=== SiteVault – Backup, Restore, Migration & Cloning ===
Contributors: royalpluginsteam
Donate link: https://www.royalplugins.com
Tags: backup, restore, migration, database, clone
Requires at least: 5.8
Tested up to: 7.0
Stable tag: 1.5.7
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html
Preview-On-WordPress-Playground: yes

Simple WordPress backup, restore, and migration plugin. Create backups, restore your site, and migrate to a new domain with ease.

== Description ==

https://youtu.be/xmKjuMeP9Bo

**SiteVault** is a free WordPress backup, restore, and migration plugin built for reliability. Back up your entire site — database, plugins, themes, and uploads — with one click. Restore from any backup instantly, or create a migration package to move your site to a new host with automatic URL remapping and serialized data handling.

No account required, no file size limits, no backup caps. SiteVault stores everything locally in a protected directory, works on shared hosting, and handles large sites with async processing so you never hit timeout or memory errors.

= Works With Your Hosting & Stack =

SiteVault runs on any standards-compliant WordPress host and backs up any content stored in your database and uploads directory:

* **Shared hosting** — Async chunked processing keeps backups completing reliably under strict PHP timeout and memory limits.
* **Managed hosting** — Host-specific exclusion paths are detected and respected automatically.
* **eCommerce and memberships** — Customer orders, products, course progress, and membership data are backed up as standard WordPress posts and meta.
* **Page builders** — Builder content stored in post meta and serialized fields is captured intact regardless of which builder created it.
* **Multilingual** — Translated posts and language taxonomies back up with all language relationships preserved.
* **Caching plugins** — Common cache directories are auto-detected and excluded so backup sizes stay lean.

= Backup Features =

* **Full Site Backup** - Complete backup of database, plugins, themes, and uploads
* **Database-Only Backup** - Quick database snapshots for content changes
* **Plugins & Themes Backup** - Back up just your plugins and themes before updates
* **Uploads-Only Backup** - Back up just your media library files
* **Backup History** - View all your backups with size, date, and status
* **Backup Manifest** - Each backup includes metadata about your site configuration

= Restore Features =

* **One-Click Restore** - Restore your entire site from any backup
* **Backup Validation** - Validates backup integrity before restoring
* **Safe Restore** - Checks permissions and requirements before starting
* **Status Tracking** - Monitor restore progress in real-time

= Migration Features =

* **Migration Packages** - Create complete site packages for moving hosts
* **Standalone Installer** - Migration packages include a standalone installer
* **URL Remapping** - Automatic URL replacement for new domains
* **Serialized Data Handling** - Properly handles WordPress serialized data
* **Download Packages** - Download migration packages for manual upload

= Core Features =

* **Protected Storage** - Backups stored in protected directories
* **Logging System** - Comprehensive logs for troubleshooting
* **Clean Interface** - Simple, intuitive admin panel
* **Lightweight** - Minimal impact on site performance
* **Secure** - Proper nonce verification and capability checks

= Pro Features =

Upgrade to [SiteVault Pro](https://royalplugins.com/sitevault) for advanced features:

* **Cloud Storage** - Google Cloud, Dropbox, Amazon S3, OneDrive, FTP/SFTP
* **Staging Environments** - Create staging sites to test changes safely
* **Push to Live** - Push staging changes to production
* **AES-256 Encryption** - Encrypt backups for maximum security
* **Email Notifications** - Get notified of backup success or failure
* **WooCommerce Integration** - Enhanced WooCommerce backup handling
* **Multisite Support** - Full network backup capabilities
* **Priority Support** - Fast, dedicated support from our team

== Installation ==

= Automatic Installation =

1. Go to your WordPress admin panel
2. Navigate to Plugins → Add New
3. Search for "SiteVault"
4. Click "Install Now" then "Activate"

= Manual Installation =

1. Download the plugin ZIP file
2. Go to Plugins → Add New → Upload Plugin
3. Choose the ZIP file and click "Install Now"
4. Activate the plugin

= After Activation =

1. Go to SiteVault in your admin menu
2. Create your first backup on the Dashboard
3. Configure preferences in Settings

== Frequently Asked Questions ==

= How many backups can I keep? =

There is no limit on the number of backups. Old backups are automatically cleaned up based on your retention settings. The default retention is 30 backups.

= Where are backups stored? =

Backups are stored in `wp-content/uploads/sitevault/backups/` and are protected from direct access with .htaccess rules.

= How long does a backup take? =

Backup time depends on your site size. Small sites (under 100MB) typically complete in under a minute. Larger sites may take several minutes.

= Can I migrate to a different domain? =

Yes! Create a migration package and use the included installer on your new server. URLs are automatically replaced.

= Is my data safe? =

Backups are stored in protected directories with .htaccess restrictions.

= Does it work with WooCommerce? =

Yes! Backup and restore works with WooCommerce sites.

= Can I schedule automatic backups? =

This plugin creates backups when you click the "Create Backup" button in the admin screen. It does not schedule automatic backups.

