Yes \u2014 the plugin is completely free and fully functional on its own. You can create, download and restore local backups without any account or external service. The optional<\/strong> Yedekalma cloud service (for off-site\/multi-cloud storage and scheduling) has its own free tier (1 GB \/ 1 month, no credit card) with usage-based billing afterwards, but you are not required to use it.<\/p><\/dd>\nDo I need an account?<\/h3><\/dt>\nNo. Local backup, download and restore work without an account or any external connection. An account is only needed if you choose to use the optional Yedekalma cloud service for off-site storage.<\/p><\/dd>\n
Where are my backups stored?<\/h3><\/dt>\nBy default, local backups are stored on your own site under wp-content\/uploads\/yedekalma-backups\/<\/code>. If you connect the optional cloud service, backups are packaged on your own server and uploaded directly to your chosen storage (Google Drive, S3, your own FTP\/SFTP, etc.) \u2014 never stored on the Yedekalma servers; only backup metadata (date, size, status) is kept in our data center located in Turkey (turkticaret.net infrastructure); data is not transferred abroad (KVKK compliant).<\/p><\/dd>\nAre my keys and tokens secure?<\/h3><\/dt>\nYes. The optional cloud API token you enter in WordPress is encrypted locally using AES-256-CBC with your site's unique AUTH_KEY. With BYOK, backups are encrypted with AES-256 on your own server before upload, and your encryption passphrase is stored only on your own site<\/strong> (encrypted with your AUTH_KEY) \u2014 it is never sent to or stored on the Yedekalma servers, so nobody but you can open the archives.<\/p><\/dd>\nHow does restore work?<\/h3><\/dt>\nRestore runs directly inside your WordPress admin. Open Yedekalma \u2192 Backups<\/strong>, click Restore<\/strong> on a backup, choose full \/ files-only \/ database-only, and confirm \u2014 the plugin downloads (or reads the local file) and applies it on your own server. This works for local backups with no account. If you use the optional cloud service, the same in-admin restore applies backups pulled from your own cloud storage.<\/p><\/dd>\nWhat happens to my backups if I uninstall the plugin?<\/h3><\/dt>\nLocal backups stored under wp-content\/uploads\/yedekalma-backups\/<\/code> stay on your site unless you delete them. If you used the optional cloud service, those backups remain in your own connected cloud storage. Deleting the plugin does not delete your backup files or any optional cloud account.<\/p><\/dd>\nIs Multisite (WP Multi-site) supported?<\/h3><\/dt>\nFull support is not available in V1 \u2014 it requires a separate plugin instance per site. This is on our V2 roadmap.<\/p><\/dd>\n
Which backup types are supported?<\/h3><\/dt>\n\n- Full Backup<\/strong>: WordPress files (themes, plugins, uploads) + database.<\/li>\n
- Files Only<\/strong>: Site files.<\/li>\n
- Database Only<\/strong>: MySQL dump.<\/li>\n<\/ul><\/dd>\n
Is it KVKK\/GDPR compliant?<\/h3><\/dt>\nYes. When you use the optional cloud service, explicit consent is obtained during registration for data transfers (KVKK Article 9).<\/p><\/dd>\n\n<\/dl>\n\n\n
1.10.2 \u2014 2026-07-15<\/h4>\n\n\n- NEW: Cleaned settings page to focus on custom language preferences and system info.<\/li>\n
- NEW: Made Settings (Ayarlar) page visible in the WordPress left sidebar menu.<\/li>\n<\/ul>\n\n
1.10.1 \u2014 2026-07-15<\/h4>\n\n\n- NEW: Internationalization added with translations for English, German, Russian, Arabic, and Turkish.<\/li>\n
- NEW: Added new SVG brand logo and official asset icons.<\/li>\n
- FIX: Resolved permission issue with hidden settings page access.<\/li>\n<\/ul>\n\n
1.10.0 \u2014 2026-07-13<\/h4>\n\n\n- SECURITY: The chunked-backup progress state is stored in a transient with a plugin-specific key prefix (yedekalma_chk_) so it can never collide with another plugin's transients.<\/li>\n
- SECURITY: The backup encryption passphrase is now encrypted (with the site's AUTH_KEY) before it is written into that transient \u2014 it is never persisted in plaintext.<\/li>\n
- PERFORMANCE: Bulky per-file backup state arrays (file list, manifest, reference file list) are kept in private system temp files instead of the transient, keeping the option\/transient store small.<\/li>\n<\/ul>\n\n
1.9.0 \u2014 2026-07-08<\/h4>\n\n\n- NEW: Multi-channel source size measurement for the cloud \"Kontrol Et\" (check) flow.<\/li>\n<\/ul>\n\n
1.8.19 \u2014 2026-07-04<\/h4>\n\n\n- COMPLIANCE: PHP
