=== Yedekalma — Backup, Restore, Migration & Malware Scanner ===
Contributors: kamkactemha
Tags: backup, migration, restore, database backup, malware scanner
Requires at least: 5.8
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.29.0
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Free WordPress backup plugin — full site & database backup, one-click restore, migration to a new domain, and a built-in malware scanner.

== Description ==

Yedekalma is a free **WordPress backup plugin** that takes a one-click **backup** of your entire site — files *and* database — and **restores** it again from the same screen. It also **migrates** your WordPress site to a new host or domain and **scans** it for **malware**. One backup plugin covers backup, restore, migration and security, so you do not need a separate tool for each job.

Everything runs on your own server. No account, no sign-up and no API key: install, activate, click **Take Backup**. Your backup archives stay on your hosting, and you can download them as a ZIP at any time.

Looking for a **free backup plugin** that also does migration and malware scanning without a paywall? Yedekalma gives you a full **WordPress backup**, a **database backup**, one-click **restore**, site **migration** and a **malware scanner** in a single plugin — no premium unlock required for any of it.

= Backup =

* **Full backup** — every file (themes, plugins, uploads) plus the complete database.
* **Database backup** — MySQL dump only, gzip compressed (`.sql.gz`) for large sites.
* **Files backup** — site files only, without the database.
* **Works on shared hosting** — chunked, time-sliced backup that finishes even when `exec()` is disabled and PHP limits are strict.
* **Incremental backup** — compares real file modification times, so a changed file is never skipped.
* **Safe storage** — local backups live in a hardened, non-browsable folder with unguessable file names.

= Restore =

* **One-click restore** of the database, plugins, themes and uploads straight from your dashboard.
* **Restore only what you need** — pick just the database, just uploads, just plugins or the whole site.
* **Restore from an archive you already have** — drag & drop a `.zip`, `.sql` or `.sql.gz` file and restore from it.
* **Integrity checked** — a truncated or corrupt archive is refused instead of half-applied, so a bad file can never damage a working site.
* **SHA-256 verification** of every archive before a restore begins.

= Migration =

* **Move your site to a new host** — download the backup, install Yedekalma on the target server and restore.
* **Change domain safely** — site URL and home URL are rewritten in the database automatically during the restore.
* **New database server** — `wp-config.php` credentials can be updated as part of a restore.
* **Clone your website** to a fresh install for disaster recovery, staging or a redesign.

= Malware scanner =

* **Security scan** of PHP, JS and configuration files across WordPress core, your plugins and the active theme.
* Detects **code injections, web shells and backdoors** using malicious-pattern matching.
* **Persistent results** — the scan report survives page reloads, so you can review it whenever you like.
* **Bulk clean** — select detected files and delete them in one click.
* **Core protection** — WordPress core files are shielded from accidental deletion while planted files can still be removed.

= Test environment (staging) =

* **One-click staging** — clone your live site into a `/staging` subfolder with a separate `stg_` database prefix, entirely on your own server.
* Try plugin or theme updates safely; your live site is **never** modified.

= Optional cloud service — backup to your own cloud storage =

Local backup, restore, migration and the malware scanner are complete on their own and never contact an external server. If you also want **off-site backup** copies, you can connect the optional Yedekalma cloud service (see *External services* below) to:

* **Backup to Google Drive** — stream backups straight to your own Google Drive.
* **Backup to Dropbox and OneDrive** — send archives to your own Dropbox or Microsoft OneDrive account.
* **Backup to Amazon S3** and S3-compatible storage — Backblaze B2, Wasabi, Cloudflare R2 and MinIO.
* **Backup to FTP / SFTP** — upload to any FTP or SFTP server you control.
* Run **scheduled automatic backups** — daily, weekly, hourly or as often as every few minutes for busy sites — with retention rules.
* **Table-level incremental database backup** — only the database tables that actually changed are exported, so even very frequent backups stay small and fast; unchanged runs are skipped automatically.
* Encrypt archives with **client-side AES-256 (BYOK)** before they leave your server — the passphrase never leaves your site.

= Languages =

Yedekalma ships with English, Turkish (Türkçe), German, Russian and Arabic translations.

