FeatureData security for your backups

Enterprise-grade data security for your WordPress backups

Your backups hold everything your site has: content, customer details and orders. BlogVault protects them the way large companies protect their data. Every backup is encrypted, stored as 9 copies with 2 separate providers in EU data centres, and kept away from your server, with no backup files or storage keys left on your site for a hacker to find.

Back up my site See where backups are stored

9Encrypted copies of every backup
2Separate storage providers
EUData centres, GDPR-compliant
400,000+Websites protected

GDPR-compliant off-site storage

Your backups are stored off-site, in EU data centres, in line with GDPR, so the personal data in them (customer names, emails and orders) is handled lawfully. Follow one backup from your site to storage, then use the switch to see what a hacker who takes over your server could reach.

▸ Fig. 1 · Northwind Store, one backup

[Your host]The server your site runs onAttacker has shell access

northwindstore.comWordPress · WooCommerce

▸ Files + database18,703 files

▸ BlogVault pluginPublic key only

Backup data on this disk

Zip archives0

Temp files0

Storage keys0

Secure connection

Instruction signed · verified
Encrypted in transit
12 changed files · 2.4 MB

No storage keys on the server · no way in

[BlogVault storage]EU data centresSafe

Provider AEU data centre

Provider BEU data centre

Encrypted copies9 / 9

▸ Storage keysHeld here, not on your site

▸ At restEncrypted

backup.log[Normal night][Host compromised]

22:00:02sync18,703 files checked · 12 changed
22:00:03verifyInstruction signature ok · public key
22:00:05transfer2.4 MB · encrypted in transit
22:00:09store9 encrypted copies · 2 providers · EU
22:00:09site0 files written to your server

09:14:21attackerls wp-content → no backup archives
09:14:26attackerread wp-config, wp_options → no storage keys
09:14:40attackersend plugin an instruction → refused, not signed
09:14:41storage9 of 9 copies intact · no path from this server
09:20:05youRestore point Sep 7, 22:00 · from before the break-in

A normal night: the backup is sent from your site over a secure connection and stored as 9 encrypted copies with 2 providers in EU data centres. No backup files are saved on your server.

No backups on your server

BlogVault leaves no zip files or temporary files on your server and adds nothing to your database, so there’s no backup there to steal or delete.

No storage passwords on your site

The keys to BlogVault’s storage never touch your site, so a hacker can’t use your site to get to your backups.

Only BlogVault can give commands

The plugin only follows instructions signed by BlogVault and checked against a public key on your site. Anyone else is ignored.

Copies with two providers in the EU

9 encrypted copies with 2 cloud providers, so one company’s outage can’t take away your only backup.

What happens to your backups if something goes wrong

Eight things that happen to real WordPress sites, and whether your BlogVault backups are affected. Only the last one depends on you.

If this happens	What happens to your backups	Result
Your site is hacked or infected	Your backups aren’t on your site and the plugin has no storage keys, so the hacker can’t delete them. Restore a backup from before the attack.	Safe
Your host’s server is hacked	Nothing on the server leads to BlogVault’s storage, and the plugin ignores any instruction that BlogVault didn’t sign.	Safe
The data centre goes offline	A fire, flood or long outage can take your host offline. Your backups are in other data centres, run by other companies.	Unaffected
An update breaks the site and it won’t load	The backups live outside the site, so they are there when it isn’t. The Emergency Connector restores a site that can’t be reached.	Ready to restore
Someone sends your plugin commands	Every instruction must be signed by BlogVault and is checked against a public key on your site. Anything unsigned is ignored.	Ignored
A storage provider has an outage	Copies are also held with a second provider, so there is no single point of failure.	Still available
You close or lose your hosting account	Your backups are kept by BlogVault, not your host, so you still have them. Restore or migrate them to a new host.	Unaffected
Someone gets into your BlogVault account	This is the account to protect. Give it its own strong password and only share access with people who need it. The activity log shows who did what.	Up to you

BlogVault leaves no backup files on your server

Many backup plugins save backup files and storage passwords on your server. Anyone who gets into the server can find them. BlogVault leaves nothing there, and uses none of your disk space.

