CloudScale Backup & Restore

A backup is only worth the restore behind it. CloudScale Backup & Restore is built for the day something goes wrong: a multi-gigabyte site, a dead server, a plugin update that takes the site down. It backs up to every destination you choose at once, restores your whole site in one click, and can keep a second server ready to take over. No size limit, no destination limit, no paid restore button.

Why CloudScale

• Free full restore. Files and database, from a local backup, an upload or any connected cloud. No premium tier is needed to get your site back.
• Built for large sites. The database streams in 500-row pages, never loaded into memory. Uploads go in chunks, retried and resumed after a dropped connection or throttle.
• Back up anywhere, to several places at once. A dozen storage services plus your own servers, listed under Where Backups Go.
• Ten storage regions on six continents. Managed Cloud keeps backups on Amazon S3 in the Americas, Europe, Africa, Asia and Australia. Automatic mode uses the nearest region, so copies and restores take the lowest-latency path, or pick one for data residency.
• Automated disaster recovery. A standby server restores itself from the newest cloud backup on a schedule, refuses a stale one, and reports recovery time and a file-by-file reconciliation.
• Self-healing backups. A backup killed mid-run is detected and finished or restarted, and you are told. Archives can be integrity-checked before upload.
• Rollback for bad plugin updates. Automatic Crash Recovery copies a plugin before an update and rolls it back if the site starts failing.
• Recovery from a hack, not only from a crash. Protected Mode locks out whoever got in while you repair the site.
• Alerts that reach you. Email and Telegram alerts for failed backups, restores and recoveries, including PHP fatal errors.

Where Backups Go

• Amazon S3, with access keys or an EC2 instance role
• S3-compatible storage: Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces, Google Cloud Storage, Hetzner Object Storage, MinIO
• Google Drive, Dropbox, Microsoft OneDrive
• Your own server: SFTP, FTPS or FTP, and WebDAV (Nextcloud, ownCloud, Synology, QNAP)
• CloudScale Managed Cloud, with nothing to set up

Every destination gets the same retention, resumable transfers, one-click restore and Automated Restore.

Backup: Everything, Any Size

Pick any combination; it is packaged into one .zip whose name says what it holds, with a backup-meta.json inside:

• Database (all tables), media uploads, plugins, themes
• Must-use plugins, languages, drop-ins, .htaccess, wp-config.php and WordPress core files
• Site root extras (robots.txt, favicon, .well-known/) and a snapshot of your server, PHP and MySQL settings
• Optional AES-256 encryption with your own password
• Schedule by day of the week and time, with retention (keep the last N) on every destination
• Space check and “delete oldest” for cloud destinations that are filling up

Restore: One Click, Server-Side

• Full restore puts back the backup’s files, then its database. It runs on the server, so you can close the page
• Specific tables only or a single post or page with its metadata, no maintenance mode needed
• Restore from this server, an uploaded .zip or .sql, or straight from any connected cloud. S3 and Managed Cloud downloads run in parallel when faster, and resume
• Encrypted backups are checked against your password first
• Visitors see a maintenance page; it is removed whether the restore succeeds or fails
• wp-config.php is never overwritten, so the site keeps its own database credentials
• Afterwards: file-by-file reconciliation, drop-in health check, and an old-versus-new server comparison

Restoring a Hacked Site

A plain restore of a hacked site is usually re-hacked within hours: it puts back the vulnerable plugin and leaves stolen credentials working. Tick This site was hacked on a full restore and, before visitors return, Protected Mode:

• Rotates the security keys, signing everyone out everywhere, and revokes every application password
• Makes every administrator set a new password
• Locks sign-in, wp-admin, XML-RPC and changing REST requests to browsers holding a device pass, which the restoring browser is given
• Blocks installing plugins and themes and the file editor, while updates stay allowed because updating is the cure

It stays on until you complete an exit checklist, with no timer that could reopen a site you have not finished repairing.

Disaster Recovery and Failover

• Standby & DR tab: turn a second install into a hot standby or a refreshed test copy
• Automated Restore: the standby lists your cloud storage, copies the newest backup straight to the server and restores it on a schedule. A backup older than your limit (36 hours by default) is refused and alerted
• Safe by design: an armed standby never takes or uploads its own backups, so it cannot overwrite production’s. While it is serving traffic, refreshes pause so nothing visitors wrote is lost
• DNS failover: a Cloudflare script in the plugin’s GitHub repository repoints DNS at the standby when production fails, and back when it recovers
• EC2 AMI snapshots: create and restore full machine images of an AWS-hosted server from the plugin

Staging Clones

Clone any backup into a separate WordPress install on the same server, with its own directory and database. URLs are rewritten everywhere, including serialized data and JSON. It refuses this site’s own directory or database, and can refresh after each scheduled backup.

Security

• Signed backups: every backup is signed with your site’s key. A standby holding that key automatically restores only what your site made, and refuses anything else placed in your storage
• Backup folder with a random name, deny rules for Apache, nginx and IIS, and 0700 permissions
• A daily self-check confirms backups are not publicly downloadable, and shows the server rule to add if they are
• Cloud credentials and the encryption password are kept in a protected file outside the database, so they never travel inside your backups
• Storage addresses cannot reach a cloud metadata service, or your server’s private network unless you allow it in wp-config.php
• Plain FTP and FTPS are labelled for what they protect, and automatic restore refuses a source that can be altered in transit unless your backups are signed

WP-CLI

wp csbr restore, `wp csbr cloud-list`, `wp csbr cloud-pull`, `wp csbr sync-from-cloud`, `wp csbr auto-restore`, `wp csbr role` and `wp csbr doctor` let a system timer keep a standby in sync without WP-Cron.