memory_limit<\/code>\/set_time_limit<\/code> are now raised only inside the specific backup\/restore endpoints that need them (via a helper), never as a global default on init.<\/li>\n- COMPLIANCE: Replaced all raw cURL calls with the WordPress HTTP API (
wp_remote_*<\/code>); large streaming uploads use the http_api_curl<\/code> hook as recommended.<\/li>\n- COMPLIANCE: Restore-time
wp-config.php<\/code> update now uses the WordPress Filesystem API (WP_Filesystem<\/code>) with strict value sanitization; no .bak<\/code> copy is left in the site.<\/li>\n- COMPLIANCE: Renamed the internal notify-card guard constant to use the full
YEDEKALMA_<\/code> prefix.<\/li>\n<\/ul>\n\n1.8.18 \u2014 2026-07-03<\/h4>\n\n\n- FEATURE: Keyset pagination for database dumping to optimize performance on large sites.<\/li>\n
- FEATURE: Native .sql.gz compression support for streaming database backups.<\/li>\n
- FEATURE: Chunked execution flow for database and file backups.<\/li>\n<\/ul>\n\n
1.8.16 \u2014 2026-07-02<\/h4>\n\n\n- UX: Removed the \"Bulut Hesab\u0131na Ba\u011flan\" (Connect to Cloud Account) link from the admin submenu. The connect page stays accessible from the in-page CTA; only the sidebar menu item is hidden (via remove_submenu_page) to keep the menu clean.<\/li>\n<\/ul>\n\n
1.8.15 \u2014 2026-07-01<\/h4>\n\n\n- COMPLIANCE (Guideline 5): No built-in feature is locked behind an account any more. When no Yedekalma account is connected, the plugin now runs fully in local mode by default \u2014 one-click backup (files + database), local\/FTP\/SFTP targets, download and restore all work with no account. The optional cloud connection only changes where backups are delivered.<\/li>\n
- PRIVACY (Guideline 6 \/ no phone-home): Removed automatic anonymous registration and anonymous heartbeat. The plugin now makes NO external connection unless you deliberately connect the optional Yedekalma cloud service (enter an API token). This matches the \"External services\" section exactly.<\/li>\n
- SECURITY: Hardened the local backup directory (wp-content\/uploads\/yedekalma-backups) \u2014 Apache 2.2 & 2.4 deny rules + index.php\/index.html + directory-listing off, and backup archive filenames now include an unguessable random token so the file cannot be reached by direct URL (important on Nginx where .htaccess is ignored). Raw SQL dumps are written only to the private system temp dir and removed after archiving.<\/li>\n<\/ul>\n\n
1.8.14 \u2014 2026-06-30<\/h4>\n\n\n- FIX: Recent\/local backup list showed the wrong date & time. Timestamps are stored in the site's local timezone, but the list rendered them through get_date_from_gmt(), which re-applied the UTC offset. Now displayed with mysql2date() (no double conversion) on both the dashboard and the backups list.<\/li>\n<\/ul>\n\n
1.8.13 \u2014 2026-06-30<\/h4>\n\n\n- FIX: Local backup could fail at finalization with \"archive could not be opened\" when the file list resolved to zero entries (e.g. database-only, or an empty temporary archive). libzip does not write an empty archive to disk, so re-opening it failed. The intermediate and finalize steps now open the archive with the CREATE flag, making the chunked backup resilient.<\/li>\n<\/ul>\n\n
1.8.12 \u2014 2026-06-30<\/h4>\n\n\n- UX: Local backup now runs in time-sliced chunks, so the progress bar advances smoothly file-by-file (it no longer appears stuck at 50% on large sites). Added a \"Show details\" log panel that shows, in real time, which file is currently being added (n\/total).<\/li>\n<\/ul>\n\n
1.8.11 \u2014 2026-06-30<\/h4>\n\n\n- PRIVACY: True client-side BYOK. The backup encryption passphrase is now entered and stored only on your own site (Yedekalma \u2192 Connect Cloud \u2192 Backup Encryption), encrypted with your AUTH_KEY. It is never sent to or stored on the Yedekalma servers \u2014 the key stays entirely with you. Backup\/restore\/verify read the passphrase locally.<\/li>\n<\/ul>\n\n
1.8.10 \u2014 2026-06-30<\/h4>\n\n\n- FIX: Local backup produced an empty archive (\"Yedek ar\u015fivi bo\u015f \u00fcretildi\") on sites with many files. ZipArchive keeps a file handle open per added file until close(), so large sites hit the OS open-files limit and close() failed silently. The builder now adds files in batches (close\/reopen every 400 files) and verifies close() succeeded. The local backups folder is also excluded from the archive (prevents bloat and self-inclusion).<\/li>\n<\/ul>\n\n
