Skip to content

Where your backups are stored, and who can reach them

One archive from creation to deletion: the locked folder on your own site, the transfer, the private bucket in Amsterdam, the ten-minute download link, and what "encrypted" does and does not mean here.

Last updated

A backup archive is the most sensitive thing WP Safer holds: it contains your database and your files, which means it can contain the personal data of your own visitors and customers. This article follows one archive from the moment it is created to the moment it is deleted, and says who can reach it at each step.

1. On your own site: minutes, behind a locked door

The archive is built on your server, in a folder inside wp-content whose name starts with a random prefix (for example wp-content/a1b2c3d4e5-backups). While it sits there:

  • The folder is closed to the web. WP Safer writes an .htaccess file (Apache), a web.config (IIS) and an empty index.html, and the rule is an unconditional deny — not a password or a query string.
  • The only way in is a signed URL of the form /wpsafer-backup/<file>.zip?exp=…&sig=…. The signature is made with a secret that belongs to that site alone, is tied to that one file name, and expires after an hour.
  • As soon as we have pulled the archive, the copy on your site is deleted. In practice the file exists on your server for minutes, not days.

One thing to know if you run nginx: nginx does not read .htaccess, so there the protection is the signed gate plus the short lifetime of the file. The gate needs WordPress rewrite rules to work, so a site left on plain permalinks (?p=123) falls back to serving the file directly. If you manage sites on plain permalinks, switching them to any other permalink structure is worth doing for this reason alone.

2. In transit

We fetch the archive over HTTPS with full certificate verification — both that the certificate is valid and that it belongs to the host we asked for. Interrupted transfers resume from where they stopped rather than starting over, which is what makes 500 MB archives finish at all.

3. At rest: Amsterdam, private, outside every web root

Archives are stored in object storage at DigitalOcean Spaces, in the Amsterdam region (ams3) — inside the EU. The bucket’s access control is private: there is no public URL for an object in it.

Archives are also not under any web root of ours. A guessed address on our CDN host does not return a file; it returns a 404. The only path to an archive is through the panel, authenticated as the account that owns it.

Being precise about what this is and is not: the archive is protected by transport encryption and access control, not by client-side encryption. It is not encrypted with a key that you hold, and we do not offer such a key. If your own compliance requirements demand customer-held encryption keys for backup archives, WP Safer does not meet that requirement today.

4. Downloading one

When you press download in the panel, you do not get a permanent address. You get a link that:

  • expires in 10 minutes, and
  • is bound to your account — the same link opened in someone else’s session does not work — and
  • still requires you to be signed in; the signature is an extra layer on top of the session, not a replacement for it.

Every attempt, successful or not, is written to our system log with the account, the IP address, the file and the outcome, and a single account is limited to 10 downloads per minute. That limit is far above anything a person does by hand; it exists so that a stolen session cannot be used to drain an entire archive library in one script.

5. How long an archive is kept

Nothing expires on a fixed calendar. What governs retention is the Full backups to retain setting on each schedule (1–10): when a new full backup completes, the oldest chain beyond that number is dropped.

Deleting a backup, or deleting a site, does not erase the files on the spot. They are moved to Trash, where the panel lists them with their size and lets you either Restore them or Delete permanently — that second button is the one that removes the bytes. Anything you leave there is removed for good three months after the notice email that tells you an inactive subscription’s stored data is due for deletion.

The formal retention commitments — including what happens after an account is closed — are in the Privacy Policy, which is the document that governs if it and this page ever disagree.