== External services ==

This plugin can optionally connect to the Yedekalma cloud service (an external SaaS) to perform off-site backup and restore operations, package backups for delivery to your own cloud storage, check subscription state, and monitor backup quota. This connection only happens if you choose to use the cloud service (by entering an API token, by clicking the optional "Connect with Google" button, or by clicking the optional "register this site" button described below); the plugin's local backup, restore, migration and malware-scanner features work with no external connection at all.

* **Service URL:** https://yedekalma.com
* **Terms of Service:** https://yedekalma.com/legal
* **Privacy Policy:** https://yedekalma.com/legal#privacy
* **Connect with Google (opt-in):** The dashboard shows an optional "Connect with Google" button. It does nothing unless you click it. If you click it, your browser is sent to https://yedekalma.com where you sign in with Google; Yedekalma then creates or finds your account from your Google e-mail address and links this site (identified by its Site URL) to it. Only your e-mail address and the Site URL are used for this; no Google Drive or other Google data permission is requested, and no site content is sent. A one-time connection token is returned to your site and stored encrypted locally.
* **Optional site registration (opt-in):** The dashboard also shows an optional "register this site with Yedekalma" button. It does nothing unless you click it. If you click it, the plugin sends only your Site URL and technical version info (plugin, WordPress, PHP version and locale) to https://yedekalma.com so the site can be listed in your Yedekalma panel; no site content or personal data is sent. If you also enter a notification e-mail, that address and your marketing-consent choice are sent as well. You can ignore the button entirely and every built-in feature still works.
* **Data Transmission:** When connected (or after opt-in registration), the plugin sends requests to the Yedekalma API containing your Site URL, active plugin features, backup metadata (such as file lists, sizes, and checksums), and your API token (or anonymous install id) to perform secure backup and restore tasks.

== Installation ==

1. In your WordPress admin, go to **Plugins → Add New**.
2. Search for **Yedekalma**.
3. Click **Install Now**, then **Activate**.
4. Open **Yedekalma** in the admin sidebar.
5. Click **Start without an account** and take your first backup.

Manual installation: upload the `yedekalma` folder to `/wp-content/plugins/` and activate it from the Plugins screen.

== Frequently Asked Questions ==

= Is this backup plugin free? =

Yes. Backup, restore, migration and the malware scanner are fully functional with no account and no payment. The optional Yedekalma cloud service adds off-site storage and has a free tier.

= Is this a good free backup plugin for WordPress? =

Yedekalma is a free WordPress backup plugin that bundles full-site backup, database backup, one-click restore, site migration, a malware scanner and a one-click staging environment — features that many plugins split between free and premium tiers. Everything runs on your own server and needs no account.

= How do I back up my WordPress site? =

Open **Yedekalma → Dashboard** and click **Take Backup**. Choose **Full** (files + database), **Files Only** or **Database Only**. The backup runs in time-sliced chunks on your own server and you can download the archive as a ZIP when it finishes.

= How do I back up my WordPress database? =

Open **Yedekalma → Dashboard**, click **Take Backup** and choose **Database Only**. You get a compressed MySQL dump (`.sql.gz`) that you can download or restore later.

= Can I back up a WooCommerce store? =

Yes. A full backup includes your entire WordPress database — WooCommerce orders, products, customers and settings — together with your files, so your whole store is captured. For very busy stores you can schedule frequent incremental backups through the optional cloud service so new orders are protected between runs.

= Can it back up large sites (5 GB, 10 GB or more)? =

Yes. Backups run in small time-sliced chunks and the database is streamed to a gzip-compressed dump, so large sites finish without hitting PHP time or memory limits. For very large sites, connecting the optional cloud service lets archives stream straight to your own Google Drive, S3 or FTP storage instead of filling your hosting disk.

= Does it work on shared hosting, cPanel, Plesk or DirectAdmin? =

Yes. Yedekalma is a pure-PHP plugin with no server dependencies, so it works on any standard WordPress host — shared hosting, cPanel, Plesk, DirectAdmin or a managed platform. It does not need `exec()`, shell access or SSH.

