Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 87% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Modeled within the band wp.org reports; tightens as we track daily.

A declining trend compresses what a buyer would pay. The range spans more than 10x because wp.org publishes install counts as broad bands, and conversion and price compound on top. Read the midpoint as an order of magnitude, not a valuation.

Reviewers keep praising Duplicator for easy site migrations and backups, with one recent 1-star complaint about unsolicited marketing emails sent under the site's name.

1. ★★★★★ iznet

   1mo ago

   I had to move my site from old hosting to new hosting. I was panic because I didn’t know how to move my data.This duplicator saved me at the situation. Thanks

   Read on wp.org ↗
2. ★★★★★ sblar

   1mo ago

   Install, activate and enjoy 🙂

   Read on wp.org ↗
3. ★★★★★ james4311

   2mo ago

   Warning! Using Duplicator on your website could lead to you being banned from your transactional email sending service! I do not appreciate this plugin disguising marketing emails as “Weekly Summaries” and sending them to me from my website without my consent. This is extremely underhanded behaviour, and especially problematic if your website uses a transactional email sending service which explicitly forbids the use of its service for marketing emails.

   Read on wp.org ↗
4. ★★★★★ Cynthia

   2mo ago

   Moving the hosting from one server to another has never been easier. thank you for your job und the work!!!

   Read on wp.org ↗
5. ★★★★★ analyst001

   2mo ago

   Duplicator is simply a 6-Star plugin, keep it up good people, you took me out of sinkhole 😉

   Read on wp.org ↗
6. ★★★★★ Madame Labs

   2mo ago

   Me ajudou a controlar os backups do meu site e dos meus clientes

   Read on wp.org ↗
7. ★★★★★ aschi

   2mo ago

   As I have a local staging page of the online-site, I copy often the whole site either up or down. Of course I know how to do it with FTP and changing some files – but Duplicator is stressless and works everytime and without errors. Really very good Tool! I had another Tool for my regular Backup – but I am changing now to Duplicator, because it is much easier to restore from backup. Just delete the content of the database (but keep the empty database) and all WordPreess files. Then you can restore, using the names and passwords for that site. Easily done. Recommended Plugin! Regards Aschi

   Read on wp.org ↗
8. ★★★★★ josblomsma

   2mo ago

   Works very well, even in the free version.

   Read on wp.org ↗

15 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 5.3 Duplicator <= 1.5.9 - Full Path Disclosure ↗
   2024-07-10 CVE-2024-6210 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 1.5.9 Patched in 1.5.10
2. Medium · 4.3 Duplicator <= 1.5.7 - Cross-Site Request Forgery via views/tools/diagnostics/information.php ↗
   2023-12-27 CVE-2023-51681 Cross-Site Request Forgery (CSRF) Affects <= 1.5.7 Patched in 1.5.7.1
3. Critical · 9.8 Duplicator < 1.3.0 - Unauthenticated Remote Code Execution ↗
   2023-12-15 CVE-2018-25095 Improper Control of Generation of Code ('Code Injection') Affects < 1.3.0 Patched in 1.3.0
4. Critical · 9.8 Duplicator <= 1.5.7 AND Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Information Exposure ↗
   2023-12-04 CVE-2023-6114 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 1.5.7 Patched in 1.5.7.1
5. High · 7.5 Duplicator – WordPress Migration Plugin <= 1.4.7 - Sensitive Information Disclosure ↗
   2022-07-27 CVE-2022-2552 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 1.4.7 Patched in 1.4.7.1
6. Critical · 9.8 Duplicator – WordPress Migration Plugin <= 1.4.7 - Unauthenticated Backup Download ↗
   2022-07-27 CVE-2022-2551 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 1.4.7 Patched in 1.4.7.1
7. High · 7.5 Duplicator < 1.3.28 - Directory Traversal ↗
   2020-02-28 CVE-2020-11738 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects < 1.3.28 Patched in 1.3.28
8. Critical · 9.8 Duplicator <= 1.2.41 - Sensitive Information Disclosure leading to Remote Code Execution ↗
   2018-08-29 CVE-2018-17207 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 1.2.40 Patched in 1.2.42
9. Medium · 6.1 Duplicator <= 1.2.32 - Cross-Site Scripting ↗
   2018-03-15 CVE-2018-7543 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.2.32 Patched in 1.2.33
10. Medium · 6.1 Duplicator <= 1.2.28 – Unauthenticated Stored Cross-Site Scripting ↗
    2017-11-07 CVE-2017-16815 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.2.28 Patched in 1.2.30
11. Medium · 6.5 Duplicator < 1.1.4 - Cross-Site Request Forgery ↗
    2016-02-09 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.1.4 Patched in 1.1.4
12. Medium · 5.5 Duplicator <= 0.5.26 - Authenticated (Admin+) Cross-Site Scripting ↗
    2015-08-15 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 0.5.28 Patched in 0.5.28
13. High · 8.8 Duplicator <= 0.5.14 - SQL Injection ↗
    2015-04-10 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 0.5.14 Patched in 0.5.16
14. High · 8.2 Duplicator < 0.5.10 - Arbitrary Backup Creation and Download ↗
    2015-02-19 CVE-2014-9262 Improper Authentication Affects < 0.5.10 Patched in 0.5.10
15. Medium · 6.1 Duplicator – WordPress Migration Plugin <= 0.4.4 - Cross-Site Scripting ↗
    2014-08-01 CVE-2013-4625 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 0.4.4 Patched in 0.4.5

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 64 languages, 16 at 90% or more

Plus 40 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

No tier crossings observed yet.

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• UpdraftPlus: WP Backup & Migration Plugin 3M+ installs · 4.8★ · 5 shared tags A
• Backuply – Backup, Restore, Migrate and Clone 600K+ installs · 4.5★ · 4 shared tags A
• BackWPup – WordPress Backup & Restore Plugin 400K+ installs · 4.0★ · 4 shared tags A
• Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid 50K+ installs · 4.8★ · 4 shared tags A
• WP Database Backup – Unlimited Database & Files Backup by Backup for WP 30K+ installs · 4.4★ · 4 shared tags A
• Backup, Restore and Migrate your sites with XCloner 10K+ installs · 4.2★ · 4 shared tags A

Embed this report card

Drop a live Pulse card for Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More into a readme, a review or a deck. It updates itself.

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More: 1M+ active installs, 4.9★ (4,927 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/duplicator