= What's the difference between backup types? =

* **Full** - Database + all files (plugins, themes, uploads)
* **Database** - Just the MySQL database (fastest)
* **Plugins & Themes** - Just plugins and themes, no uploads or database
* **Uploads** - Just media library files

= How do I restore a backup? =

Go to Backups, find your backup, and click "Restore". The plugin validates the backup and restores your site automatically.

= Can I download my backups? =

Yes! Each backup has a download button so you can save copies locally or transfer to another server.

= Will SiteVault work on shared hosting? =

Yes. SiteVault is built for shared hosting from the ground up. The async backup engine uses chunked ZIP streaming, primary-key pagination, adaptive chunk sizing, and semaphore locking — all designed to complete on hosts with strict 30-second PHP timeouts, 128MB memory limits, and limited file handle counts.

= Will SiteVault slow down my WordPress site? =

No. The plugin only runs when you click "Create Backup" or "Restore" in the admin — there is no scheduler running in the background and zero impact on visitor-facing pages. The admin UI loads only when you visit a SiteVault settings page.

= Does SiteVault work with multilingual plugins? =

Yes. Translated posts are backed up like any other WordPress content — the language taxonomy, translation meta, and per-language post records are all included in full and database-only backups. After a migration or restore, translated content reappears with all language relationships intact.

= Can I use SiteVault to clone my live site for staging or local development? =

Yes. Create a Migration Package on your live site, download it, and run the included standalone installer (`installer.php`) on your staging server, local environment, or a fresh WordPress install. SiteVault automatically remaps the site URL and handles serialized data so widgets, theme customizer settings, page builder content, and plugin options all work without manual search-and-replace.

= What's the maximum backup file size SiteVault can handle? =

There is no fixed maximum — SiteVault streams ZIP archives with adaptive chunk sizing, so the limit is your server's available disk space and execution time. Sites with 50+ GB of uploads have been backed up successfully on shared hosting using the async engine. For very large sites, the database-only backup option remains fast even when full backups take longer.

= Does SiteVault work with caching plugins? =

Yes. SiteVault automatically detects and excludes common cache directories from backups (they regenerate on the destination site after restore, so backing them up is wasted space). The plugin's own admin pages are not cached because most caching plugins exclude `/wp-admin/` by default.

== Screenshots ==

1. Dashboard - Overview of your backups with quick actions
2. Create Backup - Choose backup type and create backups
3. Backup List - View, download, restore, or delete backups
4. Migration - Create migration packages for moving your site
5. Settings - Configure backup preferences

== Changelog ==

= 1.5.7 =
* Security: Hardened backup-directory deny rules. Pre-1.5.7 only emitted Apache 2.2 `Order deny,allow` syntax, which Apache 2.4+ silently ignores and nginx / LiteSpeed never read at all — backup zips containing wp-config and the full SQL dump were publicly downloadable on most managed hosts. The plugin now writes a modern Apache 2.4 `Require all denied` directive (with a 2.2 fallback block), a `web.config` deny rule for IIS, and a hardened `index.php` that returns 403 on direct hits regardless of server flavor. Idempotent overwrite on upgrade so existing installs pick up the new rules. nginx / OpenLiteSpeed customers still need a server-block rule for direct file hits (the `index.php` blocks the directory root regardless).
* Security: Zip-slip hardening on archive extraction. Pre-1.5.7 the restore and migration-import paths called `ZipArchive::extractTo()` directly with zero validation — a crafted archive entry like `../../wp-content/shell.php` could write files anywhere the web user has permissions. Both call sites (file manager + standalone migration installer) now validate every entry: absolute paths, parent-dir traversal (`..`), and symlink entries are refused, and each target is confirmed to resolve inside the destination after path canonicalization.
* Fix: Async backups no longer saturate PHP-FPM workers on heavy installs. Pre-1.5.7 the cron-spawn helper bypassed WordPress's 60-second throttle on every resumption tick AND every AJAX status poll. On sites with many plugins (where each `wp-cron.php` boot ties up a worker for 3-5 seconds) the backup chain could starve the very workers needed to advance it, stalling backups indefinitely. The helper now applies its own 60-second throttle (matching WP core's behavior) — the chain still progresses naturally via any front-end / admin request, with a slower-but-stable fallback cadence on zero-traffic sites.
* Security: Default backup filenames now include an 8-character random suffix (`backup-2026-05-18-153000-a3f9b8c2.zip`). On hosts where the directory-level deny rules don't apply (nginx, LiteSpeed — both ignore `.htaccess`), the previous timestamp-only naming was enumerable: an attacker who knew a site ran SiteVault could iterate minute-precision timestamps over the retention window and download every backup. The random suffix adds 4.3 billion possibilities per timestamp, taking enumeration from practical to infeasible. Custom backup names supplied by the user are preserved as-is; only the default fallback is affected.
* These backports are from SiteVault Pro 1.7.23 + 1.7.26.

