UpdraftPlus: WP Backup & Migration Plugin

Reviewers call UpdraftPlus reliable and easy to set up, with quick support and free-tier S3 backups praised enough to prompt premium upgrades.

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

2500 searches this plugin appeared in over the last 90 days, 20 listed. 2419 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 67% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 2 days ago and a band this size takes about a year or more to cross, so the real count is still just over 4M.

At the current install trend, crossing 5M+ in roughly 232 days.

1. ★★★★★ molester

   3mo ago

   Superb plug-in for safely backing up and maintaining stability when undertaking site updates. I wouldn’t manage a website without this plug-in installed. Top Marks!

   Read on wp.org ↗
2. ★★★★★ andrearanha90

   3mo ago

   I found UpdraftPlus just after getting my WPsite hacked, and after long difficult hours trying to get it back. That never happened again. 👏

   Read on wp.org ↗
3. ★★★★★ John1153

   4mo ago

   I have been using UpdraftPlus to back up my WordPress site for a number of years. And the best comment I can make is, it just works. You never have to worry about it, it doesn’t break, and it just runs like clockwork. It is an excellent plugin that I would recommend to anyone using WordPress to ensure they have a security net when needed, and let’s face it, sometimes you need one!

   Read on wp.org ↗
4. ★★★★★ zakarianano

   4mo ago

   been using it for years, it’s the best

   Read on wp.org ↗
5. ★★★★★ bobblair

   4mo ago

   UpdraftPlus just keeps chugging along in the background. No drama, no problems, just backups on schedule.

   Read on wp.org ↗
6. ★★★★★ PsYk3s

   4mo ago

   For decades Ive built wordpress sites and updraft plus has been my go-to backups and recovery addon. Ive tried many others and it is just an intuitive plugin. Daily, weekly or custom times to backup offsite is a winner. On the other hand I applied to work for them and I think they just dont want outsiders moving to Cape Town so I may hold off a subscription or two xD. JK. Great work guys, hopefully my application will eventually be up to your standard.

   Read on wp.org ↗
7. ★★★★★ devjr64

   4mo ago

   It just works, thx 😀

   Read on wp.org ↗
8. ★★★★★ kanwarsation

   4mo ago

   Installed and backed up in minutes. I can’t believe the Updraft devs thought it would be ok to make a great, feature-rich plugin that is also easy to use and doesn’t need noobs to chew up their own hair in frustration. WTF, devs? You’re making the other plugins look bad.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 1.26.5 SECURITY: Previous versions contained a defect allowing sites with an active Migrator key (paid versions only) or UpdraftCentral key (free and paid versions) to have unauthorised operations carried out on them. All users 1.26.5
2. — Version 1.26.4 FIX: In version 1.26.2, a regression prevented the backup schedule, including the day name or number, as well as backup entity exclusion rules, from being saved. TWEAK: Alert users who wrongly enter URLs instead of an ac 1.26.4
3. — Version 1.26.3 FEATURE: Implemented enhanced streaming extraction for large files during restoration to handle cases where the file size exceeds the PHP memory limit. FIX: Fix users role filter empty state shows generic “Failed to Fetc 1.26.3
4. — Version 1.26.2 TWEAK: Added PHP 8.5 support to UpdraftClone TWEAK: Fix deprecation warnings in PHP 8.4 for the Dropbox integration TWEAK: Make abort backup warning icon responsive with percentage-based sizing TWEAK: Prevent the suppres 1.26.2
5. — Version 1.26.1 FIX: Google Drive chunked uploads didn’t resume from where it left off but started from the beginning resulting in file duplicates TWEAK: Add a WP-CLI command to register a product key (premium) TWEAK: Add product regist 1.26.1
6. — Version 1.25.9 FIX: A regression that resulted in the list of tables within the “Database size” tools not being displayed, due to code refactoring implemented in version 1.25.8. TWEAK: Add function for returning Advanced Tools menu dat 1.25.9

All 19 disclosed vulnerabilities are patched in the current version (1.26.14). Sites still on an older version should update.

