Nimble Backup

Changelog

1.44.1

• PHP execution limits are no longer set to unlimited. A backup, restore, export or import now raises the limit to a bounded 900 seconds, and only when the host allows it and the current limit is lower; memory is raised with wp_raise_memory_limit() instead of ini_set().
• A restore or a migration import no longer unpacks the archive to a folder first. The database dump is streamed out on its own, and everything under wp-content is streamed from the archive straight to its final path, so no plugin or theme source is ever written to the uploads folder in between. Every path in the archive is checked before a single byte is written, and a short write is now detected instead of being counted as a success.

1.44.0

• Off-site storage. Each finished backup can be uploaded to an S3-compatible bucket of your own – Amazon S3, Backblaze B2, Wasabi, Cloudflare R2, DigitalOcean Spaces, Hetzner, or your own MinIO. Switched off until you enter a bucket and credentials. A backup on the same server shares that server’s bad days; this is the copy that does not.
• The upload is part of the same paced batch process the archive is built with, so a multi-gigabyte archive is sent a piece at a time instead of in one request that a host would cut short. An interrupted upload resumes from the piece it reached rather than starting over, and an upload that cannot be finished is cancelled at the provider – an abandoned multipart upload keeps billing for the pieces already sent, and does not show up in a listing.
• A failing upload gives up after five attempts instead of retrying for ever. A rotated key or a deleted bucket would otherwise have left the backup permanently “running”, and a run in progress blocks the next one – every later scheduled backup would have been skipped in silence.
• A failed upload never invalidates the backup. The archive is on disk and verified, so it is recorded as the success it is, with the off-site failure reported separately.
• Remote copies follow the same retention count as local ones, and only ever delete archives this plugin wrote. Object storage is billed by the gigabyte-month, and a nightly backup that is never pruned becomes a bill nobody is watching.
• The secret key is stored encrypted, never rendered back into the page, and can be removed by clearing the field. The settings screen says whether this installation keeps its salts in wp-config.php, where a backup cannot reach them.
• “Test the connection” proves the credentials before a backup depends on them, rather than finding out at three in the morning after the archive is built.

1.43.0

• Every declaration, hook and stored name now carries the full nimble_backup / Nimble_Backup_ / NIMBLE_BACKUP_ prefix. The short NMT_, NB_ and nmt_ names are gone. Settings saved by earlier versions are migrated automatically, and cron events scheduled under the old hook names are still picked up.
• Uploaded migration packages go through wp_handle_upload() instead of move_uploaded_file(), with the upload directed at the plugin’s own protected folder and restricted to zip files.
• Restoring a database dump now runs through $wpdb->query() rather than the raw mysqli handle. Checked against WordPress core: wpdb::query() neither adds nor removes placeholder escapes, so the “%” corruption the raw handle was meant to avoid was never caused by it. The repair tool stays for sites damaged by versions before 1.41.
• A restore no longer activates or deactivates anything. It only rewrites the plugin’s own entry in the active list when the restored database still names the 1.40.x folder, so an administrator’s existing choice survives the rename.
• A restore now stops at the first statement the database refuses, and names the table, instead of running the rest of the dump into a database that is already half replaced.
• The options cache is flushed the moment a database import finishes. Without it every option read for the rest of that request still answered with the values from before the restore.
• Other plugins can no longer touch a restore or a package upload in flight: the query filter is lifted for the duration of the import, and the upload filters that media-offload plugins use are lifted while the package is stored, so a database archive is never copied to third-party storage.
• An uploaded package keeps a high-entropy filename, and is deleted on every failure path, not just some of them.
• While the legacy 1.40.x package is active this one stands down and says so, whichever of the two WordPress loads first.

1.42.4

• Screenshot captions in the readme now describe the three screens the plugin actually has. No code changes.

1.42.3

• Documents where the plugin writes: everything it creates stays in a protected folder inside the uploads directory, and the only write outside it is restoring wp-content, which is what a backup plugin is for.
• No functional changes.

1.42.2

• Moves the admin stylesheet and script into real files loaded through wp_enqueue_style() and wp_enqueue_script() instead of being printed inline on the page.
• No backup, restore or migration behaviour changes.

1.42.1

• Documents why the server-to-server download endpoint has no nonce: the caller is another site rather than a browser session, and authentication is a random expiring token compared with hash_equals(). The existing annotation sat one line below the line that needed it.
• Documents the usermeta prefix rewrite during migration, where meta_key is the column being written rather than a query argument.
• No behaviour change.

1.42.0

• Removes the cross-promotion sidebar. It accounted for 94 percent of the plugin’s download size: 3.98 MB of images against 216 KB of code. The package is now 240 KB.
• Internationalises the interface. 89 previously untranslated strings now use the standard WordPress translation functions, and the plugin ships a .pot file for the first time.
• Documents the two outbound requests the plugin makes, neither of which involves a third party, and adds External services and Privacy sections to the readme.
• Corrects the Contributors username.

1.41.2

• The admin header mark was an inline SVG drawn in PHP with no class names; it now uses the
  shipped brand file like every other surface.
• The three cross-product promo images carried the old mark baked in. Each now shows the
  promoted product’s own colour.
• Replaces the placeholder mark with the real Nimble logo across the plugin, in the
  product’s own colour so the WordPress admin menu stays readable when several
  Nimble plugins are installed side by side.
• No behaviour change.

1.41.0

• Renamed the install package and plugin root to nimble-backup/nimble-backup.php.
• Migrates durable 1.40.x settings into the nimble_backup_* namespace so deleting the legacy package cannot reset the new plugin.
• Moves primary cron workers to nimble_backup_* hooks while retaining legacy action aliases for compatibility.
• Preserves legacy nmt_* admin/action aliases and the public Security/Operations contracts while moving persistent runtime state to the new namespace.
• Moves new private working data below uploads/nimble-backup/ and adds Apache/IIS deny files plus randomized archive filenames.
• Migrates compatible legacy backup archives into the new protected backup directory.
• Validates migration and restore ZIP files before extraction, rejecting unsafe paths, unexpected top-level entries and symbolic links.
• Adds verified archive metadata and only marks new backups successful after ZIP/manifest/database validation.
• Creates a verified safety recovery point before restore and migration import and stops destructive work if that point cannot be created.
• Fixes destination URL capture so migration URL replacement uses the real destination URL even after the source database has been imported.
• Adds migration support for differing WordPress database table prefixes.
• Sends the migration token in a request header on new transfers while retaining legacy query-token compatibility on the source endpoint.
• Adds a one-click transfer-token/package revoke action.
• Fixes top-level admin navigation so Backup, Export and Import use the real admin.php?page=nimble-backup route.
• Records migration success/failure telemetry for the existing Operations 1.1 health provider.
• Keeps the Nimble Security recovery-point provider contract intact and fail-closed.
• Fails closed on WordPress Multisite instead of exposing unsafe network-wide restore/migration behavior.

1.40.2

• Keeps the Nimble Security recovery-point provider registered while Backup is temporarily running, continuing or locked.
• Separates durable provider capability from per-request readiness so Operations no longer reports a false missing-provider issue during normal backup activity.
• Preserves the fail-closed response gate while Backup is busy.

1.40.1

• Registers Nimble Backup through the public Nimble Security recovery-point provider contract.
• Creates and verifies a complete local recovery point before Security may continue destructive automatic quarantine.
• Refuses the recovery request when storage, ZipArchive or backup concurrency is unsafe.

1.40.0

• Moves Nimble Backup to its own top-level admin menu.

1.39.0

• Adds the Operations native health provider contract 1.1 and privacy-bounded backup/restore outcome telemetry.