= Does it work on LiteSpeed, Nginx and Apache? =

Yes. The plugin runs inside WordPress itself and does not depend on the web server, so it works the same on LiteSpeed, Nginx, Apache or any other server that runs PHP.

= Can I use it to migrate my site to a new host or domain? =

Yes. Take a full backup, download the ZIP, install Yedekalma on the target site and restore the archive there. The site URL and home URL in the database are updated for the new domain automatically.

= Can I clone my website for staging or disaster recovery? =

Yes. Use the built-in **Test Ortamı (Staging)** page to clone your live site into a `/staging` subfolder on the same server, or take a full backup and restore it onto a completely separate install. Either way your live site is never modified.

= Where are my backups stored? =

In `wp-content/uploads/yedekalma-backups/` on your own server. The folder is protected from directory browsing and the archive names include a random token, so nobody can guess the URL. If you connect optional cloud storage, backups go to your own Google Drive, Dropbox, OneDrive, S3 or FTP account instead.

= Can I back up to Google Drive? =

Yes, through the optional Yedekalma cloud service. Backups stream directly from your server to **your own** Google Drive; Yedekalma never keeps a copy.

= Can I back up to Dropbox or OneDrive? =

Yes. With the optional cloud service you can send scheduled backups to your own Dropbox or Microsoft OneDrive account.

= Does it support Amazon S3, Backblaze B2 or Wasabi? =

Yes. The optional cloud service supports Amazon S3 and any S3-compatible storage — Backblaze B2, Wasabi, Cloudflare R2 and MinIO. Uploads use a client-side signed (SigV4) request and your secret key is AES-256 encrypted on your own site, never sent to Yedekalma.

= Can I back up to FTP or SFTP? =

Yes. The optional cloud service can upload backups to any FTP or SFTP server you control. The credentials are encrypted on your own site.

= Does it support scheduled automatic backups? =

Yes, through the optional cloud service. You can schedule automatic backups daily, weekly, hourly or as often as every few minutes for busy sites, each with its own retention rules. One-click manual backups are always available for free without any schedule.

= What is incremental backup and does it support it? =

An incremental backup only saves what changed since the last run, so it stays small and fast. Yedekalma compares real file modification times for files and, with the cloud service, exports only the database tables that actually changed — unchanged runs are skipped automatically.

= Can I encrypt my backups? =

Yes. With the optional cloud service you can turn on client-side AES-256 (BYOK) encryption. Archives are encrypted on your own server before they leave it, and the passphrase never reaches Yedekalma.

= How does the malware scanner work? =

It scans PHP, JS and configuration files in WordPress core, your plugins and the active theme for malicious patterns, code injections, web shells and backdoors. Results are saved so you can review them later, and you can delete detected files in bulk. Core WordPress files are protected from deletion.

= How do I restore a WordPress backup for free? =

Open **Yedekalma → Backups**, find the backup you want and click **Restore**. You can restore the database, plugins, themes and uploads separately or all at once. You can also drag & drop a `.zip`, `.sql` or `.sql.gz` archive you already have and restore from it — no account and no payment required.

= Can I restore only the database? =

Yes. When restoring, pick the **Database** section on its own and the rest of the site is left untouched. This is handy for rolling back a bad content change without reverting files.

= Can I restore only the uploads, media or a single component? =

Yes. Restore offers each section your backup contains — database, plugins, themes and uploads — so you can restore just your media/uploads, just plugins or any single part instead of the whole site.

= Is there a free WordPress migration plugin here? =

Yes. Yedekalma migrates your WordPress site to a new host or domain for free: take a full backup, download the ZIP, install Yedekalma on the target site and restore. The site URL and home URL are rewritten in the database automatically, and `wp-config.php` credentials can be updated during the restore.

= How can I scan WordPress for malware without a subscription? =

The built-in malware scanner is completely free and needs no account. Open **Yedekalma → Malware Scanner** and start a scan; it checks WordPress core, your plugins and the active theme for injected code, web shells and backdoors, then lets you delete detected files in bulk while protecting core files.

= How often should I back up my WordPress site? =

For most sites a weekly full backup plus a daily database backup is a good baseline; busy or e-commerce sites should back up daily or more often. You can run a one-click backup any time for free, and the optional Yedekalma cloud service adds scheduled automatic backups with retention rules.

