Mozzy Assistance connects a WordPress website to the Mozzy monitoring service.\nA Mozzy account is required for hosted monitoring and remote management. Local backups, downloads and restoration remain available without an account. To connect, open Mozzy > Overview and\nselect Connect to Mozzy. Sign in, choose or create a project, and approve the\nwebsite. WordPress exchanges a short-lived authorization code directly with\nMozzy; the permanent connector token is never placed in a browser URL.<\/p>\n\n
The plugin contacts https:\/\/mozzy.au to authorize the connection and send the\nmonitoring information described in the Privacy section. Nothing is sent until\nan administrator approves or manually configures a connection.<\/p>\n\n
Mozzy Assistance can also create complete database and file archives, retain\nprotected local copies, and upload them directly to a Google Drive account using\nGoogle's least-privilege drive.file permission. Backup contents upload directly\nto Google. With easy connection, Mozzy securely manages Google authorization.\nAdvanced setup can keep your own Google application credentials in WordPress.<\/p>\n\n
Administrators can instead send backups directly to Backblaze B2, Amazon S3,\nCloudflare R2, Wasabi, DigitalOcean Spaces, or another service with an\nS3-compatible HTTPS endpoint. Credentials and archive contents are sent directly\nfrom WordPress to the destination selected and configured by the administrator;\nthey never pass through Mozzy.<\/p>\n\n
Protected updates let an administrator select pending plugin, theme, and\nWordPress core updates. Mozzy Assistance creates and verifies a new full safety\nbackup first, requires any connected remote upload to succeed, applies updates\none at a time, refreshes inventory, and runs database and filesystem checks.\nNormal WordPress automatic updates are not intercepted.<\/p>\n\n
Maintenance Autopilot lets an authorized Mozzy user approve specific update\nversions in Mozzy. The connected plugin receives those maintenance commands in\nheartbeat responses and performs the same backup-gated updates locally. If\npost-update verification fails, Mozzy can request an automatic rollback using\nthe verified pre-update archive. WordPress creates a failed-state safety backup\nbefore restoring that archive; this rollback does not require a separate\nconfirmation in WordPress.<\/p>\n\n
Remote recovery can browse Mozzy-created Google Drive, Backblaze B2, and\nS3-compatible archives and download a selected copy into protected local storage\nin resumable chunks. Transport and archive checks run before the existing\nexplicit guided-restore confirmation is enabled.<\/p>\n\n
Optional encrypted backups use authenticated XChaCha20-Poly1305 chunks in a\nMozzy .mzb container. Encryption and decryption are resumable, plaintext working\narchives are removed after encryption, and weak cryptographic fallbacks are not\nused. Administrators can export offline recovery-key files and rotate to a new\nkey while retaining previous keys for older archives. Existing ZIP archives\nremain fully supported.<\/p>\n\n
New backups contain a small manifest archive and numbered component parts. Keep\nall files in a set together: the manifest alone cannot restore the website.\nRecent backups offers separate downloads for the manifest and every part.\nConnected cloud destinations receive the parts before the final manifest.<\/p>\n\n
The plugin contacts https:\/\/mozzy.au only after an administrator connects the\nsite or manually saves a connector token. It sends the monitoring and backup\nstatus and maintenance progress listed in the Privacy section to provide the\nMozzy monitoring and maintenance service. Heartbeat responses can contain managed\nbackup settings and requests, approved maintenance updates, or automatic rollback\ncommands as described in the FAQ. Easy Google Drive connection also sends authorization\nrequests and the selected folder ID\/name to Mozzy. Mozzy stores an encrypted Google\nrefresh token and issues short-lived access tokens to the authenticated website.\nMozzy does not receive backup archives, object-storage secrets, or recovery keys.<\/p>\n\n
When you submit Contact Mozzy, your topic, message and reply email are saved in\nMozzy's support inbox and linked to your connected project. An email notification\nis sent by Mozzy, not by WordPress. WordPress, PHP and Mozzy version numbers are\nincluded only if you select the optional technical-details checkbox.<\/p>\n\n
Mozzy privacy policy: https:\/\/mozzy.au\/privacy\nMozzy terms: https:\/\/mozzy.au\/terms<\/p>\n\n
After an administrator selects Connect Google Drive, Mozzy handles Google consent\nand folder selection. Authorization codes and tokens pass through Mozzy; backup\nfiles upload directly from WordPress to Google. Disconnect removes this website's\nMozzy grant without deleting Drive files or disconnecting other websites. You can\nalso revoke Mozzy in your Google account permissions.<\/p>\n\n
Advanced setup uses your own Google application with tokens held in WordPress.\nBoth modes use\nhttps:\/\/accounts.google.com for authorization, https:\/\/oauth2.googleapis.com for\nOAuth token exchange and revocation, and https:\/\/www.googleapis.com for Drive\nfile operations. OAuth identifiers, authorization codes, access and refresh\ntokens, backup archives, filenames, sizes, checksums, and plugin-created folder\nmetadata are sent directly to Google as required to store, list, download, and\nremove retained backups in the administrator's Drive account.<\/p>\n\n
Google privacy policy: https:\/\/policies.google.com\/privacy\nGoogle terms: https:\/\/policies.google.com\/terms<\/p>\n\n
