UpdraftPlus: WP Backup & Migration Plugin

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 67% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Modeled within the band wp.org reports; tightens as we track daily.

A large install base, a clear pro tier and a steady trend. As reliable as an outside estimate gets.

Reviewers call UpdraftPlus reliable and easy to set up, with quick support and free-tier S3 backups praised enough to prompt premium upgrades.

1. ★★★★★ molester

   1mo ago

   Superb plug-in for safely backing up and maintaining stability when undertaking site updates. I wouldn’t manage a website without this plug-in installed. Top Marks!

   Read on wp.org ↗
2. ★★★★★ andrearanha90

   1mo ago

   I found UpdraftPlus just after getting my WPsite hacked, and after long difficult hours trying to get it back. That never happened again. 👏

   Read on wp.org ↗
3. ★★★★★ John1153

   1mo ago

   I have been using UpdraftPlus to back up my WordPress site for a number of years. And the best comment I can make is, it just works. You never have to worry about it, it doesn’t break, and it just runs like clockwork. It is an excellent plugin that I would recommend to anyone using WordPress to ensure they have a security net when needed, and let’s face it, sometimes you need one!

   Read on wp.org ↗
4. ★★★★★ zakarianano

   1mo ago

   been using it for years, it’s the best

   Read on wp.org ↗
5. ★★★★★ bobblair

   1mo ago

   UpdraftPlus just keeps chugging along in the background. No drama, no problems, just backups on schedule.

   Read on wp.org ↗
6. ★★★★★ PsYk3s

   1mo ago

   For decades Ive built wordpress sites and updraft plus has been my go-to backups and recovery addon. Ive tried many others and it is just an intuitive plugin. Daily, weekly or custom times to backup offsite is a winner. On the other hand I applied to work for them and I think they just dont want outsiders moving to Cape Town so I may hold off a subscription or two xD. JK. Great work guys, hopefully my application will eventually be up to your standard.

   Read on wp.org ↗
7. ★★★★★ devjr64

   1mo ago

   It just works, thx 😀

   Read on wp.org ↗
8. ★★★★★ kanwarsation

   1mo ago

   Installed and backed up in minutes. I can’t believe the Updraft devs thought it would be ok to make a great, feature-rich plugin that is also easy to use and doesn’t need noobs to chew up their own hair in frustration. WTF, devs? You’re making the other plugins look bad.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 1.26.5 SECURITY: Previous versions contained a defect allowing sites with an active Migrator key (paid versions only) or UpdraftCentral key (free and paid versions) to have unauthorised operations carried out on them. All users 1.26.5
2. — Version 1.26.4 FIX: In version 1.26.2, a regression prevented the backup schedule, including the day name or number, as well as backup entity exclusion rules, from being saved. TWEAK: Alert users who wrongly enter URLs instead of an ac 1.26.4
3. — Version 1.26.3 FEATURE: Implemented enhanced streaming extraction for large files during restoration to handle cases where the file size exceeds the PHP memory limit. FIX: Fix users role filter empty state shows generic “Failed to Fetc 1.26.3
4. — Version 1.26.2 TWEAK: Added PHP 8.5 support to UpdraftClone TWEAK: Fix deprecation warnings in PHP 8.4 for the Dropbox integration TWEAK: Make abort backup warning icon responsive with percentage-based sizing TWEAK: Prevent the suppres 1.26.2
5. — Version 1.26.1 FIX: Google Drive chunked uploads didn’t resume from where it left off but started from the beginning resulting in file duplicates TWEAK: Add a WP-CLI command to register a product key (premium) TWEAK: Add product regist 1.26.1
6. — Version 1.25.9 FIX: A regression that resulted in the list of tables within the “Database size” tools not being displayed, due to code refactoring implemented in version 1.25.8. TWEAK: Add function for returning Advanced Tools menu dat 1.25.9

