Frequently asked questions

Yes — you can move between WP Safer plans at any time. An upgrade is bought from the pricing page and the larger site limit is active as soon as the payment is recorded, so you do not lose a day. A downgrade applies at the end of the period you have already paid for; sites above the new limit keep running and keep their backups, you simply cannot connect new ones until you upgrade again.

Nothing is switched off. Sites you already connected stay in the panel and keep running on their backup schedule; only adding a new site is refused once you reach your plan's limit — Free 1 site, Starter 5, Pro 25, Agency 100. Upgrading raises the limit as soon as the payment is recorded, and extra backup space can be bought separately without changing your plan.

Yes. WP Safer sells extra backup space as separate storage packs — 500 GB, 1 TB or 2 TB — on the pricing page. The space is added to your plan quota right after payment, your site limit stays the same, and you can cancel the pack on its own.

Yes, we offer a 14-day money-back guarantee on all paid plans. No questions asked.

Yes. On annual Starter, Pro and Agency plans you can move a site yourself from the dashboard: open the site, go to Backups and choose Migrate to a new host. The wizard copies a backup to the new server over SFTP/FTPS, checks it and switches over once your DNS points at the new host.

Free and monthly plans do not include the self-service wizard. You can switch to annual billing at any time, or use our migration service, where our team moves the site for a fixed fee.

Yes. Your backups are kept in private cloud storage that is not publicly accessible, they are transferred over encrypted connections (TLS), and they can only be downloaded from your dashboard through a personal link that expires after 10 minutes.

As often as your backup schedule says: daily, weekly or monthly, at the hour you choose (UTC). The first run is a full backup; later runs store only what changed until a new full backup is due. You can also start a full or incremental backup by hand at any time.

A restore starts within a couple of minutes of clicking Restore. How long it takes depends on the size of the site and the speed of your host; visitors see a maintenance message only while files and the database are being replaced. If something goes wrong, the previous version is put back automatically, and a completed restore can be undone for 24 hours.

In private cloud storage (DigitalOcean Spaces), in the backup region you pick for the site; new sites default to Amsterdam, the Netherlands, inside the EU, and the regions you can pick are listed in the panel. Backups are not kept on your web host, and they are transferred over encrypted connections (TLS).

It depends on how often your site changes. For a corporate or brochure site whose content is rarely updated, a weekly backup is usually enough. For a blog, a news site or a WooCommerce store taking orders every day, a daily backup is the sensible choice — otherwise the data you lose in an incident (the latest order, the latest post) grows. The rule is simple: your backup frequency defines the maximum amount of data you are willing to lose. In WP Safer you pick a daily, weekly or monthly schedule per site, so you can back up busy sites often and static ones less frequently.

Every connected site is requested on a schedule — every 30 seconds on Agency, every minute on Starter and Pro, every 5 minutes on Free. A single failed request is not treated as an outage: the check has to fail twice in a row before an incident is opened, so a momentary blip does not wake you up.

The incident records what actually went wrong — DNS failure, connection refused, a timeout, an SSL/TLS certificate error or an HTTP error code — together with the first failing response. It closes itself on the first successful check, and the downtime is measured from the first failed check to that recovery.

Checks run from our node in Finland.

By email to your account address, on every plan including Free. On Starter and above you can add your own channels as well: Slack, Discord, Telegram or a custom webhook — up to 10 of them, each one testable with a "Send test" button before you rely on it.

You are notified when the incident opens and again when the site recovers. If you want to be nudged while a site is still down, you can turn on a reminder (every 30 minutes up to once a day); it is off by default.

Planning an upgrade? Set a maintenance window on the site and alerts are paused for it — incidents are still recorded, you just are not paged about them.

Yes, on the Pro and Agency plans. The certificate of every monitored site is read twice a day and its expiry date is shown on the site's Uptime tab.

Those plans also include a keyword check: you give WP Safer a word or phrase that must appear on the page — or must not appear, which is the useful way to catch a "critical error" screen. If the rule is broken the site counts as down, exactly like a failed request, and you are alerted the same way.

90 days per site. The site's Uptime tab shows a day-by-day strip for that period, its total downtime, and the list of incidents with the cause and duration of each. Response times are charted hour by hour for the last 24 hours.

