Incremental Backup & Restore

Complete WordPress backup and restore solution with automatic chunking, real-time progress tracking, intelligent timeout handling, and enhanced security features.

Description

Incremental Backup & Restore provides a comprehensive and secure solution for backing up and restoring your WordPress website. The plugin automatically handles large sites by breaking backups into manageable chunks and processing them incrementally to avoid server timeouts.

Key Features

• Automatic Chunking - Files and database are automatically split into 9MB chunks
• Incremental Processing - Handles large sites without hitting PHP execution time limits
• Real-time Progress - AJAX-powered progress bars with elapsed and estimated time
• Safe Restore - Intelligent table dropping and duplicate key handling
• Multi-line SQL Support - Properly parses complex CREATE TABLE statements
• Byte-based Progress - Accurate progress tracking during database restore
• Relative Path ZIP - Cross-platform compatible ZIP archives with proper relative paths
• Error Recovery - Robust state management allows resume after interruptions
• Automatic Cleanup - Keeps only the 5 most recent backups
• Security Enhanced - Symlink protection and SQL injection prevention (v1.0.5)

Security Features (NEW in v1.0.5)

• Symlink Protection - Prevents path traversal attacks by excluding symbolic links from backups
• SQL Statement Whitelisting - Only allows DROP, CREATE, and INSERT statements during restore
• Dangerous Pattern Detection - Blocks LOAD_FILE, INTO OUTFILE, EXEC, and other risky SQL operations
• Table Name Validation - Sanitizes and validates all table names to prevent SQL injection
• Enhanced Error Logging - Comprehensive security event logging for audit trails

Technical Specifications

• Maximum chunk size: 9MB
• Files processed per step: 100
• Database rows per batch: 1,000
• Execution time limit: 50 seconds with 10-second safety buffer
• Backup retention: 5 most recent backups
• Security: Nonce verification, capability checks, input sanitization

Backup Features

• Complete file system backup excluding cache and temporary directories
• Full database export with table structure and data
• Automatic chunking when files or databases exceed size limits
• ZIP compression for file backups with relative paths
• SQL format for database backups
• Cross-platform compatibility (Windows, Linux, macOS)
• Symlink exclusion for enhanced security

Restore Features

• Multi-line SQL statement parsing with string delimiter awareness
• Automatic DROP TABLE before CREATE TABLE to prevent conflicts
• INSERT IGNORE for duplicate primary key protection
• Support for complex table schemas including PRIMARY KEY, KEY, UNIQUE KEY
• Byte-based progress calculation prevents overflow issues
• Portable backup archives work across different server environments
• SQL injection prevention with statement whitelisting

Internationalization

• Translation ready with .pot file included
• Text domain: incremental-backup
• Simplified Chinese (zh_CN) and Traditional Chinese (zh_TW) translations available

Installation

1. Upload the incremental-backup-restore folder to /wp-content/plugins/
2. Activate the plugin through the Plugins menu in WordPress
3. Navigate to Tools → Incremental Backup to access the plugin
4. Click "Start Backup" to create your first backup

Manual Installation

1. Download the plugin ZIP file
2. Go to Plugins → Add New → Upload Plugin
3. Choose the downloaded ZIP file and click Install Now
4. Activate the plugin after installation

System Requirements

• WordPress 5.0 or higher
• PHP 7.4 or higher (PHP 8.0+ recommended)
• ZipArchive PHP extension
• MySQL 5.6 or higher / MariaDB 10.0 or higher
• Sufficient disk space (at least 2x your site size recommended)
• Write permissions on wp-content directory
• manage_options capability (Administrator role)

Frequently Asked Questions

How large of a site can this plugin handle?

The plugin uses incremental processing and automatic chunking, so it can handle sites of virtually any size. Each processing step respects PHP execution time limits (50 seconds) and automatically resumes where it left off. Sites with millions of database rows and gigabytes of files are supported.

Where are backups stored?

Backups are stored in /wp-content/backups/ with restricted access via .htaccess. This directory is created automatically when the plugin is activated. Direct web access is denied for security.

