shouldiuse.io

VERDICT

Should I use Duplicator?

Duplicator is the best WordPress backup and migration plugin, trusted by 1,000,000+ users. - duplicator.com

Depends. Buy if you manage or migrate multiple WordPress sites and will keep the plugin updated; the free tier covers basics. Skip it for a single small blog — host backups or UpdraftPlus do the job cheaper.

Confidence

Medium. Based on ~13 usable public sources; many search results were unrelated duplicator hardware products and were excluded.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityNo reliable support evidence found
  • Security posture

Pricing

$0

Free (WordPress.org)

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Duplicator ProAnnual per-site license (see site)

Best for

  • Agencies migrating client WordPress sites
  • Freelancers managing multiple WP installs
  • Sites needing scheduled cloud backups
  • Host-to-host migration workflows

Not for

  • Non-WordPress sites — WordPress only
  • Single small blogs — host backups suffice
  • Anyone who won't keep plugins patched — its flaws get actively exploited
  • Price-sensitive hobbyists hit by Pro price increases

Gotchas - check before you buy

high

Versions below 1.5.7.1 exposed backups to unauthenticated downloads — update before trusting it

high

2018 RCE and 2020 path traversal were exploited in the wild on outdated installs

medium

Leftover installer files on the server are a known risk; follow Duplicator's own cleanup guidance

medium

Pro price hikes drew public complaints; compare against the free tier before renewing

Pros and cons

Pros

  • Free version on; vendor claims 1,000,000+ users
  • Reviewers praise fast, straightforward site migrations
  • 4.8/5 Capterra rating across 60 reviews
  • Redditor preferred it over WP Migrate after extensive comparison
  • Built-in cloud backup storage options

Cons

  • Users publicly call Pro pricing 'very expensive' after increases
  • Track record of critical, actively-exploited vulnerabilities
  • Trustpilot rated just 4.0/5 in a competitor's comparison
  • Mostly vendor-controlled review pages; independent signal is thin

Sources & method

Analyzed 9/20/2026 - 13 sources - Patched history of serious flaws, including exploited RCE and path traversal — safe if kept current.

official x3review x5security x4news x1
  • Unauthenticated backup exposure in versions <1.5.7.1, Older versions let unauthenticated users download backup archives containing full site data.
  • Unauthenticated RCE, CVE-2018-25095, Versions below 1.3.0 allowed remote code execution; exploited via outdated installs.
  • Path traversal, CVE-2020-11738, Directory traversal flaw exploited in the wild in February 2020 against 1M+ potential targets.

Key stats

  • Value for money: 2/5

    Rating

  • $0

    Starting price

  • 13

    Sources

  • Analyzed

  • Value for money: 2/5. Users call Pro pricing 'very expensive' after increases
  • Ease of use: 4/5. Reviewers call migrations fast and simple
  • Feature depth: 4/5. Automated backups, cloud storage, migration, staging comparisons
  • Support quality. No reliable support evidence found
  • Security posture: 2/5. Multiple critical CVEs, some exploited in the wild
  • 4.8/5 Capterra rating 60 reviews
  • 4.0/5 Trustpilot rating per third-party comparison
  • 1,000,000+ Claimed users vendor-stated installs
  • Yes Free tier free plugin on WordPress.org

Pricing

Free (WordPress.org)

$0

  • Core backup and migration
  • Manual exports

Duplicator Pro

Annual per-site license (see site)

  • Automated scheduled backups
  • Cloud storage options

Security

Patched history of serious flaws, including exploited RCE and path traversal — safe if kept current.

  • Unauthenticated backup exposure in versions <1.5.7.1Older versions let unauthenticated users download backup archives containing full site data.⁹
  • Unauthenticated RCE, CVE-2018-25095Versions below 1.3.0 allowed remote code execution; exploited via outdated installs.10
  • Path traversal, CVE-2020-11738Directory traversal flaw exploited in the wild in February 2020 against 1M+ potential targets.11

Companies that use it

  • Team 21813
Full analysis

Based on ~13 usable public sources; many search results were unrelated duplicator hardware products and were excluded.

Solid WordPress backup/migration plugin for multi-site owners; keep it updated and expect rising Pro prices.

Methodology

Based on ~13 usable public sources; many search results were unrelated duplicator hardware products and were excluded.

Sources

  1. Duplicator Pro homepageduplicator.com
    official
  2. Duplicator on WordPress.orgwordpress.org
    official
  3. Duplicator Pro pricing pageduplicator.com
    official
  4. Duplicator Pro Capterra reviewscapterra.com
    review
  5. Duplicator plugin review (FatLab)fatlabwebsupport.com
    review
  6. All-in-One WP Migration vs Duplicator (ServMask)blog.servmask.com
    review
  7. Reddit: Duplicator vs WP Migratereddit.com
    review
  8. Very expensive now (WordPress.org support)wordpress.org
    review
  9. Exploit-DB 51874: unauthenticated backup exposureexploit-db.com
    security
  10. WPScan: CVE-2018-25095 unauthenticated RCEwpscan.com
    security
  11. Tenable: Duplicator vulnerability exploited in the wildtenable.com
    security
  12. Wordfence: active attack affecting 1M+ siteswordfence.com
    security
  13. Team 218 Duplicator case studyteam218.com
    news

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.