[Typical backup plugin]

Creates zip files on your server

wp-content/backups/site-2026-09-07.zipon disk
wp-content/backups/tmp/part-archive while it buildson disk
wp-config.phpyour cloud storage keysreadable
wp_optionsschedule and destinationreadable

A hacker could findBackups and storage keys

[BlogVault]

Nothing stored on your server

wp-content/plugins/blogvault/the plugin and a public keyplugin
wp-content/backups/no zip filesnone
/tmpno temporary filesnone
databasenothing added to itnone

Backup space used on your server0 bytes

Storing zip files and keys on the server is a reasonable design when you manage your own storage. The downside is that whoever gets into the server can also reach the backups.

A backup stored on the same server as your site is lost when the server fails, and exposed when it’s hacked. BlogVault keeps your backups somewhere your server can’t reach, even if someone takes it over.

Back up my site How we handle GDPR

How BlogVault protects your backup data

Encryption, storage location, number of copies and cost, plus the one thing we don’t offer.

Read our GDPR page

Backup security details8 entries

Encryption: In transit and at restBackups are encrypted on the way to storage and while they sit there.
Location: EU data centresStored in line with GDPR. Names, emails and orders in a backup are customer data too. GDPR at BlogVault
Redundancy: 9 copies, 2 providersDifferent cloud providers, so no single outage or company holds the only copy.
Storage keys: Held by BlogVaultNever on your site: nothing in wp-config or the database points at your backups.
Commands: Signed and checkedThe plugin only follows instructions signed by BlogVault, checked against a public key on your site.
Storage cost: IncludedNo bucket to create and no storage bill. Plans cover sites up to 20, 50 or 100 GB.
History: 30, 90 or 365 daysHow far back you can restore, depending on the plan.
Your own storage: Not offeredYou can’t send backups to your own Amazon S3 or Dropbox. If you need that, BlogVault isn’t the right fit today.

An activity log shows who did what

The activity log records every update, backup and restore, and who ran it. When your site breaks, you can see what changed just before and who changed it.

Every update, backup and restore
Who ran each one
What changed just before a problem

See how restores work

Northwind StoreActivity logLast 24 hours

Sep 7 · 22:00Backup complete · 12 files changedAutomaticBackup
Sep 8 · 09:02payments-gateway updated to 3.2.1Auto-updateUpdate
Sep 8 · 09:31Test restore of Sep 7, 22:00 · checkout ok · 58sPriya NairTest
Sep 8 · 09:36Restored wp-content/plugins, wp_optionsPriya NairRestore
Sep 8 · 09:41Backup complete · checkout working againAutomaticBackup

Trusted by store owners and agencies

Agencies and store owners trust BlogVault with their clients’ data. Here is what two of them say.

For the online store owners, the security and reliability of my clients’ websites are of utmost importance, and this plugin has truly been a game-changer.

Jo WalthamCallia Web

“Their automatic backups are an incredible safety net. No matter what goes wrong, I can just restore my site before anyone notices anything.”

Kimberly Lipari ValetBlogVault customer

400,000+Websites protected
120Countries
5,000+Web hosts supported
1M+Successful restores

Data security questions

Are my backups encrypted?

Yes. Backups are encrypted in transit, on the way from your site to storage, and at rest, while they are stored. You don’t configure or manage any of it.

Where exactly are my backups stored?

In EU data centres, as nine encrypted copies spread across two cloud storage providers. None of them is on your site or with your host. Our GDPR page covers how that data is handled.

If someone hacks my site, can they delete my backups?

No. Your backups aren’t on your site, the plugin has no storage keys, and it ignores instructions that BlogVault hasn’t signed. One thing to know: backups made after a hack include the hacker’s changes, so restore from a backup made before it.

Can I keep backups in my own Amazon S3 or Dropbox?

No. Storage is managed by us and included in the price. If you need backups in storage you control, BlogVault doesn’t offer that today.

Does storage cost extra as my site grows?

No. Storage is part of every plan, with nothing to set up or pay for separately. Plans cover sites up to 20, 50 or 100 GB, and backup history of 30, 90 or 365 days.

Does BlogVault make my site secure?

No. BlogVault keeps your backups safe and gets your site back after something goes wrong. It doesn’t scan for malware or block attacks, so use a security plugin or firewall as well.

Who can see or restore my backups?

People with access to your BlogVault account. The activity log records every backup, restore and update with the person who ran it, so on a team you can always see who did what.

Backups built for scale. Restores for the bad day.

Back up my site — free Talk to an expert

No credit card · 14-day money-back guarantee