Can I download backup files?

Backup files are stored on your server in the backups directory. You can access them via FTP, SFTP, or your hosting control panel. Each backup consists of multiple chunk files (files_TIMESTAMP_chunkX.zip and database_TIMESTAMP_chunkX.sql).

What happens if a backup or restore is interrupted?

The plugin saves its state after each processing step. If interrupted, you can return to the Incremental Backup page and click "Start Backup" or "Restore" again. The process will resume from where it stopped.

How many backups are kept?

By default, the plugin keeps the 5 most recent backups and automatically deletes older ones. This can be modified by changing the IBR_MAX_BACKUPS constant in the plugin file.

Does this backup the uploads folder?

Yes, the complete file system is backed up including the uploads folder. Only the backup directory itself, cache directories, and WooCommerce log directories are excluded.

Can I restore to a different server?

Yes, the plugin creates ZIP files with relative paths, making backups fully portable. Simply:

1. Copy all backup chunk files to the /wp-content/backups/ directory on the target server
2. Access the plugin dashboard
3. Select the backup timestamp and click "Restore"

What SQL statements are supported during restore?

The plugin supports DROP TABLE IF EXISTS, CREATE TABLE (with all index types), and INSERT INTO statements. For security, only these whitelisted statements are allowed. Dangerous operations like LOAD_FILE, INTO OUTFILE, EXEC, and CALL are blocked.

Does this work on Windows servers?

Yes, version 1.0.5 specifically addresses Windows path handling to ensure ZIP archives contain proper relative paths regardless of the server operating system. Tested on Local by Flywheel, XAMPP, and WAMP.

Is this plugin secure?

Yes, version 1.0.5 includes comprehensive security measures:

• Nonce verification on all AJAX requests
• Capability checks (only administrators can access)
• Input sanitization and validation
• Symlink exclusion to prevent path traversal
• SQL injection prevention with statement whitelisting
• Directory protection with .htaccess
• Prepared SQL statements with escaping

Can symbolic links compromise my backup?

No. Version 1.0.5 includes symlink protection. All symbolic links are automatically excluded from backups to prevent path traversal attacks where malicious symlinks could expose sensitive system files.

What happens if someone modifies a backup file?

The restore process validates all SQL statements against a whitelist. Only DROP TABLE, CREATE TABLE, and INSERT statements are allowed. Dangerous operations like file system access, code execution, or stored procedure calls are automatically blocked and logged.

Screenshots

1. Main dashboard showing available backups with size and date information
2. Backup progress screen with real-time file and database progress bars
3. Restore progress with byte-based tracking and statement count
4. Completed backup notification with automatic cleanup
5. Security-enhanced backup process excluding symlinks

Changelog

1.0.5 - 2025-12-05

• SECURITY: Added symlink exclusion to prevent path traversal attacks
• SECURITY: Implemented SQL statement whitelisting (DROP, CREATE, INSERT only)
• SECURITY: Added dangerous SQL pattern detection (blocks LOAD_FILE, INTO OUTFILE, EXEC, CALL)
• SECURITY: Enhanced table name validation to prevent SQL injection
• SECURITY: Comprehensive error logging for security events
• Fixed: ZIP archives now contain proper relative paths instead of absolute Windows paths
• Enhanced: Cross-platform path normalization for Windows, Linux, and macOS
• Improved: Path validation to prevent absolute paths in backup archives
• Updated: Database rows per batch increased to 1,000 for faster backups
• Updated: Chunk size optimized to 9MB for better hosting compatibility
• Verified: Backup portability across different server environments and operating systems
• Updated: File path handling now works correctly on Local by Flywheel, XAMPP, WAMP, and standard hosting

