Akeeba Backup for WordPress

#43457 Backup on core update silently turns off after every plugin update (mu-plugin only copied on activation)

Posted in ‘Akeeba Backup for WordPress’

This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

WordPress version

7.1.3

PHP version

8.3.36

Akeeba Backup version

9.3.0

Latest post by nicholas on Wednesday, 28 October 2026 01:29 CDT

Tuesday, 27 October 2026 16:34 CDT

genr8r

Hi Nicholas,

On Akeeba Backup Pro for WordPress, the "back up before a WordPress core update" feature switches itself off after every plugin update, and nothing in the interface shows it.

The issue

wp-content/mu-plugins/akeeba-backup-coreupdate.php returns early unless AKEEBABACKUP_MUPLUGIN_COREUPDATE_VERSION equals AKEEBABACKUP_VERSION (the version_compare(..., 'eq') check near the top of the file).
The file is copied into mu-plugins only from the activation hook in helpers/AkeebaBackupWP.php. Updating the plugin replaces helpers/assets/mu-plugins/akeeba-backup-coreupdate.php but never the deployed copy, and the post-upgrade script does not touch it either.
So the first update after activation leaves the two versions different, and from then on a manual core update proceeds with no backup.

Real-world scenario

Across our WordPress sites, every deployed copy was older than its plugin, some by years (3.5.1, 7.5.8, 7.8.1.1 against 9.1.2). We copied the 9.2.0 file into place by hand on 27 October, and the same afternoon the plugin auto-updated to 9.3.0, which switched the feature off again within 30 minutes.

Suggested fix

Re-copy the mu-plugin whenever the plugin is updated, not only on activation, for example from the post-upgrade step or an upgrader_process_complete handler. Only overwrite a copy that already exists, so a site that removed it on purpose stays that way. A notice in the plugin's control panel when the two versions differ would also make it visible.

Admin Tools for WordPress has the same pattern with mu-plugins/admintoolswp.php, where a mismatch switches off the whole WAF, so the same fix there would be worth considering.

For now we re-copy the vendor file on a schedule, so there is no urgency on our side.

Thanks,
Brian

btw - Missed you at JWC26 :(

Wednesday, 28 October 2026 01:29 CDT

nicholas

This is a valid issue. I am going to address it in the next version, but it's gonna be a while before a new release is made.

I am going for a triple plan of attack here:

Try to copy the file after an update is installed (and invalidate its OPcache cache for good measure).
On plugin startup, check the last version the mu-plugin file was updated. If it's not the currently installed version, copy it as above.
On visiting the Control Panel page check if the hash of the mu-plugin file matches what we ship. If not, copy it as above.

This should cover all failure modes I am aware of, including the post-update code not running or being interrupted, manual plugin updates, restoring an old files-only (or partial) backup over a newer site, deleting the file, and messing with the file manually.

I will also check Admin Tools for WordPress. I have only looked at Akeeba Backup for WordPress so far. I believe it will be the same situation, and a similar solution will be implemented; my belief is based on the fact that I am using similar patters in both of my published WordPress plugins.

Regarding JWC26, the price of airfare was insane, even though I started looking for plane tickets as soon as it was announced. A flight from Athens to Frankfurt was only marginally cheaper that a flight from Athens to Chicago through Frankfurt. I have no idea how that makes sense. That made it very impractical for me to travel, as it blew my projected budget for JWC26 just by paying for airfare and the hotel.

In all fairness, before the JWC26 dates were announced I couldn't have guessed that a demented (in the literal sense) octogenarian would start a war he didn't need and couldn't fight in the Middle East, nor that it would drag on forever. Ugh... I guess I will have to budget very differently for next year.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Support