diff --git a/admin/actions.php b/admin/actions.php
index 532d7c35..6ff1aa54 100755
--- a/admin/actions.php
+++ b/admin/actions.php
@@ -185,7 +185,7 @@ function edit_schedule_services_submit() {
 	check_admin_referer( 'hmbkp-edit-schedule-services', 'hmbkp-edit-schedule-services-nonce' );
 
 	if ( empty( $_POST['hmbkp_schedule_id'] ) ) {
-		wp_die( __( 'The schedule ID was not provided. Aborting.', 'backupwordpress' ) );
+		wp_die( esc_html__( 'The schedule ID was not provided. Aborting.', 'backupwordpress' ) );
 	}
 
 	$schedule = new Scheduled_Backup( sanitize_text_field( $_POST['hmbkp_schedule_id'] ) );
@@ -633,13 +633,51 @@ function ajax_cron_test() {
 
 	if ( is_wp_error( $response1 ) && is_wp_error( $response2 ) && is_wp_error( $response3 ) ) {
 
-		echo '<div id="hmbkp-warning" class="updated fade"><p><strong>' . __( 'BackUpWordPress has detected a problem.', 'backupwordpress' ) . '</strong> ' . sprintf( __( '%1$s is returning a %2$s response which could mean cron jobs aren\'t getting fired properly. BackUpWordPress relies on wp-cron to run scheduled backups. See the %3$s for more details.', 'backupwordpress' ), '<code>wp-cron.php</code>', '<code>' . $response1->get_error_message() . '</code>', '<a href="http://wordpress.org/extend/plugins/backupwordpress/faq/">FAQ</a>' ) . '</p></div>';
+		echo '<div id="hmbkp-warning" class="updated fade"><p>';
+
+		printf(
+			wp_kses(
+				/* translators: 1: wp-cron.php 2: Error messages 3: URL to plugin's FAQ page in wordpress.org plugin directory */
+				__( '<strong>BackUpWordPress has detected a problem.</strong> %1$s is returning a %2$s response which could mean cron jobs aren\'t getting fired properly. BackUpWordPress relies on wp-cron to run scheduled backups. See the <a href="%3$s">FAQ</a> for more details.', 'backupwordpress' ),
+				array(
+					'strong' => array(),
+					'code'   => array(),
+					'a'      => array(
+						'href' => array(),
+					),
+				)
+			),
+			'<code>wp-cron.php</code>',
+			'<code>' . esc_html( $response1->get_error_message() ) . '</code>',
+			'http://wordpress.org/extend/plugins/backupwordpress/faq/'
+		);
+
+		echo '</p></div>';
 
 		update_option( 'hmbkp_wp_cron_test_failed', true );
 
 	} elseif ( ! in_array( 200, array_map( 'wp_remote_retrieve_response_code', array( $response1, $response2, $response3 ) ) ) ) {
 
-		echo '<div id="hmbkp-warning" class="updated fade"><p><strong>' . __( 'BackUpWordPress has detected a problem.', 'backupwordpress' ) . '</strong> ' . sprintf( __( '%1$s is returning a %2$s response which could mean cron jobs aren\'t getting fired properly. BackUpWordPress relies on wp-cron to run scheduled backups, and more generally relies on HTTP loopback connections not being blocked for manual backups. See the %3$s for more details.', 'backupwordpress' ), '<code>wp-cron.php</code>', '<code>' . esc_html( wp_remote_retrieve_response_code( $response1 ) ) . ' ' . esc_html( get_status_header_desc( wp_remote_retrieve_response_code( $response1 ) ) ) . '</code>', '<a href="http://wordpress.org/extend/plugins/backupwordpress/faq/">FAQ</a>' ) . '</p></div>';
+		echo '<div id="hmbkp-warning" class="updated fade"><p>';
+
+		printf(
+			wp_kses(
+				/* translators: 1: wp-cron.php 2: Error messages 3: URL to plugin's FAQ page in wordpress.org plugin directory */
+				__( '<strong>BackUpWordPress has detected a problem.</strong> %1$s is returning a %2$s response which could mean cron jobs aren\'t getting fired properly. BackUpWordPress relies on wp-cron to run scheduled backups, and more generally relies on HTTP loopback connections not being blocked for manual backups. See the <a href="%3$s">FAQ</a> for more details.', 'backupwordpress' ),
+				array(
+					'strong' => array(),
+					'code'   => array(),
+					'a'      => array(
+						'href' => array(),
+					),
+				)
+			),
+			'<code>wp-cron.php</code>',
+			'<code>' . esc_html( wp_remote_retrieve_response_code( $response1 ) . ' ' . get_status_header_desc( wp_remote_retrieve_response_code( $response1 ) ) ) . '</code>',
+			'http://wordpress.org/extend/plugins/backupwordpress/faq/'
+		);
+
+		echo '</p></div>';
 
 		update_option( 'hmbkp_wp_cron_test_failed', true );
 
diff --git a/admin/backups-table.php b/admin/backups-table.php
index 9b6c243b..1b36cd0c 100644
--- a/admin/backups-table.php
+++ b/admin/backups-table.php
@@ -11,9 +11,9 @@
 		<tr>
 
 			<th scope="col"><?php backups_number( $schedule ); ?></th>
-			<th scope="col"><?php _e( 'Size', 'backupwordpress' ); ?></th>
-			<th scope="col"><?php _e( 'Type', 'backupwordpress' ); ?></th>
-			<th scope="col"><?php _e( 'Actions', 'backupwordpress' ); ?></th>
+			<th scope="col"><?php esc_html_e( 'Size', 'backupwordpress' ); ?></th>
+			<th scope="col"><?php esc_html_e( 'Type', 'backupwordpress' ); ?></th>
+			<th scope="col"><?php esc_html_e( 'Actions', 'backupwordpress' ); ?></th>
 
 		</tr>
 
@@ -38,7 +38,7 @@
 		else : ?>
 
 			<tr>
-				<td class="hmbkp-no-backups" colspan="4"><?php _e( 'This is where your backups will appear once you have some.', 'backupwordpress' ); ?></td>
+				<td class="hmbkp-no-backups" colspan="4"><?php esc_html_e( 'This is where your backups will appear once you have some.', 'backupwordpress' ); ?></td>
 			</tr>
 
 		<?php endif; ?>
diff --git a/admin/backups.php b/admin/backups.php
index 0a92aaee..a858ba82 100644
--- a/admin/backups.php
+++ b/admin/backups.php
@@ -23,7 +23,7 @@
 
 		<?php endforeach; ?>
 
-		<li><a href="<?php echo esc_url( add_query_arg( array( 'hmbkp_add_schedule' => '1', 'action' => 'hmbkp_edit_schedule', 'hmbkp_schedule_id' => time(), 'hmbkp_panel' => 'hmbkp_edit_schedule_settings' ), HMBKP_ADMIN_URL ) ); ?>" class="<?php if ( ! Schedules::get_instance()->get_schedule( $current_schedule->get_id() ) ) { ?> current<?php } ?>"> + <?php _e( 'add schedule', 'backupwordpress' ); ?></a></li>
+		<li><a href="<?php echo esc_url( add_query_arg( array( 'hmbkp_add_schedule' => '1', 'action' => 'hmbkp_edit_schedule', 'hmbkp_schedule_id' => time(), 'hmbkp_panel' => 'hmbkp_edit_schedule_settings' ), HMBKP_ADMIN_URL ) ); ?>" class="<?php if ( ! Schedules::get_instance()->get_schedule( $current_schedule->get_id() ) ) { ?> current<?php } ?>"> + <?php esc_html_e( 'add schedule', 'backupwordpress' ); ?></a></li>
 
 	</ul>
 </div>
diff --git a/admin/constants.php b/admin/constants.php
index 330e47ef..a51c49fa 100644
--- a/admin/constants.php
+++ b/admin/constants.php
@@ -17,10 +17,10 @@
 			<td>
 
 				<?php if ( defined( 'HMBKP_PATH' ) ) { ?>
-					<p><?php printf( __( 'You\'ve set it to: %s', 'backupwordpress' ), '<code>' . esc_html( HMBKP_PATH ) . '</code>' ); ?></p>
+					<p><?php whitelist_html( printf( __( 'You\'ve set it to: %s', 'backupwordpress' ), '<code>' . esc_html( HMBKP_PATH ) . '</code>' ), 'code' ); ?></p>
 				<?php } ?>
 