= What happens to my backups if I delete the plugin? =

Nothing. Local archives under `wp-content/uploads/yedekalma-backups/` stay where they are unless you remove them yourself, and anything in your own cloud storage stays there too.

= Türkçe destekliyor mu? =

Evet. Yedekalma tamamen Türkçe arayüze sahiptir: site yedekleme, veritabanı yedekleme, yedekten geri yükleme, site taşıma ve virüs/zararlı yazılım taraması işlemlerinin tümünü Türkçe olarak yapabilirsiniz.

= Is Multisite supported? =

Not in version 1 — a separate plugin instance per site is required. Full Multisite support is on the roadmap.

= Is it GDPR / KVKK compliant? =

Yes. The plugin makes no external connection at all unless you deliberately connect the optional cloud service, and explicit consent is collected for that data transfer.

== Screenshots ==

1. Dashboard — one-click full, files-only or database backup; runs on your own server, no account needed.
2. All backups — one-click restore or download, each with size and SHA-256 checksum.
3. Built-in malware scanner — scan WordPress core, plugins and the active theme for injected code, web shells and backdoors.
4. Settings — interface language and safe uninstall data handling.
5. Optional Yedekalma Pro — connect to schedule off-site backups straight to your own cloud (Google Drive, S3, FTP) with client-side AES-256.
6. Test Ortamı (Staging) — create a full copy of your live site in a /staging subfolder with a separate stg_ database prefix, right from the dashboard; your live site is never modified.

== Changelog ==

For the full history of older releases, see `changelog.txt` in the plugin folder.

= 1.29.0 — 2026-07-30 =
* FIX: Malware scanner no longer reports the plugin's own files as threats. Because the scanner's signature table literally contains web-shell names and command patterns, left-over copies of the plugin (WordPress's wp-content/upgrade/ staging folder and any trashed/old copies) were flagged as "known web shell / backdoor". The self-exclusion now recognises the plugin's layout in any location.
* FIX: Fewer false positives overall — the bare words "webshell"/"backdoor" were dropped from the known-web-shell signature (they occur in legitimate security plugins and documentation), and the command-parameter signature no longer matches $_POST['pass']/['pwd']/['code'] used by normal login and verification-code forms.

= 1.28.0 — 2026-07-30 =
* DOCS: Refreshed the plugin listing for clarity and search. Corrected the short description (real-time Instant Backup was removed in 1.22.0 and is no longer advertised), gave the supported cloud destinations their own lines (Google Drive, Dropbox, OneDrive, Amazon S3 / Backblaze B2 / Wasabi / R2 / MinIO, FTP/SFTP), and expanded the FAQ with answers about WooCommerce backups, large sites, hosting compatibility (cPanel, Plesk, DirectAdmin, LiteSpeed, Nginx, Apache), per-section restore (database-only, uploads-only), scheduled and incremental backups, and archive encryption. No functional changes.

= 1.26.0 — 2026-07-29 =
* NEW: Inbound provisioning for servers that block outbound connections. When a site cannot reach the Yedekalma cloud (egress-blocked), the plugin's handshake — which carries the secure pull key — never arrives, so the panel cannot read the database / files / email summary. A new authenticated `provision` endpoint lets the panel fetch the key inbound instead, using the API token it already issued for the site (sent only in the Authorization header, over TLS). No outbound call from the site is needed.

= 1.25.0 — 2026-07-29 =
* NEW: Self-healing connection. The 6-hourly heartbeat now sends full site info (including the secure pull key + REST pull URL) in the POST body, so a connection that skipped the full handshake (e.g. connected via Google or an older version) is automatically upgraded to a working data-pull channel on the next heartbeat — no manual reconnect needed. The panel can then read the database / files / email summary directly from WordPress. The key travels only in the POST body (never a query string), so it never lands in access logs. On plugin upgrade the heal fires immediately on the first admin page load.

