. Requests carry your access key ID and a signature computed with the secret key; the secret key itself is not sent. |
| Backblaze B2 | As S3-compatible storage, through the S3-compatible endpoint you enter. |
| SFTP | Archive data, file names and list/delete requests to the host and port you enter, authenticated with the user name and the password or private key (the private key signs the login locally and is not sent). |
| FTP / FTPS | Archive data, file names and list/delete requests to the host and port you enter, with the user name and password. The connection is not encrypted unless you tick the FTPS option. |
| Dropbox (api.dropboxapi.com, content.dropboxapi.com) | Archive data, file paths and list/delete requests, plus the app key, app secret, authorization code and access/refresh tokens used to sign in. |
| Google Drive (oauth2.googleapis.com, www.googleapis.com) | Archive data, file names, the folder ID and list/delete requests, plus the client ID, client secret, authorization code and access/refresh tokens used to sign in. |
| OneDrive (login.microsoftonline.com, graph.microsoft.com) | Archive data, file paths and list/delete requests, plus the application ID, client secret, authorization code and access/refresh tokens used to sign in. |
| WebDAV | Archive data, file paths and list/delete (PROPFIND) requests to the URL you enter, with the user name and password (HTTP Basic or Digest). |
Each of these services has its own terms and privacy policy.
wp-content/brverify-working/ unless you add a remote destination. The newest 3 are kept by default (Settings → Retention).By default your settings, backup history and backup files are kept; scheduled events and transients are removed. Tick Delete all data when the plugin is deleted in Settings first to remove all plugin options, tables, user meta and the backup files.
It proves that the archive is intact (checksums, format, safe paths). It does not start a copy of the site.
On first load the plugin moves the old options, tables and backup folder to the new names. Backups that pre-release builds made with database encryption turned on used a different header format and cannot be opened by this version; make new backups after upgrading.
E-mail admin@007aj.com.