New to the community? Start here

[Snapshot Pro] Ability to use plugins without Whitelisting IPs

0

For security reasons, both clients, and other hosting providers I work with, refuse to whitelist external IPs. There’s nothing I can do about it, and some clients want to use their hosting.

Defender v3 used to have the option to create external backups without having to use your incremental backup service – but for some (stupid) reason, you retired it.

I need a way to create backups on at least 1-2 more destinations, without being connected to your server.

Smush also requires whitelisting IPs.

Neither plugins like TinyPng nor Updraft require whitelisting IPs – and yet they get the job done.

I’m already a paying customer – why can’t I use the plugins like normally? Why am I forced to install competitor plugins or loose out on a client?

I’m not going to brute force and arm wrestle a client to use WPMUdev’s hosting if it’s not what they need or want.

And I respect that some clients don’t want to take ANY risks with their servers so pragmatically refuse to whitelist any IPs. Plugins should work without this security risk. And we as customers should have the option to connect to your servers or not to – but we should not be forced to. WordPress is all about data democracy anyways.

Also – what if you have a server failure? Does that mean that every single site that is FORCED to connect to your servers to create ANY backups – won’t get backed up at all? Will the plugin just totally skip that backup, and leave people without the day/week/month backup?

Why even risk letting that happen? It’s stupid to be confident that your servers and services will always be available and active. People choose WordPress to be in control of their data, and plugins should have the ability to work independently.

Now – I know this is probably a niche request – and might never be implemented – but please seriously consider adding an option for people to turn off Incremental backups, to allow backing up to another destination without having to whitelist IPs or be locked into your server.

Fri, 23 Feb 2024 4:13:41
More Snapshot Pro discussions
Snapshot Pro
  • Adam
    • Support Gorilla

    Hi Alex

    I hope you’re well today and thank you for your feedback!

    I understand your concerns and about that but allowing IPs is only necessary on some sites/environments where they fall under some sort of firewall. I can tell from years of experience with our plugins/services that in fact in majority of cases they work out of the box without the need to change such settings.

    But of course I understand your point and there are many sites where allowing IPs is necessary. There currently is no way to change it easily as there is a need to connect with our API and it needs to be able to do incoming connections to the site.

    While it is not necessary for all the features (majority of features of the free versions of our plugins would work without API connection), for features such as backups and for some Pro-only features access to API is necessary.

    We do put uttermost care to make it safe and secure on our end.

    As for some specific aspects that you raised:

    1. the way Snapshot works was changed mainly due ot many requests for it to do incremental backups and provide different way than most of other backup plugins do

    2. you can still export backups created by Snapshot to any external location (such as Google Drive, S3 compatible storage or just FTP) and restore it even if you don’t have access to the Hub; or even if you no longer are WPMU DEV Member at all – provided that you still have backup files; they don’t use any internal data format and can easily be simply extracted (like any other zip file) and restored manually – if necessary

    3. Smush uses optimization app in our cloud so it needs to be able to access it as well

    But also:

    And I respect that some clients don’t want to take ANY risks with their servers so pragmatically refuse to whitelist any IPs. Plugins should work without this security risk

    Surely this is understandable but also a bit too strict. Whether you want it or not, it’s not only our plugins – more and more complex plugins require connection to external services and that is something that is and will be happening because it helps maintain compatibility, speed up development, actually increase security (we need to focus on safety of data on a specific single environment over which we have full control instead of trying to predict each and every possible scenario of thousands of sites’ configurations types etc) and address constantly growing resources needs.

    Jetpack? Many page builders and premium themes? Nitropack? – to name just a few… all need some sort of constant connection to external services. Sometimes it’s just not that “openly stated” as in our case.

    ——

    Making everything work without the need for API connection would require complete change of most of the plugins and services – and I mean complete, pretty much creating most of them from scratch, totally differently and with a totally different business model as well.

    It’s a very valuable feedback and thank you for sharing it. This space is closely watched by our Project Managers and developers and they’ll be made aware of it. However, it really may be rather difficult to change everything to not have to use API and where there’s a need to use API there may be a need to allow some IPs connections, I’m afraid. Not only for our plugins and services.

    Kind regards,
    Adam