The plugin contacts an object-storage service only after an administrator saves\nits HTTPS endpoint and credentials. It sends signed S3 API requests, the access\nkey identifier, backup archives, filenames, sizes, and storage metadata directly\nto that endpoint to test the connection and to store, list, download, and remove\nretained backups. The secret key remains stored encrypted in WordPress and is\nused locally to sign requests. Supported services include Backblaze B2, Amazon\nS3, Cloudflare R2, Wasabi, DigitalOcean Spaces, and other administrator-selected\nS3-compatible services. Use of a configured service is governed by that\nprovider's terms and privacy policy.<\/p>\n\n
For Amazon S3, the standard API endpoint is https:\/\/s3.amazonaws.com. An Amazon\nWeb Services account, an S3 bucket, an access key ID, and a secret access key are\nrequired. Administrators must explicitly enter their provider's HTTPS endpoint;\nthe plugin does not prefill or contact one merely by being activated or viewed.\nRequests begin only after an administrator saves the destination and explicitly\ntests it or runs a backup, recovery, retention, or restore operation. This is an\noptional storage API integration, not a source of remotely loaded JavaScript,\nCSS, images, fonts, or executable code.<\/p>\n\n
Backblaze privacy: https:\/\/www.backblaze.com\/company\/policy\/privacy\nBackblaze terms: https:\/\/www.backblaze.com\/company\/policy\/terms-of-service\nAWS privacy: https:\/\/aws.amazon.com\/privacy\/\nAWS service terms: https:\/\/aws.amazon.com\/service-terms\/\nCloudflare privacy: https:\/\/www.cloudflare.com\/privacypolicy\/\nCloudflare terms: https:\/\/www.cloudflare.com\/terms\/\nWasabi privacy: https:\/\/wasabi.com\/legal\/privacy-policy\nWasabi terms: https:\/\/wasabi.com\/legal\/terms-of-use\nDigitalOcean privacy: https:\/\/www.digitalocean.com\/legal\/privacy-policy\nDigitalOcean terms: https:\/\/www.digitalocean.com\/legal\/terms-of-service-agreement<\/p>\n\n
When connected and enabled, the plugin sends data to https:\/\/mozzy.au. Data can\ninclude health heartbeats; WordPress, PHP, theme and plugin names and versions;\nactive plugin status; fatal error messages, file locations, line numbers and the\naffected URL; database error messages; backup state, progress, filenames, sizes\nand destination labels; maintenance command identifiers, update and rollback\nprogress, results and backup filenames; failed email events; and supported\nscheduled-task failures.<\/p>\n\n
The plugin does not intentionally send passwords, cookies, form contents,\ndatabase records, WordPress users, visitor IP addresses, backup archives, object-storage\ncredentials or recovery keys. Easy Google Drive connection stores encrypted Google\nauthorization credentials and destination metadata on Mozzy. Review Mozzy's privacy policy at\nhttps:\/\/mozzy.au\/privacy and terms at https:\/\/mozzy.au\/terms.<\/p>\n\n\n
Administrators can alternatively paste a connector token from Mozzy. Monitoring\ncan be paused and local credentials can be removed from the settings page.<\/p>\n\n
Verified local backups can be restored from Mozzy > Backups. Manual\nguided restore requires explicit administrator confirmation, creates a fresh safety\nbackup first, preserves wp-config.php and the active Mozzy recovery component,\nrestores in background batches, and finishes with database and filesystem checks.<\/p>\n\n
Connecting to Mozzy activates this website against its project using a private\nconnection token. Each project can activate one WordPress website. Your account's\nproject allowance controls new activations. Existing connections remain active\nwhen a plan limit is lowered. Remove a connection in Mozzy to revoke its token;\ndisconnecting in WordPress removes the local credentials. Local backup and restore\nfeatures remain available without a Mozzy activation. Activation status and plan\nallowances refresh with successful monitoring heartbeats. Existing clients remain\ncompatible; upgrading adds website-URL checks to monitoring requests.<\/p>\n\n\n
Only after a WordPress administrator approves the connection or saves a connector\ntoken. Deactivating the plugin stops its scheduled events. The connection can also\nbe paused or disconnected from Mozzy > Overview.<\/p><\/dd>\n
When an administrator enables managed backups, Mozzy can supply the schedule,\nretention and backup preset and request a new backup through the authenticated\nheartbeat. WordPress performs every backup locally and uploads directly to the\nconfigured destination.<\/p>\n\n
Maintenance Autopilot also lets an authorized Mozzy user approve specific plugin,\ntheme, and WordPress core update versions. Mozzy sends these limited maintenance\ncommands through heartbeat responses. WordPress checks that the requested\nversions are still available and creates and verifies a full safety backup before\napplying updates; connected remote backup uploads must also succeed.<\/p>\n\n
If post-update verification fails, Mozzy can request an automatic rollback using\nthe verified pre-update archive. WordPress validates that archive against its\nprotected-update history and creates a failed-state safety backup before\nrestoring it. Automatic rollback does not require a separate confirmation in\nWordPress. Manual guided restores still require explicit confirmation from a\nlogged-in WordPress administrator.<\/p>\n\n
These commands are limited to the plugin's backup, update, and rollback workflows;\nthey do not provide a general-purpose remote shell or arbitrary file editor.\nRecovery keys and object-storage credentials remain in WordPress. Easy Google Drive\nconnection keeps the Google refresh token encrypted on Mozzy; WordPress requests\nshort-lived access for direct uploads. Advanced Google setup keeps its credentials\nin WordPress. Recovery keys and archives are not sent to Mozzy. Any archive\ndecryption required for restoration happens locally.<\/p><\/dd>\n
Mozzy cannot decrypt the archive and does not receive a copy of the key. Download\nand securely retain every recovery-key file, including older keys kept after a\nrotation. Importing the matching key makes its encrypted archives restorable.<\/p><\/dd>\n\n<\/dl>\n\n\n