-				<p><?php printf( __( 'The path to the folder you would like to store your backup files in, defaults to %s.', 'backupwordpress' ), '<code>' . esc_html( Path::get_path() ) . '</code>' ); ?> <?php _e( 'e.g.', 'backupwordpress' ); ?> <code>define( 'HMBKP_PATH', '/home/willmot/backups' );</code></p>
+				<p><?php whitelist_html( printf( __( 'The path to the folder you would like to store your backup files in, defaults to %s.', 'backupwordpress' ), '<code>' . esc_html( Path::get_path() ) . '</code>' ), 'code' ); ?> <?php esc_html_e( 'e.g.', 'backupwordpress' ); ?> <code>define( 'HMBKP_PATH', '/home/willmot/backups' );</code></p>
 
 			</td>
 
@@ -33,10 +33,10 @@
 			<td>
 
 				<?php if ( defined( 'HMBKP_MYSQLDUMP_PATH' ) ) { ?>
-					<p><?php printf( __( 'You\'ve set it to: %s', 'backupwordpress' ), '<code>' . esc_html( HMBKP_MYSQLDUMP_PATH ) . '</code>' ); ?></p>
+					<p><?php whitelist_html( printf( __( 'You\'ve set it to: %s', 'backupwordpress' ), '<code>' . esc_html( HMBKP_MYSQLDUMP_PATH ) . '</code>' ), 'code' ); ?></p>
 				<?php } ?>
 
-				<p><?php printf( __( 'The path to your %1$s executable. Will be used for the %2$s part of the back up if available.', 'backupwordpress' ), '<code>mysqldump</code>', '<code>' . __( 'database', 'backupwordpress' ) . '</code>' ); ?> <?php _e( 'e.g.', 'backupwordpress' ); ?> <code>define( 'HMBKP_MYSQLDUMP_PATH', '/opt/local/bin/mysqldump' );</code></p>
+				<p><?php whitelist_html( printf( __( 'The path to your %1$s executable. Will be used for the %2$s part of the back up if available.', 'backupwordpress' ), '<code>mysqldump</code>', '<code>' . __( 'database', 'backupwordpress' ) . '</code>' ), 'code' ); ?> <?php esc_html_e( 'e.g.', 'backupwordpress' ); ?> <code>define( 'HMBKP_MYSQLDUMP_PATH', '/opt/local/bin/mysqldump' );</code></p>
 
 			</td>
 
@@ -49,10 +49,10 @@
 			<td>
 
 				<?php if ( defined( 'HMBKP_ZIP_PATH' ) ) { ?>
-					<p><?php printf( __( 'You\'ve set it to: %s', 'backupwordpress' ), '<code>' . esc_html( HMBKP_ZIP_PATH ) . '</code>' ); ?></p>
+					<p><?php whitelist_html( printf( __( 'You\'ve set it to: %s', 'backupwordpress' ), '<code>' . esc_html( HMBKP_ZIP_PATH ) . '</code>' ), 'code' ); ?></p>
 				<?php } ?>
 
-				<p><?php printf( __( 'The path to your %1$s executable. Will be used to zip up your %2$s and %3$s if available.', 'backupwordpress' ), '<code>zip</code>', '<code>' . __( 'files', 'backupwordpress' ) . '</code>', '<code>' . __( 'database', 'backupwordpress' ) . '</code>' ); ?> <?php _e( 'e.g.', 'backupwordpress' ); ?> <code>define( 'HMBKP_ZIP_PATH', '/opt/local/bin/zip' );</code></p>
+				<p><?php whitelist_html( printf( __( 'The path to your %1$s executable. Will be used to zip up your %2$s and %3$s if available.', 'backupwordpress' ), '<code>zip</code>', '<code>' . __( 'files', 'backupwordpress' ) . '</code>', '<code>' . __( 'database', 'backupwordpress' ) . '</code>' ), 'code' ); ?> <?php esc_html_e( 'e.g.', 'backupwordpress' ); ?> <code>define( 'HMBKP_ZIP_PATH', '/opt/local/bin/zip' );</code></p>
 
 			</td>
 
@@ -65,10 +65,10 @@
 			<td>
 
 				<?php if ( defined( 'HMBKP_EXCLUDE' ) ) { ?>
-					<p><?php printf( __( 'You\'ve set it to: %s', 'backupwordpress' ), '<code>' . esc_html( HMBKP_EXCLUDE ) . '</code>' ); ?></p>
+					<p><?php whitelist_html( printf( __( 'You\'ve set it to: %s', 'backupwordpress' ), '<code>' . esc_html( HMBKP_EXCLUDE ) . '</code>' ), 'code' ); ?></p>
 				<?php } ?>
 
-				<p><?php _e( 'Comma separated list of files or directories to exclude, the backups directory is automatically excluded.', 'backupwordpress' ); ?> <?php _e( 'e.g.', 'backupwordpress' ); ?> <code>define( 'HMBKP_EXCLUDE', '/wp-content/uploads/, /stats/, .svn/, *.txt' );</code></p>
+				<p><?php esc_html_e( 'Comma separated list of files or directories to exclude, the backups directory is automatically excluded.', 'backupwordpress' ); ?> <?php esc_html_e( 'e.g.', 'backupwordpress' ); ?> <code>define( 'HMBKP_EXCLUDE', '/wp-content/uploads/, /stats/, .svn/, *.txt' );</code></p>
 
 			</td>
 
@@ -81,10 +81,10 @@
 			<td>
 
 				<?php if ( defined( 'HMBKP_CAPABILITY' ) ) { ?>
-					<p><?php printf( __( 'You\'ve set it to: %s', 'backupwordpress' ), '<code>' . esc_html( HMBKP_CAPABILITY ) . '</code>' ); ?></p>
+					<p><?php whitelist_html( printf( __( 'You\'ve set it to: %s', 'backupwordpress' ), '<code>' . esc_html( HMBKP_CAPABILITY ) . '</code>' ), 'code' ); ?></p>
 				<?php } ?>
 
-				<p><?php printf( __( 'The capability to use when calling %1$s. Defaults to %2$s.', 'backupwordpress' ), '<code>add_menu_page</code>', '<code>manage_options</code>' ); ?> <?php _e( 'e.g.', 'backupwordpress' ); ?> <code>define( 'HMBKP_CAPABILITY', 'edit_posts' );</code></p>
+				<p><?php whitelist_html( printf( __( 'The capability to use when calling %1$s. Defaults to %2$s.', 'backupwordpress' ), '<code>add_menu_page</code>', '<code>manage_options</code>' ), 'code' ); ?> <?php esc_html_e( 'e.g.', 'backupwordpress' ); ?> <code>define( 'HMBKP_CAPABILITY', 'edit_posts' );</code></p>
 
 			</td>
 
@@ -97,10 +97,10 @@
 			<td>
 
 				<?php if ( defined( 'HMBKP_ROOT' ) ) { ?>
-					<p><?php printf( __( 'You\'ve set it to: %s', 'backupwordpress' ), '<code>' . esc_html( HMBKP_ROOT ) . '</code>' ); ?></p>
+					<p><?php whitelist_html( printf( __( 'You\'ve set it to: %s', 'backupwordpress' ), '<code>' . esc_html( HMBKP_ROOT ) . '</code>' ), 'code' ); ?></p>
 				<?php } ?>
 
-				<p><?php printf( __( 'The root directory that is backed up. Defaults to %s.', 'backupwordpress' ), '<code>' . Path::get_home_path() . '</code>' ); ?> <?php _e( 'e.g.', 'backupwordpress' ); ?> <code>define( 'HMBKP_ROOT', ABSPATH . 'wp/' );</code></p>
+				<p><?php whitelist_html( printf( __( 'The root directory that is backed up. Defaults to %s.', 'backupwordpress' ), '<code>' . Path::get_home_path() . '</code>' ), 'code' ); ?> <?php esc_html_e( 'e.g.', 'backupwordpress' ); ?> <code>define( 'HMBKP_ROOT', ABSPATH . 'wp/' );</code></p>
 
 			</td>
 
@@ -113,10 +113,10 @@
 			<td>
 
 				<?php if ( defined( 'HMBKP_SCHEDULE_TIME' ) && HMBKP_SCHEDULE_TIME !== '11pm' ) { ?>
-					<p><?php printf( __( 'You\'ve set it to: %s', 'backupwordpress' ), '<code>' . esc_html( HMBKP_SCHEDULE_TIME ) . '</code>' ); ?></p>
+					<p><?php whitelist_html( printf( __( 'You\'ve set it to: %s', 'backupwordpress' ), '<code>' . esc_html( HMBKP_SCHEDULE_TIME ) . '</code>' ), 'code' ); ?></p>
 				<?php } ?>
 
