WordPress Backup Requirements, Security, WP-CLI & Hooks

Webhook Notifications

In Settings → Notifications, you can enable HTTP webhooks for backup lifecycle events. Choose a format: Generic JSON, Slack incoming webhook, or Discord webhook. Use Webhook on success and Webhook on failure to control which outcomes send a POST. Test delivery from the same screen when your host allows outbound HTTPS.

Typical Generic JSON payload fields include:

{
  "job_id": "backupridge-2026-001",
  "status": "completed",
  "size": 104857600,
  "duration": 143
}

Slack and Discord formats are encoded for those APIs (e.g. Slack text field, Discord content). The plugin fires backupridge_send_webhook when a webhook should be sent; advanced multi-endpoint management is planned for Pro.

Security Overview

Credential encryption: Storage provider credentials and similar secrets are encrypted at rest using AES-256 before being saved to the WordPress database. Keys are derived using WordPress security primitives; plain secrets are not stored in options.

Directory protection: The backup directory includes .htaccess and index.php guards on Apache-compatible hosts. For Nginx, deny direct access to the backup path (see FAQ on backupridge.com).

Archive encryption (Pro): Optional AES-256-GCM authenticated encryption of backup archives before upload, separate from credential encryption. Legacy archives encrypted with AES-256-CBC remain decryptable.

Admin requests: AJAX and REST handlers use check_ajax_referer where appropriate, verify nonces, and require manage_options (or equivalent) capability.

Database export: Sensitive options can be excluded from SQL exports per plugin rules; review exclusions if you extend exports.

Uninstall Behavior

When Delete all data on uninstall is enabled in Settings, uninstall removes BackupRidge backups under the configured directory, log files, plugin options (backupridge_*), scheduled cron hooks, and related transients. If disabled, only the plugin files are removed and data may remain on disk.

System Requirements

Requirement	Minimum	Recommended
WordPress	6.7+	6.8+
PHP	8.0+	8.2+

WP-CLI Commands

wp backupridge backup — Start a backup job.
wp backupridge list — List backups and statuses.
wp backupridge run — Run a backup directly, optionally for a schedule (Pro).
wp backupridge schedules list — List advanced schedules (Pro).
wp backupridge schedules run-due — Run due schedules (Pro).
wp backupridge restore <job-id> — Restore a backup (Pro).
wp backupridge license status — Show license activation status (Pro).
wp backupridge license activate <key> — Activate a license key (Pro).

Hooks & Filters

Subset of public hooks — see plugin source for full signatures.

Name	Type	Purpose
`backupridge_backup_started`	action	Fires when a backup job starts.
`backupridge_backup_status_changed`	action	Status transitions during a job.
`backupridge_backup_finalized`	action	Backup completed or terminal state.
`backupridge_before_upload_archives`	action	Before remote upload begins.
`backupridge_send_webhook`	action	Outbound webhook dispatch.
`backupridge_retention_enforced`	action	After retention deletes archives.
`backupridge_retention_error`	action	Retention cleanup failed.
`backupridge_storage_connection_check`	action	During storage connection tests.
`backupridge_file_scan_warning`	action	File scan warnings.
`backupridge_store_url`	filter	Override store / marketing URLs.
`backupridge_docs_url`	filter	Documentation URL.
`backupridge_support_url`	filter	Support URL.
`backupridge_changelog_url`	filter	Changelog URL.
`backupridge_exclusion_patterns`	filter	Add file/path exclusion regexes.
`backupridge_file_backup_files`	filter	Adjust file list for file backup phase.
`backupridge_phase_weights`	filter	Progress weights per backup phase.
`backupridge_filename_template`	filter	Filename template string.
`backupridge_filename_context`	filter	Context for filename resolution.
`backupridge_optional_tables`	filter	Optional DB tables for export.
`backupridge_db_export_query`	filter	SQL export query tuning.
`backupridge_sslverify`	filter	HTTP SSL verify for remote calls.
`backupridge_webhook_allowed_formats`	filter	Registered webhook payload formats.
`backupridge_cron_trigger_url`	filter	REST cron trigger URL.

Example:

add_filter('backupridge_exclusion_patterns', function($patterns) {
  $patterns[] = '/wp-content\/cache\//i';
  return $patterns;
});
add_action('backupridge_backup_finalized', function($job) {});
add_filter('backupridge_file_backup_files', function($files) { return $files; });