=== Rythzen Backup ===
Contributors: rythzen
Tags: backup, restore, google drive, s3, dropbox, onedrive, ftp, sftp, webdav
Requires at least: 6.2
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Free WordPress backups, restores, scheduling, retention, and remote storage by Rythzen.

== Description ==
Rythzen Backup is a fully free backup and disaster-recovery plugin from Rythzen — Technology in Perfect Rhythm.

Features:
* Full, database-only, and files-only backups.
* wp-content-only or entire-site file scope.
* Local protected backup storage.
* One-click local download, restore, upload-to-remote, and delete actions.
* Scheduled backups using WP-Cron.
* Local retention controls.
* Google Drive resumable uploads using OAuth refresh tokens.
* Amazon S3 and S3-compatible storage using AWS Signature Version 4.
* Dropbox with access-token/refresh-token support and chunked upload sessions for large archives.
* Microsoft OneDrive using Microsoft Graph resumable upload sessions.
* FTP, FTPS, and SFTP (SSH2 extension required for SFTP).
* Generic WebDAV uploads.
* Remote credentials encrypted at rest when OpenSSL is available.
* Optional email notifications for scheduled backup success/failure.
* No ads, telemetry, license key, upsells, or paid feature locks.

== Installation ==
1. Upload rythzen-backup.zip from Plugins > Add New Plugin > Upload Plugin.
2. Activate Rythzen Backup.
3. Open Rythzen Backup in the WordPress admin menu.
4. Configure backup contents, schedule, retention, and optional remote destinations.
5. Create a manual backup and verify that it can be downloaded before relying on automation.

== Remote storage notes ==
Remote providers require credentials created in the relevant provider account. Rythzen Backup never ships shared cloud credentials.

Google Drive requires an OAuth client ID, client secret, and refresh token. An optional folder ID can target a specific Drive folder.

S3 supports AWS and compatible endpoints. For non-AWS providers, set the provider's endpoint, region, bucket, credentials, and path-style setting as required by that service.

Dropbox can use an access token, or app key/app secret/refresh token. Large files automatically use Dropbox upload sessions.

OneDrive requires a Microsoft OAuth client ID and refresh token. Some application types also require a client secret.

SFTP requires the PHP SSH2 extension on the WordPress server.

== Security ==
* Administrative operations require manage_options capability and WordPress nonces.
* Backup directory is protected with Apache .htaccess, IIS web.config, and index.php files.
* Backup downloads are streamed through authenticated WordPress admin actions instead of direct public URLs.
* Remote secrets are encrypted with AES-256-GCM when OpenSSL is available, using WordPress installation salts as key material.
* Restore accepts only Rythzen Backup archives already present in the protected local backup directory.
* Archive paths are checked during file restoration to prevent traversal outside ABSPATH.

== Important recovery notes ==
A backup is only useful if it can be restored. Periodically test restores on staging or a non-production copy.

The default file scope is wp-content, which avoids copying WordPress core and wp-config.php. Select Entire WordPress installation only when you intentionally want those files included. Full-site archives can contain database credentials and other secrets; store them only in locations you trust.

Uninstalling the plugin removes plugin settings and scheduled events but intentionally leaves backup ZIP files on disk to prevent accidental data loss.

== Changelog ==

= 1.1.1 =
Fixed: WordPress's own "Check again" on the Updates screen now bypasses the plugin's
six-hour metadata cache, so a freshly published release shows up immediately.

= 1.1.0 =
Added: self-hosted automatic updates through the new Rythzen update service.
Added: an Updates tab showing the installed and latest version, release channel and last check.
Security: backup archives now carry an unguessable token in their filename. Previously the name
was entirely predictable, and on nginx — where the .htaccess guard is ignored — anyone who
guessed a timestamp could download the full site and its database.
Fixed: the database export paged through tables without an ORDER BY, so rows could be duplicated
or silently skipped. Exports are now ordered by primary key.
Fixed: binary and BLOB columns were written as if they were text and came back corrupted on
restore. They are now written as hex literals.
Fixed: large sites could fail with "too many open files" because every file stayed open until the
archive was closed. The archive is now flushed in batches.
Fixed: the archive manifest was written twice.
Added: the Diagnostics tab now says plainly when OpenSSL is unavailable and stored cloud
credentials are therefore only encoded, not encrypted.

= 1.0.0 =
* Initial release.
* Local database/files/full backups and restore.
* Scheduling and retention.
* Google Drive, S3-compatible, Dropbox, OneDrive, FTP/FTPS/SFTP, and WebDAV remote uploads.
* Rythzen-branded admin interface and diagnostics.
