WordPress Backup Security Best Practices: Protecting Your Safety Net

Backup Encryption

Encrypt backups before storage:

function encrypt_backup_file($source_path) {
    $encryption_key = defined('BACKUP_ENCRYPTION_KEY')
        ? BACKUP_ENCRYPTION_KEY
        : hash('sha256', wp_salt('auth'));

    $iv = random_bytes(16);
    $encrypted_path = $source_path . '.enc';

    $source = fopen($source_path, 'rb');
    $dest = fopen($encrypted_path, 'wb');

    // Write IV first
    fwrite($dest, $iv);

    // Encrypt in chunks
    while (!feof($source)) {
        $chunk = fread($source, 8192);
        $encrypted = openssl_encrypt(
            $chunk,
            'AES-256-CBC',
            $encryption_key,
            OPENSSL_RAW_DATA,
            $iv
        );
        fwrite($dest, $encrypted);
    }

    fclose($source);
    fclose($dest);

    // Remove unencrypted file
    unlink($source_path);

    return $encrypted_path;
}

function decrypt_backup_file($encrypted_path, $destination) {
    $encryption_key = defined('BACKUP_ENCRYPTION_KEY')
        ? BACKUP_ENCRYPTION_KEY
        : hash('sha256', wp_salt('auth'));

    $source = fopen($encrypted_path, 'rb');
    $dest = fopen($destination, 'wb');

    // Read IV
    $iv = fread($source, 16);

    // Decrypt in chunks
    while (!feof($source)) {
        $chunk = fread($source, 8208); // Slightly larger for padding
        $decrypted = openssl_decrypt(
            $chunk,
            'AES-256-CBC',
            $encryption_key,
            OPENSSL_RAW_DATA,
            $iv
        );
        if ($decrypted !== false) {
            fwrite($dest, $decrypted);
        }
    }

    fclose($source);
    fclose($dest);

    return $destination;
}

Secure Remote Storage

Transfer backups to secure remote location:

function upload_to_s3($backup_path) {
    $s3_config = array(
        'bucket' => defined('S3_BACKUP_BUCKET') ? S3_BACKUP_BUCKET : '',
        'region' => defined('S3_BACKUP_REGION') ? S3_BACKUP_REGION : 'us-east-1',
        'key' => defined('S3_BACKUP_KEY') ? S3_BACKUP_KEY : '',
        'secret' => defined('S3_BACKUP_SECRET') ? S3_BACKUP_SECRET : '',
    );

    if (empty($s3_config['bucket']) || empty($s3_config['key'])) {
        return new WP_Error('config_error', 'S3 not configured');
    }

    // Use AWS SDK
    $s3 = new Aws\S3\S3Client(array(
        'version' => 'latest',
        'region' => $s3_config['region'],
        'credentials' => array(
            'key' => $s3_config['key'],
            'secret' => $s3_config['secret'],
        ),
    ));

    $key = 'backups/' . date('Y/m/') . basename($backup_path);

    try {
        $s3->putObject(array(
            'Bucket' => $s3_config['bucket'],
            'Key' => $key,
            'SourceFile' => $backup_path,
            'ServerSideEncryption' => 'AES256', // S3-managed encryption
        ));

        // Log successful upload
        log_backup_event('s3_upload', $key);

        return true;

    } catch (Exception $e) {
        log_backup_event('s3_error', $e->getMessage());
        return new WP_Error('upload_failed', $e->getMessage());
    }
}

Backup Access Control

Restrict who can manage backups:

// Custom capability for backup management
add_action('admin_init', function() {
    $admin = get_role('administrator');
    $admin->add_cap('manage_backups');
});

function can_manage_backups() {
    return current_user_can('manage_backups') && is_user_logged_in();
}

// Verify backup download requests
function serve_backup_download($backup_id) {
    if (!can_manage_backups()) {
        wp_die('Access denied');
    }

    // Verify nonce
    if (!wp_verify_nonce($_GET['nonce'], 'download_backup_' . $backup_id)) {
        wp_die('Invalid request');
    }

    $backup = get_backup_record($backup_id);

    if (!$backup || !file_exists($backup['path'])) {
        wp_die('Backup not found');
    }

    // Log download
    log_backup_event('download', array(
        'backup_id' => $backup_id,
        'user' => get_current_user_id(),
        'ip' => $_SERVER['REMOTE_ADDR'],
    ));

