Title: Mozzy Assistance Author: mozzzy Published: August 28, 2026 Last modified: September 13, 2026 --- Search plugins ![](https://ps.w.org/mozzy-assistance/assets/banner-772x250.png?rev=3669768) ![](https://ps.w.org/mozzy-assistance/assets/icon.svg?rev=3669768) # Mozzy Assistance By [mozzzy](https://profiles.wordpress.org/mozzzy/) [Download](https://downloads.wordpress.org/plugin/mozzy-assistance.3.2.0.zip) * [Details](https://li.wordpress.org/plugins/mozzy-assistance/#description) * [Reviews](https://li.wordpress.org/plugins/mozzy-assistance/#reviews) * [Installation](https://li.wordpress.org/plugins/mozzy-assistance/#installation) * [Development](https://li.wordpress.org/plugins/mozzy-assistance/#developers) [Support](https://wordpress.org/support/plugin/mozzy-assistance/) ## Description Mozzy Assistance connects a WordPress website to the Mozzy monitoring service. A Mozzy account is required for hosted monitoring and remote management. Local backups, downloads and restoration remain available without an account. To connect, open Mozzy > Overview and select Connect to Mozzy. Sign in, choose or create a project, and approve the website. WordPress exchanges a short-lived authorization code directly with Mozzy; the permanent connector token is never placed in a browser URL. The plugin contacts https://mozzy.au to authorize the connection and send the monitoring information described in the Privacy section. Nothing is sent until an administrator approves or manually configures a connection. Mozzy Assistance can also create complete database and file archives, retain protected local copies, and upload them directly to a Google Drive account using Google’s least-privilege drive.file permission. Backup contents upload directly to Google. With easy connection, Mozzy securely manages Google authorization. Advanced setup can keep your own Google application credentials in WordPress. Administrators can instead send backups directly to Backblaze B2, Amazon S3, Cloudflare R2, Wasabi, DigitalOcean Spaces, or another service with an S3-compatible HTTPS endpoint. Credentials and archive contents are sent directly from WordPress to the destination selected and configured by the administrator; they never pass through Mozzy. Protected updates let an administrator select pending plugin, theme, and WordPress core updates. Mozzy Assistance creates and verifies a new full safety backup first, requires any connected remote upload to succeed, applies updates one at a time, refreshes inventory, and runs database and filesystem checks. Normal WordPress automatic updates are not intercepted. Maintenance Autopilot lets an authorized Mozzy user approve specific update versions in Mozzy. The connected plugin receives those maintenance commands in heartbeat responses and performs the same backup-gated updates locally. If post-update verification fails, Mozzy can request an automatic rollback using the verified pre-update archive. WordPress creates a failed-state safety backup before restoring that archive; this rollback does not require a separate confirmation in WordPress. Remote recovery can browse Mozzy-created Google Drive, Backblaze B2, and S3-compatible archives and download a selected copy into protected local storage in resumable chunks. Transport and archive checks run before the existing explicit guided-restore confirmation is enabled. Optional encrypted backups use authenticated XChaCha20-Poly1305 chunks in a Mozzy. mzb container. Encryption and decryption are resumable, plaintext working archives are removed after encryption, and weak cryptographic fallbacks are not used. Administrators can export offline recovery-key files and rotate to a new key while retaining previous keys for older archives. Existing ZIP archives remain fully supported. New backups contain a small manifest archive and numbered component parts. Keep all files in a set together: the manifest alone cannot restore the website. Recent backups offers separate downloads for the manifest and every part. Connected cloud destinations receive the parts before the final manifest. ### External services #### Mozzy The plugin contacts https://mozzy.au only after an administrator connects the site or manually saves a connector token. It sends the monitoring and backup status and maintenance progress listed in the Privacy section to provide the Mozzy monitoring and maintenance service. Heartbeat responses can contain managed backup settings and requests, approved maintenance updates, or automatic rollback commands as described in the FAQ. Easy Google Drive connection also sends authorization requests and the selected folder ID/name to Mozzy. Mozzy stores an encrypted Google refresh token and issues short-lived access tokens to the authenticated website. Mozzy does not receive backup archives, object-storage secrets, or recovery keys. When you submit Contact Mozzy, your topic, message and reply email are saved in Mozzy’s support inbox and