Yedekalma — Backup, Restore, Migration & Malware Scanner

Yedekalma is a free WordPress backup plugin that takes a one-click backup of your entire site — files and database — and restores it again from the same screen. It also migrates your WordPress site to a new host or domain and scans it for malware. One backup plugin covers backup, restore, migration and security, so you do not need a separate tool for each job.

Everything runs on your own server. No account, no sign-up and no API key: install, activate, click Take Backup. Your backup archives stay on your hosting, and you can download them as a ZIP at any time.

Looking for a free backup plugin that also does migration and malware scanning without a paywall? Yedekalma gives you a full WordPress backup, a database backup, one-click restore, site migration and a malware scanner in a single plugin — no premium unlock required for any of it.

Backup

• Full backup — every file (themes, plugins, uploads) plus the complete database.
• Database backup — MySQL dump only, gzip compressed (.sql.gz) for large sites.
• Files backup — site files only, without the database.
• Works on shared hosting — chunked, time-sliced backup that finishes even when exec() is disabled and PHP limits are strict.
• Incremental backup — compares real file modification times, so a changed file is never skipped.
• Safe storage — local backups live in a hardened, non-browsable folder with unguessable file names.

Restore

• One-click restore of the database, plugins, themes and uploads straight from your dashboard.
• Restore only what you need — pick just the database, just uploads, just plugins or the whole site.
• Restore from an archive you already have — drag & drop a .zip, .sql or .sql.gz file and restore from it.
• Integrity checked — a truncated or corrupt archive is refused instead of half-applied, so a bad file can never damage a working site.
• SHA-256 verification of every archive before a restore begins.

Migration

• Move your site to a new host — download the backup, install Yedekalma on the target server and restore.
• Change domain safely — site URL and home URL are rewritten in the database automatically during the restore.
• New database server — wp-config.php credentials can be updated as part of a restore.
• Clone your website to a fresh install for disaster recovery or a redesign.

Malware scanner

• Security scan of PHP, JS and configuration files across WordPress core, your plugins and the active theme.
• Detects code injections, web shells and backdoors using malicious-pattern matching.
• Persistent results — the scan report survives page reloads, so you can review it whenever you like.
• Bulk clean — select detected files and delete them in one click.
• Core protection — WordPress core files are shielded from accidental deletion while planted files can still be removed.

Optional cloud service — backup to your own cloud storage

Local backup, restore, migration and the malware scanner are complete on their own and never contact an external server. If you also want off-site backup copies, you can connect the optional Yedekalma cloud service (see External services below) to:

• Backup to Google Drive — stream backups straight to your own Google Drive.
• Backup to Dropbox and OneDrive — send archives to your own Dropbox or Microsoft OneDrive account.
• Backup to Amazon S3 and S3-compatible storage — Backblaze B2, Wasabi, Cloudflare R2 and MinIO.
• Backup to FTP / SFTP — upload to any FTP or SFTP server you control.
• Run scheduled automatic backups — daily, weekly, hourly or as often as every few minutes for busy sites — with retention rules.
• Table-level incremental database backup — only the database tables that actually changed are exported, so even very frequent backups stay small and fast; unchanged runs are skipped automatically.
• Encrypt archives with client-side AES-256 (BYOK) before they leave your server — the passphrase never leaves your site.

Languages

Yedekalma ships with English, Turkish (Türkçe), German, Russian and Arabic translations.

External services

This plugin can optionally connect to the Yedekalma cloud service (an external SaaS) to perform off-site backup and restore operations, package backups for delivery to your own cloud storage, check subscription state, and monitor backup quota. This connection only happens if you choose to use the cloud service (by entering an API token, by clicking the optional “Connect with Google” button, or by clicking the optional “register this site” button described below); the plugin’s local backup, restore, migration and malware-scanner features work with no external connection at all.

• Service URL: https://yedekalma.com
• Terms of Service: https://yedekalma.com/legal
• Privacy Policy: https://yedekalma.com/legal#privacy
• Connect with Google (opt-in): The dashboard shows an optional “Connect with Google” button. It does nothing unless you click it. If you click it, your browser is sent to https://yedekalma.com where you sign in with Google; Yedekalma then creates or finds your account from your Google e-mail address and links this site (identified by its Site URL) to it. Only your e-mail address and the Site URL are used for this; no Google Drive or other Google data permission is requested, and no site content is sent. A one-time connection token is returned to your site and stored encrypted locally.
• Optional site registration (opt-in): The dashboard also shows an optional “register this site with Yedekalma” button. It does nothing unless you click it. If you click it, the plugin sends only your Site URL and technical version info (plugin, WordPress, PHP version and locale) to https://yedekalma.com so the site can be listed in your Yedekalma panel; no site content or personal data is sent. If you also enter a notification e-mail, that address and your marketing-consent choice are sent as well. You can ignore the button entirely and every built-in feature still works.
• Data Transmission: When connected (or after opt-in registration), the plugin sends requests to the Yedekalma API containing your Site URL, active plugin features, backup metadata (such as file lists, sizes, and checksums), and your API token (or anonymous install id) to perform secure backup and restore tasks.