Skip to main content
Plugins Docs About Support Pricing My Account Browse Plugins
Backup

Bodholdt Backup for Google Drive

Automated WordPress backups to Google Drive

v6.54.0
PHP 7.4+
WP 6.0+
GPL-licensed
Free forever
Free and open source

Freeforever

One edition, free forever, on as many sites as you like. Full and incremental backups on a schedule, full and selective restore, multisite, an email after every run, and up to 500 backups kept. No license key, no account, and updates arrive in your dashboard.

  • Streaming restore that stays FK-safe and BLOB-safe
  • Full and incremental backups, scheduled or on demand
  • Complete multisite-network backup
  • Selective restore of the database, plugins, themes, uploads, and core, free on every install
  • Resumable chunked upload with auto-retry
  • Pre-restore safety snapshot
  • Guided setup wizard with an OAuth walkthrough
  • An email after every backup, success or failure, to whichever address you choose
  • Updates in your WordPress dashboard, with no license key to enter
  • The Night Watch arcade, with an Unbroken Watch streak and a live protection shield for every clean backup, free and off until you switch it on
Download free →

No account and no email address needed. Updates arrive in your WordPress dashboard.

Optional. The download above never asks for an email, and this does not change that. One short message per release, and you can leave at any time.

Next step, when you need it

Get the same news in Slack or Discord

This plugin already emails you after every backup attempt, success or failure. Bodholdt Backup Pro is a separate paid companion that puts those same events where your team already works, and adds a scheduled summary of how the whole site is doing.

  • Five backup events posted to your own Slack or Discord webhook, each with its own toggle
  • A backup-health digest by email, webhook, or both, weekly or daily
  • One license covers both clouds, and it works with the free editions of both
See Bodholdt Backup Pro, From $29 →

This plugin stays free either way, and nothing in it is locked behind the companion.

Automated WordPress backups to Google Drive with selective restore, setup wizard, and a cyberpunk-themed admin panel. Built with accessibility in mind (keyboard navigation, reduce-motion gating, ARIA semantics) and security-hardened against XSS.

Streaming restore that stays FK-safe and BLOB-safe

Full and incremental backups, scheduled or on demand

Complete multisite-network backup

Selective restore of the database, plugins, themes, uploads, and core, free on every install

Resumable chunked upload with auto-retry

Pre-restore safety snapshot

Guided setup wizard with an OAuth walkthrough

An email after every backup, success or failure, to whichever address you choose

Updates in your WordPress dashboard, with no license key to enter

The Night Watch arcade, with an Unbroken Watch streak and a live protection shield for every clean backup, free and off until you switch it on