-				<p><?php printf( __( 'The time that your schedules should run. Defaults to %s.', 'backupwordpress' ), '<code>23:00</code>' ); ?> <?php _e( 'e.g.', 'backupwordpress' ); ?> <code>define( 'HMBKP_SCHEDULE_TIME', '07:30' );</code></p>
+				<p><?php whitelist_html( printf( __( 'The time that your schedules should run. Defaults to %s.', 'backupwordpress' ), '<code>23:00</code>' ), 'code' ); ?> <?php esc_html_e( 'e.g.', 'backupwordpress' ); ?> <code>define( 'HMBKP_SCHEDULE_TIME', '07:30' );</code></p>
 
 			</td>
 
diff --git a/admin/enable-support.php b/admin/enable-support.php
index f72e0ebb..7e10ffb1 100644
--- a/admin/enable-support.php
+++ b/admin/enable-support.php
@@ -1,8 +1,16 @@
 <?php require_once HMBKP_PLUGIN_PATH . 'classes/class-requirements.php'; ?>
 
-<h2><?php _e( 'Enable BackUpWordPress Support', 'backupwordpress' ); ?></h2>
-
-<p class="howto"><?php printf( __( 'BackUpWordPress uses %s to provide support. In addition to allowing you to send and receive messages we also send the following server information along with your requests:', 'backupwordpress' ), '<a target="blank" href="https://www.intercom.io">Intercom</a>' ); ?></p>
+<h2><?php esc_html_e( 'Enable BackUpWordPress Support', 'backupwordpress' ); ?></h2>
+
+<p class="howto">
+	<?php whitelist_html(
+		printf(
+			/* translators: Link to Intercom site */
+			__( 'BackUpWordPress uses %s to provide support. In addition to allowing you to send and receive messages we also send the following server information along with your requests:', 'backupwordpress' ),
+			'<a target="blank" href="https://www.intercom.io">Intercom</a>'
+		), 'a'
+	); ?>
+</p>
 
 <div class="server-info">
 
@@ -55,7 +63,7 @@
 
 </div>
 
-<p class="howto"><?php _e( 'You can disable support in the future by deactivating BackUpWordPress.', 'backupwordpress' ); ?></p>
+<p class="howto"><?php esc_html_e( 'You can disable support in the future by deactivating BackUpWordPress.', 'backupwordpress' ); ?></p>
 
-<a href="#" class="button-secondary hmbkp-thickbox-close"><?php _e( 'No, thanks', 'backupwordpress' ); ?></a>
-<a href="<?php echo esc_url( wp_nonce_url( add_query_arg( array( 'action' => 'hmbkp_request_enable_support' ), admin_url( 'admin-post.php' ) ), 'hmbkp_enable_support', 'hmbkp_enable_support_nonce' ) ); ?>" class="button-primary right"><?php _e( 'Yes, I want to enable support', 'backupwordpress' ); ?></a>
+<a href="#" class="button-secondary hmbkp-thickbox-close"><?php esc_html_e( 'No, thanks', 'backupwordpress' ); ?></a>
+<a href="<?php echo esc_url( wp_nonce_url( add_query_arg( array( 'action' => 'hmbkp_request_enable_support' ), admin_url( 'admin-post.php' ) ), 'hmbkp_enable_support', 'hmbkp_enable_support_nonce' ) ); ?>" class="button-primary right"><?php esc_html_e( 'Yes, I want to enable support', 'backupwordpress' ); ?></a>
diff --git a/admin/extensions.php b/admin/extensions.php
index 22b13e69..ee71db3b 100644
--- a/admin/extensions.php
+++ b/admin/extensions.php
@@ -182,14 +182,11 @@ class="thickbox"
 						</div>
 
 						<div class="column-updated">
-							<?php printf(
-								wp_kses(
+							<?php whitelist_html(
+								printf(
 									__( '<strong>Last Updated:</strong> %s ago', 'backupwordpress' ),
-									array(
-										'strong' => array(),
-									)
-								),
-								esc_html( human_time_diff( strtotime( $extension->modified ) ) )
+									esc_html( human_time_diff( strtotime( $extension->modified ) ) )
+								), 'strong'
 							); ?>
 						</div>
 					</div>
diff --git a/admin/faq.php b/admin/faq.php
index 187b729f..bb774eb2 100644
--- a/admin/faq.php
+++ b/admin/faq.php
@@ -1,58 +1,55 @@
-<?php
-echo '<p><strong>' . __( 'Where does BackUpWordPress store the backup files?', 'backupwordpress' ) . '</strong></p>' .
+<p><strong><?php esc_html_e( 'Where does BackUpWordPress store the backup files?', 'backupwordpress' ); ?></strong></p>
 
-	 '<p>' . __( 'Backups are stored on your server in <code>/wp-content/backups</code>, you can change the directory.', 'backupwordpress' ). '</p>' .
+<p><?php echo whitelist_html( __( 'Backups are stored on your server in <code>/wp-content/backups</code>, you can change the directory.', 'backupwordpress' ), 'code' ); ?></p>
 
-	 '<p>' . __( 'Important: By default BackUpWordPress backs up everything in your site root as well as your database, this includes any non WordPress folders that happen to be in your site root. This does mean that your backup directory can get quite large.', 'backupwordpress' ) . '</p>' .
+<p><?php esc_html_e( 'Important: By default BackUpWordPress backs up everything in your site root as well as your database, this includes any non WordPress folders that happen to be in your site root. This does mean that your backup directory can get quite large.', 'backupwordpress' ); ?></p>
 
-	 '<p><strong>' . __( 'What if I want to back up my site to another destination?', 'backupwordpress' ) . '</strong></p>' .
+<p><strong><?php esc_html_e( 'What if I want to back up my site to another destination?', 'backupwordpress' ); ?></strong></p>
 
-	 '<p>' . __( 'BackUpWordPress Pro supports Dropbox, Google Drive, Amazon S3, Rackspace, Azure, DreamObjects and FTP/SFTP. Check it out here: <a href="http://bwp.hmn.md/?utm_source=wordpress-org&utm_medium=plugin-page&utm_campaign=freeplugin" title="BackUpWordPress Homepage" target="_blank">https://bwp.hmn.md</a>', 'backupwordpress' ) . '</p>' .
+<p><?php echo whitelist_html( __( 'BackUpWordPress Pro supports Dropbox, Google Drive, Amazon S3, Rackspace, Azure, DreamObjects and FTP/SFTP. Check it out here: <a href="http://bwp.hmn.md/?utm_source=wordpress-org&utm_medium=plugin-page&utm_campaign=freeplugin" title="BackUpWordPress Homepage" target="_blank">https://bwp.hmn.md</a>', 'backupwordpress' ), 'a' ); ?></p>
 
-	 '<p><strong>' . __( 'How do I restore my site from a backup?', 'backupwordpress' ) . '</strong></p>' .
+<p><strong><?php esc_html_e( 'How do I restore my site from a backup?', 'backupwordpress' ); ?></strong></p>
 
-	 '<p>' . __( 'You need to download the latest backup file either by clicking download on the backups page or via <code>FTP</code>. <code>Unzip</code> the files and upload all the files to your server overwriting your site. You can then import the database using your hosts database management tool (likely <code>phpMyAdmin</code>).', 'backupwordpress' ) . '</p>' .
+<p><?php echo whitelist_html( __( 'You need to download the latest backup file either by clicking download on the backups page or via <code>FTP</code>. <code>Unzip</code> the files and upload all the files to your server overwriting your site. You can then import the database using your hosts database management tool (likely <code>phpMyAdmin</code>).', 'backupwordpress' ), 'code' ); ?></p>
 
-	 '<p>' . __( 'See this guide for more details - <a href="https://bwp.hmn.md/support-center/restore-backup/" title="Go to support center" target="_blank">How to restore from backup</a>.', 'backupwordpress' ) . '</p>' .
+<p><?php echo whitelist_html( __( 'See this guide for more details - <a href="https://bwp.hmn.md/support-center/restore-backup/" title="Go to support center" target="_blank">How to restore from backup</a>.', 'backupwordpress' ), 'a' ); ?></p>
 