= 1.24.0 — 2026-07-29 =
* NEW: The plugin now reports a **configuration summary** to the Yedekalma panel, so the panel's **Backup Plan** step enables or locks each component (Files / Database / Mail) based on what you actually set up on your site — exactly like the standalone PHP backup module already did. If you have **not added any email account** on the *Yedekalma Pro → E-posta* tab, the *Mail backup* row is locked in the panel (no more misleading "mail backup" appearing active when there is nothing to back up). Files and the WordPress database are always available. Only counts and masked names are sent — no passwords ever leave your site.

= 1.23.0 — 2026-07-29 =
* IMPROVED: On the **Yedekalma Pro → File System** tab, the folder browser is now open by default (no extra "Browse folders" click) and loads the site root automatically.
* IMPROVED: Excluded paths now show a green "✓ excluded" badge in the browser, both for items you just excluded and for paths already in your exclude list, so you can see at a glance what is left out.
* NOTE: This release also bumps the asset version, so browsers reliably load the latest admin scripts — this ensures the 1.22.x fixes (Pro connect/disconnect returning to the Pro page, and the real backup-status panel) actually take effect. If a previous update looked like it "did nothing", installing 1.23.0 and hard-refreshing (Ctrl+Shift+R) resolves it.

= 1.22.2 — 2026-07-29 =
* NEW: The **Yedekalma Pro** page now shows the real backup status from your cloud panel — *Awaiting payment / not started*, *Expired*, or *Active* — plus the last backup time. Previously the "connected" box alone could give the false impression that scheduled backups were running when payment was still pending.

= 1.22.1 — 2026-07-29 =
* FIX: After connecting or disconnecting your Yedekalma account from the **Yedekalma Pro** page, the browser now returns to the Pro page instead of jumping to the main control panel.

= 1.22.0 — 2026-07-28 =
* REMOVED: Real-time **Instant Backup** (WooCommerce order / post-page change trigger). Each trigger re-packaged the whole component (it was not incremental), which caused heavy CPU, disk and bandwidth load on large sites. Scheduled incremental backups — as often as every few minutes — cover this need efficiently. All related hooks and settings were removed.

= 1.21.0 — 2026-07-28 =
* NEW: **Restore a backup into the test environment.** On the Test Ortamı page you can now build the /staging copy from one of your local backups instead of from the live site — so you can safely open and check an older backup (or a backup you are about to restore) in the sandbox first. Files and database are restored into /staging + stg_ only; your live site is never touched.

= 1.20.0 — 2026-07-28 =
* IMPROVED: Instant Backup activates faster. When you turn it on in the cloud panel, the plugin now picks it up within about half an hour on its own (a lightweight settings check runs every 30 minutes), instead of waiting for the next 6-hour heartbeat.
* IMPROVED: On sites without WooCommerce, an instant backup triggered by publishing/updating a post or page now also captures newly uploaded media (it backs up files + database, incrementally, so it stays small), not just the database.

= 1.19.0 — 2026-07-28 =
* NEW: **Staging (test environment) is now built into the plugin.** A new "Test Ortamı" item appears in the Yedekalma admin menu; open it and create a full copy of your live site in a `/staging` subfolder with a separate `stg_` database prefix — right from your WordPress dashboard, without the cloud panel. Create, open, re-create (refresh from live) and delete the staging copy from one page. The clone runs entirely on your own server and your live site is never modified. WordPress only.

= 1.18.0 — 2026-07-28 =
* NEW: Real-time **Instant Backup** now also covers regular WordPress content. On a site without WooCommerce, publishing or updating a post or page triggers an automatic incremental backup within seconds (debounced, so a burst of edits becomes a single backup). Autosaves and revisions are ignored. Requires the optional Yedekalma cloud service. WordPress only.
* IMPROVED: The one-time review request now also recognises cloud and scheduled backups, not just local ones, so it appears for connected sites once they have real backups behind them.

= 1.17.0 — 2026-07-28 =
* NEW: Real-time **Instant Backup for WooCommerce**. When a new order is placed, an order status changes or a payment completes, an automatic incremental backup runs within seconds — merged into a single backup during busy periods — so you never lose orders between scheduled backups. Runs entirely on your own server via the plugin's own engine; nothing is kept on Yedekalma. Requires the optional Yedekalma cloud service. WooCommerce only.