1.8.9 \u2014 2026-06-30<\/h4>\n\n\n- FIX: Local backup could appear stuck at 50%. The archive build now runs without the default time\/memory limits (and continues server-side even if the connection drops), a lock prevents duplicate concurrent builds, and the admin progress poller now handles request timeouts\/errors (retries, and surfaces the real error instead of freezing).<\/li>\n
- HARDENING: Additional output escaping (esc_attr\/esc_html) on schedule selects and the notification field; wp_unslash on the restore mode input.<\/li>\n<\/ul>\n\n
1.8.8 \u2014 2026-06-30<\/h4>\n\n\n- COMPLIANCE: Clarified that the plugin is fully functional standalone \u2014 local one-click backup, download and restore work with no account and no external service; the Yedekalma cloud service is clearly documented as optional (Guidelines 5 & 6). Updated readme\/description and FAQ accordingly.<\/li>\n
- FIX: Removed the diagnostic log file written under wp-content\/uploads; diagnostic steps now go to PHP error_log() only when WP_DEBUG is on (no predictable, web-accessible log file).<\/li>\n
- SECURITY: The temporary wp-config.php safety copy made during a config-restore is now written to the system temp directory (outside the web root) instead of next to wp-config.php, so database credentials are never left in a downloadable file.<\/li>\n<\/ul>\n\n
1.8.7 \u2014 2026-06-30<\/h4>\n\n\n- NEW: Use the plugin without a Yedekalma account. On activation the site is registered anonymously (technical info only \u2014 domain & versions, no personal data) so it can back up and restore right away.<\/li>\n
- NEW: \"Where should backup notifications go?\" email field with double opt-in verification and an optional product-updates consent. Entering an email turns the install into a lead; signing up on yedekalma.com later with the same address automatically links this site to your account (no duplicate accounts).<\/li>\n
- PRIVACY: Marketing consent is stored separately from transactional notifications; commercial messaging is gated behind explicit opt-in.<\/li>\n<\/ul>\n\n
1.8.6 \u2014 2026-06-30<\/h4>\n\n\n- SECURITY: Real client-side AES-256 backup encryption (BYOK). When a passphrase is set, the archive is encrypted with AES-256 (CBC + HMAC) on your own server before upload and can only be opened with your passphrase. Each encrypted backup is self-verified (decrypt + checksum) before upload, so an unrecoverable archive is never sent. Restore and integrity-check transparently decrypt.<\/li>\n<\/ul>\n\n
1.8.5 \u2014 2026-06-29<\/h4>\n\n\n- INFRA: Panel servers migrated to Turkey (turkticaret infrastructure); data is not transferred abroad (KVKK). Removed unverified certification wording.<\/li>\n<\/ul>\n\n
1.8.4 \u2014 2026-06-29<\/h4>\n\n\n- RELIABILITY: Added a read-only backup integrity verification endpoint (downloads + checks SHA-256, archive and completion marker; never restores), so backups taken via the plugin can be auto-verified.<\/li>\n<\/ul>\n\n
1.8.3 \u2014 2026-06-29<\/h4>\n\n\n- RELIABILITY: Incremental backups now compare real file mtime (not just size), so files whose content changes without a size change are correctly captured.<\/li>\n<\/ul>\n\n
1.8.2 \u2014 2026-06-29<\/h4>\n\n\n- SECURITY: SSRF protection on restore download URLs (https + public-IP only). DATA INTEGRITY: DB dumps now write and verify a completion marker on the plain .sql path too (partial dumps are refused on restore).<\/li>\n<\/ul>\n\n
1.8.1 \u2014 2026-06-29<\/h4>\n\n\n- CLARITY: When the selected storage target is not configured (e.g. \"My Own Storage \/ FTP-SFTP\" chosen but no credentials entered), the backup now fails with a clear, actionable message instead of a cryptic \"no direct upload\" error.<\/li>\n<\/ul>\n\n
1.8.0 \u2014 2026-06-29<\/h4>\n\n\n- CLARITY: Renamed the \"Bandwidth\" quota to \"Backup Quota\" (Yedekleme Kotas\u0131) with a one-line explanation, so customers understand the monthly quota measures the data our engine packages and sends to your cloud \u2014 not the central server's bandwidth.<\/li>\n<\/ul>\n\n
1.7.9 \u2014 2026-06-29<\/h4>\n\n\n- RELIABILITY: Full & files-only backups can now complete on restricted hosts (exec disabled) via chunked, time-sliced processing. Restore transparently handles the gzipped SQL stored inside the chunked archive.<\/li>\n<\/ul>\n\n
1.7.8 \u2014 2026-06-29<\/h4>\n\n\n- RELIABILITY: Chunked database restore now verifies a completion marker and aborts loudly on a truncated\/corrupt archive instead of silently applying a partial restore (data-loss protection).<\/li>\n<\/ul>\n\n