  • Streaming restore that stays FK-safe and BLOB-safe
  • Full and incremental backups, scheduled or on demand
  • Complete multisite-network backup
  • Selective restore of the database, plugins, themes, uploads, and core, free on every install
  • Resumable chunked upload with auto-retry
  • Pre-restore safety snapshot
  • Guided setup wizard with an OAuth walkthrough
  • An email after every backup, success or failure, to whichever address you choose
  • Updates in your WordPress dashboard, with no license key to enter
  • The Night Watch arcade, with an Unbroken Watch streak and a live protection shield for every clean backup, free and off until you switch it on
Version
6.54.0
PHP Required
7.4+
WordPress
6.0+
Setup
About 15 minutes, once
License
GPL, no key
v6.54.0 · Sep 6, 2026
  • Groundwork, with no change to what a backup contains or where a restore writes. The restore path used to work out where themes, plugins, must-use plugins, uploads and translations live by rebuilding those paths by hand in six separate places. Nothing checked that the six agreed, and they governed different things: what a restore deletes, what it snapshots first, what it checks it can write to, and where it stops tidying up empty folders. They now read one answer. On every site the answer is exactly what those six lists produced before, and this release is verified to make no other difference.
  • This edition can now read a backup that records where its folders were. Nothing writes one yet. Shipping the reader on its own, ahead of the writer, means that by the time such a backup can exist, installs are already able to read it. A backup of that kind taken by a future release is refused, safely and before anything is changed, by every version older than this one.
  • A restore onto a site laid out differently from the backup is refused by name. If a future backup records its plugins folder somewhere this site does not load plugins from, the restore stops before touching anything and names the setting to change. Restoring it anyway would write the files where WordPress would not read them, and delete what is there now.
v6.53.3 · Sep 6, 2026
  • Deleting the plugin could interrupt a running backup or restore on hosts that set WP_TEMP_DIR. The plugin writes its staging folders and its operation locks under WordPress's own temporary directory, which honours that constant. The uninstaller looked under the system temporary directory instead. Where the two differ, the busy check that is supposed to stop Delete while a backup or restore is in flight looked in the wrong place, found no lock, and reported the plugin idle. On the same hosts, staging holding a full database export was left behind after Delete. Uninstall now resolves the directory exactly as the plugin does, a regression test proves the two can never part again, and cleanup also sweeps the old location so anything already orphaned is collected.
  • Core directory locations. The wp-includes folder is now read through WordPress's own WPINC constant, the plugins and must-use plugins folders through WP_PLUGIN_DIR and WPMU_PLUGIN_DIR, and the plugin's own folder through plugin_dir_path(). Twenty-nine defensive checks for constants WordPress always defines before a plugin loads have been removed, along with the hardcoded folder names they fell back to. What a backup reads and the names it records inside the archive are unchanged, and existing backups are unaffected.
v6.53.2 · Sep 5, 2026
  • The readme fix in 6.53.1 landed in the wrong file. These plugins ship one edition, the free one, and its readme is built from readme-wporg.txt. That file still carried every sentence the 6.53.1 entry said had gone: a verify button on every backup row, a one-click full restore, and log status pills reading success, error and running. So the note describing the correction shipped without the correction. The Screenshots section you are reading now matches what the plugin actually shows.
v6.53.1 · Sep 5, 2026
  • The Screenshots list in this readme described a few screens that are no longer here. The Logs page has counted chips for complete, error and warning rather than a filter and sort pair, and there was never a "running" or "success" status in the log itself. The backup list shows verify only where an archive can actually be checked. And the restore section now says the two things that matter most: you choose exactly what comes back, and there is no undo. Nothing about the plugin changed in this release. It only stops describing itself wrongly.
  • Recent releases are listed here. The complete history for every version is at https://bodholdtlabs.com/changelog/
v6.53.0
  • The check that asks your own site whether it came back up is now careful about who it will trust. After a restore, and again before your first backup, this plugin asks your own site for one page and reads nothing but the answer code. That request goes to the very address you are being served from, so it has always accepted that address's certificate without checking it, which is what lets the check work on a staging site with a self signed certificate. The list of addresses it asks for can be redirected by a filter, and until now anything the filter supplied was accepted the same way. From this release only the address you are being served from right now is accepted unchecked. Every other address is verified exactly like every other request this plugin makes.
  • This still cannot change the outcome of a restore. It never rolls anything back and it never turns a finished restore into a failed one. When it cannot get an answer, for any reason at all, it says nothing rather than guessing. A certificate your server cannot verify is now one of those reasons.
  • One thing to know if you use that filter. If you point the check at an address over https whose certificate does not validate on your server, you will get no verdict instead of a wrong one. Point it at an http address, or at a name the certificate is valid for.
  • Held in place by tests. All four answers this check can give, healthy, server error, maintenance and no answer, are now pinned for an address on your own site and for one the filter supplied, so this cannot quietly drift back.
v6.52.4
  • The list of requests that never leave your own site was one short. That section said it was complete and named two: cron starting a backup, and the check after a restore. There is a third. Before your first backup, and again each time you start a backup by hand, the plugin asks your own admin screen whether your site can answer itself, which is how the setup check knows to warn you that backups may not start on their own. It has worked that way since 6.50.8, it never leaves your server, and nothing about it has changed. It is now described alongside the other two.
