Back up, restore and migrate without a timeout in sight
Set up a backup manager WordPress sites can rely on for real migrations: step-based processing that never hits PHP's time limit, a serialized-data-aware restore that gets URL migration right, and site-to-site push between two TheOneWP installs.
- Complete, Database-only or Files-only backups, stepped to avoid timeouts.
- Serialized-data-aware search-replace — migration that doesn't corrupt data.
- Site-to-site push between two TheOneWP installs, no manual upload.
- Optional AES-256 encryption and multiple named automation schedules.
Backup manager WordPress: what does the module actually do?
This is what a backup manager WordPress sites get with TheOneWP: TOWP_Backup_Manager creates Complete, Database-only or Files-only archives through a series of AJAX steps — 20,000 database rows or up to 400 files/40 MB per step — so large sites never risk a PHP execution timeout. Restoring an archive runs URL changes through a serialized-data-aware search-replace, so migrating between two domains doesn't corrupt PHP-serialized content. Archives can be encrypted with AES-256, sent to remote destinations, pushed directly to another TheOneWP site, or scheduled across multiple named automations — all logged, and all restricted to manage_options.
Backups and migrations fail in very specific ways
A backup on a large site risks hitting PHP's execution time limit mid-run, and a migration between two domains risks silently corrupting any serialized data that contains the old URL.
One long request is a fragile way to back up a whole site
Compressing gigabytes of database and files in a single PHP request means one slow host, one large table, or one timeout setting away from a backup that never finishes.
Naive find-and-replace breaks serialized WordPress data
PHP's serialization format encodes the exact byte length of every string — replacing a URL inside one without updating that length silently corrupts the array or object it lives in.
Stepped, and correct where it counts
The module breaks large operations into steps and treats serialized data as data, not as a string to blindly search and replace.
Fixed budgets, as many steps as needed
Each AJAX step processes a bounded amount of work, so total site size determines step count, not success or failure.
Serialization-aware, recursively
Every string is checked, unserialized when needed, walked field by field, and re-serialized with correct lengths.
A direct path between two sites
Site-to-site push moves an archive from one TheOneWP install to another without a manual download and re-upload step.
The complete backup manager WordPress feature set
Every capability below is present in the class, its AJAX handlers, or its companion sync class.
Complete, Database-only or Files-only
Choose exactly what a given backup covers, each with its own naming, notes, colored labels and token-based custom names.
Serialized-aware restore search-replace
Up to 20 search/replace pairs, applied recursively through arrays and objects with string lengths kept correct.
Incremental Complete backups
After a baseline, an incremental Complete backup captures only what changed, tracked as a chain of members and fingerprints.
Site-to-site push
A paired TheOneWP install receives an archive directly over REST, chunked at 3 MB, stepped the same way a local backup is.
Multiple named schedules
Several independent automations, each with its own frequency, time and retention, reconciled automatically rather than one global schedule.
Remote destinations, encryption, splitting
Send archives to configured remote destinations, encrypt with AES-256, and split large archives into fixed-size parts.
Run a backup manager WordPress migration in four steps
Test a restore before relying on a backup for a real migration.
Create a Complete archive
Pick a name, an optional password, and let the stepped process run to completion.
Move it — download, remote destination, or direct push
Download the archive, let it upload to a configured destination, or push it straight to a paired TheOneWP site.
Restore with the right search-replace pairs
Enter the old and new URLs so every serialized reference updates correctly on the new domain.
Set up an automation for the future
Schedule recurring backups with retention rules once the manual process is confirmed working.
Where stepped, correct backups actually matter
The module fits situations where "it usually works" isn't a good enough standard.
Staging-to-production migrations
Search-replace pairs applied correctly to serialized page-builder and plugin data, not just plain-text content.
Agencies moving client sites between hosts
Site-to-site push skips the manual download-and-re-upload cycle when both ends run TheOneWP.
Large, media-heavy sites
Step-based processing and incremental Complete backups both scale with real site size instead of one long, fragile request.
Backups built for the failure cases that matter
Every design choice in the verified code addresses a real, specific way backups and migrations go wrong.
Bounded work, every single step
The verified implementation caps what any one request does, on both the backup and restore sides.
20,000 rows per database step
Fetched in batches of 2,000 within that budget, keeping memory use predictable on very large tables.
400 files or 40 MB per files step
Whichever limit is reached first ends that step — large media libraries process across several steps automatically.
Smart per-file compression
Roughly 30 already-compressed extensions are stored rather than re-deflated, saving CPU without losing space.
Hardened storage, administrator-only, every action
A backup archive is effectively a full copy of the site — the code treats it with matching caution.
A hardened, non-guessable backup folder
A randomly-suffixed directory (or an admin-chosen custom path) gets .htaccess, index.php and web.config guards so archives are never web-served.
manage_options on every operation
Creating, restoring, downloading, deleting or scheduling a backup all require this capability, checked before anything runs.
