Site Migration

What it does

Exports a WordPress site — its database, and the uploads, themes and plugins under wp-content — into one encrypted archive, with options to leave out media, themes, plugins, spam comments or revisions. The archive is always encrypted with a password you set; nobody, including us, can open one without it.

An import starts from a file uploaded in the browser, sent in chunks so the server's upload size limit does not apply, or from WP-CLI pointed at an archive already copied onto the server. The same commands cover export, import, list, delete and restore. Importing writes the database under a temporary table prefix and swaps it in once the import has finished, and extracts files to a separate staging directory before moving them into place. Before any of that starts, a backup of the site being imported into is taken, and that backup can be restored.

A Backups tab lists every archive this site has made, with a download, a restore and a delete action against each one. Storage can be pointed outside the web root. Nothing read from an archive is ever unserialized, and every file path in one is checked against the directory it is meant to land in before anything is written. Every screen and action needs an administrator account.

It sends no telemetry and talks to no outside service. The one request it makes is to this site's own address, to check that its storage directory cannot be read over the web.

What the licence covers

• Updates to the plugin for as long as the licence is current, in Dashboard → Updates like any other plugin — or installed for you as part of your regular update run if we look after your site.
• Compatibility work as WordPress and PHP change.
• Support by email from the people who wrote it.

What it does not do

• Single site only. It is not multisite-aware, and a multisite install is not supported.
• No scheduled backups. An export runs when you start it, from the plugin's screen or from WP-CLI.
• No cloud storage. An archive is written to this site, or to the directory you point it at — getting it anywhere else is your own transfer.
• It does not import a .wpress archive from All-in-One WP Migration or any other tool's format. It reads only its own archives.
• An archive is always password-encrypted, and the password is never stored anywhere. Lose it and the archive cannot be opened by anyone, including us.
• It is not a backup service. Nothing is scheduled, retained or stored off-site on your behalf — what you export is a file you are responsible for.
• Must-use plugins are left out unless you tick the option. An export does not carry wp-content/mu-plugins by default; ticking the box on the Export or Import screen, or passing --include-mu-plugins on WP-CLI, includes them. Even when they are left out, an import lists their filenames on the confirmation screen so nothing is silently missing.

Requirements

WordPress

6.5 or later

PHP

8.1 or later

PHP extensions

sodium and zlib

Version and changelog