  • The wording no longer depends on counting. "Two more requests" is a promise that has to be rechecked by hand every time anything is added, which is exactly how it went out of date. The Privacy section and the External services section now describe every request this plugin makes to your own site, which stays true whatever the number is.
  • The note for 6.52.3 counted them too, and no longer does.
  • Waking cron is described more accurately. It happens when you start a restore by hand as well as a backup.
  • Nothing in the plugin changed. This release is readme wording only.
v6.52.3
  • The privacy wording is now generated from one description of what this copy sends, and where. The Privacy section, the External services section and the FAQ answer about the log table were each written at a different time and had drifted apart from one another. All three now come from the same statement, so a claim cannot be true in one of them and false in another three screens down. Nothing in the plugin changed, and nothing about what it sends changed.
  • The Privacy section no longer contradicts itself. It said nothing about your site or its contents ever reaches us, and then, two sentences later, that the update check sends this site's address. Your address is something about your site, so the first half of that was simply wrong. It now names what never goes to us and what does, in the same breath.
  • The answer about the log table was wrong, and is now right. It said the backup history rows are never sent anywhere. They are never sent to us and never to anyone else, but a database backup exports every table in your database, so those rows do travel inside `database.sql` to your own Google Drive like every other table. The same answer now also lists the four arcade tables this copy creates, which it had never mentioned at all.
  • The update check is described honestly. "About twice a day" was only the twelve hour cache on a good answer; a failure is cached for one hour, so while our server is unreachable the check can ask up to once an hour. "You can switch it off" meant a one line PHP filter and not a setting, and the section now says so. It also now says what happens when you accept an update, and that we count the download.
  • Two things that were never written down now are. The requests this plugin makes to Google carry the user agent WordPress itself sets, which names your WordPress version and your site address, so Google sees your address on every backup call. And some requests go to your own site and nowhere else: cron starting a backup, and the check after a restore that asks your own site whether it came back up. Both are described under External services.
  • The install step no longer offers a plugin directory listing that does not exist. It tells you to install the file you downloaded from bodholdtlabs.com and keep it, because this is the copy that offers you new versions in your dashboard.
v6.52.2
  • A correction to the release notes, not to the plugin. The note for 6.52.1 was written about the WordPress.org copy of this plugin, and it was wrong about the copy you are holding. It said nothing here had changed, and that this copy updates from WordPress.org. Neither was ever true of it. The corrected note is below, and nothing in the plugin itself changed here.
v6.52.1
  • This copy now says in its own header where it updates from. You downloaded this plugin from bodholdtlabs.com, and it installs into the same folder name a WordPress.org listing would use. WordPress matches an installed plugin to WordPress.org by that folder name, so if these plugins are ever listed there, WordPress could have replaced this copy with the WordPress.org build without anybody asking, and that build carries no update channel of its own. This copy now states in its own header that it updates from bodholdtlabs.com, which is WordPress's own way of saying leave this one where it is. It goes on updating from bodholdtlabs.com, the way it has since 6.52.0, and the check it makes is described under External services above.
v6.52.0
  • The card advertising a paid edition is gone. A small card sat at the top of every screen of this plugin, pointing at a paid edition of it. That edition has been retired, so the card was advertising something nobody can buy. It has been removed and nothing replaced it: there is now no upsell of any kind anywhere in this plugin.
  • The description now says what is actually true. One edition, free, no tiers, nothing switched off: full and incremental backups, scheduling, retention, full restore, selective restore, multisite, unlimited sites, and email notifications after every backup whether it succeeded or failed. Nothing on that list will ever move behind a payment.
v6.51.2
  • A backup that cannot reach Google Drive now ends as a failure, and tells you. If your Google connection had expired or been withdrawn, the backup got as far as signing in and then simply stopped. Nothing was recorded as a failure, no "Backup Failed" email arrived, and the dashboard was left saying "Authenticating with Google..." at 10 per cent until that status aged out an hour later. The run now ends the way every other failure ends, so the log entry, the email, and anything else listening all happen once, and the message names the expired connection and the control that fixes it. A connection you removed on purpose, and a site that has never connected, stay quiet exactly as before, and the dashboard no longer claims a backup is running after one of those.
  • A failed backup now carries a one line diagnosis with it. The plugin already works out a short cure for the failures it recognises, such as "Re-authenticate Google Drive in Settings.", and until now only the paid Slack and Discord alerts could see it. That sentence now travels with the failure itself, so anything listening for a failed backup can lead with the cure instead of the raw error text. When there is no honest short answer, such as a brief outage at Google's end, the sentence is deliberately left empty and the full message is always there behind it. What the paid alerts send is unchanged.
v6.51.1
  • Free build packaging cleanup. No functional changes in either edition.
v6.51.0
  • Developers can now listen for what the plugin does. The backup engine announces five moments as ordinary WordPress actions: `bodholdt_gdrive_backup_success`, `bodholdt_gdrive_backup_failure`, `bodholdt_gdrive_restore_initiated`, `bodholdt_gdrive_watchdog_stale`, and `bodholdt_gdrive_preflight_blocked`. Each one hands over a single array of plain facts, such as the archive name and size. A sixth action, `bodholdt_gdrive_settings_sections`, lets other code add a section to the end of the Settings screen. If you do not write code against WordPress, nothing changes for you.
  • Tidier packaging for the free edition. The free download no longer carries fragments of paid-only code it could never run. This is housekeeping in how the package is put together. No feature was added or removed in either edition.