AES-256 encryption, verified as available first
Encryption support is checked against the server's actual ZipArchive build — EM_AES_256 and setEncryptionName() — rather than assumed.
Single-writer job locking
A reservation lock prevents two backup jobs from running against each other at the same time.
Works with what a real WordPress database actually contains
The supplied code accounts for serialized data, incomplete class objects, and both Apache and IIS hosting. No compatibility claim beyond the verified implementation is assumed.
Nested arrays and objects
The recursive walker handles arrays, objects, and correctly leaves an unrecognized __PHP_Incomplete_Class object binary-identical rather than guessing at it.
Apache and IIS
Backup folder protection covers both server types, with .htaccess for Apache and web.config for IIS.
Paired TheOneWP installs
Site-to-site push relies on a companion sync class registering REST routes so a paired site can receive a pushed archive.
TheOneWP versus common alternatives
Compare a real backup manager WordPress implementation with typical dedicated backup plugins.
| Capability | TheOneWP Backup Manager | Other common solutions |
|---|---|---|
| Large-site reliability | Fixed-budget AJAX steps, no single long-running request | Varies; some tools risk a timeout on very large sites |
| Migration correctness | Serialized-data-aware search-replace, recursive | Some tools use a plain string replace that can corrupt data |
| Site-to-site transfer | Direct push between two TheOneWP installs | Usually download-then-upload manually |
| Automation | Multiple independent named schedules | Often a single schedule for the whole site |
| Archive encryption | AES-256, checked against real server support | Not always offered, or not verified before use |
| Administration | One TheOneWP dashboard, submenu or standalone | May require a separate plugin and its own account |
Back up like you'll actually need to restore it
A backup is only as good as the restore nobody has tried yet.
Test a restore before you need one for real
Confirm a Complete archive actually restores cleanly, ideally on a staging copy, before treating it as a safety net.
Use search-replace pairs deliberately
Double-check old and new URLs before restoring onto a different domain — this is what makes or breaks a migration.
Set retention on every automation
Unbounded retention quietly fills up storage; a sensible limit keeps only what's actually useful.
Keep at least one copy off-server
A remote destination or a downloaded copy protects against the one scenario a local-only backup can't: losing the server itself.
Avoid assumptions the code does not support
The module has a defined, verified scope — a few assumptions outside it cause confusion.
Expecting a local copy after a remote-only backup
Selecting a remote destination means exactly that — no redundant local copy is kept once the upload completes.
Expecting site-to-site push to work with any host
Push requires both sites to run TheOneWP with the sync endpoints paired — it is not a generic file-transfer feature.
Forgetting the archive password
An AES-256 encrypted archive cannot be restored without its password — there is no recovery path around a forgotten one.
Backup Manager FAQ
These answers come directly from the verified class and its AJAX handlers.
Can a large site's backup fail from a PHP timeout?
No, by design. Backups run as a series of AJAX steps rather than one long request — each step processes a fixed budget (20,000 database rows, or 400 files up to 40 MB), so a large site simply takes more steps instead of risking the PHP execution time limit.
What actually makes a migration between two URLs work correctly?
A serialized-data-aware search-replace. Database values are checked for PHP-serialized structure, unserialized, walked recursively field by field, and re-serialized with correct string lengths — a plain string replacement would corrupt any serialized array or object containing the old URL.
What happens if a value fails to unserialize during restore?
It is left completely untouched rather than guessed at — the code explicitly treats a corrupted or unrecognized payload as safer left alone than partially rewritten.
Can I move a site directly from one server to another without downloading anything?
Yes, if both sites run TheOneWP. Site-to-site push sends an existing archive directly to a paired site's own REST endpoint in 3 MB chunks, stepped the same way a normal backup is, without a manual download and re-upload.
Are backup archives encrypted?
Optionally, with AES-256 — checked against what the server's ZipArchive build actually supports, not assumed. The archive manifest itself stays unencrypted on purpose, so an archive can still be identified before you enter a password to restore it.
Does compressing a backup waste time on images and videos that are already compressed?
No. Around 30 already-compressed file types — images, video, audio, PDFs, Office documents, fonts, other archives — are stored without re-deflating them, which is faster with no meaningful size cost.
Can I schedule more than one automated backup?
Yes. The module supports multiple named automations, each with its own type, frequency, time and retention, reconciled automatically rather than being limited to a single schedule.
What happens to the local copy when a backup goes to remote storage?
If any remote destination is selected, that backup becomes remote-only — no local copy is kept on the server once the upload finishes, keeping disk usage from doubling up unnecessarily.
Stop hoping the backup works.Build one that actually restores.
Use a backup manager WordPress migrations can depend on: step-based processing, serialized-data-aware restores, and a direct path between two TheOneWP sites.