linked to your connected project. An email notification is sent by Mozzy, not by WordPress. WordPress, PHP and Mozzy version numbers are included only if you select the optional technical-details checkbox. Mozzy privacy policy: https://mozzy.au/privacy Mozzy terms: https://mozzy.au/terms #### Google Drive After an administrator selects Connect Google Drive, Mozzy handles Google consent and folder selection. Authorization codes and tokens pass through Mozzy; backup files upload directly from WordPress to Google. Disconnect removes this website’s Mozzy grant without deleting Drive files or disconnecting other websites. You can also revoke Mozzy in your Google account permissions. Advanced setup uses your own Google application with tokens held in WordPress. Both modes use https://accounts.google.com for authorization, https://oauth2.googleapis. com for OAuth token exchange and revocation, and https://www.googleapis.com for Drive file operations. OAuth identifiers, authorization codes, access and refresh tokens, backup archives, filenames, sizes, checksums, and plugin-created folder metadata are sent directly to Google as required to store, list, download, and remove retained backups in the administrator’s Drive account. Google privacy policy: https://policies.google.com/privacy Google terms: https:// policies.google.com/terms #### Backblaze B2 and S3-compatible storage The plugin contacts an object-storage service only after an administrator saves its HTTPS endpoint and credentials. It sends signed S3 API requests, the access key identifier, backup archives, filenames, sizes, and storage metadata directly to that endpoint to test the connection and to store, list, download, and remove retained backups. The secret key remains stored encrypted in WordPress and is used locally to sign requests. Supported services include Backblaze B2, Amazon S3, Cloudflare R2, Wasabi, DigitalOcean Spaces, and other administrator-selected S3-compatible services. Use of a configured service is governed by that provider’s terms and privacy policy. For Amazon S3, the standard API endpoint is https://s3.amazonaws.com. An Amazon Web Services account, an S3 bucket, an access key ID, and a secret access key are required. Administrators must explicitly enter their provider’s HTTPS endpoint; the plugin does not prefill or contact one merely by being activated or viewed. Requests begin only after an administrator saves the destination and explicitly tests it or runs a backup, recovery, retention, or restore operation. This is an optional storage API integration, not a source of remotely loaded JavaScript, CSS, images, fonts, or executable code. Backblaze privacy: https://www.backblaze.com/company/policy/privacy Backblaze terms: https://www.backblaze.com/company/policy/terms-of-service AWS privacy: https://aws. amazon.com/privacy/ AWS service terms: https://aws.amazon.com/service-terms/ Cloudflare privacy: https://www.cloudflare.com/privacypolicy/ Cloudflare terms: https://www. cloudflare.com/terms/ Wasabi privacy: https://wasabi.com/legal/privacy-policy Wasabi terms: https://wasabi.com/legal/terms-of-use DigitalOcean privacy: https://www.digitalocean. com/legal/privacy-policy DigitalOcean terms: https://www.digitalocean.com/legal/ terms-of-service-agreement ### Privacy When connected and enabled, the plugin sends data to https://mozzy.au. Data can include health heartbeats; WordPress, PHP, theme and plugin names and versions; active plugin status; fatal error messages, file locations, line numbers and the affected URL; database error messages; backup state, progress, filenames, sizes and destination labels; maintenance command identifiers, update and rollback progress, results and backup filenames; failed email events; and supported scheduled-task failures. The plugin does not intentionally send passwords, cookies, form contents, database records, WordPress users, visitor IP addresses, backup archives, object-storage credentials or recovery keys. Easy Google Drive connection stores encrypted Google authorization credentials and destination metadata on Mozzy. Review Mozzy’s privacy policy at https://mozzy.au/privacy and terms at https://mozzy.au/terms. ## Installation 1. Install and activate Mozzy Assistance. 2. Open Mozzy > Overview. 3. Select Connect to Mozzy. 4. Sign in to Mozzy and choose or create a project. 