The Monitoring page collects the whole fleet in one view: sites that are down right now, uptime across all sites, the slowest sites and the most recent incidents.

A WordPress fatal error answers with HTTP 200, so a plain ping says the site is fine while visitors see “There has been a critical error on this website”. On every paid plan WP Safer reads the page itself: a critical-error screen or an empty response counts as downtime, with the cause recorded. The same plans also watch WP-Cron (scheduled posts, backups and updates stop when it stalls) and the connection to the WP Safer plugin — a site that answers while its plugin has gone silent is shown separately, because that is not an outage but your backups have stopped.

On Pro and Agency three more checks run: the domain name expiry date (read from the registry, warned 30, 14 and 7 days ahead), a change to the site's A, AAAA or CNAME records, and a breakdown of every response into DNS lookup, TCP connect, TLS handshake and server time. The breakdown uses the uptime check itself — no extra traffic is sent to your site.

Yes, on the Agency plan. You pick which of your sites appear, and the page shows their current state, a 90-day uptime strip, open outages and past incidents — no login, and search engines are kept out by default unless you decide otherwise.

It can live on your own address: point status.yourdomain.com at us with a CNAME and the page answers there, with your logo, your brand colour and the “powered by WP Safer” line removed. Nothing else of WP Safer is reachable on that domain.

The page only publishes what we actually measured, and it says so: checks run from a single location (our node in Finland).

Yes, on every paid plan, and it covers the whole month of maintenance rather than uptime alone.

Backups: how many ran, what they add up to in size, which runs failed, and which sites finished the month without a single successful backup. Three situations are kept apart because they say different things: no schedule at all, a schedule that never ran, and runs that all failed.

Updates: how many core, plugin and theme updates went in, which ones failed and which were rolled back — with core updates, failures and rollbacks listed one by one, because those are the lines worth reading twice. Uptime: availability per site, total downtime, how many incidents there were and what caused them, and the average response time. On top of that each site's Site Health score — the score as it stands today, not a monthly average, because we do not keep score history — a file integrity summary, and any certificate or domain name about to expire.

Nothing we did not measure becomes a number. A site with no measurements that month is listed as “not enough data yet”, and a section whose source we could not read is left out of the document altogether instead of being reported as zero — “0 updates” and “we could not see your updates” are not the same sentence.

The email carries a link that opens the same report in a browser with no sign-in, so you can forward it to your own client as it is, and the same address offers a PDF download. The link works for 365 days and then stops: a signed address is a standing secret once it has been forwarded, so it should not live forever.

You decide what goes in under Monitoring → Report template: which sections appear, your own title, an opening and closing paragraph in your own words, and whether the PDF is attached to the email. The report itself can be switched off (or back on) under Monitoring → Alert channels, where you can also preview a real sample of your own data. On Agency the report carries your branding — the name, logo and colour from your status page, without the WP Safer footer. The sending address stays ours.

On every paid plan, a few minutes after WP Safer installs an update — plugin, theme or WordPress core — the site is opened and read again: the home page, plus one inner page found in the home page's own HTML. If the answer is a WordPress critical-error screen, an empty body, a server error, or your keyword has disappeared, and the next reading says the same, the update counts as broken.

A broken update is then put back from the official wordpress.org package, so the files return to the version that was there before. The database is not touched — whatever the new version wrote there stays. WordPress core is only put back inside the same release series (6.8.2 back to 6.8.1), because WordPress does not support moving its database schema backwards. If there is no package to go back to, we say so plainly instead of guessing, and point you at the site's last backup; restoring that is always your decision, never automatic.

After a broken update, automatic updates pause on that site. Updating by hand still works, and the pause stays until you lift it from the site's Uptime tab — the package that broke the site is still out there, and the next automatic round would install it again.

If we cannot reach the site at all — a DNS failure, a timeout, a firewall — the check is recorded as “could not measure”. That never counts as broken, never triggers a rollback and never sends an alert. Checks run from a single location, so not seeing a site is not the same as the site being down.

Yes, on every paid plan. Every incident is shown together with what WP Safer recorded on that site in the minutes before it started — the plugin, theme and core updates we ran — and how long before the incident each one happened. The list says what it is: things that happened close in time, not a statement of cause.

