Zain Hassan Zain Hassan Integration & automation engineer
ZHBackup Icon

ZHBackup

Full-site WordPress backup, restore, and migration with structured database packages, scheduled automatic backups, restores that retry and resume after network drops, server-side restores, root folder support, and safe cleanup tools.

Version 2.4.2 WordPress.org Ready GPL v2 Licensed PHP 7.4+ WP 5.8 – 7.1

Built for Real WordPress Migrations

Package the database, media, plugins, themes, selected wp-content folders, root files, and optional custom root folders — on demand or on a schedule — then restore through small traceable steps that survive network drops.

Structured Database Package

Export schemas, row chunks, and separate large-value files so post meta, options, and page-builder data can be restored in smaller, traceable operations.

Restores That Retry and Resume

Every operation runs in small AJAX steps, and each step retries automatically with backoff after network drops or gateway timeouts. A Resume button continues a saved job after a hard failure — one dropped request no longer strands a restore.

Browser Upload or Server Restore

Upload backups through the browser in resumable chunks — assembly is size-verified and survives interrupted requests — or place .zip and .zhbackup archives on the server and restore them from the incoming-backups table.

Find & Replace with Dry-Run

Update URLs safely across serialized PHP data, JSON-escaped URLs, Elementor widget data, options, and post meta. Runs as a chunked, resumable job with a dry-run preview that counts changes before anything is written.

Scheduled Backups

Automatic daily or weekly full-site backups via WP-Cron, processed in resumable background bursts. The last run's status is shown in Settings, and the retention policy prunes old scheduled backups automatically.

Full-Site Backup Scope

Back up the database, uploads, plugins, themes, mu-plugins, selected wp-content folders, root files, and optional first-level folders from the WordPress root — with a manifest written into every archive.

Built-In Safety Checks

Incomplete backups are flagged and blocked from restore, uploaded archives are protected from retention deletion, multisite/single-site mismatches are refused with a clear message, and atomic locks prevent overlapping job steps.

Post-Restore Cleanup

Review the restored site first, then run a saved cleanup plan manually to remove stale plugins, uploads, themes, and selected root-folder files. Leftover staging folders from an interrupted restore are swept automatically.

See ZHBackup in Action

Seven focused admin screens cover backup creation, stored backup management, import, migration, cleanup, server checks, scheduling, retention, and optional updates.

ZHBackup Export Page
1

Create a Structured Backup

Choose the database, root files, default wp-content folders, optional folder groups, and the archive format before starting a full-site backup. Version, info icons, and grouped options keep the export screen compact.

ZHBackup Existing Backups
2

Manage Existing Backups

Review backup files in a clear table with contents, size, date, and quick actions for download, restore, or delete. Large-file guidance shows the server path for safer direct downloads when needed.

ZHBackup Import Page
3

Restore from Upload or Server

Drag a .zip or .zhbackup file into the chunked browser uploader, or place backups in the server storage directory and restore them from the server import table.

ZHBackup Find and Replace
4

Safe URL Migration

Enter the old and new URLs, preview the change with a dry run that counts matches without writing, then run serialized-safe Find & Replace as a chunked, resumable job across WordPress tables. The recommended prefix-table option avoids touching unrelated tables.

ZHBackup Restore Cleanup
5

Review, Then Clean Up

Restore cleanup is separated from the restore itself. ZHBackup shows pending cleanup plans only when stale files need review, so administrators can verify the site before removing older files.

ZHBackup Storage and Health Check
6

Check Storage and Server Health

Confirm the backup storage path, outside-webroot status, ZIP engine, PHP limits, upload limits, uploads directory, and free disk space from one settings screen.

ZHBackup Retention Policy and Optional Updates
7

Schedule Backups and Set Retention

Turn on automatic daily or weekly backups and review the last run's status, then configure the WP-Cron retention policy by count or age — retention only ever deletes backups the plugin created. The newsletter signup is optional, consent-based, and can be dismissed without limiting plugin features.

Up and Running in 30 Seconds

Install ZHBackup the same way you install any WordPress plugin.

Install the Plugin

Go to Plugins → Add New in your WordPress admin and search for ZHBackup. Click Install Now.

Activate

Click Activate on the plugins page. ZHBackup appears in your admin sidebar immediately.

Create Your First Backup

Navigate to ZHBackup → Export, select what to include, choose .zip or .zhbackup, and hit Create Backup.

Safer Storage, Cleaner Migrations

Version 2.4.2 keeps production and staging backups in site-unique folders, lists uploaded archives in Existing Backups without letting retention delete them, speeds up large database exports, and is tested with WordPress 7.1. Cross-site restores now rewrite URLs inside large page-builder fields, http/https and encoded variants, and no longer write new backups into a previous site’s folder.

Plugin Details

  • Stable tag2.4.2
  • Requires WordPress5.8+
  • Tested up to7.1
  • Requires PHP7.4+
  • LicenseGPL-2.0-or-later
  • License URIGNU GPL v2
  • Contributorszainhassandeveloper