-	 '<p><strong>' . __( 'Does BackUpWordPress back up the backups directory?', 'backupwordpress' ) . '</strong></p>' .
+<p><strong><?php esc_html_e( 'Does BackUpWordPress back up the backups directory?', 'backupwordpress' ); ?></strong></p>
 
-	 '<p>' . __( 'No.', 'backupwordpress' ) . '</p>' .
+<p><?php esc_html_e( 'No.', 'backupwordpress' ); ?></p>
 
-	 '<p><strong>' . __( 'I\'m not receiving my backups by email', 'backupwordpress' ) . '</strong></p>' .
+<p><strong><?php esc_html_e( 'I\'m not receiving my backups by email', 'backupwordpress' ); ?></strong></p>
 
-	 '<p>' . __( 'Most servers have a filesize limit on email attachments, it\'s generally about 10mb. If your backup file is over that limit, it won\'t be sent attached to the email. Instead, you should receive an email with a link to download the backup. If you aren\'t even receiving that, then you likely have a mail issue on your server that you\'ll need to contact your host about.', 'backupwordpress' ) . '</p>' .
+<p><?php esc_html_e( 'Most servers have a filesize limit on email attachments, it\'s generally about 10mb. If your backup file is over that limit, it won\'t be sent attached to the email. Instead, you should receive an email with a link to download the backup. If you aren\'t even receiving that, then you likely have a mail issue on your server that you\'ll need to contact your host about.', 'backupwordpress' ); ?></p>
 
-	 '<p><strong>' . __( 'How many backups are stored by default?', 'backupwordpress' ) . '</strong></p>' .
+<p><strong><?php esc_html_e( 'How many backups are stored by default?', 'backupwordpress' ); ?></strong></p>
 
-	 '<p>' . __( 'BackUpWordPress stores the last 10 backups by default.', 'backupwordpress' ) . '</p>' .
+<p><?php esc_html_e( 'BackUpWordPress stores the last 10 backups by default.', 'backupwordpress' ); ?></p>
 
-	 '<p><strong>' . __( 'How long should a backup take?', 'backupwordpress' ) . '</strong></p>' .
+<p><strong><?php esc_html_e( 'How long should a backup take?', 'backupwordpress' ); ?></strong></p>
 
-	 '<p>' . __( 'Unless your site is very large (many gigabytes) it should only take a few minutes to perform a backup. If your back up has been running for longer than an hour, it\'s safe to assume that something has gone wrong. Try de-activating and re-activating the plugin. If it keeps happening, contact support.', 'backupwordpress' ) . '</p>' .
+<p><?php esc_html_e( 'Unless your site is very large (many gigabytes) it should only take a few minutes to perform a backup. If your back up has been running for longer than an hour, it\'s safe to assume that something has gone wrong. Try de-activating and re-activating the plugin. If it keeps happening, contact support.', 'backupwordpress' ); ?></p>
 
-	 '<p><strong>' . __( 'What do I do if I get the wp-cron error message?', 'backupwordpress' ) . '</strong></p>' .
+<p><strong><?php esc_html_e( 'What do I do if I get the wp-cron error message?', 'backupwordpress' ); ?></strong></p>
 
-	 '<p>' . __( 'The issue is that your <code>wp-cron.php</code> is not returning a <code>200</code> response when hit with a HTTP request originating from your own server, it could be several things. In most cases, it\'s an issue with the server / site.', 'backupwordpress' ) . '</p>' .
+<p><?php echo whitelist_html( __( 'The issue is that your <code>wp-cron.php</code> is not returning a <code>200</code> response when hit with a HTTP request originating from your own server, it could be several things. In most cases, it\'s an issue with the server / site.', 'backupwordpress' ), 'code' ); ?></p>
 
-	 '<p>' . __( 'There are some things you can test to confirm this is the issue.', 'backupwordpress' ) . '</p>' .
+<p><?php esc_html_e( 'There are some things you can test to confirm this is the issue.', 'backupwordpress' ); ?></p>
 
-	 '<ul><li>' . __( 'Are scheduled posts working? (They use wp-cron as well.)', 'backupwordpress' ) . '</li>' .
+<ul>
+	<li><?php esc_html_e( 'Are scheduled posts working? (They use wp-cron as well.)', 'backupwordpress' ); ?></li>
+	<li><?php esc_html_e( 'Are you hosted on Heart Internet? (wp-cron may not be supported by Heart Internet, see below for work-around.)', 'backupwordpress' ); ?></li>
+	<li><?php esc_html_e( 'If you click manual backup, does it work?', 'backupwordpress' ); ?></li>
+	<li><?php echo whitelist_html( __( 'Try adding <code>define( \'ALTERNATE_WP_CRON\', true );</code> to your <code>wp-config.php</code>. Do automatic backups work?', 'backupwordpress' ), 'a' ); ?></li>
+	<li><?php esc_html_e( 'Is your site private (i.e. is it behind some kind of authentication, maintenance plugin, .htaccess)? If so, wp-cron won\'t work until you remove it. If you are and you temporarily remove the authentication, do backups start working?', 'backupwordpress' ); ?></li>
+</ul>
 
-	 '<li>' . __( 'Are you hosted on Heart Internet? (wp-cron may not be supported by Heart Internet, see below for work-around.)', 'backupwordpress' ) . '</li>' .
+<p><?php whitelist_html( __( 'Report the results to our support team for further help. To do this, either enable support from your Admin Dashboard (recommended), or email backupwordpress@hmn.md', 'backupwordpress' ), 'a' ); ?></p>
 
-	 '<li>' . __( 'If you click manual backup, does it work?', 'backupwordpress' ) . '</li>' .
+<p><strong><?php esc_html_e( 'How to get BackUpWordPress working in Heart Internet', 'backupwordpress' ); ?></strong></p>
 
-	 '<li>' . __( 'Try adding <code>define( \'ALTERNATE_WP_CRON\', true );</code> to your <code>wp-config.php</code>. Do automatic backups work?', 'backupwordpress' ) . '</li>' .
+<p><?php whitelist_html( __( 'The script to be entered into the Heart Internet cPanel is: <code>/usr/bin/php5 /home/sites/yourdomain.com/public_html/wp-cron.php</code> (note the space between php5 and the location of the file). The file <code>wp-cron.php</code> <code>chmod</code> must be set to <code>711</code>.', 'backupwordpress' ), 'code' ); ?></p>
 
-	 '<li>' . __( 'Is your site private (i.e. is it behind some kind of authentication, maintenance plugin, .htaccess)? If so, wp-cron won\'t work until you remove it. If you are and you temporarily remove the authentication, do backups start working?', 'backupwordpress' ) . '</li></ul>' .
+<p><strong><?php esc_html_e( 'My backups seem to be failing?', 'backupwordpress' ); ?></strong></p>
 
-	 '<p>' . __( 'Report the results to our support team for further help. To do this, either enable support from your Admin Dashboard (recommended), or email backupwordpress@hmn.md', 'backupwordpress' ) . '</p>' .
-
-	 '<p><strong>' . __( 'How to get BackUpWordPress working in Heart Internet', 'backupwordpress' ) . '</strong></p>' .
-
-	 '<p>' . __( 'The script to be entered into the Heart Internet cPanel is: <code>/usr/bin/php5 /home/sites/yourdomain.com/public_html/wp-cron.php</code> (note the space between php5 and the location of the file). The file <code>wp-cron.php</code> <code>chmod</code> must be set to <code>711</code>.', 'backupwordpress' ) . '</p>' .
-
-	 '<p><strong>' . __( 'My backups seem to be failing?', 'backupwordpress' ) . '</strong></p>' .
-
-	 '<p>' . __( 'If your backups are failing, it\'s commonly caused by a lack of available resources on your server. To establish this is the case, exclude the complete (or parts of the) uploads folder and run a backup. If that succeeds, you know it\'s probably a server issue. If it does not succeed, report the results to our support team for further help. You can contact support by enabling support from your Admin Dashboard (recommended), or emailing backupwordpress@hmn.md', 'backupwordpress' ) . '</p>';
+<p><?php esc_html_e( 'If your backups are failing, it\'s commonly caused by a lack of available resources on your server. To establish this is the case, exclude the complete (or parts of the) uploads folder and run a backup. If that succeeds, you know it\'s probably a server issue. If it does not succeed, report the results to our support team for further help. You can contact support by enabling support from your Admin Dashboard (recommended), or emailing backupwordpress@hmn.md', 'backupwordpress' ); ?></p>
diff --git a/admin/menu.php b/admin/menu.php
index f938c6e3..516d6854 100644
--- a/admin/menu.php
+++ b/admin/menu.php
@@ -74,7 +74,7 @@ function highlight_submenu( $submenu_file ) {
 function plugin_action_link( $links, $file ) {
 
 	if ( false !== strpos( $file, HMBKP_PLUGIN_SLUG ) ) {
-		array_push( $links, '<a href="' . esc_url( HMBKP_ADMIN_URL ) . '">' . __( 'Backups', 'backupwordpress' ) . '</a>' );
+		array_push( $links, '<a href="' . esc_url( HMBKP_ADMIN_URL ) . '">' . esc_html__( 'Backups', 'backupwordpress' ) . '</a>' );
 	}
 
 	return $links;
diff --git a/admin/page.php b/admin/page.php
index 2262cb13..804487b8 100755
--- a/admin/page.php
+++ b/admin/page.php
@@ -14,12 +14,12 @@
 
