An UpdraftPlus security block or firewall issue often shows up as a 403, ModSecurity, WAF, “Access denied,” failed UpdraftCentral connection, or uploaded backup files that will not appear after a rescan. Start in Settings > UpdraftPlus Backups and check the Backup / Restore tab and the UpdraftPlus log for the exact action that failed before changing security settings.
Quick checks before changing anything
Open Plugins > Installed Plugins and confirm UpdraftPlus is active and current. If an update is available, apply it first. WordPress explains plugin updates in its official guide to managing plugins, and UpdraftPlus publishes security and compatibility updates through its own site.
Then go to Settings > UpdraftPlus Backups and identify the failure:
- A backup starts but stops, times out, or returns a security message.
- Uploaded backup files are on the server but do not appear in the Existing backups list.
- UpdraftCentral cannot connect to the site.
- A 403, ModSecurity, WAF, “Not Acceptable,” “Access denied,” or “firewall” message appears.
- The issue began after a PHP version change, host migration, or security plugin update.
Do not delete existing backup files while troubleshooting. If you need to change security settings, make one change at a time so you can reverse it.
Safest fix order
1. Update UpdraftPlus and WordPress
If UpdraftPlus is behind, update it before testing anything else. Security tooling may block older plugin endpoints more aggressively, and compatibility fixes often arrive in plugin updates.
Also check Dashboard > Updates for WordPress core and other plugin updates. If the site uses managed hosting, take a backup or confirm the host has a restore point before updating multiple items.
2. Check the UpdraftPlus log for the failed action
In Settings > UpdraftPlus Backups, open the log for the failed backup, restore, upload scan, or remote connection. Look for the point where the process stops and note the time, visible error, and action being attempted.
This matters because firewall blocks are easiest to find when you can match the UpdraftPlus failure time to a security event in another tool. A vague “backup failed” report is much harder for a host or plugin vendor to investigate than “the rescan failed at 14:32 with a 403.”
3. Check whether a security plugin is blocking UpdraftPlus
If the site uses a security plugin, firewall plugin, login protection plugin, or malware scanner, look for blocked events at the same time as the UpdraftPlus failure.
Common places to inspect:
- Firewall or WAF logs inside the security plugin.
- Login protection or bot-blocking logs.
- “Live traffic,” “blocked requests,” or “security events” screens.
- Rules mentioning
admin-ajax.php, REST API requests,wp-cron.php, or UpdraftPlus plugin paths.
If the security plugin has learning mode, temporary allowlisting, or a log-based “allow this request” action, use that instead of disabling the whole plugin. Retest the exact UpdraftPlus action after allowing the request.
4. Check host firewall or ModSecurity blocks
A 403 page, “Not Acceptable,” “Access denied,” or generic security block often comes from the host’s WAF or ModSecurity layer rather than WordPress itself.
Look in the hosting control panel for:
- WAF or ModSecurity logs.
- Blocked request logs.
- Security events.
- PHP or web server error logs around the exact time of the failed UpdraftPlus action.
If you can see the blocked rule but cannot change it safely, contact the host and ask them to review the WAF block for UpdraftPlus. Give them the timestamp, site URL, action you were taking, and visible error. Avoid asking them to disable the firewall globally unless they suggest a temporary test window.
5. If UpdraftCentral cannot connect, verify the connection path
For UpdraftCentral issues, check the remote-control setup rather than only the backup schedule. UpdraftPlus documents connection checks for UpdraftCentral, including whether the remote site is online, whether remote control is enabled, and whether a firewall or security module is blocking access in its UpdraftCentral troubleshooting guide.
In WordPress admin, confirm that:
- The site is reachable without maintenance mode or password protection.
- UpdraftPlus is active.
- Remote control is enabled if you are using UpdraftCentral.
- A security plugin is not blocking remote requests.
- Browser console errors are not appearing during the connection attempt.
If the site recently moved hosts or changed domain, disconnect and reconnect the site in UpdraftCentral after checking firewall logs.
6. If uploaded backups do not appear, rescan the right storage location
When backup files are visible on the server but not listed in WordPress admin, go to Settings > UpdraftPlus Backups and use the rescan option for the storage location you are actually using.
Use rescan local storage when the files were uploaded to the server’s UpdraftPlus backup folder. Use rescan remote storage when the backup set is in remote storage such as cloud storage or SFTP.
Before moving files manually, confirm they are complete UpdraftPlus backup files and are in the expected UpdraftPlus backup directory. If the rescan itself is being blocked, the files may exist on disk while the Existing backups list still fails to refresh.
7. If the issue started after a PHP change, roll back or test compatibility
If the failure began immediately after switching PHP versions, change back to the previous supported PHP version from the hosting panel and retest UpdraftPlus. This is safer than editing plugin files.
After the rollback, update UpdraftPlus and other plugins, then test the newer PHP version again during a low-traffic window. If the same failure returns, collect the PHP error log entry and send it to UpdraftPlus support or your host.
Optional SSH check
If you have SSH access and WP-CLI installed, you can confirm whether WordPress sees UpdraftPlus as active:
wp plugin status updraftplusUse this only as a status check. It does not prove the firewall path is clear, because many WAF blocks happen during browser, AJAX, cron, or remote connection requests.
How to confirm the fix worked
Retest the same action that failed, not just the settings page.
For backups, start a small manual backup and confirm it finishes. For uploaded backups, rescan storage and confirm the backup set appears in the Existing backups list. For UpdraftCentral, reconnect the site and confirm the dashboard can communicate with it.
Then check the firewall or security log again. A fixed issue should stop producing new blocks for the same UpdraftPlus request.
Rollback and escalation
If a firewall allowlist rule makes the site behave unexpectedly, remove that rule and restore the previous security setting. If you disabled a security feature for testing, turn it back on after the test.
Contact the host when the block appears in server-side WAF, ModSecurity, or access logs. Contact UpdraftPlus support when the request is not blocked by the host or security plugin but UpdraftPlus still fails, especially after an update or PHP version change. Include the exact error, timestamp, UpdraftPlus version, PHP version, and whether the failure happens during backup, restore, upload scan, or UpdraftCentral connection.