UpdraftPlus Backup deleted from hacker

To prevent a hacker from deleting your backups, change passwords as frequently as you care to, using the random password generators in both WP and cPanel, and then save those to a password manager, like ‘Keychain’, in the case of a Mac. There are other password manager options for Windows. Also consider using a security plugin like Wordfence, if you haven’t already.

But most importantly, don’t keep the only copy of your backups on the same server as your site. Think eggs in a basket.

You can set UD to upload your backups to a remote site like Google Drive or Dropbox. You can also subsequently download to your computer a copy of your backups directly from your remote site of choice, or from your site using FTP. Your ability to download to your own computer will be affected by the size of your site and/or your local internet connection. Whereas UD will automatically send the backups directly to remote storage regardless of your local connection by first zipping the files and uploading in chunks to avoid timeouts.

Depending on your hosting account storage space, you can tell UD to keep a copy of your backups on your server. This makes for a quicker restore, if like me, you accidentally delete something. But it is highly recommended to send a copy elsewhere for the very valid reason/concerns you have just mentioned.

If a hacker gets in, or your host/server goes bang, it’s just a question of installing a fresh copy of WordPress, on the same domain, with any random user credentials and installing a fresh UpdraftPlus and either uploading from your computer the backup files you downloaded, or telling UD which remote site to fetch them from. Click ‘restore’. Your fresh install should be overwritten with all your original site content and settings, users included.

That is true. If a hacker gets into your WP installation, they can delete your remote backups, hence the reason to use yet another level of protection such as Spinbackup, or manually downloading a copy of your backups, and then backing up your computer.

Including my actual site, I have backups in Google Drive, on my laptop, and 2 external drives. So basically, our site which my wife and I have spent the last 2 years building exists in 5 distinctly separate locations. I guess you have to decide how much your work is worth and how far you are willing to go in order to protect it.

It’s sad but true, but there are plenty people out there with nothing better to do than look around only to delete other peoples hard work just for fun.

Various extremely cost effective tools and methods are there for you to use, as well as the horror stories to learn from. Don’t get caught out.

On a side note, the biggest threat to my site so far has been me, myself, and I. I’m the kind of guy who might sort of break something that I own, just to see if I can fix it. And this is where backups have saved my site. The missus also wouldn’t be too pleased if I couldn’t get the site back up 😉

One approach to keeping your Google Drive backups (more) secure in the event your web site is hacked:

1. Share the UpdraftPlus folder with a second Google account. View access is fine. If you want to remove the source files after copying to the second account, grant edit access.
2. On your second Google account, create an unshared folder (e.g. UpdraftPlusCopy).
3. On your second Google account, go to script.google.com. Copy/paste the following (I renamed myFunction to CopyNewFiles) and replace the [bogus] folder IDs with the folder IDs for your source/destination folders:
   function CopyNewFiles() {
   var SourceFolder = DriveApp.getFolderById(‘JMtgsgM9sY9Fe5Z7wCbb4YVVqfeZiZ’);
   var SourceFiles = DriveApp.getFolderById(‘JMtgsgM9sY9Fe5Z7wCbb4YVVqfeZiZ’).getFiles();
   var DestFolder = DriveApp.getFolderById(‘SFGXwgvX6DmkAvPrrnWC2KY3imy7s2’);
   var DestFiles = DriveApp.getFolderById(‘SFGXwgvX6DmkAvPrrnWC2KY3imy7s2’).getFiles();
   var NotInDest = true;
   while (SourceFiles.hasNext()) {
   SourceFile = SourceFiles.next();
   while (DestFiles.hasNext()) {
   DestFile = DestFiles.next();
   if (SourceFile.getName() === DestFile.getName()) {
   NotInDest = false;
   }
   }
   if (NotInDest) {
   SourceFile.makeCopy(SourceFile.getName(), DestFolder);
   NotInDest = true;
   }
   DestFiles = DriveApp.getFolderById(‘SFGXwgvX6DmkAvPrrnWC2KY3imy7s2’).getFiles();
   }
   }
4. Optionally, rename the project. Save it (Ctrl+S) works and click the Run button.
   The first time you run it, you should be prompted to grant the script access to manage your (second Google account) Drive.

The script above will copy all files from SourceFolder to DestFolder that don’t already exist (identically-named file) exist in the DestFolder. If you are concerned about storage limits/cost, you could update the script to remove the original file after copying (example below). With that approach, you can remove/comment the code that checks for identically-named files in DestFolder, since that should never be the case if you remove the original file in SourceFolder. To do a restore from the UpdraftPlus plugin, you would need to copy/move the backup files back to the UpdraftPlus folder on the first Google account.

function CopyNewFiles() {
var SourceFolder = DriveApp.getFolderById(‘JMtgsgM9sY9Fe5Z7wCbb4YVVqfeZiZ’);
var SourceFiles = DriveApp.getFolderById(‘JMtgsgM9sY9Fe5Z7wCbb4YVVqfeZiZ’).getFiles();
var DestFolder = DriveApp.getFolderById(‘SFGXwgvX6DmkAvPrrnWC2KY3imy7s2’);
while (SourceFiles.hasNext()) {
SourceFile = SourceFiles.next();
SourceFile.makeCopy(SourceFile.getName(), DestFolder);
SourceFolder.removeFile(SourceFile);
}
}