 		<?php if ( get_option( 'hmbkp_enable_support' ) ) : ?>
 
-			<a id="intercom" class="page-title-action" href="mailto:backupwordpress@hmn.md"><?php _e( 'Support', 'backupwordpress' ); ?></a>
+			<a id="intercom" class="page-title-action" href="mailto:backupwordpress@hmn.md"><?php esc_html_e( 'Support', 'backupwordpress' ); ?></a>
 
 		<?php else :
 
 			add_thickbox(); ?>
-			<a id="intercom-info" class="thickbox page-title-action" href="<?php echo esc_url( wp_nonce_url( add_query_arg( array( 'action' => 'load_enable_support', 'width' => '600', 'height' => '420' ), self_admin_url( 'admin-ajax.php' ) ), 'hmbkp_nonce' ) ); ?>"><span class="dashicons dashicons-admin-users"></span>&nbsp;<?php _e( 'Enable Support', 'backupwordpress' ); ?></a>
+			<a id="intercom-info" class="thickbox page-title-action" href="<?php echo esc_url( wp_nonce_url( add_query_arg( array( 'action' => 'load_enable_support', 'width' => '600', 'height' => '420' ), self_admin_url( 'admin-ajax.php' ) ), 'hmbkp_nonce' ) ); ?>"><span class="dashicons dashicons-admin-users"></span>&nbsp;<?php esc_html_e( 'Enable Support', 'backupwordpress' ); ?></a>
 
 		<?php endif; ?>
 
@@ -27,7 +27,7 @@
 
 	<?php include_once( HMBKP_PLUGIN_PATH . 'admin/backups.php' ); ?>
 
-	<p class="howto"><?php printf( __( 'If you\'re finding BackUpWordPress useful, please %1$s rate it on the plugin directory%2$s.', 'backupwordpress' ), '<a target="_blank" href="http://wordpress.org/support/view/plugin-reviews/backupwordpress">', '</a>' ); ?></p>
+	<p class="howto"><?php echo whitelist_html( sprintf( __( 'If you\'re finding BackUpWordPress useful, please %1$s rate it on the plugin directory%2$s.', 'backupwordpress' ), '<a target="_blank" href="http://wordpress.org/support/view/plugin-reviews/backupwordpress">', '</a>' ), 'a' ); ?></p>
 
 	<?php include_once( HMBKP_PLUGIN_PATH . 'admin/upsell.php' ); ?>
 
diff --git a/admin/schedule-form.php b/admin/schedule-form.php
index 4a79ca98..0f12aba9 100644
--- a/admin/schedule-form.php
+++ b/admin/schedule-form.php
@@ -39,18 +39,18 @@
 			<tr valign="top">
 
 				<th scope="row">
-					<label for="hmbkp_schedule_type"><?php _e( 'Backup', 'backupwordpress' ); ?></label>
+					<label for="hmbkp_schedule_type"><?php esc_html_e( 'Backup', 'backupwordpress' ); ?></label>
 				</th>
 
 				<td>
 
 					<select name="hmbkp_schedule_type" id="hmbkp_schedule_type">
 
-						<option<?php selected( $schedule->get_type(), 'complete' ); ?> value="complete"><?php _e( 'Both Database &amp; files', 'backupwordpress' ); ?></option>
+						<option<?php selected( $schedule->get_type(), 'complete' ); ?> value="complete"><?php esc_html_e( 'Both Database &amp; files', 'backupwordpress' ); ?></option>
 
-						<option<?php selected( $schedule->get_type(), 'file' ); ?> value="file"><?php _e( 'Files only', 'backupwordpress' ); ?></option>
+						<option<?php selected( $schedule->get_type(), 'file' ); ?> value="file"><?php esc_html_e( 'Files only', 'backupwordpress' ); ?></option>
 
-						<option<?php selected( $schedule->get_type(), 'database' ); ?> value="database"><?php _e( 'Database only', 'backupwordpress' ); ?></option>
+						<option<?php selected( $schedule->get_type(), 'database' ); ?> value="database"><?php esc_html_e( 'Database only', 'backupwordpress' ); ?></option>
 
 					</select>
 
@@ -61,14 +61,14 @@
 			<tr>
 
 				<th scope="row">
-					<label for="hmbkp_schedule_recurrence_type"><?php _e( 'Schedule', 'backupwordpress' ); ?></label>
+					<label for="hmbkp_schedule_recurrence_type"><?php esc_html_e( 'Schedule', 'backupwordpress' ); ?></label>
 				</th>
 
 				<td>
 
 					<select name="hmbkp_schedule_recurrence[hmbkp_type]" id="hmbkp_schedule_recurrence_type">
 
-						<option value="manually"><?php _e( 'Manual Only', 'backupwordpress' ); ?></option>
+						<option value="manually"><?php esc_html_e( 'Manual Only', 'backupwordpress' ); ?></option>
 
 						<?php foreach ( get_cron_schedules() as $cron_schedule => $cron_details ) : ?>
 
@@ -95,7 +95,7 @@
 			<tr id="start-day" class="recurring-setting">
 
 				<th scope="row">
-					<label for="hmbkp_schedule_start_day_of_week"><?php _e( 'Start Day', 'backupwordpress' ); ?></label>
+					<label for="hmbkp_schedule_start_day_of_week"><?php esc_html_e( 'Start Day', 'backupwordpress' ); ?></label>
 				</th>
 
 				<td>
@@ -127,7 +127,7 @@
 			<tr id="start-date" class="recurring-setting">
 
 				<th scope="row">
-					<label for="hmbkp_schedule_start_day_of_month"><?php _e( 'Start Day of Month', 'backupwordpress' ); ?></label>
+					<label for="hmbkp_schedule_start_day_of_month"><?php esc_html_e( 'Start Day of Month', 'backupwordpress' ); ?></label>
 				</th>
 
 				<td>
@@ -139,7 +139,7 @@
 			<tr id="schedule-start" class="recurring-setting">
 
 				<th scope="row">
-					<label for="hmbkp_schedule_start_hours"><?php _e( 'Start Time', 'backupwordpress' ); ?></label>
+					<label for="hmbkp_schedule_start_hours"><?php esc_html_e( 'Start Time', 'backupwordpress' ); ?></label>
 				</th>
 
 				<td>
@@ -148,17 +148,17 @@
 
 						<label for="hmbkp_schedule_start_hours"><input type="number" min="0" max="23" step="1" name="hmbkp_schedule_recurrence[hmbkp_schedule_start_hours]" id="hmbkp_schedule_start_hours" value="<?php echo esc_attr( $start_date_array['hour'] ); ?>">
 
-						<?php _e( 'Hours', 'backupwordpress' ); ?></label>
+						<?php esc_html_e( 'Hours', 'backupwordpress' ); ?></label>
 
 						<label for="hmbkp_schedule_start_minutes"><input type="number" min="0" max="59" step="1" name="hmbkp_schedule_recurrence[hmbkp_schedule_start_minutes]" id="hmbkp_schedule_start_minutes" value="<?php echo esc_attr( $start_date_array['minute'] ); ?>">
 
-						<?php _e( 'Minutes', 'backupwordpress' ); ?></label>
+						<?php esc_html_e( 'Minutes', 'backupwordpress' ); ?></label>
 
