Plekt is designed to run on hardware you control.

Treat the local data volume, admin credentials, provider tokens, and webhook secret as valuable operational data.

Plekt dashboard overview for a locally operated instance
Routine operations protect the instance behind the app: its archive, connections, backups, and maintenance tools.

Backups

Plekt supports two local backup families:

  • Watch-history backups include history, playstate, and resume markers.
  • Full Plekt backups are encrypted and include settings, keys, credentials, history, Watchlist, Ratings, Playlists, and other instance state.

Each has its own schedule, retention, and Back Up Now action.

The remote backup option can mirror either type to Backblaze B2 on its own schedule.

Watch-history snapshots that Plekt takes as a safety net before an import or sync are kept for at least seven days, even when the retention count would otherwise remove them. One backup file that is locked or cannot be removed no longer stops the rest of the old backups from being cleaned up.

Plekt Local backups settings showing watch-history and encrypted instance backup controls
Local backups separates the watch-history archive from the encrypted full-instance backup.
Plekt Remote backups settings showing the Backblaze B2 destination controls
Remote backups sends the selected backup family to an enabled Backblaze B2 destination.

For scheduled encrypted backups, provide a passphrase of at least 12 characters and enable Remember the passphrase for scheduled backups.

A scheduled job cannot stop to ask a human for a passphrase.

Store the passphrase separately from the backup file.

Full Plekt backup/export includes the canonical Watchlist and its non-secret Plex sync state. Restoring it invalidates remote observations and requires another safe-union snapshot before delivery resumes. Watch-history-only backups do not include Watchlist or personal rating data.

The Watch History backup status reports running or failed restores. Automated sync waits while a restore is active; Plekt automatically recovers stale operation locks after an interruption so playback tracking and history updates can resume. Review the reported error before retrying, and use Clear Status only when no restore is still running. Manual watched-status edits remain available. See Restore.

Restore safely

Plekt Restore settings showing watch-history restore scope and merge or replace controls
Restore makes the watch-history scope and merge-versus-replace choice explicit before confirmation.

Before restoring:

  1. Check whether the file is a watch-history backup or a full encrypted backup.
  2. Make a fresh backup of the current instance.
  3. Choose Merge or Replace deliberately.
  4. Review the preview and confirm the scope.
  5. Keep the original backup file until the result has been verified.
  6. Open Sync Activity and check a few known titles on each connected server.

A restore changes local state and may queue follow-up sync work.

Restoring a full Plekt backup saves a recovery copy of your current database first, and only the install administrator can restore or upload a backup (uploads are limited to 4 GB). See Restore.

If a server was offline, let it reconnect before deciding that the archive is wrong.

If a bulk operation produced unexpected unwatches, stop making further changes and identify the last good backup first.

Import history

Plekt Trakt connection settings showing the import controls
Trakt history imports start from the Trakt connection card.

Trakt exports can be uploaded from Settings → Connections. Simkl’s first connection offers a reviewable import; see Simkl.

Live Trakt sync can then remain connected for ongoing changes.

The Plex history export script is useful when bootstrapping a fresh deployment or recovering years of history.

Run a dry run before a write pass.

For a newly connected or rebuilt library, use import followed by a deliberate full sync when you want the current Plekt archive replayed to that server.

Do not use a full sync as the first response to an unexplained mismatch.

Inspect the destination result first.

Routine maintenance

Once a week or after an upgrade:

  • confirm the /data volume is mounted and writable;
  • check the scheduled backup result and retention;
  • open the dashboard and confirm recent activity is still visible;
  • review failed or partial rows in Sync Activity;
  • check provider keys and rate-limit errors if artwork is missing; and
  • keep one known-good restore point before changing release channels.

Plekt also tidies its own disk use. Diagnostic log files are kept for 14 days, artwork files that no record refers to any more are removed daily, and the database’s write-ahead log file is trimmed so it stops growing without limit. You do not need to clean these up by hand.

Security basics

Plekt General Account settings showing administrator credential controls
Security begins with the administrator account, then extends to the data volume, network, and integration secrets.
  • Use a unique administrator password and keep it out of source control.
  • Keep data/ on persistent storage with permissions appropriate to the host.
  • Put remotely reachable instances behind HTTPS or a VPN/reverse proxy.
  • Set COOKIE_SECURE=true when serving through HTTPS.
  • Treat API keys, webhook secrets, Trakt tokens, and the optional credential-vault key as secrets. Rotate them when exposure is suspected.
  • Keep the webhook URL private because the token may be in its query string.
  • Remove private-list titles and runtime/build details before sharing screenshots or logs.

Plekt applies password hashing, signed sessions, rate limits, security headers, and authenticated routes. Logging out ends that session for good, even after a restart. Changes sent from another website or an untrusted origin are rejected, while Plekt’s own pages and server-to-server callers such as webhooks keep working. Redirects to another site do not carry your tokens, API keys, or request bodies with them.

These controls reduce risk.

They do not replace host, network, or media-server security.

Updates and release channels

Plekt Settings landing page used to confirm the running release
After an update, confirm the installed version in the About card and check the operational views.

The recommended Docker tag is latest, which follows tested releases on main.

alpha is for early testers, and develop is the least-tested rolling channel for contributors.

Back up before changing release channels or upgrading the container.

After an update, check the app version in Settings → About, open the dashboard, and review Sync Activity for unexpected failures.

PWA and local operation

Plekt is installable as a Progressive Web App on supported desktop and mobile browsers.

The browser is a client to your self-hosted instance.

The scheduler and provider requests still run on the Plekt host.

Review the Settings groups or start with troubleshooting.