= 1.16.0 — 2026-07-28 =
* NEW: One-click Staging (test environment). Clone your live site into a `/staging` subfolder with a separate `stg_` table prefix — all on your own hosting — so you can safely try plugin/theme updates or changes without touching the live site. The clone runs entirely on your server (files copied on disk, database duplicated with `CREATE TABLE ... LIKE` + `INSERT SELECT`), URLs are rewritten serialization-safely, `WP_HOME`/`WP_SITEURL` are set, and the copy is marked noindex. Managed from your Yedekalma panel. Your live site is never modified — only new `stg_`/`staging` are created. WordPress only.

= 1.15.0 — 2026-07-27 =
* NEW: A one-time, respectful review request appears only inside Yedekalma's own admin pages after you have completed at least three successful backups. It never touches the rest of wp-admin, "Remind me later" postpones it for 30 days, and "Already reviewed / Dismiss" hides it for good. It makes no external connection — clicking "Rate" simply opens the WordPress.org review page in a new tab.
* DOCS: Added FAQ answers for restoring a WordPress backup for free, free site migration, malware scanning without a subscription, and recommended backup frequency.

= 1.14.0 — 2026-07-27 =
* NEW: Manual backups now run in the background on your own server — start a backup, then leave the page or switch menus and it keeps going; it automatically resumes tracking when you return, and shows a confirmation dialog and jumps to the Backups page when finished.
* NEW: Backups on disk are auto-recovered — if a backup file exists in your uploads folder but is missing from the list, it is detected and re-added so it stays visible and restorable.
* IMPROVED: Restore now only offers the sections your backup actually contains (a database-only backup offers only "Database", etc.).
* IMPROVED: "Yedekalma Pro" screen clearly reflects that it is the Yedekalma (yedekalma.com) cloud service; its Files/Database/E-mail tabs stay inactive until you connect. Database and e-mail sections now let you auto-discover accounts and test the connection before saving; the exclude-folder browser also lists files.
* IMPROVED: Admin pages no longer hang when your host blocks outbound connections to yedekalma.com (short timeouts + graceful fallback).
* Various UI polish and fixes.

= 1.13.0 — 2026-07-27 =
* NEW: S3-compatible storage as a Yedekalma Pro target — Amazon S3, Backblaze B2, Wasabi, Cloudflare R2, MinIO. Enter endpoint/region/bucket/access key/secret key; scheduled backups are uploaded straight from your server via a client-side SigV4 presigned PUT. Secret key is AES-256 encrypted on your own site and never sent to Yedekalma (zero-data).

= 1.12.0 — 2026-07-25 =
* NEW: "Yedekalma Pro" menu — Connection, Backup Content (files/database/e-mail components, browsable exclude-folder tree, client-side AES-256 passphrase), Storage Target (your own FTP/SFTP, credentials encrypted on your own site) and Scheduling (WP-Cron). E-mail is backed up over IMAP as .eml files. Zero data kept on Yedekalma; backups go straight from your server to your own storage.
* NEW: "Connect with Google" button on the dashboard (opt-in). One click links the site to your Yedekalma account via Google sign-in in your browser, so it works even on hosts that block the web server's outbound connections. Only your e-mail (for the account) and the Site URL are used; no Google Drive permission is requested. See *External services*.
* NEW: Optional "register this site with Yedekalma" button on the dashboard (opt-in). Clicking it lists your site in your Yedekalma panel using only the Site URL and technical version info — no site content or personal data. It is entirely optional; every built-in feature works without it. See *External services*.
* SECURITY: Restore-time database search-replace now unserializes option values with `allowed_classes => false`, so a crafted serialized payload inside a restored row can never trigger PHP object injection.
* SECURITY: Upload-limit raising (runtime ini and the optional `.user.ini` line) now runs only on the plugin's own screens and AJAX endpoints instead of on every wp-admin request, following least-privilege and avoiding unnecessary global PHP-config changes.
* HARDENING: Output-escaping pass for strict WordPress.org late-escaping compliance (admin backup-limit notice and the CLI cron hint now escape their dynamic values); bulk threat-removal input is now unslashed and string-cast before validation.

