ServerMetry Backup Monitoring

Where and when data is sent

Reports are HTTPS POST requests to the configured job ping URL. For the hosted service this is https://api.servermetry.com/api/v1/backup/ping/YOUR_SECRET_TOKEN. A Dev setup uses https://dev-api.servermetry.com instead. Custom publicly reachable HTTPS hosts with the same API path are accepted; only configure an endpoint you trust. Redirects are disabled and WordPress validates outgoing URLs.

Requests occur when a configured UpdraftPlus backup starts or finishes and during limited retries of final results. Activating the plugin or opening its settings does not send a monitoring event.

Data sent

• The secret ping token in the request URL, which authenticates the backup job.
• Backup status, a run ID made from the WordPress site ID and UpdraftPlus backup nonce, and a short generic message. Completion messages can include the warning count.
• At backup start: the mapped components (files/database), their WP-Cron intervals in seconds and next scheduled UTC timestamps. Manual or absent schedules have empty interval/timestamp values.
• Standard HTTP connection metadata. The receiving server sees the sending server IP address and the WordPress HTTP user agent, which normally includes the WordPress version and site URL.

No backup files, database contents, original log lines, visitor data or WordPress login credentials are included in the report body. The ping token itself is a credential: do not publish it or include it in screenshots.

Service: https://servermetry.com Documentation: https://servermetry.com/docs/backups Terms of use: https://servermetry.com/terms Privacy policy: https://www.floba-media.de/datenschutz

Local storage and stopping reports

Ping URLs are stored in WordPress options without separate encryption and can be present in database backups. Only administrators with manage_options can change settings. Stored URLs are not returned in the form or exposed by this plugin through the REST API. Empty fields keep existing values; use the removal checkbox and save to clear a URL.

Existing runs keep their initial URLs until completion or cleanup. Removing a setting stops new runs for that target, but not pending reports. Rotate the job ping URL in ServerMetry to revoke an old token immediately, or deactivate the plugin to stop its callbacks.

Run options are removed after delivery finishes or retry attempts are exhausted. A duplicate-suppression marker without the URL lasts one week. Stale run options are scheduled for cleanup after one week. WP-Cron requires site traffic or an external cron trigger; cleanup and retries can be delayed.

Deactivation and deletion retain settings, last-delivery information and any pending run options/cron entries in WordPress. Cleanup cannot run while the plugin is absent. Reinstalling can resume pending reports. Clear saved URLs, allow outstanding runs to finish and revoke tokens before permanent removal. Removing this plugin does not delete history in ServerMetry.