5. Confirm the connection test in WordPress. Administrators can alternatively paste a connector token from Mozzy. Monitoring can be paused and local credentials can be removed from the settings page. Verified local backups can be restored from Mozzy > Backups. Manual guided restore requires explicit administrator confirmation, creates a fresh safety backup first, preserves wp-config.php and the active Mozzy recovery component, restores in background batches, and finishes with database and filesystem checks. #### Website activation Connecting to Mozzy activates this website against its project using a private connection token. Each project can activate one WordPress website. Your account’s project allowance controls new activations. Existing connections remain active when a plan limit is lowered. Remove a connection in Mozzy to revoke its token; disconnecting in WordPress removes the local credentials. Local backup and restore features remain available without a Mozzy activation. Activation status and plan allowances refresh with successful monitoring heartbeats. Existing clients remain compatible; upgrading adds website-URL checks to monitoring requests. ## FAQ ### When does the plugin start contacting Mozzy? Only after a WordPress administrator approves the connection or saves a connector token. Deactivating the plugin stops its scheduled events. The connection can also be paused or disconnected from Mozzy > Overview. ### What can Mozzy remotely control? When an administrator enables managed backups, Mozzy can supply the schedule, retention and backup preset and request a new backup through the authenticated heartbeat. WordPress performs every backup locally and uploads directly to the configured destination. Maintenance Autopilot also lets an authorized Mozzy user approve specific plugin, theme, and WordPress core update versions. Mozzy sends these limited maintenance commands through heartbeat responses. WordPress checks that the requested versions are still available and creates and verifies a full safety backup before applying updates; connected remote backup uploads must also succeed. If post-update verification fails, Mozzy can request an automatic rollback using the verified pre-update archive. WordPress validates that archive against its protected- update history and creates a failed-state safety backup before restoring it. Automatic rollback does not require a separate confirmation in WordPress. Manual guided restores still require explicit confirmation from a logged-in WordPress administrator. These commands are limited to the plugin’s backup, update, and rollback workflows; they do not provide a general-purpose remote shell or arbitrary file editor. Recovery keys and object-storage credentials remain in WordPress. Easy Google Drive connection keeps the Google refresh token encrypted on Mozzy; WordPress requests short-lived access for direct uploads. Advanced Google setup keeps its credentials in WordPress. Recovery keys and archives are not sent to Mozzy. Any archive decryption required for restoration happens locally. ### What happens if I lose an encrypted backup recovery key? Mozzy cannot decrypt the archive and does not receive a copy of the key. Download and securely retain every recovery-key file, including older keys kept after a rotation. Importing the matching key makes its encrypted archives restorable. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Mozzy Assistance” is open source software. The following people have contributed to this plugin. Contributors * [ mozzzy ](https://profiles.wordpress.org/mozzzy/) [Translate “Mozzy Assistance” into your language.](https://translate.wordpress.org/projects/wp-plugins/mozzy-assistance) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/mozzy-assistance/), check out the [SVN repository](https://plugins.svn.wordpress.org/mozzy-assistance/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/mozzy-assistance/) by [RSS](https://plugins.trac.wordpress.org/log/mozzy-assistance/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 3.2.0 * Replace multipart download dialogs with animated inline download rows and retry handling. * Stream complete and component ZIP wrappers without recompressing or duplicating backups on disk. * Preserve original manifest, part checksums and encrypted files for recovery after extraction. * Show one download row at a time with grouped cards, loading feedback and an animated close control. * Include all plugins and themes in Essential files while excluding WordPress core; Custom remains configurable. #### 3.1.149 * Add resumable multipart backups, component archives and manifest-based recovery with adaptive processing. * Cache source-size estimates and improve backup progress, diagnostics and recovery controls. * Refresh account plans automatically and verify activations for Mozzy-hosted services while preserving local recovery. * Add private support messaging through Mozzy with clearer delivery errors. * Detect supported active applications and provide native export entry points with bundled product icons. * Refine Overview, accordion animations, accessibility labels and backup selection controls. #### 3.1.131 * Add visible warm-coloured scrollbars and an overflow-aware bottom fade to backup- selection lists. #### 3.1.130 * Apply logo-peach styling to Overview actions and preserve confirmed project metadata across incomplete responses. * Read project identity from successful API responses and accept both nested and legacy pairing metadata. #### 3.1.129 * Sanitize backup control inputs, use