= 1.11.7 — 2026-07-22 =
* I18N: Completed the English, German, Russian and Arabic interface translations. 69 strings — confirmation dialogs, error messages, progress text and settings labels — previously fell back to the Turkish source text. All five bundled languages are now at 100%.
* I18N: The plugin name and description shown on the Plugins screen are now translatable.

= 1.11.6 — 2026-07-21 =
* DOCS: Rewrote the plugin description, feature list and FAQ.
* ASSETS: Added plugin directory icon and banner images.

= 1.11.5 — 2026-07-21 =
* FIX: Responsive threat table layout. Adjusted column widths and increased action column width to 110px so the protected shield badges fit cleanly without horizontal overflow.

= 1.11.4 — 2026-07-21 =
* FEATURE: Finalized malware scanner enhancements, core protection filters, and uninstall cleanup logic.

= 1.11.3 — 2026-07-20 =
* FEATURE: Custom malware scan protection layout. Integrated granular, detailed reasons for critical files (wp-config.php, active theme assets, root boot scripts, drop-ins, and admin/includes core files) to protect them from deletion, while still allowing the deletion of planted non-core exploits.

= 1.11.2 — 2026-07-20 =
* FIX: Robust option structure mapping. Hardened list rendering and DB option cleanup to support both array and object elements, preventing PHP type-error crashes on page loads and threat file deletions.

= 1.11.1 — 2026-07-20 =
* FIX: WordPress core protection. Added a strict safety check to prevent accidental deletion of critical WordPress files (such as files inside wp-admin, wp-includes, wp-config.php, index.php, etc.) via the malware scanner deletion tool.

= 1.11.0 — 2026-07-20 =
* NEW: Built-in Malware & Virus Scanner. Scan all PHP, JS, and configuration files for code injections, web shells, backdoors, and malicious patterns.
* NEW: Persistent Scan Results. Scanner results are securely saved on your site so they persist across page refreshes.
* NEW: Bulk Actions. Select all or specific detected threat files and delete them collectively with one click.
* NEW: Security Reminders. Contextual security notices recommend taking a virus scan before taking backups or restoring a backup.

= 1.10.4 — 2026-07-20 =
* NEW: Added drag-and-drop local backup file upload zone (.zip, .sql, .sql.gz) with real-time progress bar.
* FIX: Fixed critical bug where restored backups disappeared from the list due to options database caching.
* FIX: Fixed settings loss on restore by correcting options key preservation to 'yedekalma_settings'.

== Upgrade Notice ==

= 1.28.0 =
Documentation and search-listing refresh: corrected short description, clearer cloud storage options (Google Drive, Dropbox, OneDrive, S3, FTP) and a much larger FAQ. No functional changes.

= 1.22.0 =
Real-time Instant Backup has been removed — it re-packaged the whole site on every change and could overload large sites. Use scheduled incremental backups (as frequent as every few minutes) instead.

= 1.19.0 =
Staging (test environment) is now built into the plugin — a "Test Ortamı" admin page lets you create/refresh/delete a full `/staging` copy of your live site on your own server, no cloud panel needed. Recommended for all users.

= 1.18.0 =
Adds real-time Instant Backup: on WooCommerce sites a backup runs within seconds of every order change, and on other sites when a post or page is published or updated (debounced, optional cloud service). Recommended for all users.

= 1.15.0 =
Adds a one-time, respectful in-plugin review request (shown only after three successful backups, easy to dismiss, no external connection) and new FAQ entries. Recommended for all users.

= 1.13.0 =
Adds S3-compatible storage (Amazon S3, Backblaze B2, Wasabi, R2, MinIO) as a Pro backup target with client-side signing; your secret key stays encrypted on your own site.

= 1.12.0 =
Adds an optional "Connect with Google" button (browser-based account link that works even behind outbound-blocking hosts) and an optional "register this site" button (both off by default, opt-in). Also ships security hardening: blocks PHP object injection during restore search-replace, scopes upload-limit changes to the plugin only, and completes output-escaping for WordPress.org compliance. Recommended for all users.

= 1.11.7 =
Completes the English, German, Russian and Arabic interface translations; 69 strings previously appeared in Turkish.

= 1.11.6 =
Documentation and plugin directory listing refresh. No functional changes.