 					</span>
 
 					<p class="description">
 						<?php esc_html_e( '24-hour format.', 'backupwordpress' ); ?>
-						<span class="twice-js <?php if ( $schedule->get_reoccurrence() !== 'fortnightly' ) { ?> hidden<?php } ?>"><?php _e( 'The second backup will run 12 hours after the first.', 'backupwordpress' ); ?><span>
+						<span class="twice-js <?php if ( $schedule->get_reoccurrence() !== 'fortnightly' ) { ?> hidden<?php } ?>"><?php esc_html_e( 'The second backup will run 12 hours after the first.', 'backupwordpress' ); ?><span>
 					</p>
 
 				</td>
@@ -168,7 +168,7 @@
 			<tr>
 
 				<th scope="row">
-					<label for="hmbkp_schedule_max_backups"><?php _e( 'Number of backups to store on this server', 'backupwordpress' ); ?></label>
+					<label for="hmbkp_schedule_max_backups"><?php esc_html_e( 'Number of backups to store on this server', 'backupwordpress' ); ?></label>
 				</th>
 
 				<td>
@@ -177,14 +177,14 @@
 
 					<p class="description">
 
-						<?php printf( __( 'Past this limit older backups will be deleted automatically.', 'backupwordpress' ) ); ?>
+						<?php esc_html_e( 'Past this limit older backups will be deleted automatically.', 'backupwordpress' ); ?>
 
 						<?php
 
 						$site_size = new Site_Size( $schedule->get_type(), $schedule->get_excludes() );
 
 						if ( $site_size->is_site_size_cached() ) :
-							printf( __( 'This schedule will store a maximum of %s of backups.', 'backupwordpress' ), '<code>' . esc_html( size_format( $site_size->get_site_size() * $schedule->get_max_backups() ) ) . '</code>' );
+							echo whitelist_html( sprintf( __( 'This schedule will store a maximum of %s of backups.', 'backupwordpress' ), '<code>' . esc_html( size_format( $site_size->get_site_size() * $schedule->get_max_backups() ) ) . '</code>' ), 'code' );
 						endif; ?>
 
 					</p>
diff --git a/admin/schedule-sentence.php b/admin/schedule-sentence.php
index 721b4d6a..7b1b66ad 100644
--- a/admin/schedule-sentence.php
+++ b/admin/schedule-sentence.php
@@ -11,7 +11,13 @@
 $day = date_i18n( 'l', $schedule->get_next_occurrence( false ) );
 
 // Next Backup
-$next_backup = 'title="' . esc_attr( sprintf( __( 'The next backup will be on %1$s at %2$s %3$s', 'backupwordpress' ), date_i18n( get_option( 'date_format' ), $schedule->get_next_occurrence( false ) ), date_i18n( get_option( 'time_format' ), $schedule->get_next_occurrence( false ) ), date_i18n( 'T', $schedule->get_next_occurrence( false ) ) ) ) . '"';
+$next_backup = 'title="' . esc_attr( sprintf(
+	/* translators: 1: Date 2: Time 3: Timezone abbreviation. Eg., EST, MDT */
+	__( 'The next backup will be on %1$s at %2$s %3$s', 'backupwordpress' ),
+	date_i18n( get_option( 'date_format' ), $schedule->get_next_occurrence( false ) ),
+	date_i18n( get_option( 'time_format' ), $schedule->get_next_occurrence( false ) ),
+	date_i18n( 'T', $schedule->get_next_occurrence( false ) )
+	) ) . '"';
 
 // Backup status
 $status = new Backup_Status( $schedule->get_id() );
@@ -21,13 +27,23 @@
 
 	case 'hourly' :
 
-		$reoccurrence = date_i18n( 'i', $schedule->get_next_occurrence( false ) ) === '00' ? '<span ' . $next_backup . '>' . __( 'hourly on the hour', 'backupwordpress' ) . '</span>' : sprintf( __( 'hourly at %s minutes past the hour', 'backupwordpress' ), '<span ' . $next_backup . '>' . intval( date_i18n( 'i', $schedule->get_next_occurrence( false ) ) ) ) . '</span>';
+		$reoccurrence = date_i18n( 'i', $schedule->get_next_occurrence( false ) ) === '00'
+			? '<span ' . $next_backup . '>' . esc_html__( 'hourly on the hour', 'backupwordpress' ) . '</span>'
+			: sprintf(
+				/* translators: Number of minutes */
+				__( 'hourly at %s minutes past the hour', 'backupwordpress' ),
+				'<span ' . $next_backup . '>' . esc_html( intval( date_i18n( 'i', $schedule->get_next_occurrence( false ) ) ) ) . '</span>'
+			);
 
 	break;
 
 	case 'daily' :
 
-		$reoccurrence = sprintf( __( 'daily at %s', 'backupwordpress' ), '<span ' . $next_backup . '>' . esc_html( date_i18n( get_option( 'time_format' ), $schedule->get_next_occurrence( false ) ) ) . '</span>' );
+		$reoccurrence = sprintf(
+			/* translators: Time */
+			__( 'daily at %s', 'backupwordpress' ),
+			'<span ' . $next_backup . '>' . esc_html( date_i18n( get_option( 'time_format' ), $schedule->get_next_occurrence( false ) ) ) . '</span>'
+		);
 
 	break;
 
@@ -38,25 +54,45 @@
 
 		sort( $times );
 
-		$reoccurrence = sprintf( __( 'every 12 hours at %1$s &amp; %2$s', 'backupwordpress' ), '<span ' . $next_backup . '>' . esc_html( reset( $times ) ) . '</span>', '<span>' . esc_html( end( $times ) ) ) . '</span>';
+		$reoccurrence = sprintf(
+			/* translators: 1: First time the back up runs 2: Second time backup runs */
+			__( 'every 12 hours at %1$s &amp; %2$s', 'backupwordpress' ),
+			'<span ' . $next_backup . '>' . esc_html( reset( $times ) ) . '</span>',
+			'<span>' . esc_html( end( $times ) ) . '</span>'
+		);
 
 	break;
 
 	case 'weekly' :
 
-		$reoccurrence = sprintf( __( 'weekly on %1$s at %2$s', 'backupwordpress' ), '<span ' . $next_backup . '>' .esc_html( $day ) . '</span>', '<span>' . esc_html( date_i18n( get_option( 'time_format' ), $schedule->get_next_occurrence( false ) ) ) . '</span>' );
+		$reoccurrence = sprintf(
+			/* translators: 1: Full name of the week day, eg. Monday 2: Time */
+			__( 'weekly on %1$s at %2$s', 'backupwordpress' ),
+			'<span ' . $next_backup . '>' . esc_html( $day ) . '</span>',
+			'<span>' . esc_html( date_i18n( get_option( 'time_format' ), $schedule->get_next_occurrence( false ) ) ) . '</span>'
+		);
 
 	break;
 
 	case 'fortnightly' :
 
-		$reoccurrence = sprintf( __( 'every two weeks on %1$s at %2$s', 'backupwordpress' ), '<span ' . $next_backup . '>' . $day . '</span>', '<span>' . esc_html( date_i18n( get_option( 'time_format' ), $schedule->get_next_occurrence( false ) ) ) . '</span>' );
+		$reoccurrence = sprintf(
+			/* translators: 1: Full name of the week day, eg. Monday 2: Time */
+			__( 'every two weeks on %1$s at %2$s', 'backupwordpress' ),
+			'<span ' . $next_backup . '>' . esc_html( $day ) . '</span>',
+			'<span>' . esc_html( date_i18n( get_option( 'time_format' ), $schedule->get_next_occurrence( false ) ) ) . '</span>'
+		);
 
 	break;
 
 	case 'monthly' :
 
-		$reoccurrence = sprintf( __( 'on the %1$s of each month at %2$s', 'backupwordpress' ), '<span ' . $next_backup . '>' . esc_html( date_i18n( 'jS', $schedule->get_next_occurrence( false ) ) ) . '</span>', '<span>' . esc_html( date_i18n( get_option( 'time_format' ), $schedule->get_next_occurrence( false ) ) ) . '</span>' );
+		$reoccurrence = sprintf(
+			/* translators: 1: Ordinal number of a day of a month, eg. 1st, 10th 2: Time */
+			__( 'on the %1$s of each month at %2$s', 'backupwordpress' ),
+			'<span ' . $next_backup . '>' . esc_html( date_i18n( 'jS', $schedule->get_next_occurrence( false ) ) ) . '</span>',
+			'<span>' . esc_html( date_i18n( get_option( 'time_format' ), $schedule->get_next_occurrence( false ) ) ) . '</span>'
+		);
 
 	break;
 
@@ -73,26 +109,34 @@
 
 endswitch;
 