WordPress deletion APIs and document required native streaming/atomic restore operations. * Update tested WordPress version and release metadata. #### 3.1.128 * Use readable website/CMS/component filenames with UTC date, time and unique backup ID. Older backup names remain supported. * Tune archive sizes independently per component, avoid shrinking on small final parts, and raise the per-part file limit. * Use more available request time for checkpointed work and record upload and phase timing separately. #### 3.1.126 * Group file inventories by component using bounded, resumable passes to reduce small backup parts and upload requests. * Restore accessible Download, Restore and Delete tooltips after recent-backup rows refresh. #### 3.1.125 * Add a saved per-user Show diagnostics switch under Advanced, off by default. Backup progress and errors remain visible. #### 3.1.124 * Show backup identity, result and timestamps beside a dismissible diagnostics download button. Export filenames include the backup ID and export time. #### 3.1.123 * Create bounded, immutable backup parts for database, core, uploads, plugins, themes and other content, with a manifest describing the complete set. * Verify and stage every part before restoring files; retain support for existing single-file ZIP and encrypted backups. * Encrypt, transfer, download and retain multipart backups as one logical backup set. * Cache source-size estimates persistently and refresh them in background after WordPress content and extension changes. * Respect the host PHP execution limit and record runtime capabilities in diagnostics. #### 3.1.122 * Bound repeated worker crashes and archive rebuilds, preserve valid ZIP checkpoints on retry, and report worker delays. * Add downloadable backup timings and reduce compression work for already-compressed media. #### 3.1.8 * Show Check connection only after Google Drive is connected, replacing the confusing Test Google Drive label. #### 3.1.7 * Connect Google Drive through Mozzy without entering developer credentials in WordPress. * Create or select a backup destination folder and preserve Advanced Google application setup. * Keep backup uploads direct and explain how managed Google authorization is stored. #### 3.1.6 * Explain connection and inventory failures with transport or HTTP error details. * Allow 15 seconds for manual connection tests and inventory uploads. * Distinguish enabled monitoring from confirmed uploads and website availability. #### 3.1.5 * Let connected maintenance requests update directly or create a verified backup first. * Keep backups enabled by default for existing update requests. #### 3.1.4 * Start requested maintenance scans through a signed, on-demand wake-up instead of waiting for the next scheduled heartbeat. * Reject expired and replayed wake-ups, rate-limit requests, and prevent concurrent remote inventory scans. * Keep the existing heartbeat as a fallback when the wake-up cannot reach WordPress. #### 3.1.3 * Check for maintenance commands every 30 seconds while an administrator is active in WordPress. Background checks remain every five minutes. #### 3.1.2 * Let Mozzy request a fresh authenticated software inventory before maintenance verification. * Deduplicate remote inventory commands and retry them safely when a sync fails. #### 3.1.1 * Store new local backups under the WordPress uploads directory while retaining read access to legacy archives. * Require explicit object-storage endpoint entry and clarify the optional Amazon S3 account requirements, transmitted data, and activation behavior. * Document installation-root access required for full-site backup, restore, and WordPress core health checks. * Clarify Maintenance Autopilot commands, automatic rollback, manual restore confirmation, and maintenance status data sent to Mozzy. #### 3.1.0 * Added Maintenance Autopilot rollback using the exact verified pre-update archive. * Added a failed-state safety backup, resumable restore progress, and post-rollback verification reporting. #### 3.0.0 * Add authenticated Maintenance Autopilot commands with exact-version approval. * Report backup-gated update progress and results to the Mozzy maintenance record. #### 2.9.3 * Document the live schema reads required to export database structures without stale cache data. * Document the intentional installation-root write performed by an administrator- approved guided restore. #### 2.9.2 * Resolve all errors and warnings reported by the official WordPress Plugin Check rules. * Use WordPress file-deletion APIs and document necessary resumable streaming operations. * Strengthen input sanitization and OAuth redirect validation. #### 2.9.1 * Load administration CSS and JavaScript through the WordPress enqueue API. * Improve compatibility with custom uploads and content-directory locations. * Confirm request authorization checks and external-service disclosures for WordPress. org review. #### 2.9.0 * Add optional