ཞིབ་བརྗོད།
Yedekalma is a free WordPress backup plugin that takes a one-click backup of your entire site — files and database — and restores it again from the same screen. It also migrates your WordPress site to a new host or domain and scans it for malware. One backup plugin covers backup, restore, migration and security, so you do not need a separate tool for each job.
Everything runs on your own server. No account, no sign-up and no API key: install, activate, click Take Backup. Your backup archives stay on your hosting, and you can download them as a ZIP at any time.
Looking for a free backup plugin that also does migration and malware scanning without a paywall? Yedekalma gives you a full WordPress backup, a database backup, one-click restore, site migration and a malware scanner in a single plugin — no premium unlock required for any of it.
Backup
- Full backup — every file (themes, plugins, uploads) plus the complete database.
- Database backup — MySQL dump only, gzip compressed (
.sql.gz) for large sites. - Files backup — site files only, without the database.
- Works on shared hosting — chunked, time-sliced backup that finishes even when
exec()is disabled and PHP limits are strict. - Incremental backup — compares real file modification times, so a changed file is never skipped.
- Safe storage — local backups live in a hardened, non-browsable folder with unguessable file names.
Restore
- One-click restore of the database, plugins, themes and uploads straight from your dashboard.
- Restore only what you need — pick just the database, just uploads, just plugins or the whole site.
- Restore from an archive you already have — drag & drop a
.zip,.sqlor.sql.gzfile and restore from it. - Integrity checked — a truncated or corrupt archive is refused instead of half-applied, so a bad file can never damage a working site.
- SHA-256 verification of every archive before a restore begins.
Migration
- Move your site to a new host — download the backup, install Yedekalma on the target server and restore.
- Change domain safely — site URL and home URL are rewritten in the database automatically during the restore.
- New database server —
wp-config.phpcredentials can be updated as part of a restore. - Clone your website to a fresh install for disaster recovery or a redesign.
Malware scanner
- Security scan of PHP, JS and configuration files across WordPress core, your plugins and the active theme.
- Detects code injections, web shells and backdoors using malicious-pattern matching.
- Persistent results — the scan report survives page reloads, so you can review it whenever you like.
- Bulk clean — select detected files and delete them in one click.
- Core protection — WordPress core files are shielded from accidental deletion while planted files can still be removed.
Optional cloud service — backup to your own cloud storage
Local backup, restore, migration and the malware scanner are complete on their own and never contact an external server. If you also want off-site backup copies, you can connect the optional Yedekalma cloud service (see External services below) to:
- Backup to Google Drive — stream backups straight to your own Google Drive.
- Backup to Dropbox and OneDrive — send archives to your own Dropbox or Microsoft OneDrive account.
- Backup to Amazon S3 and S3-compatible storage — Backblaze B2, Wasabi, Cloudflare R2 and MinIO.
- Backup to FTP / SFTP — upload to any FTP or SFTP server you control.
- Run scheduled automatic backups — daily, weekly, hourly or as often as every few minutes for busy sites — with retention rules.
- Table-level incremental database backup — only the database tables that actually changed are exported, so even very frequent backups stay small and fast; unchanged runs are skipped automatically.
- Encrypt archives with client-side AES-256 (BYOK) before they leave your server — the passphrase never leaves your site.
Languages
Yedekalma ships with English, Turkish (Türkçe), German, Russian and Arabic translations.
External services
This plugin can optionally connect to the Yedekalma cloud service (an external SaaS) to perform off-site backup and restore operations, package backups for delivery to your own cloud storage, check subscription state, and monitor backup quota. This connection only happens if you choose to use the cloud service (by entering an API token, by clicking the optional “Connect with Google” button, or by clicking the optional “register this site” button described below); the plugin’s local backup, restore, migration and malware-scanner features work with no external connection at all.