From the same place you can put a plugin back to the version it had before the update, or restore the site's last backup. Both ask you to confirm first and neither ever happens on its own — a rollback replaces files, a restore also replaces the database. If there is no earlier version to go back to, the button stays disabled and says why.

Every site gets a single score between 0 and 100, built from five things we already measure: uptime over the last 30 days, the most recent PageSpeed result, known vulnerabilities in the installed plugins and themes, how fresh the last backup is, and whether the site's files still match what was published. The panel always shows the breakdown — how many points each part cost, and which part could not be measured.

What we could not measure is never counted as zero; its weight leaves the total instead. If too little could be measured, no score is shown at all, because a flattering number built on one measurement is worse than no number. Backups that were never scheduled count as a choice rather than a bad result and stay out of the score entirely.

On any paid plan you can embed the badge in the site itself: a static image, no login needed, showing the uptime percentage we measured and nothing else. It has its own address that you can replace whenever you want, and the panel gives you the snippet to paste. On Agency you can put your own wording on it and take our name off.

It protects wp-login.php, the /wp-admin area, and xmlrpc.php. admin-ajax.php and admin-post.php are left open by default, since your site’s front-end forms and cart typically use these endpoints — restricting them could break those features.

A single IPv4 or IPv6 address, a CIDR block, a right-hand wildcard range (e.g. 192.168.1.*), or a numeric range (e.g. 1.2.3.10-50). Any line that can’t be parsed is flagged as invalid and left out of the active filter.

Two safeguards prevent this: an empty allow list is rejected everywhere, both in the dashboard and on the site, so you can’t accidentally block every visitor; and if you do get locked out, adding a single constant to your wp-config.php disables the firewall instantly without deleting your saved list.

Yes — build an IP pool once in your dashboard and apply it to as many sites as you want. Applying a pool copies the list to that site at that moment; it isn’t kept in sync, so if you update the pool later you’ll need to re-apply it to sites you already set up.

The request is blocked. If a bypass address is configured, it’s redirected there (HTTP 302); otherwise it receives a 403 Forbidden response.

Yes. WP Safer checks each site every 5 minutes on the Free plan, every minute on Starter and Pro, and every 30 seconds on Agency. An incident only opens after two consecutive failed checks, so a single temporary blip doesn't trigger an alert.

Open the migration wizard from your WP Safer dashboard, pick a backup, and enter the SFTP or FTPS details for your new host. The wizard checks compatibility, transfers your files and database in the background, and finishes once you update a single DNS record. See our step-by-step guide for the full walkthrough.

No — your current site keeps running throughout the backup transfer and setup. The only moment anything changes is after you update the destination's DNS record yourself, and even then the switch depends on DNS propagation rather than WP Safer. We describe this as minimal downtime, not zero downtime, since propagation timing isn't something we control.

The self-service migration wizard is included on annual Starter, Pro and Agency plans at no extra cost. If you're on the free plan or paying monthly, the wizard isn't included, but you can switch to annual billing any time or use WP Safer's migration service: our team moves a single site up to 10 GB for a fixed $300, including a page-by-page verification check.

Any host that gives you SFTP or FTPS access to the destination site works. Plain FTP isn't accepted, since it would send your login credentials unencrypted. If your new host only offers FTP, or doesn't give you file access at all, that's a case for WP Safer's migration service — get in touch and we'll quote it.

Orders, customers and stock changes made on your current site after the backup you migrate are not carried over automatically — the wizard asks you to acknowledge this before starting. Right before the DNS switch, you can run a Final sync to copy a fresher backup, which is worth doing if any sales came in while you worked through the earlier steps. For busy stores, consider pausing checkout for the short window around the switch.

On a schedule set by your plan — weekly on Pro and Agency, monthly on Starter — the WP Safer plugin walks your site's files and reports only the differences back to the panel; your file list never leaves the site.

WordPress itself and the plugins you installed from wordpress.org are compared against the file lists wordpress.org publishes for exactly the version you are running. Everything else — your themes, premium plugins, mu-plugins and drop-ins — has no official list anywhere, so it is compared against a baseline recorded the first time we scan the site, and only later changes are reported. Under wp-content/uploads nothing is compared at all; we only look for files that could be executed there, because uploads is a folder for data, not for code.