-$server = '<code title="' . __( 'Check the help tab to learn how to change where your backups are stored.', 'backupwordpress' ) . '">' . esc_attr( str_replace( Path::get_home_path(), '', Path::get_path() ) ) . '</code>';
+$server = '<code title="' . __( 'Check the help tab to learn how to change where your backups are stored.', 'backupwordpress' ) . '">' . str_replace( Path::get_home_path(), '', Path::get_path() ) . '</code>';
 
 // Backup to keep
 switch ( $schedule->get_max_backups() ) :
 
 	case 1 :
 
-		$backup_to_keep = sprintf( __( 'store the most recent backup in %s', 'backupwordpress' ), $server );
+		$backup_to_keep = sprintf(
+			__( 'store the most recent backup in %s', 'backupwordpress' ),
+			$server
+		);
 
 	break;
 
 	case 0 :
 
-		$backup_to_keep = sprintf( __( 'don\'t store any backups in on this server', 'backupwordpress' ), Path::get_path() );
+		$backup_to_keep = __( 'don\'t store any backups in on this server', 'backupwordpress' );
 
 	break;
 
 	default :
 
-		$backup_to_keep = sprintf( __( 'store the last %1$s backups in %2$s', 'backupwordpress' ), esc_html( $schedule->get_max_backups() ), $server );
+		$backup_to_keep = sprintf(
+			/* translators: 1: The number of backups to store 2: Path on a server */
+			__( 'store the last %1$s backups in %2$s', 'backupwordpress' ),
+			$schedule->get_max_backups(),
+			$server
+		);
 
 endswitch;
 
@@ -117,14 +161,27 @@
 
 <div class="hmbkp-schedule-sentence<?php if ( $status->get_status() ) { ?> hmbkp-running<?php } ?>">
 
-	<?php $sentence = sprintf( _x( 'Backup my %1$s %2$s %3$s, %4$s.', '1: Backup Type 2: Total size of backup 3: Schedule 4: Number of backups to store', 'backupwordpress' ), '<span>' . esc_html( $type ) . '</span>', $filesize, $reoccurrence, $backup_to_keep );
+	<?php $sentence = whitelist_html(
+		sprintf(
+			/* translators: 1: Backup Type (eg. complete, files, database, ...) 2: Total size of backup 3: Schedule (eg. hourly, daily, weekly, ...) 4: Number of backups to store */
+			__( 'Backup my %1$s %2$s %3$s, %4$s.', 'backupwordpress' ),
+			'<span>' . esc_html( $type ) . '</span>',
+			$filesize,
+			$reoccurrence,
+			$backup_to_keep
+		), array( 'code', 'span', 'a' )
+	);
 
 	if ( $email_msg ) {
 		$sentence .= ' ' . $email_msg;
 	}
 
 	if ( ! empty( $services ) ) {
-		$sentence .= ' ' . sprintf( __( 'Send a copy of each backup to %s.', 'backupwordpress' ), implode( ', ', $services ) );
+		$sentence .= ' ' . esc_html( sprintf(
+			/* translators: List of available services for storing backups */
+			__( 'Send a copy of each backup to %s.', 'backupwordpress' ),
+			implode( ', ', $services )
+		) );
 	}
 
 	echo $sentence; ?>
@@ -155,12 +212,24 @@ function get_site_size_text( Scheduled_Backup $schedule ) {
 
 	$site_size = new Site_Size( $schedule->get_type(), $schedule->get_excludes() );
 
-	if ( 'database' === $schedule->get_type() || $site_size->is_site_size_cached() ) {
-		return sprintf(
-			'(<code title="' . __( 'Backups will be compressed and should be smaller than this.', 'backupwordpress' ) . '">%s</code>)',
-			esc_html( $site_size->get_formatted_site_size() )
+	if ( ( 'database' === $schedule->get_type() ) || $site_size->is_site_size_cached() ) {
+
+		return whitelist_html(
+			sprintf(
+				'(<code title="%1$s">%2$s</code>)',
+				__( 'Backups will be compressed and should be smaller than this.', 'backupwordpress' ),
+				esc_html( $site_size->get_formatted_site_size() )
+			), 'code'
 		);
-	}
 
-	return '';
+	} else {
+
+		return whitelist_html(
+			sprintf(
+				'(<code class="calculating" title="%1$s">%2$s</code>)',
+				esc_attr__( 'this shouldn\'t take long&hellip;', 'backupwordpress' ),
+				__( 'calculating the size of your site&hellip;', 'backupwordpress' )
+			), 'code'
+		);
+	}
 }
diff --git a/admin/schedule-settings.php b/admin/schedule-settings.php
index 523bd256..a606ea1f 100644
--- a/admin/schedule-settings.php
+++ b/admin/schedule-settings.php
@@ -8,17 +8,17 @@
 
 		<?php if ( is_backup_possible() ) : ?>
 
-			<a class="hmbkp-run" href="<?php echo esc_url( wp_nonce_url( add_query_arg( array( 'action' => 'hmbkp_run_schedule', 'hmbkp_schedule_id' => $schedule->get_id() ), admin_url( 'admin-ajax.php' ) ), 'hmbkp_run_schedule', 'hmbkp_run_schedule_nonce' ) ); ?>"><?php _e( 'Run now', 'backupwordpress' ); ?></a>  |
+			<a class="hmbkp-run" href="<?php echo esc_url( wp_nonce_url( add_query_arg( array( 'action' => 'hmbkp_run_schedule', 'hmbkp_schedule_id' => $schedule->get_id() ), admin_url( 'admin-ajax.php' ) ), 'hmbkp_run_schedule', 'hmbkp_run_schedule_nonce' ) ); ?>"><?php esc_html_e( 'Run now', 'backupwordpress' ); ?></a>  |
 
 		<?php endif; ?>
 
-		<a href="<?php echo esc_url( add_query_arg( array( 'action' => 'hmbkp_edit_schedule', 'hmbkp_panel' => 'hmbkp_edit_schedule_settings', 'hmbkp_schedule_id' => $schedule->get_id() ), get_settings_url() ), 'hmbkp-edit-schedule' ); ?>"><?php _e( 'Settings', 'backupwordpress' ); ?></a> |
+		<a href="<?php echo esc_url( add_query_arg( array( 'action' => 'hmbkp_edit_schedule', 'hmbkp_panel' => 'hmbkp_edit_schedule_settings', 'hmbkp_schedule_id' => $schedule->get_id() ), get_settings_url() ), 'hmbkp-edit-schedule' ); ?>"><?php esc_html_e( 'Settings', 'backupwordpress' ); ?></a> |
 
 		<?php
 
 		// Only show excludes if we are backing up files
 		if ( 'database' !== $schedule->get_type() ) : ?>
-			<a href="<?php echo esc_url( add_query_arg( array( 'action' => 'hmbkp_edit_schedule', 'hmbkp_panel' => 'hmbkp_edit_schedule_excludes', 'hmbkp_schedule_id' => $schedule->get_id() ), get_settings_url() ) ); ?>"><?php _e( 'Excludes', 'backupwordpress' ); ?></a> |
+			<a href="<?php echo esc_url( add_query_arg( array( 'action' => 'hmbkp_edit_schedule', 'hmbkp_panel' => 'hmbkp_edit_schedule_excludes', 'hmbkp_schedule_id' => $schedule->get_id() ), get_settings_url() ) ); ?>"><?php esc_html_e( 'Excludes', 'backupwordpress' ); ?></a> |
 		<?php endif; ?>
 
 		<?php foreach ( Services::get_services( $schedule ) as $service ) :
@@ -31,7 +31,7 @@
 
 		<?php endforeach; ?>
 
-		<a class="delete-action" href="<?php echo esc_url( wp_nonce_url( add_query_arg( array( 'action' => 'hmbkp_request_delete_schedule', 'hmbkp_schedule_id' => $schedule->get_id() ), admin_url( 'admin-post.php' ) ), 'hmbkp_delete_schedule', 'hmbkp_delete_schedule_nonce' ) ); ?>"><?php _e( 'Delete', 'backupwordpress' ); ?></a>
+		<a class="delete-action" href="<?php echo esc_url( wp_nonce_url( add_query_arg( array( 'action' => 'hmbkp_request_delete_schedule', 'hmbkp_schedule_id' => $schedule->get_id() ), admin_url( 'admin-post.php' ) ), 'hmbkp_delete_schedule', 'hmbkp_delete_schedule_nonce' ) ); ?>"><?php esc_html_e( 'Delete', 'backupwordpress' ); ?></a>
 
