Skip to content
PluginCanary

Backup, Restore and Migrate your sites

by watchful · 10,000+ active installs · Checked 5 Nov 2026
Healthy

Healthy: released 8 days ago, no open vulnerabilities.

95/ 100Healthy
Canary Score

Based on 3 of 5 areas

Capped at 95: not enough support or review data for a full score.

Sub-scores for Backup, Restore and Migrate your sites
Ownership100
Maintenance100
Security90
SupportNo data
ReputationNo data

How the score works

Active signals

Open issues right now, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

History: 17 past vulnerabilities, all patched. Patched issues are listed in the Security record, not here.

Quick answers

Is Backup, Restore and Migrate your sites still maintained?
Yes. Last release 28 Oct 2026, 13 releases in the last 24 months. 28 Oct 2026 · wordpress.org
Who owns Backup, Restore and Migrate your sites, and has it changed hands?
No change recorded. Main committer watchful since Mar 2020. 5 Nov 2026 · SVN log
Was Backup, Restore and Migrate your sites removed from wordpress.org?
No. Listed on wordpress.org as of 5 Nov 2026. 5 Nov 2026 · wordpress.org
Is Backup, Restore and Migrate your sites safe?
17 known vulnerabilities, all fixed (latest in 4.8.7). Not on the exploited list. 3 Jun 2026 · Wordfence Intelligence
Is the latest Backup, Restore and Migrate your sites update safe to install?
No ownership change before 4.8.8. No one-star spike after it. 28 Oct 2026 · Release history

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
xcloner28 Sep 2010 to 24 Jan 2020, 649 commits
watchful24 Mar 2020 to 28 Oct 2026, 181 commits

2 committers recorded. No ownership changes recorded since 2010.

Maintenance

Last release
8 days ago
Releases, 24 months
13
Tested up to
7.0 vs 7.1
Requires PHP
7.3 supported 8.2+
Releases per quarter
Releases per quarter for Backup, Restore and Migrate your sites
Q1 20241
Q2 20242
Q3 20243
Q4 20242
Q1 20250
Q2 20252
Q3 20251
Q4 20253
Q1 20261
Q2 20263
Q3 20260
Q4 20261

Last release 28 Oct 2026. Tested up to 7.0, 1 major version behind WordPress 7.1.

Support

Resolved, last 2 months
0%
Threads, last 2 months
2

Trend appears after 8 weekly snapshots.

Security record

2 vulnerabilities in 24 months (17 on record), all patched (latest fixed in 4.8.7).

Show 17 patched vulnerabilities
DateIssueCVSSAffectedFixed inDays to patch
3 Jun 2026Authenticated (Subscriber+) Information Exposure4.3<= 4.8.64.8.7Before disclosure
4 Dec 2025Cross-Site Request Forgery in Xcloner_Remote_Storage:save()4.3<= 4.8.24.8.3Before disclosure
15 Jul 2024Unauthenticated Full Path Disclosure5.3<= 4.7.34.7.41
6 Jun 2022Unauthenticated Plugin Settings Reset9.8<= 4.2.164.3.615
18 Aug 2020Cross-Site Request Forgery9.8< 4.2.1534.2.15322
18 Aug 2020Unprotected AJAX Actions8.84.2.1 to 4.2.124.2.15322
31 Dec 2016Path Traversal to Sensitive Information Disclosure4.3<= 3.1.43.1.5Before disclosure
10 May 2015Remote Code Execution9.8< 3.1.33.1.369
10 May 2015Cross-Site Scripting6.1<= 3.1.23.1.369
10 May 2015Remote Command Execution8.8<= 3.1.23.1.369
17 Oct 2014Sensitive Information Disclosure7.2< 3.1.23.1.248
17 Oct 2014Remote Code Execution7.2< 3.1.23.1.248
17 Oct 2014Sensitive Information Disclosure7.5< 3.1.23.1.248
17 Oct 2014Improper Access Control to Information Disclosure7.5<= 3.1.13.1.248
17 Oct 2014Directory Traversal4.9< 3.1.23.1.248
9 Apr 2014Multiple Cross-Site Request Forgery9.6< 3.1.13.1.1Before disclosure
2 Apr 2014Cross-Site Request Forgery5.4< 3.1.13.1.1Before disclosure

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Reputation

Last 90 days: no reviews. Lifetime: 4.2.

Last 90 days vs lifetime average rating for Backup, Restore and Migrate your sites
Last 90 daysNo reviews
Lifetime4.2
Average rating per quarter
Average rating per quarter for Backup, Restore and Migrate your sites
Q2 20245.0
Q2 20251.0
Q3 20255.0

Average rating stayed at 5.0 between Q2 2024 and Q3 2025.

Rating distribution
5 star94
4 star7
3 star5
2 star3
1 star20
Latest low reviews

Momentum

Active installs
10,000+
Downloads, last full week
4,289
Weekly downloads, last 26 complete weeks
Weekly downloads for Backup, Restore and Migrate your sites
4 May 2026206
11 May 2026574
18 May 2026676
25 May 20264,012
1 Jun 20261,083
8 Jun 2026849
15 Jun 2026724
22 Jun 2026571
29 Jun 2026599
6 Jul 2026687
13 Jul 2026561
20 Jul 2026521
27 Jul 2026497
3 Aug 2026547
10 Aug 2026533
17 Aug 2026508
24 Aug 2026496
31 Aug 2026525
7 Sep 2026467
14 Sep 2026510
21 Sep 2026578
28 Sep 2026576
5 Oct 2026789
12 Oct 2026665
19 Oct 2026829
26 Oct 20264,289

Weekly downloads over the last 4 weeks are 87% above the 26-week average.

Facts

Full name
Backup, Restore and Migrate your sites with XCloner
Version
4.8.8
Author
watchful
Added
28 Sep 2010
Last updated
28 Oct 2026
Active installs
10,000+
Requires WordPress
5.1
Tested up to
7.0.8
Requires PHP
7.3
Category
Site Administration & Utilities > Site Migration & Cloning
Tags
backup, cloud backup, database backup, wordpress backup, wordpress migration

Other plugins by this author: Remote Website Management by Watchful, Changed Files app for Watchful

Questions about Backup, Restore and Migrate your sites

Is Backup, Restore and Migrate your sites still maintained?

Yes. Last release 28 Oct 2026, 13 releases in the last 24 months.

Who owns Backup, Restore and Migrate your sites, and has it changed hands?

No change recorded. Main committer watchful since Mar 2020.

Was Backup, Restore and Migrate your sites removed from wordpress.org?

No. Listed on wordpress.org as of 5 Nov 2026.

Is Backup, Restore and Migrate your sites safe?

17 known vulnerabilities, all fixed (latest in 4.8.7). Not on the exploited list.

Is the latest Backup, Restore and Migrate your sites update safe to install?

No ownership change before 4.8.8. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 5 Nov 2026.Report a data issue