- Service URL: https://yedekalma.com
- Terms of Service: https://yedekalma.com/legal
- Privacy Policy: https://yedekalma.com/legal#privacy
- Connect with Google (opt-in): The dashboard shows an optional “Connect with Google” button. It does nothing unless you click it. If you click it, your browser is sent to https://yedekalma.com where you sign in with Google; Yedekalma then creates or finds your account from your Google e-mail address and links this site (identified by its Site URL) to it. Only your e-mail address and the Site URL are used for this; no Google Drive or other Google data permission is requested, and no site content is sent. A one-time connection token is returned to your site and stored encrypted locally.
- Optional site registration (opt-in): The dashboard also shows an optional “register this site with Yedekalma” button. It does nothing unless you click it. If you click it, the plugin sends only your Site URL and technical version info (plugin, WordPress, PHP version and locale) to https://yedekalma.com so the site can be listed in your Yedekalma panel; no site content or personal data is sent. If you also enter a notification e-mail, that address and your marketing-consent choice are sent as well. You can ignore the button entirely and every built-in feature still works.
- Data Transmission: When connected (or after opt-in registration), the plugin sends requests to the Yedekalma API containing your Site URL, active plugin features, backup metadata (such as file lists, sizes, and checksums), and your API token (or anonymous install id) to perform secure backup and restore tasks.
གཏུབ་རེིས།





སྒྲིག་འཇུག
- In your WordPress admin, go to Plugins Add New.
- Search for Yedekalma.
- Click Install Now, then Activate.
- Open Yedekalma in the admin sidebar.
- Click Start without an account and take your first backup.
Manual installation: upload the yedekalma folder to /wp-content/plugins/ and activate it from the Plugins screen.
FAQ
-
Is this backup plugin free?
-
Yes. Backup, restore, migration and the malware scanner are fully functional with no account and no payment. The optional Yedekalma cloud service adds off-site storage and has a free tier.
-
Is this a good free backup plugin for WordPress?
-
Yedekalma is a free WordPress backup plugin that bundles full-site backup, database backup, one-click restore, site migration and a malware scanner — features that many plugins split between free and premium tiers. Everything runs on your own server and needs no account.
-
How do I back up my WordPress site?
-
Open Yedekalma Dashboard and click Take Backup. Choose Full (files + database), Files Only or Database Only. The backup runs in time-sliced chunks on your own server and you can download the archive as a ZIP when it finishes.
-
How do I back up my WordPress database?
-
Open Yedekalma Dashboard, click Take Backup and choose Database Only. You get a compressed MySQL dump (
.sql.gz) that you can download or restore later. -
Can I back up a WooCommerce store?
-
Yes. A full backup includes your entire WordPress database — WooCommerce orders, products, customers and settings — together with your files, so your whole store is captured. For very busy stores you can schedule frequent incremental backups through the optional cloud service so new orders are protected between runs.
-
Can it back up large sites (5 GB, 10 GB or more)?
-
Yes. Backups run in small time-sliced chunks and the database is streamed to a gzip-compressed dump, so large sites finish without hitting PHP time or memory limits. For very large sites, connecting the optional cloud service lets archives stream straight to your own Google Drive, S3 or FTP storage instead of filling your hosting disk.
-
Yes. Yedekalma is a pure-PHP plugin with no server dependencies, so it works on any standard WordPress host — shared hosting, cPanel, Plesk, DirectAdmin or a managed platform. It does not need
exec(), shell access or SSH. -
Does it work on LiteSpeed, Nginx and Apache?
-
Yes. The plugin runs inside WordPress itself and does not depend on the web server, so it works the same on LiteSpeed, Nginx, Apache or any other server that runs PHP.
-
Can I use it to migrate my site to a new host or domain?
-
Yes. Take a full backup, download the ZIP, install Yedekalma on the target site and restore the archive there. The site URL and home URL in the database are updated for the new domain automatically.
-
Can I clone my website for disaster recovery?
-
Yes. Take a full backup and restore it onto a completely separate install; the site URL is rewritten for the new domain automatically. Your original site is never modified.
-
Where are my backups stored?
-
In
wp-content/uploads/yedekalma-backups/on your own server. The folder is protected from directory browsing and the archive names include a random token, so nobody can guess the URL. If you connect optional cloud storage, backups go to your own Google Drive, Dropbox, OneDrive, S3 or FTP account instead. -
Can I back up to Google Drive?
-
Yes, through the optional Yedekalma cloud service. Backups stream directly from your server to your own Google Drive; Yedekalma never keeps a copy.
-
Can I back up to Dropbox or OneDrive?
-
Yes. With the optional cloud service you can send scheduled backups to your own Dropbox or Microsoft OneDrive account.
-
Does it support Amazon S3, Backblaze B2 or Wasabi?
-
Yes. The optional cloud service supports Amazon S3 and any S3-compatible storage — Backblaze B2, Wasabi, Cloudflare R2 and MinIO. Uploads use a client-side signed (SigV4) request and your secret key is AES-256 encrypted on your own site, never sent to Yedekalma.
-
Can I back up to FTP or SFTP?
-
Yes. The optional cloud service can upload backups to any FTP or SFTP server you control. The credentials are encrypted on your own site.
-
Does it support scheduled automatic backups?
-
Yes, through the optional cloud service. You can schedule automatic backups daily, weekly, hourly or as often as every few minutes for busy sites, each with its own retention rules. One-click manual backups are always available for free without any schedule.
-
What is incremental backup and does it support it?
-
An incremental backup only saves what changed since the last run, so it stays small and fast. Yedekalma compares real file modification times for files and, with the cloud service, exports only the database tables that actually changed — unchanged runs are skipped automatically.
-
Can I encrypt my backups?
-
Yes. With the optional cloud service you can turn on client-side AES-256 (BYOK) encryption. Archives are encrypted on your own server before they leave it, and the passphrase never reaches Yedekalma.
-
How does the malware scanner work?
-
It scans PHP, JS and configuration files in WordPress core, your plugins and the active theme for malicious patterns, code injections, web shells and backdoors. Results are saved so you can review them later, and you can delete detected files in bulk. Core WordPress files are protected from deletion.
-
How do I restore a WordPress backup for free?
-
Open Yedekalma Backups, find the backup you want and click Restore. You can restore the database, plugins, themes and uploads separately or all at once. You can also drag & drop a
.zip,.sqlor.sql.gzarchive you already have and restore from it — no account and no payment required. -
Can I restore only the database?
-
Yes. When restoring, pick the Database section on its own and the rest of the site is left untouched. This is handy for rolling back a bad content change without reverting files.
-
Can I restore only the uploads, media or a single component?
-
Yes. Restore offers each section your backup contains — database, plugins, themes and uploads — so you can restore just your media/uploads, just plugins or any single part instead of the whole site.
-
Is there a free WordPress migration plugin here?
-
Yes. Yedekalma migrates your WordPress site to a new host or domain for free: take a full backup, download the ZIP, install Yedekalma on the target site and restore. The site URL and home URL are rewritten in the database automatically, and
wp-config.phpcredentials can be updated during the restore. -
How can I scan WordPress for malware without a subscription?
-
The built-in malware scanner is completely free and needs no account. Open Yedekalma Malware Scanner and start a scan; it checks WordPress core, your plugins and the active theme for injected code, web shells and backdoors, then lets you delete detected files in bulk while protecting core files.
-
How often should I back up my WordPress site?
-
For most sites a weekly full backup plus a daily database backup is a good baseline; busy or e-commerce sites should back up daily or more often. You can run a one-click backup any time for free, and the optional Yedekalma cloud service adds scheduled automatic backups with retention rules.
-
What happens to my backups if I delete the plugin?
-
Nothing. Local archives under
wp-content/uploads/yedekalma-backups/stay where they are unless you remove them yourself, and anything in your own cloud storage stays there too. -
Türkçe destekliyor mu?
-
Evet. Yedekalma tamamen Türkçe arayüze sahiptir: site yedekleme, veritabanı yedekleme, yedekten geri yükleme, site taşıma ve virüs/zararlı yazılım taraması işlemlerinin tümünü Türkçe olarak yapabilirsiniz.
-
Is Multisite supported?
-
Not in version 1 — a separate plugin instance per site is required. Full Multisite support is on the roadmap.
-
Is it GDPR / KVKK compliant?
-
Yes. The plugin makes no external connection at all unless you deliberately connect the optional cloud service, and explicit consent is collected for that data transfer.
གདེང་འཇོག
There are no reviews for this plugin.
བྱས་རྗེས་འཇོག་མཁན། & གསར་འབྱེད་པ།
“Yedekalma — Backup, Restore, Migration & Malware Scanner” is open source software. The following people have contributed to this plugin.
བྱས་རྗེས་འཇོག་མཁན།ཁྱེད་ཀྱི་སྐད་ཡིག་ནང་ལ་ “Yedekalma — Backup, Restore, Migration & Malware Scanner” ཡིག་སྒྱུར་བྱོས།
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
དག་བཅོས་ཉིན་ཐོ།
For the full history of older releases, see changelog.txt in the plugin folder.
1.44.5 — 2026-08-01
- FIX: The Pro screen showed the “Manage backups” and “Open panel” buttons twice — the page and the asynchronously loaded status block each drew their own copy. Only the page draws them now, so they also appear when the panel cannot be reached.
1.44.4 — 2026-08-01
- UX: The Pro screen no longer repeats the last few backups. The Backups page already lists them in full — with type, destination, source and restore — so the Pro screen just links there. It also loads a little faster: one fewer request to the panel.
1.44.3 — 2026-08-01
- FIX: Backups stored in the cloud never showed up in the Backups list. The plugin had always asked the panel for them, but the endpoint did not exist, so the request failed and the empty answer was accepted silently — only archives lying on this server were listed. They are now fetched and shown.
- NEW: A “Destination” column tells you where each backup actually went — Google Drive (with the account), S3 (with the bucket), your own receiver module, or this site’s own disk.
1.44.2 — 2026-08-01
- UX: The status card now shows where the backups are actually sent (Google Drive, S3, your own server, in-domain storage…), right under the backup times. It said “running” and listed the hours, but you had to open the panel to find out the destination. When more than one destination is set, every one of them is listed and marked primary/copy.
1.44.1 — 2026-07-31
- UX: The Pro screen now names every place a backup can be sent. It listed Google Drive, S3 and FTP only, which left out the simplest destination of all — the server WordPress itself runs on. The intro text, the setup step and the storage box in the diagram now all mention in-domain storage as well.
1.44.0 — 2026-07-31
- NEW: The Pro screen now explains the optional cloud service before asking you to sign in. When you are not connected it shows what the service does, a diagram of where a backup actually travels (packed and encrypted on your own server, sent straight to your own storage, never through our servers), a three-step setup guide and what connecting adds. Previously there were four bullet points and a sign-in button, so you had to connect first and find out afterwards. All artwork is inline SVG: the screen makes no external requests.
- NEW: The connection screen lists your actual schedule. Files, database and e-mail each show when they are due (for example “Every day 02:00”); you no longer have to open the Yedekalma panel to find out.
- FIX: A component that cannot run is no longer shown with a time next to it. E-mail is archived over IMAP, so with no mail account configured it never runs — yet the schedule still read “Every day 04:00”, which looked like mail was being backed up. It now reads that no mail account is defined and is greyed out, matching what the panel reports.
1.43.0 — 2026-07-31
- UX: The connection screen now tells you two separate things instead of one long sentence. Backup status (is it actually running, when was the last one) and membership status (days left, expiry date, renew) used to be crammed into a single paragraph that was easy to skim past. They are now two side-by-side panels, and the membership panel turns red with a primary “Manage subscription” button in the last seven days, so an expiring subscription is impossible to miss.
1.42.2 — 2026-07-31
- UX: You can now see which kind of backup is running. “Full Backup” was always drawn as the filled, primary button, so choosing “Database Only” left the screen looking as if a full backup had been started — the right backup was taken, but the screen said otherwise. The button you clicked is now highlighted for the duration of the run and the progress line is prefixed with the backup type at every stage.
1.42.1 — 2026-07-31
- FIX: Deleting the plugin no longer orphans backups it deliberately keeps. Removing the plugin is meant to leave your archives on disk unless you explicitly opt in to deleting them — but the cleanup was still wiping the records that point at those archives (the download-token map, the backup list and the backup folder name). The files survived while every download link returned 404, so it looked as if all backups had been lost. Those three records are now kept whenever the files are kept; opting in to full deletion still removes everything.
1.42.0 — 2026-07-31
- PERFORMANCE: Backups are dramatically faster on large sites. The archive is now written by appending each file to the end of it, instead of letting PHP rewrite the whole archive at the end of every step. Rewriting made the cost grow with the square of the site size — on a real 5,502-file site a single step had grown to over two minutes and kept getting slower. That cost is gone: the work is now proportional to the amount of data, once.
- FIX: Backups no longer need roughly twice the backup size in free disk space. The old approach kept a second copy of the whole archive while rewriting it, which is what turned a nearly-full disk into an “archive came out empty” failure. Only the archive itself needs to fit now, and the free-space check was relaxed accordingly.
- FIX: A file is written into the archive the moment it is read, instead of being queued and read later. A file that changed or disappeared between being listed and being packed can no longer end up silently missing from the backup.
- NEW: Archives larger than 4 GB (or with more than 65,535 files) are written with ZIP64 fields, so very large sites produce a valid archive.
- UX: Because finishing a step is now free, steps are short again — the progress console updates continuously and a running backup no longer holds a PHP process long enough to make wp-admin unresponsive.
1.41.4 — 2026-07-31
- FIX: “Backup archive came out empty” told you nothing. The message now names the most likely cause — no space left in the temporary directory — and reports the free space, the directory and the expected archive size, so you can act on it.
- NEW: Free-space preflight. A backup that cannot possibly fit now stops before packing thousands of files instead of failing at the very last step. Writing the archive keeps a second copy while it is rewritten, so roughly twice the backup size must be free.
- FIX: A failing backup no longer deletes a half-finished archive that another process may still be writing to; this could turn a recoverable hiccup into an “archive is empty” failure.
- FIX: If the temporary archive disappears mid-run (server temp cleanup or a full disk), packing no longer silently starts a fresh archive and produces an incomplete backup — it stops with a clear message.
1.41.3 — 2026-07-31
- UX: The backup screen now says what it is waiting for. Writing the archive to disk, adding the database dump and computing the SHA-256 signature can each take minutes, and during them the file counter does not move — previously the screen just showed the last file name with a ticking counter, which reads as a frozen system. Each of those steps is now announced before it starts (“Archive is being written to disk…”, “Computing integrity signature…”), the headline above the progress bar shows the same thing, and the seconds counter now reads “running…” instead of a bare number.
- UX: Preparation is no longer silent either — the database dump and the file scan are announced as they happen.
1.41.2 — 2026-07-31
- UX: The star on the “Yedekalma Pro” menu item now sits after the label instead of before it, so the submenu items line up on the left.
1.41.1 — 2026-07-31
- FIX: On shared hosting a running backup could make the whole WordPress admin unresponsive — pages and plugin uploads would spin forever. Version 1.40.3 let a single backup slice hold a PHP worker for up to 90 seconds plus the archive write, and most shared accounts allow only one or two PHP processes at a time, so admin requests queued behind it. A slice is now capped at 30 seconds, which still removes most of the slow repeated archive writes without blocking your dashboard.
1.41.0 — 2026-07-31
- REMOVED: The Test Environment (staging) feature has been dropped completely. It cloned your live site into a
/stagingsubfolder with astg_table prefix — useful on its own, but unrelated to backup and restore, and it carried a large amount of code and a write-capable surface on your server for no backup benefit. The “Test Ortamı” menu item, its page, the REST endpoint and all clone/teardown code are gone. Existing/stagingfolders andstg_tables on your server are left untouched; delete them yourself if you no longer need them.