= 1.5.6 =
* Compliance: Renamed plugin display from "SiteVault – WordPress Backup, Restore, Migration & Cloning" to "SiteVault – Backup, Restore, Migration & Cloning" per WordPress.org Plugin Directory naming guidelines (plugin names may not contain "WordPress").
* Compliance: Rewrote the "Works With Your Hosting & Stack" section to remove enumerations of third-party host, eCommerce, page builder, multilingual, and caching plugin brand names. Section now describes capabilities generically.
* Compliance: Removed the "free alternative to..." sentence that listed seven competitor backup plugins by name and made comparative pricing claims.
* Compliance: Removed the FAQ entry that compared SiteVault to other backup plugins by name.
* Compliance: Rewrote four FAQ titles and answer bodies that named third-party hosts, multilingual plugins, local development tools, or caching plugins by brand. Answers now describe capabilities generically.
* No plugin functionality has changed in this release. Description and FAQ rewrites only.

= 1.5.5 =
* New: WordPress Playground live preview — click "Live Preview" on the plugin listing to try the Backups dashboard in a browser sandbox with 4 sample backup entries pre-seeded.
* New: Video walkthrough embedded on the plugin listing page.

= 1.5.4 =
* Compliance: Rewrote the "SiteVault Pro" admin screen to describe Pro as a separate plugin with additional features, removing the previous Lite vs Pro comparison table. No plugin functionality has changed; this is a documentation/presentation update to align with WordPress.org Plugin Directory Guideline 5.
* Compliance: Removed "Scheduled Backups" from the Pro feature list and rewrote the related FAQ answer to state only that this plugin creates backups on demand from the admin screen.
* Code: Removed two orphan `wp_clear_scheduled_hook('sitevault_scheduled_backup')` calls from `uninstall.php` and the deactivation handler. The hook was never registered by this plugin.

= 1.5.3 =
* Tested: Verified compatibility with WordPress 7.0
* Improvement: Updated plugin description

= 1.5.2 =
* Fix: Removed backup storage limit for full WordPress.org compliance
* Fix: Replaced hardcoded ABSPATH reference with WordPress directory functions
* Fix: Scoped PHP ini_set() calls to specific operations instead of generic helper
* Improvement: Backup retention now uses configurable option (default 30)

= 1.5.1 =
* Fix: Settings link now navigates to correct admin page
* Fix: Replaced all inline styles with CSS classes for WordPress.org compliance
* Fix: Replaced all file_put_contents() calls with WP_Filesystem API
* Fix: Replaced file_get_contents() with WP_Filesystem in restore engine

= 1.5.0 =
* REBRAND: Plugin renamed to "SiteVault – Backup, Restore & Migration"
* Updated prefix from rbl to sitevault for WordPress.org compliance
* Updated text-domain to sitevault-backup-restore-migration
* Updated all admin menu labels and UI text
* Replaced hardcoded path constants with WordPress functions
* Scoped PHP limits to specific functions only
* Added "Built by Royal Plugins" footer branding
* Backup storage location: wp-content/uploads/sitevault/

= 1.4.6 =
* Renamed plugin to "RoyalPlugins Backup Manager" for WordPress.org compliance
* Changed slug to "royalplugins-backup-manager" to avoid naming conflict
* Updated text-domain to "royalplugins-backup-manager"

= 1.4.5 =
* FIX: Corrected admin menu slug
* FIX: Fixed backup exclusion path (prevents recursive backups)
* FIX: Replaced missing logo.svg with dashicon in dashboard header
* FIX: Settings link now correctly navigates to plugin dashboard
* Added View Details and Docs links to plugins page

= 1.4.4 =
* FIX: Downloads now properly resume instead of restarting
* FIX: Downloads are fast again - restored 64KB chunked streaming
* Added Last-Modified and ETag HTTP headers for resume validation

= 1.4.3 =
* FIX: Backup completion now auto-refreshes page reliably
* Added 3-tier redirect with fallback button

= 1.4.0 =
* MAJOR FIX: Backup completion auto-redirects reliably
* MAJOR FIX: Downloads no longer spin/stall in Chrome
* MAJOR FIX: Migration/restore shows real-time streaming progress
* Added HTTP 206 Partial Content support for resumable downloads

= 1.3.0 =
* MAJOR: Async reliability improvements for large site backups
* NEW: ZIP batching, keyset pagination, semaphore locking
* NEW: Gzip file list persistence, adaptive chunk sizing
* FIX: Large uploads/full backups complete reliably on shared hosting

= 1.2.0 =
* MAJOR: Complete backup engine rewrite for shared hosting
* NEW: ZIP streaming, primary key pagination, adaptive chunking
* FIXED: Out of memory and timeout errors on large sites

= 1.0.0 =
* Initial release
* Full site, database, and files backup types
* One-click restore with validation
* Site migration with standalone installer

== Upgrade Notice ==

= 1.5.0 =
REBRAND: Plugin is now "SiteVault". All functionality preserved. Backup storage location changed to wp-content/uploads/sitevault/.