Mozzy-managed backup schedules, including monthly and three-month intervals. * Accept idempotent remote backup requests through the existing authenticated heartbeat. * Report throttled backup progress and terminal results without sending archives or credentials. * Keep destination credentials, encryption keys, emergency controls and restores in WordPress. #### 2.8.1 * Replace the generic WordPress shield menu icon with the Mozzy brand mark. #### 2.8.0 * Move Mozzy Assistance from Tools into its own top-level WordPress admin menu. * Add dedicated Overview and Backups child pages. * Keep backup, recovery, encryption, and protected-update workflows together on the Backups page. * Correct the Mozzy brand mark alignment in the administration header. #### 2.7.0 * Add optional authenticated XChaCha20-Poly1305 backup encryption using PHP sodium. * Encrypt and authenticate large archives in resumable, independently verified chunks. * Add offline recovery-key generation, protected key storage, import, export, and rotation. * Retain previous keys so encrypted archives remain restorable after rotation. * Add resumable authenticated decryption before guided restore begins destructive stages. * Remove plaintext working archives after encryption and decrypted staging files after restore. * Introduce the .mzb encrypted container while retaining full legacy ZIP compatibility. * Block encryption when secure sodium support or a recovery key is unavailable. #### 2.6.0 * Add provider-neutral remote backup catalogue and recovery contracts. * Browse Mozzy-created Google Drive backups from the WordPress administration page. * Download large remote archives in resumable background chunks with retry and cancellation controls. * Add SHA-256 and site-identity metadata to new Google Drive backups. * Verify remote MD5 metadata, SHA-256, ZIP integrity, and same-site identity before enabling guided restore. * Clean partial recovery files safely and preserve verified copies under normal local retention. #### 2.5.0 * Add administrator-approved protected updates for plugins, themes, and WordPress core. * Require a new verified safety backup and successful connected remote upload before updating. * Apply approved updates one at a time in a recoverable background queue. * Verify installed target versions, refresh Mozzy inventory, and run post-update health checks. * Preserve the safety archive as an explicit rollback source when an update or health check fails. #### 2.4.0 * Add guided restore for verified, same-site local backups. * Create and verify a fresh safety backup before restoration begins. * Restore files and database statements in resumable background batches. * Protect wp-config.php and the active Mozzy recovery runner during file restoration. * Add path traversal protection, guarded cancellation, maintenance responses, retries, and post-restore health checks. #### 2.3.0 * Build database and file archives in resumable WP-Cron batches. * Persist backup progress across requests and recover stalled jobs automatically. * Add live progress, continue-now and safe cancellation controls. * Retry failed stages three times and remove partial files after cancellation or failure. #### 2.2.0 * Add manual and scheduled full-site backups with protected local storage. * Add direct Google Drive OAuth and resumable, chunked uploads. * Add archive verification, SHA-256 checksums, execution locking, history, and retention. * Add an extensible destination-provider contract for future storage services. #### 2.1.2 * Keep notices from other WordPress plugins outside the Mozzy Assistance hero. #### 2.1.1 * Refresh WordPress update information before inventory scans and support third- party update payload formats. #### 2.1.0 * Include available WordPress, theme and plugin versions in inventory scans. #### 2.0.0 * Add secure one-click account pairing with PKCE. * Store connection credentials in WordPress instead of plugin files. * Start monitoring only after explicit administrator approval. ## Meta * Version **3.2.0** * Last updated **11 hours ago** * Active installations **10+** * WordPress version ** 6.0 or higher ** * Tested up to **7.1** * PHP version ** 7.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/mozzy-assistance/) * Tags * [backup](https://li.wordpress.org/plugins/tags/backup/)[google drive](https://li.wordpress.org/plugins/tags/google-drive/) [health check](https://li.wordpress.org/plugins/tags/health-check/)[monitoring](https://li.wordpress.org/plugins/tags/monitoring/) [wordpress maintenance](https://li.wordpress.org/plugins/tags/wordpress-maintenance/) * [Advanced View](https://li.wordpress.org/plugins/mozzy-assistance/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/mozzy-assistance/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/mozzy-assistance/reviews/) ## Contributors * [ mozzzy ](https://profiles.wordpress.org/mozzzy/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/mozzy-assistance/)