1.7.5 \u2014 2026-06-29<\/h4>\n\n\n- COMPLIANCE: Removed all trial-expired premium locking screens and replaced them with non-blocking warning notices, fully complying with WordPress.org Guideline 5 (Trial\/Expired Software).<\/li>\n<\/ul>\n\n
1.7.4 \u2014 2026-06-29<\/h4>\n\n\n- SECURITY: Enforced strict Zero-Server-Storage architecture. Restores and backups are now processed strictly client-side or streamed direct-to-cloud; no temporary backup files or SQL dumps are ever cached\/stored on the central backup servers.<\/li>\n
- COMPLIANCE: Removed the custom updater class to fully comply with official WordPress.org Plugin Guidelines (Section 3: \"Plugins may not bypass the update system\").<\/li>\n
- COMPATIBILITY: Compatibility enhancements and optimization for PHP 8.x and latest WordPress versions.<\/li>\n<\/ul>\n\n
1.5.6 \u2014 2026-06-27<\/h4>\n\n\n- FIX: Restore button is now a progressive-enhanced link \u2014 it opens the secure panel login even if admin JavaScript is unavailable, and shows an in-admin confirmation modal when JS is loaded.<\/li>\n<\/ul>\n\n
1.5.5 \u2014 2026-06-27<\/h4>\n\n\n- RENAME: Plugin display name and slug updated to \"Yedekalma \u2014 Cloud Backup & Restore\" (slug: yedekalma), now that domain ownership is verified.<\/li>\n
- DOCS: Clarified the Restore Drill description to match the actual weekly integrity verification.<\/li>\n<\/ul>\n\n
1.5.4 \u2014 2026-06-27<\/h4>\n\n\n- UX: \"Restore\" button now opens an in-admin confirmation modal.<\/li>\n<\/ul>\n\n
1.5.3 \u2014 2026-06-27<\/h4>\n\n\n- NEW: In-admin \"Restore\" button on dashboard.<\/li>\n
- FIX: Escaped translation strings and resolved REST API route permission callbacks.<\/li>\n
- RENAME: Renamed plugin display name and slug to avoid WP brand confusion.<\/li>\n
- REMOVE: Removed custom updater to comply with WordPress.org guidelines.<\/li>\n<\/ul>\n\n
1.5.2 \u2014 2026-06-25<\/h4>\n\n\n- RESTORE: Added new
\/restore-wpconfig<\/code> endpoint to update DB details in wp-config.php<\/code> during database restores to a different host.<\/li>\n- RESILIENCE: Bridge URLs migrated to
?rest_route=<\/code> format for compatibility with plain permalink sites.<\/li>\n<\/ul>\n\n1.5.1 \u2014 2026-06-25<\/h4>\n\n\n- INFO: Added notes to Backup Frequency page explaining synchronization with the optional cloud service.<\/li>\n<\/ul>\n\n
1.4.0 \u2014 2026-06-24<\/h4>\n\n\n- SPEED: Added chunked file transfer support via
\/zip-batch<\/code> (POST) to speed up backups.<\/li>\n<\/ul>\n\n1.3.0 \u2014 2026-06-24<\/h4>\n\n\n- Support for large sites: added manifest-based file transfer to avoid execution time limits.<\/li>\n<\/ul>\n\n
1.2.1 \u2014 2026-06-24<\/h4>\n\n\n- Folder exclusions and shared hosting permission handling improvements in file bridge.<\/li>\n<\/ul>\n\n
1.2.0 \u2014 2026-06-24<\/h4>\n\n\n- PLUG-AND-PLAY: FTP\/SFTP or MySQL credentials are no longer required to take backups.<\/li>\n<\/ul>\n\n
1.1.4 \u2014 2026-06-24<\/h4>\n\n\n- Bandwidth usage indicator widgets added to admin bar and side dashboard panel.<\/li>\n<\/ul>\n\n
1.1.3 \u2014 2026-06-18<\/h4>\n\n\n- New billing model: 1 GB free bandwidth for new accounts.<\/li>\n<\/ul>\n\n
1.0.0 \u2014 2026-06-17<\/h4>\n\n\n- Initial release.<\/li>\n<\/ul>","raw_excerpt":"Local one-click WordPress backup & restore (files + database). Optionally connect the free Yedekalma cloud service for off-site, multi-cloud storage.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ms.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/332082","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ms.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/ms.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/ms.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=332082"}],"author":[{"embeddable":true,"href":"https:\/\/ms.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/kamkactemha"}],"wp:attachment":[{"href":"https:\/\/ms.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=332082"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/ms.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=332082"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/ms.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=332082"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/ms.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=332082"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/ms.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=332082"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/ms.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=332082"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}