UpdraftPlus Backup Plugin

Version 2.26.14.26 — 26 October 2026

• New SFTP/SCP remote storage now supports modern host key algorithms like Ed25519 and also new cryptographies
• New Improve the restoration of the ‘uploads’ entity to be more efficient, and add the ‘UPDRAFTPLUS_RESTORE_DELETE_OLD_UPLOAD_FILES’ constant to allow the deletion of leftover files in the ‘uploads’ directory that are not part of the backup file
• Fixed Fixed a JS error and incorrect checkbox state handling on the auto-backup before update prompt.
• Fixed Prevent a fatal TypeError on PHP 8+ when an admin URL contains an “action” query argument as an array.
• Improved Disabled the option to automatically add websites to UDCentral upon connection by default. Users must now explicitly enable this option if they want websites to be added automatically upon connection.
• Improved Adjusted the Abort Backup popup icon sizing and added the missing “X” icon to the Close button on the backup completion popup.
• Improved Avoid warning by handling $_ENV variable.
• Improved Change the ‘pre_database_backup_setup’ action hook name to ‘updraftplus_pre_database_backup_setup’
• Improved Check the existence of the user’s folder before doing any UpdraftVault storage-related oprations to ensure the same directory is used even if the home/site URL has changed from using “www” to without using “www” or vice versa.
• Improved Enforce the WordPress DISALLOW_FILE_MODS constant to block all restore operations (including database) via the admin UI, WP-CLI, and the core restore method.
• Improved Ensure SFTP/SCP remote storage works with the phpseclib3 library upgrade, including SCP mode, Ed25519 SSH keys, database restores and rescans
• Improved Exclude the unused common-libs sub-libraries updraft-tasks and updraft-theme from the build to reduce the plugin size
• Improved Improved the remote storage UI with cleaner spacing, layout, font sizes, colors, and clearer wording, while fixing tooltip visibility for UpdraftVault.
• Improved Removed dead code and references left behind by the retirement of the Tour feature.
• Improved Removed implicit nullable type hints in the bundled PEAR library (HTTP_Request2_CookieJar and Net_URL2) to resolve PHP 8.4 deprecation notices
• Improved Removed the CURLOPT_BINARYTRANSFER cURL option (a no-op since PHP 5.1.2) from the Dropbox consumer to prevent deprecation warnings on PHP 8.4+
• Improved Removed the UDP_Google_Client type hint from the $client parameter in UDP_Google_Http_REST::decodeHttpResponse() to resolve a PHP 8.4 deprecation notice caused by implicit nullable typing
• Improved Resolve PHP 8.2+ deprecation warning by explicitly declaring $commands property on UpdraftPlus_CLI_Command
• Improved Resolve an SQL error when backing up the sitemeta table on multisite using mysqldump on Windows.
• Improved The “Follow TeamUpdraft” social media notice now stays hidden for 84 days once dismissed
• Improved Update all links in the udaddons folder to use teamupdraft.com instead of updraftplus.com.
• Improved Upgraded phpseclib to the version 3 while still maintaining compatibility with the phpseclib version 2
• Improved Addressed several issues identified during Plugin Check (PCP) validation and improved overall plugin compatibility and code quality.

Earlier versions

• 2.26.13.26 (19 October 2026): 1 fixed
• 2.26.11.26 (16 October 2026): 2 improved, 1 fixed, 1 security
• 2.26.10.26 (15 October 2026): 1 security