Find leftover backup files on every client site
For agencies and freelancers who run client sites with MainWP. One table shows every backup file on every site and which ones anyone can download. You clean them up in a few clicks.
Full refund any time before delivery. Target delivery 31 January 2027.
| Site | File | Made by | Size | Public |
|---|---|---|---|---|
| Client store 3 | monthly.tar | BackWPup | 38.4 GB | Yes |
| Oak Street Vets | monthly.tar | BackWPup | 22.1 GB | Yes |
| Riverside Dental | site.wpress | All-in-One WP Migration | 6.2 GB | Yes |
| Client site 12 | old-site.zip | Unknown | 1.1 GB | No |
| Maple Bakery | db.gz | UpdraftPlus | 0.4 GB | No |
BackWPup's job list changed after last night's update:
The new file is in /wp-content/uploads and its URL is public.
Three steps, all from your MainWP dashboard
You don't need to log in to each site.
Add the free child plugin
Install it on your sites from MainWP. It looks for .zip, .tar, .gz, .sql and .wpress files in each site's web root.
See everything in one table
Each file shows its size, age, the plugin that probably made it, and whether anyone can download it.
Clean up and get alerts
Delete, move or block files in bulk. Korenda checks again every day and emails you when something new turns up.
Backup files pile up where you can't see them
They eat disk space
BackWPup, UpdraftPlus, Duplicator and All-in-One WP Migration keep backup files inside wp-content. On every client site, they fill up the disk and your own backups.
Some are public
A backup file can hold the whole site and its database. BackWPup's CVE-2026-86826, fixed in version 5.7.7, exposed backup files on servers that ignore .htaccess.
You check one site at a time
Wordfence flags some of these files, but only per site. The MainWP BackWPup add-on also manages backups one site at a time.
With 50 client sites, nobody has time to check each one, so the files keep growing.
What v1 will and won't do
v1 will
- Scan each site. The free child plugin finds .zip, .tar, .gz, .sql and .wpress files in the web root.
- Show one table. Size, age, the plugin that probably made it, and a check of whether the file can be downloaded publicly.
- Filter. By public files, files over a size you choose, files older than a number of days, or by plugin.
- Clean up in bulk. Delete, move outside the web root, or add rules that block downloads. Nothing happens until you click.
- Alert you. A daily scan, with an email when a new file appears or a BackWPup job list changes after an update.
- Sum up your week. A weekly email with GB freed and public files still left.
v1 will not
- Delete or move anything on its own
- Make or restore backups
- Check remote storage like S3 or Dropbox
- Work with WP Umbrella or as a separate web app
The plugin guesses which plugin made a file from its folder and file name, so some files will show as "Unknown".
Half price for your first year
Pre-order now and help decide what goes into v1. If it isn't built, you get your money back.
Good fit: you run 10 to 200 client sites in MainWP, and some of them use BackWPup or other backup plugins.
Not a fit: you don't use MainWP, or you only manage one or two sites. The free child plugin may be enough for you.
Founding licence
$39/ first year, up to 25 sites
Regular price $79/year for up to 25 sites. Unlimited sites will be $149/year.
- Korenda MainWP extension, year one
- Free Korenda child plugin
- Daily scans, alerts and weekly email
Pre-order terms
- The product is not built yet.
- Target delivery: 31 January 2027.
- Full refund on request any time before delivery. No questions asked.
- Automatic full refund if it isn't delivered by 31 January 2027.
- Full refund within 14 days after delivery if it doesn't work on your setup.
- One $39 charge. Nothing renews on its own. We'll ask you before any renewal.
Payment is handled by Stripe on a secure checkout page.
Not ready to pay? Get notified.
Questions
Does it work without MainWP?
Partly. The free child plugin is planned to scan single sites on its own. The table that covers all your sites needs MainWP.
Will it delete client files on its own?
No. It only finds and reports files. Nothing is deleted, moved or blocked until you click.
Which servers does it support?
Apache and Nginx. The public check simply tries to open each file's URL over HTTP, the way a stranger would.
What if it never ships?
You get a full automatic refund if it isn't delivered by 31 January 2027. You can also ask for a refund any time before then.
Who is behind this?
Georgi Dimitrov, a solo developer in Bulgaria, trading as Korenda. Email [email protected]. The postal address is in the footer.
Who's behind it
I'm Georgi Dimitrov, a solo developer in Bulgaria, building this as Korenda. I'm taking pre-orders to see if agencies will pay before I spend months building it. Questions or ideas? Write to [email protected]. I read every email.
Privacy
If you pre-order, Stripe handles your payment details. We only keep the email you use and your order record. If you join the notify list, we only keep your email.
This page uses Cloudflare Web Analytics, which sets no cookies.
Korenda is not affiliated with or endorsed by MainWP, BackWPup/WP Media, Wordfence/Defiant, UpdraftPlus, Duplicator or ServMask. Product names are used only to describe compatibility.