 	</div>
 
diff --git a/admin/upsell.php b/admin/upsell.php
index e2286dca..8e923af4 100644
--- a/admin/upsell.php
+++ b/admin/upsell.php
@@ -4,11 +4,12 @@
 <p>
 
 <?php
-/** translators:  the 1st placeholder is the first part of the anchor tag with the link to the extensions admin page and the second is the closing anchor tag */
-printf(
-	__( 'Store your backups securely in the Cloud with %1$sour extensions%2$s', 'backupwordpress' ),
-	'<a href="' . esc_url( get_settings_url( HMBKP_PLUGIN_SLUG . '_extensions' ) ) . '">',
-	'</a>'
+echo whitelist_html(
+	sprintf(
+		/* translators: Link to plugin's extensions page in WordPress admin */
+		__( 'Store your backups securely in the Cloud with <a href="%s">our extensions</a>', 'backupwordpress' ),
+		esc_url( get_settings_url( HMBKP_PLUGIN_SLUG . '_extensions' ) )
+	), 'a'
 );
 ?>
 
diff --git a/classes/class-email-service.php b/classes/class-email-service.php
index 51987c9d..a223b40d 100644
--- a/classes/class-email-service.php
+++ b/classes/class-email-service.php
@@ -27,7 +27,7 @@ public function field() {
 		<tr>
 
 			<th scope="row">
-				<label for="<?php echo esc_attr( $this->get_field_name( 'email' ) ); ?>"><?php _e( 'Email notification', 'backupwordpress' ); ?></label>
+				<label for="<?php echo esc_attr( $this->get_field_name( 'email' ) ); ?>"><?php esc_html_e( 'Email notification', 'backupwordpress' ); ?></label>
 			</th>
 
 			<td>
@@ -64,7 +64,7 @@ public static function constant() {
 				<p><?php printf( __( 'You\'ve set it to: %s', 'backupwordpress' ), '<code>' . HMBKP_ATTACHMENT_MAX_FILESIZE . '</code>' ); ?></p>
 				<?php } ?>
 
-				<p><?php printf( __( 'The maximum filesize of your backup that will be attached to your notification emails . Defaults to %s.', 'backupwordpress' ), '<code>10MB</code>' ); ?> <?php _e( 'e.g.', 'backupwordpress' ); ?> <code>define( 'HMBKP_ATTACHMENT_MAX_FILESIZE', '25MB' );</code></p>
+				<p><?php printf( __( 'The maximum filesize of your backup that will be attached to your notification emails . Defaults to %s.', 'backupwordpress' ), '<code>10MB</code>' ); ?> <?php esc_html_e( 'e.g.', 'backupwordpress' ); ?> <code>define( 'HMBKP_ATTACHMENT_MAX_FILESIZE', '25MB' );</code></p>
 
 			</td>
 
diff --git a/classes/class-setup.php b/classes/class-setup.php
index a77c99eb..162da305 100644
--- a/classes/class-setup.php
+++ b/classes/class-setup.php
@@ -28,7 +28,7 @@ public static function activate() {
 
 		if ( ! self::meets_requirements() ) {
 
-			wp_die( self::get_notice_message(), __( 'BackUpWordPress', 'backupwordpress' ), array( 'back_link' => true ) );
+			wp_die( self::get_notice_message(), esc_html__( 'BackUpWordPress', 'backupwordpress' ), array( 'back_link' => true ) );
 
 		}
 
diff --git a/functions/core.php b/functions/core.php
index 8201614f..45bea264 100755
--- a/functions/core.php
+++ b/functions/core.php
@@ -328,7 +328,7 @@ function setup_default_schedules() {
 	$schedules->refresh_schedules();
 
 	add_action( 'admin_notices', function() {
-		echo '<div id="hmbkp-warning" class="updated fade"><p><strong>' . __( 'BackUpWordPress has set up your default schedules.', 'backupwordpress' ) . '</strong> ' . __( 'By default BackUpWordPress performs a daily backup of your database and a weekly backup of your database &amp; files. You can modify these schedules.', 'backupwordpress' ) . '</p></div>';
+		echo '<div id="hmbkp-warning" class="updated fade"><p><strong>' . esc_html__( 'BackUpWordPress has set up your default schedules.', 'backupwordpress' ) . '</strong> ' . esc_html__( 'By default BackUpWordPress performs a daily backup of your database and a weekly backup of your database &amp; files. You can modify these schedules.', 'backupwordpress' ) . '</p></div>';
 	} );
 
 }
diff --git a/functions/interface.php b/functions/interface.php
index 57b512bf..c5929873 100644
--- a/functions/interface.php
+++ b/functions/interface.php
@@ -30,10 +30,10 @@ function get_backup_row( $file, Scheduled_Backup $schedule ) {
 		<td>
 
 			<?php if (  is_path_accessible( Path::get_path() )  ) : ?>
-				<a href="<?php echo esc_url( wp_nonce_url( add_query_arg( array( 'hmbkp_backup_archive' => $encoded_file, 'hmbkp_schedule_id' => $schedule->get_id(), 'action' => 'hmbkp_request_download_backup' ), admin_url( 'admin-post.php' ) ), 'hmbkp_download_backup', 'hmbkp_download_backup_nonce' ) ); ?>" class="download-action"><?php _e( 'Download', 'backupwordpress' ); ?></a> |
+				<a href="<?php echo esc_url( wp_nonce_url( add_query_arg( array( 'hmbkp_backup_archive' => $encoded_file, 'hmbkp_schedule_id' => $schedule->get_id(), 'action' => 'hmbkp_request_download_backup' ), admin_url( 'admin-post.php' ) ), 'hmbkp_download_backup', 'hmbkp_download_backup_nonce' ) ); ?>" class="download-action"><?php esc_html_e( 'Download', 'backupwordpress' ); ?></a> |
 			<?php endif; ?>
 
-			<a href="<?php echo esc_url( wp_nonce_url( add_query_arg( array( 'hmbkp_backup_archive' => $encoded_file, 'hmbkp_schedule_id' => $schedule->get_id(), 'action' => 'hmbkp_request_delete_backup' ), admin_url( 'admin-post.php' ) ), 'hmbkp_delete_backup', 'hmbkp_delete_backup_nonce' ) ); ?>" class="delete-action"><?php _e( 'Delete', 'backupwordpress' ); ?></a>
+			<a href="<?php echo esc_url( wp_nonce_url( add_query_arg( array( 'hmbkp_backup_archive' => $encoded_file, 'hmbkp_schedule_id' => $schedule->get_id(), 'action' => 'hmbkp_request_delete_backup' ), admin_url( 'admin-post.php' ) ), 'hmbkp_delete_backup', 'hmbkp_delete_backup_nonce' ) ); ?>" class="delete-action"><?php esc_html_e( 'Delete', 'backupwordpress' ); ?></a>
 
 		</td>
 
@@ -72,7 +72,7 @@ function admin_notices() {
 
 		<div id="hmbkp-warning-backup" class="error notice is-dismissible">
 			<p>
-				<strong><?php _e( 'BackUpWordPress detected issues with your last backup.', 'backupwordpress' ); ?></strong>
+				<strong><?php esc_html_e( 'BackUpWordPress detected issues with your last backup.', 'backupwordpress' ); ?></strong>
 			</p>
 
 			<ul>
@@ -265,7 +265,7 @@ function schedule_status( Scheduled_Backup $schedule, $echo = true ) {
 
 	<span class="hmbkp-status"<?php if ( $status->get_status() ) { ?> title="<?php printf( __( 'Started %s ago', 'backupwordpress' ), human_time_diff( $status->get_start_time() ) ); ?>"<?php } ?>>
 		<?php echo $status->get_status() ? wp_kses_data( $status->get_status() ) : __( 'Starting backup...', 'backupwordpress' ); ?>
-		<a href="<?php echo admin_action_url( 'request_cancel_backup', array( 'hmbkp_schedule_id' => $schedule->get_id() ) ); ?>"><?php _e( 'cancel', 'backupwordpress' ); ?></a>
+		<a href="<?php echo admin_action_url( 'request_cancel_backup', array( 'hmbkp_schedule_id' => $schedule->get_id() ) ); ?>"><?php esc_html_e( 'cancel', 'backupwordpress' ); ?></a>
 	</span>
 
 	<?php $output = ob_get_clean();