1.0.4 - 2025-12-01

• Fixed: Database restore progress now uses byte-based calculation to prevent statement count overflow
• Enhanced: Multi-line SQL statement parsing with proper string delimiter awareness
• Improved: Automatic DROP TABLE before CREATE TABLE to prevent schema conflicts
• Added: INSERT IGNORE for all INSERT statements to handle duplicate primary keys
• Optimized: Restore batch processing now handles 100 statements per cycle
• Updated: Progress tracking displays accurate percentages throughout restore process
• Verified: Support for complex CREATE TABLE statements with PRIMARY KEY and KEY definitions

1.0.3

• Added real-time elapsed and estimated time display
• Improved error handling and recovery mechanisms
• Enhanced AJAX progress polling reliability
• Added confirmation dialogs for critical actions
• Fixed progress bar display issues on slow connections

1.0.2

• Implemented automatic chunking for large files and databases
• Added state persistence for resumable backups and restores
• Improved memory management during processing
• Fixed ZIP file corruption issues with large archives
• Enhanced database export efficiency

1.0.1

• Initial public release
• Basic backup and restore functionality
• File and database backup support
• Progress tracking interface
• AJAX-based incremental processing

Upgrade Notice

1.0.5

CRITICAL SECURITY UPDATE: Adds symlink protection and SQL injection prevention. Highly recommended for all users. Also fixes Windows path issues and improves performance with optimized chunk size (9MB) and faster database processing (1,000 rows per batch).

1.0.4

Critical update: Fixes database restore progress calculation overflow and enhances multi-line SQL parsing. Highly recommended for all users.

1.0.3

Adds time estimation features and improves error recovery. Recommended update for better user experience.

1.0.2

Major stability improvements for large sites. Upgrade recommended if you experienced timeout issues.

Additional Information

Performance Optimization

The plugin is optimized for various hosting environments:

• Shared Hosting - 9MB chunks prevent memory exhaustion
• VPS/Dedicated - Can handle sites with millions of rows
• Local Development - Fast backups with optimized batch sizes
• Cloud Hosting - Compatible with AWS, Google Cloud, DigitalOcean

File Exclusions

The following directories are excluded from backups:

• /wp-content/backups/ - Plugin backup directory
• /wp-content/cache/ - Cache files
• /wp-content/uploads/wc-logs/ - WooCommerce logs

To exclude additional directories, modify the build_file_list() method in the plugin file.

Database Optimization

For optimal performance with large databases:

• Tables with < 5,000 rows: Fast processing
• Tables with 5,000-100,000 rows: 1,000 rows per batch
• Tables with > 100,000 rows: May take several minutes

The plugin automatically handles tables of any size without timeout errors.

Support

For bug reports, feature requests, or security concerns:

• Email: support@example.com
• GitHub: https://github.com/yourusername/incremental-backup-restore

Privacy Policy

This plugin does not collect, store, or transmit any user data to external servers. All backups are stored locally on your WordPress server. No analytics, tracking, or telemetry is included.

Compatibility

Tested and verified on:

• Local by Flywheel (Windows, macOS)
• XAMPP (Windows)
• WAMP (Windows)
• MAMP (macOS)
• Standard Linux hosting (cPanel, Plesk, DirectAdmin)
• Cloud platforms (AWS, Google Cloud, DigitalOcean)
• Managed WordPress hosting (WP Engine, Kinsta, Flywheel)

Known Limitations

• Backup files are stored on the same server (not suitable as the sole backup solution)
• Very large individual files (> 2GB) may cause issues on some hosting environments
• Requires ZipArchive PHP extension (standard on most hosts)
• Not compatible with extremely restricted shared hosting with disabled PHP functions

Recommended Practices

1. Test restores regularly - Verify backups work by testing restore on a staging site
2. Off-site storage - Download backup files and store them off-site for disaster recovery
3. Before updates - Always create a backup before updating WordPress, themes, or plugins
4. Monitor disk space - Ensure sufficient disk space for backups (2x site size recommended)
5. Security - Keep WordPress and this plugin updated for latest security patches

Credits

Developed by Kang JL Version 1.0.5 released on December 5, 2025

Special thanks to the WordPress community for feedback and testing.

Technical Documentation

Constants

You can customize plugin behavior by modifying these constants in the plugin file: