Yedekalma — Backup, Restore, Migration & Malware Scanner

Changelog

For the full history of older releases, see changelog.txt in the plugin folder.

1.14.0 — 2026-07-27

• NEW: Manual backups now run in the background on your own server — start a backup, then leave the page or switch menus and it keeps going; it automatically resumes tracking when you return, and shows a confirmation dialog and jumps to the Backups page when finished.
• NEW: Backups on disk are auto-recovered — if a backup file exists in your uploads folder but is missing from the list, it is detected and re-added so it stays visible and restorable.
• IMPROVED: Restore now only offers the sections your backup actually contains (a database-only backup offers only “Database”, etc.).
• IMPROVED: “Yedekalma Pro” screen clearly reflects that it is the Yedekalma (yedekalma.com) cloud service; its Files/Database/E-mail tabs stay inactive until you connect. Database and e-mail sections now let you auto-discover accounts and test the connection before saving; the exclude-folder browser also lists files.
• IMPROVED: Admin pages no longer hang when your host blocks outbound connections to yedekalma.com (short timeouts + graceful fallback).
• Various UI polish and fixes.

1.13.0 — 2026-07-27

• NEW: S3-compatible storage as a Yedekalma Pro target — Amazon S3, Backblaze B2, Wasabi, Cloudflare R2, MinIO. Enter endpoint/region/bucket/access key/secret key; scheduled backups are uploaded straight from your server via a client-side SigV4 presigned PUT. Secret key is AES-256 encrypted on your own site and never sent to Yedekalma (zero-data).

1.12.0 — 2026-07-25

• NEW: “Yedekalma Pro” menu — Connection, Backup Content (files/database/e-mail components, browsable exclude-folder tree, client-side AES-256 passphrase), Storage Target (your own FTP/SFTP, credentials encrypted on your own site) and Scheduling (WP-Cron). E-mail is backed up over IMAP as .eml files. Zero data kept on Yedekalma; backups go straight from your server to your own storage.
• NEW: “Connect with Google” button on the dashboard (opt-in). One click links the site to your Yedekalma account via Google sign-in in your browser, so it works even on hosts that block the web server’s outbound connections. Only your e-mail (for the account) and the Site URL are used; no Google Drive permission is requested. See External services.
• NEW: Optional “register this site with Yedekalma” button on the dashboard (opt-in). Clicking it lists your site in your Yedekalma panel using only the Site URL and technical version info — no site content or personal data. It is entirely optional; every built-in feature works without it. See External services.
• SECURITY: Restore-time database search-replace now unserializes option values with allowed_classes => false, so a crafted serialized payload inside a restored row can never trigger PHP object injection.
• SECURITY: Upload-limit raising (runtime ini and the optional .user.ini line) now runs only on the plugin’s own screens and AJAX endpoints instead of on every wp-admin request, following least-privilege and avoiding unnecessary global PHP-config changes.
• HARDENING: Output-escaping pass for strict WordPress.org late-escaping compliance (admin backup-limit notice and the CLI cron hint now escape their dynamic values); bulk threat-removal input is now unslashed and string-cast before validation.

1.11.7 — 2026-07-22

• I18N: Completed the English, German, Russian and Arabic interface translations. 69 strings — confirmation dialogs, error messages, progress text and settings labels — previously fell back to the Turkish source text. All five bundled languages are now at 100%.
• I18N: The plugin name and description shown on the Plugins screen are now translatable.

1.11.6 — 2026-07-21

• DOCS: Rewrote the plugin description, feature list and FAQ.
• ASSETS: Added plugin directory icon and banner images.

1.11.5 — 2026-07-21

• FIX: Responsive threat table layout. Adjusted column widths and increased action column width to 110px so the protected shield badges fit cleanly without horizontal overflow.

1.11.4 — 2026-07-21

• FEATURE: Finalized malware scanner enhancements, core protection filters, and uninstall cleanup logic.

1.11.3 — 2026-07-20

• FEATURE: Custom malware scan protection layout. Integrated granular, detailed reasons for critical files (wp-config.php, active theme assets, root boot scripts, drop-ins, and admin/includes core files) to protect them from deletion, while still allowing the deletion of planted non-core exploits.

1.11.2 — 2026-07-20

• FIX: Robust option structure mapping. Hardened list rendering and DB option cleanup to support both array and object elements, preventing PHP type-error crashes on page loads and threat file deletions.

1.11.1 — 2026-07-20

• FIX: WordPress core protection. Added a strict safety check to prevent accidental deletion of critical WordPress files (such as files inside wp-admin, wp-includes, wp-config.php, index.php, etc.) via the malware scanner deletion tool.

1.11.0 — 2026-07-20

• NEW: Built-in Malware & Virus Scanner. Scan all PHP, JS, and configuration files for code injections, web shells, backdoors, and malicious patterns.
• NEW: Persistent Scan Results. Scanner results are securely saved on your site so they persist across page refreshes.
• NEW: Bulk Actions. Select all or specific detected threat files and delete them collectively with one click.
• NEW: Security Reminders. Contextual security notices recommend taking a virus scan before taking backups or restoring a backup.

1.10.4 — 2026-07-20

• NEW: Added drag-and-drop local backup file upload zone (.zip, .sql, .sql.gz) with real-time progress bar.
• FIX: Fixed critical bug where restored backups disappeared from the list due to options database caching.
• FIX: Fixed settings loss on restore by correcting options key preservation to ‘yedekalma_settings’.