Backup, Restore and Migrate your sites with XCloner

78 Quality Score

Active Installs

18/30

With 10,000 active installs against competitors in the millions, XCloner is a niche player and the 60/30 popularity score reflects its limited market penetration.

Update Freshness

25/25

The plugin was updated within days of this assessment and tested against WordPress 7.0, earning a perfect 100/25 maintenance score.

User Rating

13/15

Users rate it 84 out of 100 across 129 reviews, which is solid but based on a relatively small sample compared to leading alternatives.

Support Health

8/15

Support health sits at 50/15 with zero resolved threads, meaning there is no track record of the author helping users in the public forums.

WP Compatibility

15/15

It is tested with WordPress 7.0 and requires PHP 7.3 or higher, scoring a perfect 100/15 for compatibility.

Scores higher than 64% of indexed plugins

About

XCloner is a backup plugin that allows you to safely back up and restore your WordPress sites. You can send site backups to SFTP, Dropbox, Amazon, Goo …

Active Installs 10k+

Rating ★★★★ 4.2/5

Last Updated 2026-05-26 6:31am GMT

Requires WordPress 5.1+

Tested Up To 7.0.4

Requires PHP 7.3+

Security History

17 known vulnerabilities, all patched

4 Critical 6 High 7 Medium

Most recent: June 3, 2026

View details ▸

Backup, Restore and Migrate your sites with XCloner <= 4.8.6 - Authenticated (Subscriber+) Information Exposure Medium

June 3, 2026 Patched in ["4.8.7"] CVE-2026-48965

Backup, Restore and Migrate your sites with XCloner <= 4.8.2 - Cross-Site Request Forgery in Xcloner_Remote_Storage:save() Medium

December 4, 2025 Patched in ["4.8.3"] CVE-2025-11759

XCloner <= 4.7.3 - Unauthenticated Full Path Disclosure Medium

July 15, 2024 Patched in ["4.7.4"] CVE-2024-6559

Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 4.2.16 - Unauthenticated Plugin Settings Reset Critical

June 6, 2022 Patched in ["4.3.6"] CVE-2022-0444

Backup, Restore and Migrate WordPress Sites With the XCloner Plugin 4.2.1 - 4.2.12 - Unprotected AJAX Actions High

August 18, 2020 Patched in ["4.2.153"] CVE-2020-35948

Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 4.2.152 - Cross-Site Request Forgery Critical

August 18, 2020 Patched in ["4.2.153"] CVE-2020-35950

Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.4 - Path Traversal to Sensitive Information Disclosure Medium

December 31, 2016 Patched in ["3.1.5"]

Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.2 - Remote Code Execution Critical

May 10, 2015 Patched in ["3.1.3"] CVE-2015-4338

Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.2 - Remote Command Execution High

May 10, 2015 Patched in ["3.1.3"] CVE-2015-4336

Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.2 - Cross-Site Scripting Medium

May 10, 2015 Patched in ["3.1.3"] CVE-2015-4337

Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.1 - Sensitive Information Disclosure High

October 17, 2014 Patched in ["3.1.2"] CVE-2014-8604

Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.1 - Improper Access Control to Information Disclosure High

October 17, 2014 Patched in ["3.1.2"] CVE-2014-8605

Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.1 - Directory Traversal Medium

October 17, 2014 Patched in ["3.1.2"] CVE-2014-8606

Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.1 - Remote Code Execution High

October 17, 2014 Patched in ["3.1.2"] CVE-2014-8603

Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.1 - Sensitive Information Disclosure High

October 17, 2014 Patched in ["3.1.2"] CVE-2014-8607

Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.0 - Multiple Cross-Site Request Forgery Critical

April 9, 2014 Patched in ["3.1.1"] CVE-2014-2579

Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.0 - Cross-Site Request Forgery Medium

April 2, 2014 Patched in ["3.1.1"] CVE-2014-2340

What It Does

XCloner generates full-site backups of your WordPress installation, including the database, themes, plugins, and uploaded media, and bundles them into a single archive that can be restored on the same or a different server. It supports sending backups to remote destinations like SFTP, Dropbox, Amazon S3, and Google Drive, and includes a restore workflow for migrations and disaster recovery. The plugin also handles scheduled backups and differential backup strategies for users who want to limit storage usage.

Who It's For

This plugin is a reasonable fit for site owners and developers who need free remote backup destinations like SFTP, Dropbox, or Google Drive without paying for a premium backup subscription. It also suits users migrating sites between hosts who are comfortable with a more technical, manual restore interface rather than a polished one-click wizard. Smaller agencies managing a handful of client sites may find the cloud destination options useful if they already have accounts configured.

Who Should Skip It

You should skip XCloner if you run a business-critical site or an e-commerce store, since zero resolved support threads out of zero total means you have no safety net if a backup or restore fails. You should also skip it if you want a beginner-friendly restore experience, as UpdraftPlus, All-in-One WP Migration, and Duplicator offer significantly more polished interfaces and larger install bases.

The Bottom Line

XCloner delivers full-site backups with a useful set of remote destinations and is actively maintained, but the zero resolved support threads and tiny install base make it a risky choice for anyone whose livelihood depends on reliable restores. The overall quality score of 78/100 places it firmly below every major alternative in the category. It is a workable tool for tinkerers, but most users will be better served by UpdraftPlus or All-in-One WP Migration.

Pick UpdraftPlus if you want the most popular free backup plugin with a proven support track record and a one-click restore workflow.

All-in-One WP Migration and Backup 98/100

Pick All-in-One WP Migration if you want the simplest possible drag-and-drop site migration experience with no server configuration needed.

Duplicator – Backups & Migration Plugin 95/100

Pick Duplicator if you frequently clone or migrate sites to new hosts and need a more developer-oriented package format.

Jetpack 94/100

Pick Jetpack if you want backups bundled with security, performance, and growth tools from a first-party Automattic team.

WP STAGING 92/100

Pick WP STAGING if your primary need is creating a staging environment rather than offsite cloud backups.