What's New in 2.4.2

  • Existing production and staging installs that still shared one outside-webroot backup folder now write new backups to a site-unique folder. Older archives stay listed, downloadable, and restorable — nothing is moved or deleted — and retention only deletes from this site’s own folder.
  • Uploaded backups now appear in Existing Backups as well as Import. They stay in the incoming folder so retention still cannot delete a file you uploaded to restore.
  • Faster large-database exports without changing the dump format: table column/index metadata is cached for the current table, and each AJAX step uses more of the host’s time limit when it is safe.
  • WordPress 7.1 compatibility: tested up to 7.1.
  • Fixed cross-site migrations leaving old-site URLs in large page-builder data. Column values over 128 KB (typically Elementor page data) now go through the same serialized/JSON-safe replacement as every other value.
  • Fixed backups being written into a previous site’s folder after a migration. The saved storage directory is rewritten to this installation’s own directory and re-validated on every use.
  • Fixed a restore ending with “Invalid nonce” on an import that had actually succeeded when the backup used a different database table prefix. Role keys are renamed as soon as the users table is restored and the session is renewed again at the end.
  • Improved URL migration coverage during restore: besides the exact site URL, the opposite scheme (http vs https), protocol-relative references, and URL-encoded forms of the old address are replaced too.
  • Improved JSON handling in Find & Replace and restores: values with no match are no longer re-encoded, and replaced values keep the source’s encoding style.
  • Also in 2.4.x: scheduled daily/weekly backups, restores that retry and resume after network drops, dry-run Find & Replace, and foreign-key-safe restores over an existing site.

WordPress.org-Compliant by Design

ZHBackup is built without obfuscated PHP, hidden tracking, forced accounts, license activation, or external calls during backup and restore workflows.

Security Practices

Inputs are sanitized, outputs are escaped, nonces protect form submissions, and capability checks guard every action. Backup storage is protected with server rules and guard files when stored inside the site.

No backup, restore, migration, import, export, cleanup, or find-and-replace operation requires a license key or account.

Optional External Service

The only external request is the optional newsletter signup on the Settings page. It sends the submitted email address, site URL, plugin slug, and plugin version only after an administrator submits the form.

Terms of service · Privacy policy

Frequently Asked Questions

Quick answers to common questions about ZHBackup.

Does this plugin work on shared or managed hosting?
Yes. ZHBackup uses chunked export, upload, import, and restore steps so each request stays small. The database is restored table by table from a structured package instead of replaying one large SQL file.
How large of a site can this handle?
There is no fixed size limit in the plugin. Very large sites depend on available disk space, PHP limits, and database performance, but ZHBackup is designed to process large file sets and databases in small resumable steps.
How does ZHBackup handle large Elementor or page-builder data?
Large database values are stored separately from normal row chunks and restored in smaller append operations. From 2.4.2, values over 128 KB (typically Elementor page data) also go through the same serialized/JSON-safe URL replacement as every other field during a cross-site restore, so old-site URLs are no longer left behind in page-builder content.
What is the difference between .zip and .zhbackup?
Both formats can contain the same backup data. .zip is a standard archive format. .zhbackup is ZHBackup's optimized archive format for this plugin. Both support the structured database package.
Can I restore a backup uploaded by FTP or File Manager?
Yes. Upload a .zip or .zhbackup file to the backup storage directory shown on the Import screen. It will appear in Existing Backups and in the server backup table, where you can restore it directly. Uploaded archives stay in the incoming folder, so retention never deletes a file you uploaded to restore.
Where are backups stored?
The plugin automatically selects the most secure location. It prefers a directory outside the webroot (not accessible via browser), using a site-unique folder name so production and staging installs on the same account do not share backups. If that is not possible it falls back to wp-content/zhbackup-backups/, where files are protected by .htaccess rules. Existing backups from an older shared folder remain listed after the update.
Can I import a backup from a different domain?
Yes. After importing, use the built-in Find & Replace tool to update old URLs to your new domain. It handles serialized data safely, including Elementor widget data, and a dry-run preview lets you count the changes before anything is written.
Can backups run automatically on a schedule?
Yes. Turn on daily or weekly scheduled backups from the Settings page. They run via WP-Cron in small resumable bursts so they work on shared hosting, the last run's status is shown in Settings, and the retention policy prunes old scheduled backups automatically.
What happens if my connection drops during a restore?
The restore recovers on its own. Each step retries automatically with increasing delays after network drops or gateway timeouts, and if a step still fails, a Resume button continues the saved job from where it stopped — a single dropped request no longer strands a half-restored site.
Does ZHBackup support WordPress multisite?
Backups can only be restored into the same kind of install they came from: a multisite backup into a multisite, a single-site backup into a single site. ZHBackup detects a mismatch before the restore starts and refuses with a clear message instead of half-breaking the install.
Can I include custom folders from the WordPress root?
Yes. The export screen can include optional first-level folders from the WordPress root. WordPress core folders such as wp-admin, wp-includes, and wp-content are handled separately or excluded automatically.
What is post-restore cleanup?
Restore copies files from the backup first. If older files or folders still exist on the destination site, ZHBackup saves a cleanup plan. After you verify the restored site, go to ZHBackup → Cleanup to remove stale files that are not present in the backup.
Will cleanup fail the restore if file permissions block deletion?
No. Cleanup is manual and best-effort. Permission-related deletion failures are logged as warnings so the restore can remain complete and you can review any paths that need manual attention.
Will importing overwrite my existing site?
Yes. Importing a backup will replace your database and files. Always create a fresh backup of your current site before importing.
Does this plugin make external API calls?
Yes, but only for the optional newsletter signup on the Settings page after an administrator explicitly enters an email address and submits the form. No data is sent during backup, restore, migration, import, export, or find-and-replace operations.
Is the email signup required?
No. The email signup on the Settings page is completely optional and can be dismissed permanently. The plugin is fully functional without it.
Is the .zhbackup format free to use?
Yes. The .zhbackup export format is included for free and does not require any license key or activation page.

Start Protecting Your WordPress Site

Install ZHBackup 2.4.2 and create structured full-site backups — on demand or on a schedule — with site-unique storage, restores that retry and resume on their own, safer URL migrations, and controlled cleanup. Tested with WordPress 7.1.

WhatsApp