A component we cannot verify is never shown as suspicious. “We could not check this” and “this does not match” are two different sentences, and every site has at least one premium plugin or custom theme — if they shared a colour, that colour would be on every screen and you would stop reading it.

No. Open the site's File integrity tab and mark the file as known. It stays on the list so you can always see what you accepted, but it stops producing alerts and it stops costing you points in the Site Health score.

Nothing is ever deleted or quarantined for you. WP Safer reports what it found and where; what to do about it is your decision, and if you do decide to change something, the site's last backup is one button away.

Yes, but only findings you have not acknowledged, and only once the site has actually been scanned.

A site that has never been scanned is not counted as zero — file integrity simply drops out of that site's score and the panel says there is no data, exactly like the other components. The same applies when the last scan is too old to speak for the site today, and when your plan does not include file scanning at all: you are not marked down for something we never measured or something you never bought.

Findings that need a look — a core file that is missing or does not match, a file that can be executed inside your uploads folder — weigh more than the rest, and acknowledged files weigh nothing.

Yes. WP Safer is built for agencies and freelancers: connect every site to one panel, see status/updates/backups for all of them, and log into any WP admin with a single click.

Yes. Updates can run automatically or on demand. Before a plugin is updated, its current version is copied aside; if the update fails or the plugin breaks the site, the previous version is restored automatically.

ManageWP's free tier includes a basic backup and security check. Automated, off-site, incremental backups are part of ManageWP Premium, a separate paid add-on. WP Safer includes automated incremental backups on every paid plan without a separate add-on.

Yes. After WP Safer updates a plugin, it re-checks the site; if two consecutive checks confirm the update broke the site, WP Safer automatically rolls the plugin back to the previous version and notifies you. Rollback works at the file level and does not touch your database.

Both are built for multi-site management. The practical difference is what's included by default: WP Safer bundles backup, uptime monitoring, update verification and an admin firewall into one plan, while ManageWP requires stacking its Premium add-ons to get the same coverage. Which is more cost-effective depends on how many of those add-ons your sites actually need.

Yes — MainWP's core dashboard is a plugin you install on a WordPress site you host yourself. WP Safer, by contrast, is a hosted dashboard at wpsafer.com: there's nothing to install or keep updated on your side.

Not automatically. MainWP's free core dashboard doesn't include automated backups by itself; that requires a separate paid backup extension. WP Safer includes automated, incremental backups on every paid plan.

It depends on how many MainWP extensions you'd need to match WP Safer's included feature set (backup, uptime monitoring, reporting, update rollback, admin firewall). For an agency that wants that coverage without assembling and paying for several extensions separately, WP Safer's bundled plans are usually simpler to budget for.

No — WP Umbrella's firewall, malware scanning and IP blocklists are part of a separate paid Security add-on. WP Safer's wp-admin IP firewall (restricting wp-login.php, wp-admin and XML-RPC by IP) is included on every paid plan without an add-on.

It combines backup status, update activity, uptime and a Site Health score in one white-label report, plus upcoming SSL/domain expirations. It's available as a shareable signed link and as a downloadable PDF, and is sent monthly by email.

Both describe an automatic rollback for updates. WP Safer's trigger is specific: it re-checks the site after an update and only rolls a plugin back once two consecutive checks confirm the update broke the site — an unmeasurable check (timeout, DNS, firewall block, etc.) never triggers a rollback on its own.

No — BlogVault's public feature set is centered on backup, staging, migration and malware scanning; it doesn't publish an uptime or performance monitoring feature. WP Safer includes uptime and performance monitoring on every paid plan.

BlogVault offers one-click migration as part of its plans. WP Safer offers a self-service migration wizard (SFTP/FTPS-based) for accounts on annual billing, and a fixed-price ($300) fully managed migration service for everyone else, covering a single WordPress site up to 10GB.

WP Safer's Site Health score combines backup status, update activity and uptime into a single number with an embeddable badge, plus a monthly white-label report. BlogVault doesn't publish an equivalent unified health score or report.