1. Patched Medium · 4.3 UpdraftPlus 1.23.8 - 1.26.7 - Authenticated (Subscriber+) Information Exposure ↗
   2026-09-25 CVE-2026-82841 Exposure of Sensitive Information to an Unauthorized Actor Affects 1.23.8 - 1.26.7 Patched in 1.26.8
2. Patched Medium · 4.3 UpdraftPlus: WP Backup & Migration Plugin < 1.26.7 - Cross-Site Request Forgery ↗
   2026-08-27 CVE-2026-76549 Cross-Site Request Forgery Affects < 1.26.7 Patched in 1.26.7
3. Patched Critical · 9.8 UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 (free) < 2.26.5 (premium) - Unauthenticated Authentication Bypass via UpdraftCentral udrpc ↗
   2026-06-10 CVE-2026-10795 Improper Verification of Cryptographic Signature Affects 2.0 - 2.26.5 Patched in 2.26.5
4. Patched Medium · 6.1 UpdraftPlus - Backup/Restore <= 1.24.12 - Reflected Cross-Site Scripting ↗
   2025-01-15 CVE-2025-0215 Improper Neutralization of Input During Web Page Generation Affects <= 1.24.12 Patched in 1.25.1
5. Patched High · 8.8 UpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injection ↗
   2025-01-03 CVE-2024-10957 Deserialization of Untrusted Data Affects 1.23.8 - 1.24.11 Patched in 1.24.12
6. Patched Medium · 5.4 UpdraftPlus <= 1.23.10 - Cross-Site Request Forgery to Google Drive Storage Update ↗
   2023-11-07 CVE-2023-5982 Cross-Site Request Forgery Affects <= 1.23.10 Patched in 1.23.11
7. Patched Medium · 6.1 UpdraftPlus <= 1.23.3 - Cross-Site Request Forgery to Cross-Site Scripting via action_authenticate_storage ↗
   2023-05-18 CVE-2023-32960 Cross-Site Request Forgery Affects <= 1.23.3 Patched in 1.23.4
8. Patched High · 8.8 UpdraftPlus 1.22.14 to 1.23.2 and UpdraftPlus (Premium) 2.22.14 to 2.23.2 - Privilege Escalation via updraft_central_ajax_handler ↗
   2023-03-16 Missing Authorization Affects 1.22.14 - 1.23.2 Patched in 1.23.3
9. Patched Medium · 5.3 Updraft Plus <= 1.22.24 - Information Disclosure via updraft_ajaxrestore ↗
   2023-03-08 Insertion of Sensitive Information into Log File Affects <= 1.22.24 Patched in 1.23.1
10. Patched Medium · 6.1 UpdraftPlus WordPress Backup Plugin < 1.22.9 Reflected Cross-Site Scripting ↗
    2022-04-07 CVE-2022-0864 Improper Neutralization of Input During Web Page Generation Affects < 1.22.9 Patched in 1.22.9
11. Patched Medium · 6.5 UpdraftPlus WordPress Backup Plugin < 1.22.3 - Sensitive Information Disclosure ↗
    2022-02-17 CVE-2022-0633 Missing Authorization Affects 1.16.7 - 1.22.3 Patched in 1.22.3
12. Patched Medium · 6.1 UpdraftPlus WordPress Backup Plugin <= 1.16.68 - Reflected Cross-Site Scripting via updraft_restore ↗
    2021-12-28 CVE-2021-25089 Improper Neutralization of Input During Web Page Generation Affects 0.7.4 - 1.16.68 Patched in 1.16.69
13. Patched Medium · 6.1 UpdraftPlus WordPress Backup Plugin <= 1.16.65 - Reflected Cross-Site Scripting ↗
    2021-12-06 CVE-2021-25022 Improper Neutralization of Input During Web Page Generation Affects < 1.16.66 Patched in 1.16.66
14. Patched High · 7.2 UpdraftPlus < 1.16.59 - Authenticated (Admin+) Local File Inclusion ↗
    2021-07-12 Improper Control of Filename for Include/Require Statement in PHP Program Affects <= 1.16.56 Patched in 1.16.59
15. Patched Medium · 4.8 UpdraftPlus WordPress Backup Plugin < 1.6.59 - Stored Cross-Site Scripting ↗
    2021-05-09 CVE-2021-24423 Improper Neutralization of Input During Web Page Generation Affects < 1.6.59 Patched in 1.6.59
16. Patched Medium · 6.1 UpdraftPlus <= 1.9.63 and UpdraftPlus (paid) <= 2.9.63 - Cross-Site Scripting ↗
    2020-09-22 CVE-2015-9360 Improper Neutralization of Input During Web Page Generation Affects < 1.9.64 Patched in 1.9.64
17. Patched Medium · 5.4 UpdraftPlus <= 1.13.4 - Stored Cross-Site Scripting ↗
    2017-08-08 CVE-2017-18593 Improper Neutralization of Input During Web Page Generation Affects <= 1.13.4 Patched in 1.13.5
18. Patched Medium · 6.1 UpdraftPlus WordPress Backup <= 1.9.6.3 - Cross-Site Scripting ↗
    2015-04-20 Improper Neutralization of Input During Web Page Generation Affects <= 1.9.6.3 Patched in 1.9.6.4
19. Patched Critical · 9.9 UpdraftPlus WordPress Backup Plugin <= 1.9.50 - Nonce Leak to Authorization Bypass ↗
    2015-02-03 Improper Privilege Management Affects < 1.9.51 Patched in 1.9.51

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 69 languages, 17 at 90% or more

Plus 45 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-10-29 3M+ → 4M+ up after 7 days in tier
2. 2026-10-22 4M+ → 3M+ down after 28 days in tier
3. 2026-09-24 3M+ → 4M+ up after 1451 days in tier
4. 2022-10-04 400K+ → 3M+ up after 2742 days in tier
5. 2015-04-02 300K+ → 400K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for UpdraftPlus: WP Backup & Migration Plugin into a readme, a review or a deck. It updates itself.

UpdraftPlus: WP Backup & Migration Plugin: 4M+ active installs, 4.8★ (8,706 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/updraftplus