Managed Cloud

Don’t have a cloud account? CloudScale Managed Cloud is $5/month for 750 GB on Amazon S3 Glacier Instant Retrieval, in ten regions worldwide: the one nearest your site by default, or the one you choose. Instant Retrieval means a restore downloads straight away, with no archive thaw. Your own destinations are always free.

Automatic backups are off by default. Run your first backup by hand to confirm your server, then switch on a schedule. Full documentation: help.cloudscale.consulting.

External services

Nothing below is contacted until you set it up or click something, and your keys go only to the service they belong to. Full reference, with every data item and endpoint: https://cloudscale.consulting/external-services/backup-restore/

Storage you connect (optional)

Only the backup zip is sent, to your own account, when you connect that destination. A backup holds your whole site, so choose Encrypt backups if you want it unreadable to the provider.

• Amazon S3: the Amazon S3 host for the bucket’s own AWS region, for example s3.eu-west-1.amazonaws.com. Terms https://aws.amazon.com/service-terms/ Privacy https://aws.amazon.com/privacy/
• S3-compatible storage: the endpoint shown in the S3 card. Cloudflare R2: Terms https://www.cloudflare.com/terms/ Privacy https://www.cloudflare.com/privacypolicy/ Backblaze B2: Terms https://www.backblaze.com/company/policy/terms-of-service Privacy https://www.backblaze.com/company/policy/privacy Wasabi: Terms https://wasabi.com/legal/customer-agreement Privacy https://wasabi.com/legal/privacy-policy DigitalOcean Spaces: Terms https://www.digitalocean.com/legal/terms-of-service-agreement Privacy https://www.digitalocean.com/legal/privacy-policy Google Cloud Storage: Terms https://cloud.google.com/terms Privacy https://policies.google.com/privacy Hetzner: Terms https://www.hetzner.com/legal/terms-and-conditions/ Privacy https://www.hetzner.com/legal/privacy-policy/
• Google Drive: www.googleapis.com and oauth2.googleapis.com, after you complete its sign-in. Terms https://policies.google.com/terms Privacy https://policies.google.com/privacy
• Dropbox: api.dropboxapi.com and content.dropboxapi.com, after you complete its sign-in. Terms https://www.dropbox.com/terms Privacy https://www.dropbox.com/privacy
• Microsoft OneDrive: https://graph.microsoft.com/ and https://login.microsoftonline.com/, after you complete its sign-in. Terms https://www.microsoft.com/en-us/servicesagreement/ Privacy https://www.microsoft.com/en-us/privacy/privacystatement
• Your own SFTP, FTP or WebDAV server: only the server you enter. Its owner’s terms apply.

CloudScale Managed Cloud (optional, paid)

Service: CloudScale Consulting, https://cloudscale.consulting/. Nothing is sent until a licence key is entered, except the PayPal button’s checkout details below.
Data sent: licence key and hostname to the broker for a short-lived storage token; backup zips go straight to CloudScale’s Amazon S3 storage in its ten regions, never through the broker. Timing averages pick the nearest region. Leave us a message sends what you type. The PayPal button sends the product name, hostname and optional email.
Endpoints: https://api.cloudscale.consulting/backup/token, https://api.cloudscale.consulting/backup/list, https://api.cloudscale.consulting/status, https://api.cloudscale.consulting/checkout, https://api.cloudscale.consulting/checkout-start, https://api.cloudscale.consulting/recover, https://api.cloudscale.consulting/recover/verify, https://api.cloudscale.consulting/refund-request and https://api.cloudscale.consulting/contact.
Terms https://cloudscale.consulting/terms/ Privacy https://cloudscale.consulting/privacy/

PayPal (optional, pays for Managed Cloud)

When you subscribe, your email and the $5.00 USD amount go to api-m.paypal.com (or api-m.sandbox.paypal.com when testing), and PayPal’s script loads from www.paypal.com/sdk/js on the checkout screen only. PayPal’s own origin must serve that script. Card details never reach the plugin or your site. https://developer.paypal.com/api/rest
Terms https://www.paypal.com/us/legalhub/paypal/useragreement-full Privacy https://www.paypal.com/us/legalhub/paypal/privacy-full

Other optional features

• Telegram Bot API: alerts with the site name, event status and, for errors, the PHP error, file and line, via sendMessage on api.telegram.org, once you enter a bot token and chat ID. Terms https://telegram.org/tos Privacy https://telegram.org/privacy
• AWS EC2 snapshots: instance details from the local metadata address 169.254.169.254, then snapshot requests to the EC2 host for your region, for example ec2.eu-west-1.amazonaws.com, when you use the AMI feature. Terms and privacy as for Amazon S3.
• Crash Recovery health check: a plain GET to the URL you set, by default your own site.
• Gmail port check: Send Test in Notifications opens and closes a connection to smtp.gmail.com on ports 587, 465 and 25. No email or data is sent. Terms https://policies.google.com/terms Privacy https://policies.google.com/privacy

Privacy Policy

The plugin sends no telemetry or analytics. Backups stay on your server in wp-content/uploads/cloudscale-backup-<random>/ and leave it only for destinations you configure, listed under External services. CloudScale Managed backups are encrypted at rest; Encrypt backups adds your own password.