    // Serve file
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename="' . basename($backup['path']) . '"');
    header('Content-Length: ' . filesize($backup['path']));

    readfile($backup['path']);
    exit;
}

Backup Retention Policy

Implement secure backup rotation:

function cleanup_old_backups() {
    $retention = array(
        'daily' => 7,    // Keep 7 daily backups
        'weekly' => 4,   // Keep 4 weekly backups
        'monthly' => 12, // Keep 12 monthly backups
    );

    $backup_dir = get_backup_directory();
    $backups = glob($backup_dir . '*.sql.enc');

    // Sort by date
    usort($backups, function($a, $b) {
        return filemtime($b) - filemtime($a);
    });

    $to_keep = array();
    $kept_weeks = array();
    $kept_months = array();

    foreach ($backups as $index => $backup) {
        $time = filemtime($backup);
        $age_days = (time() - $time) / 86400;
        $week = date('Y-W', $time);
        $month = date('Y-m', $time);

        // Keep daily backups within retention
        if ($index < $retention['daily']) {
            $to_keep[] = $backup;
            continue;
        }

        // Keep weekly backups
        if (!in_array($week, $kept_weeks) && count($kept_weeks) < $retention['weekly']) {
            $to_keep[] = $backup;
            $kept_weeks[] = $week;
            continue;
        }

        // Keep monthly backups
        if (!in_array($month, $kept_months) && count($kept_months) < $retention['monthly']) {
            $to_keep[] = $backup;
            $kept_months[] = $month;
            continue;
        }

        // Securely delete old backup
        secure_delete_backup($backup);
    }
}

function secure_delete_backup($path) {
    if (!file_exists($path)) {
        return;
    }

    // Overwrite with random data before deletion
    $size = filesize($path);
    $fp = fopen($path, 'w');
    fwrite($fp, random_bytes($size));
    fclose($fp);

    unlink($path);

    log_backup_event('deleted', basename($path));
}

Restoration Testing

Verify backup integrity regularly:

function test_backup_integrity($backup_path) {
    $results = array('valid' => true, 'issues' => array());

    // Check file exists and is readable
    if (!file_exists($backup_path) || !is_readable($backup_path)) {
        $results['valid'] = false;
        $results['issues'][] = 'Backup file not accessible';
        return $results;
    }

    // Check file size
    if (filesize($backup_path) < 1000) {
        $results['valid'] = false;
        $results['issues'][] = 'Backup file suspiciously small';
    }

    // Try decryption
    $temp_path = sys_get_temp_dir() . '/backup_test_' . time() . '.sql';

    try {
        decrypt_backup_file($backup_path, $temp_path);

        // Verify SQL structure
        $content = file_get_contents($temp_path, false, null, 0, 1000);

        if (strpos($content, 'WordPress') === false &&
            strpos($content, 'CREATE TABLE') === false) {
            $results['issues'][] = 'File does not appear to be valid WordPress backup';
        }

        // Check for critical tables
        $full_content = file_get_contents($temp_path);
        $required_tables = array('wp_options', 'wp_users', 'wp_posts');

        foreach ($required_tables as $table) {
            if (strpos($full_content, $table) === false) {
                $results['issues'][] = 'Missing table: ' . $table;
            }
        }

    } catch (Exception $e) {
        $results['valid'] = false;
        $results['issues'][] = 'Decryption failed: ' . $e->getMessage();
    }

    // Cleanup
    if (file_exists($temp_path)) {
        unlink($temp_path);
    }

    return $results;
}

Backup Notifications

Alert on backup issues:

function send_backup_notification($status, $details) {
    $admin_email = get_option('admin_email');

    $subject = $status === 'success'
        ? '[Backup] Completed successfully'
        : '[Backup] Warning - Action required';

    $message = "Backup Status: {$status}\n\n";
    $message .= "Details:\n";

    foreach ($details as $key => $value) {
        $message .= "- {$key}: {$value}\n";
    }

    if ($status !== 'success') {
        $message .= "\nPlease investigate immediately.\n";
    }

    wp_mail($admin_email, $subject, $message);
}

Conclusion

Backup security requires encryption, access controls, secure storage, proper retention policies, and regular integrity testing. Treat backups as sensitive data that needs protection equal to the production site.