17 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Critical · 9.8 UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 (free) < 2.26.5 (premium) - Unauthenticated Authentication Bypass via UpdraftCentral udrpc ↗
   2026-06-10 CVE-2026-10795 Improper Verification of Cryptographic Signature Affects 2.0 - 2.26.5 Patched in 2.26.5
2. Medium · 6.1 UpdraftPlus - Backup/Restore <= 1.24.12 - Reflected Cross-Site Scripting ↗
   2025-01-15 CVE-2025-0215 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.24.12 Patched in 1.25.1
3. High · 8.8 UpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injection ↗
   2025-01-03 CVE-2024-10957 Deserialization of Untrusted Data Affects 1.23.8 - 1.24.11 Patched in 1.24.12
4. Medium · 5.4 UpdraftPlus <= 1.23.10 - Cross-Site Request Forgery to Google Drive Storage Update ↗
   2023-11-07 CVE-2023-5982 Cross-Site Request Forgery (CSRF) Affects <= 1.23.10 Patched in 1.23.11
5. Medium · 6.1 UpdraftPlus <= 1.23.3 - Cross-Site Request Forgery to Cross-Site Scripting via action_authenticate_storage ↗
   2023-05-18 CVE-2023-32960 Cross-Site Request Forgery (CSRF) Affects <= 1.23.3 Patched in 1.23.4
6. High · 8.8 UpdraftPlus 1.22.14 to 1.23.2 and UpdraftPlus (Premium) 2.22.14 to 2.23.2 - Privilege Escalation via updraft_central_ajax_handler ↗
   2023-03-16 Missing Authorization Affects 1.22.14 - 1.23.2 Patched in 1.23.3
7. Medium · 5.3 Updraft Plus <= 1.22.24 - Information Disclosure via updraft_ajaxrestore ↗
   2023-03-08 Insertion of Sensitive Information into Log File Affects <= 1.22.24 Patched in 1.23.1
8. Medium · 6.1 UpdraftPlus WordPress Backup Plugin < 1.22.9 Reflected Cross-Site Scripting ↗
   2022-04-07 CVE-2022-0864 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.22.9 Patched in 1.22.9
9. Medium · 6.5 UpdraftPlus WordPress Backup Plugin < 1.22.3 - Sensitive Information Disclosure ↗
   2022-02-17 CVE-2022-0633 Missing Authorization Affects 1.16.7 - 1.22.3 Patched in 1.22.3
10. Medium · 6.1 UpdraftPlus WordPress Backup Plugin <= 1.16.68 - Reflected Cross-Site Scripting via updraft_restore ↗
    2021-12-28 CVE-2021-25089 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects 0.7.4 - 1.16.68 Patched in 1.16.69
11. Medium · 6.1 UpdraftPlus WordPress Backup Plugin <= 1.16.65 - Reflected Cross-Site Scripting ↗
    2021-12-06 CVE-2021-25022 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.16.66 Patched in 1.16.66
12. High · 7.2 UpdraftPlus < 1.16.59 - Authenticated (Admin+) Local File Inclusion ↗
    2021-07-12 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Affects <= 1.16.56 Patched in 1.16.59
13. Medium · 4.8 UpdraftPlus WordPress Backup Plugin < 1.6.59 - Stored Cross-Site Scripting ↗
    2021-05-09 CVE-2021-24423 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.6.59 Patched in 1.6.59
14. Medium · 6.1 UpdraftPlus <= 1.9.63 and UpdraftPlus (paid) <= 2.9.63 - Cross-Site Scripting ↗
    2020-09-22 CVE-2015-9360 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.9.64 Patched in 1.9.64
15. Medium · 5.4 UpdraftPlus <= 1.13.4 - Stored Cross-Site Scripting ↗
    2017-08-08 CVE-2017-18593 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.13.4 Patched in 1.13.5
16. Medium · 6.1 UpdraftPlus WordPress Backup <= 1.9.6.3 - Cross-Site Scripting ↗
    2015-04-20 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.9.6.3 Patched in 1.9.6.4
17. Critical · 9.9 UpdraftPlus WordPress Backup Plugin <= 1.9.50 - Nonce Leak to Authorization Bypass ↗
    2015-02-03 Improper Privilege Management Affects < 1.9.51 Patched in 1.9.51

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 68 languages, 13 at 90% or more

Plus 44 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

No tier crossings observed yet.

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More 1M+ installs · 4.9★ · 5 shared tags A
• Backuply – Backup, Restore, Migrate and Clone 600K+ installs · 4.5★ · 4 shared tags A
• BackWPup – WordPress Backup & Restore Plugin 400K+ installs · 4.0★ · 4 shared tags A
• Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid 50K+ installs · 4.8★ · 4 shared tags A
• WP Database Backup – Unlimited Database & Files Backup by Backup for WP 30K+ installs · 4.4★ · 4 shared tags A
• Backup, Restore and Migrate your sites with XCloner 10K+ installs · 4.2★ · 4 shared tags A

Embed this report card

Drop a live Pulse card for UpdraftPlus: WP Backup & Migration Plugin into a readme, a review or a deck. It updates itself.

UpdraftPlus: WP Backup & Migration Plugin: 3M+ active installs, 4.8★ (8,623 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/updraftplus