v6.50.13
  • The setup wizard now checks what you pasted, and says what looks wrong. A Google client ID ends in .apps.googleusercontent.com and a client secret starts with GOCSPX-, and they sit next to each other on the Credentials page. If one looks wrong, or if the two look swapped, you are told which field to look at instead of finding out later from a refused connection. It never stops you saving.
  • A connection that dies after a week now tells you why. Google's "Testing" publishing status expires access after 7 days, and the failure used to look identical to someone revoking access by hand. The plugin now remembers when you connected, and if the connection is refused within 8 days it names the likely cause and the exact control to fix it, rather than sending you round the same loop to the same result.
v6.50.12
  • Plainer writing. A few messages used long dashes where a full stop or a separator reads more easily. Nothing functional changed.
Show the full release history (6 older releases)
v6.50.11
  • A correction to the setup check added in 6.50.8. It said a private staging folder was ready after looking at only one of the two places a backup has to be able to write. A backup also needs somewhere to put a short-lived lock file, in your system temp folder, and on a host where that is not available the check reported everything was fine while every backup, restore, and settings change quietly refused to start. It now answers about both, so a site where nothing can run is told so.
v6.50.10
  • A correction to the plugin description. Nothing about the plugin changed. The Screenshots section called the backup list sortable, which it has never been, and said each row carried a delete action, which it does not. It now names the buttons that are really there: download, verify, and restore.
v6.50.9
  • A new install now points you at setup instead of leaving you to find it. Activating the plugin added a menu item near the bottom of the sidebar and said nothing else. The bolded "Set up" link on the Plugins list helped anyone who happened to look at that row, but it is on one screen and it disappears the moment you click anything, and bulk activation and WP-CLI never really show it at all. The next admin screen you open now offers one clear door into the setup wizard, once. It never appears if you have already connected your account or finished with the wizard, it is not shown on the plugin's own screens where the wizard opens by itself, and dismissing it retires it for good.
v6.50.8
  • Your first backup now tells you when it cannot start. WordPress runs backups on a scheduled task, and on some hosts that scheduler is switched off or blocked. When that happened, the backup screen showed a spinner and the word Initializing for a full hour before giving up, with nothing to explain why. Until your first backup succeeds, the dashboard now runs a short setup check and says in plain language whether your site can reach itself and whether there is a private folder to build the backup in. If a backup you started has not moved after ninety seconds, the screen stops spinning and tells you what to look at. A check we cannot complete is reported as exactly that, because on a hardened host an unanswerable test is normal and does not mean anything is wrong.
  • A missing staging folder is now visible on screen. If there is nowhere safe outside your web root to build a backup, the plugin stops backups and restores rather than write somewhere unsafe. That is the right call, but it happened in silence. It now says so on your dashboard.
v6.50.7
  • The setup wizard now tells you the truth about how long connecting Google Drive takes. It promised no technical experience and under five minutes, then asked you to create a Google Cloud project, enable the Drive API, configure a consent screen and generate OAuth credentials. That is real work. The wizard and the install guide now say to plan on about 15 minutes, once, and that we walk you through every click. Nothing about the setup itself changed.
v6.50.5
  • Packaging only, no functional change. This release exists so the code we build from and the package you receive are byte for byte the same. 6.50.4 shipped moments earlier with one comment line different in a shared file. Nothing you can see or use has changed.
Yes, all of it. There is one edition, it is GPL, and it holds no license client at all: no key to enter, no account, no activation limit, and nothing switched off until you pay, because there is nothing to pay for. Full and incremental backups, scheduling, full restore, selective restore, multisite, retention and the email report are all in it.
Download the ZIP from this page, then in your WordPress admin go to Plugins, Add New Plugin, Upload Plugin, choose the ZIP, Install, and Activate. The wizard then walks you through creating a free Google Cloud project and connecting your own Google Drive account. Plan on about 15 minutes for that, once. After that you pick a schedule and run your first backup.
They arrive in your WordPress dashboard like any other plugin, with no license key to enter. The update check asks bodholdtlabs.com for the current version number, and the request carries your plugin version and your site address in its user agent and nothing else. There is no request body, no cookies, and nothing about your content or your backups. A good answer is cached for twelve hours, so it runs about twice a day. You can also just download the newer ZIP from this page and upload it over the top.
Yes, by email, after every backup attempt, whether it succeeded or failed. It goes to your site's admin address unless you set a different one in Settings, and a failure email carries a short plain-language diagnosis of what went wrong. That has never been a paid feature. If you want the same events in Slack or Discord, or a scheduled summary across a site, that is what the separate Bodholdt Backup Pro companion adds.
As many as you like. There is no license client in the plugin, so there is nothing to count and nothing to activate. Staging and development copies do not cost you anything either.
Into your own Google Drive account, through your own app credentials. We never hold them and we cannot reach them. Your site files and your cloud credentials are never uploaded to us, and the plugin sends nothing to Bodholdt Labs except the version check described above.
It is retired, and nothing was taken away with it. Everything it included is in this free edition, including the dashboard updates it used to be the only way to get. The Slack and Discord delivery it also carried now lives in Bodholdt Backup Pro, a separate companion plugin that covers both clouds on one license and adds a scheduled backup-health digest. If you already hold a backup license it keeps working and keeps updating; nothing about it changed.

Related reading: How WordPress backups to your own Google Drive work