Description

InstaMigrate provides authenticated REST API endpoints that enable full WordPress site migrations between servers. It handles database export/import with binary-safe hex encoding, file archiving and transfer, and serialization-aware search-replace for domain changes.

Features:

Database export with binary-safe hex encoding (preserves serialized PHP data)
Database import with streaming line-by-line parsing (handles large dumps)
File upload, download, archiving (tar.gz/zip), and extraction
Serialization-aware search-replace for domain migrations
Dual authentication: API key header or WordPress Application Passwords
WP-CLI detection (informational, reported in status endpoint)
Admin UI showing API key and endpoint documentation

Important: This plugin grants full database and filesystem access via its REST API. Deactivate and delete it immediately after your migration is complete.

Installation

Upload the insta-migrate folder to /wp-content/plugins/
Activate the plugin through the ‘Plugins’ menu in WordPress
Go to Tools > InstaMigrate to find your API key
Use the API key in the X-Insta-Key header for all REST API requests
Remove the plugin after migration is complete

FAQ

Where do I find my API key?: Go to Tools > InstaMigrate in your WordPress admin. The API key is displayed there and can be regenerated if needed.
Is this plugin safe to leave active?: No. This plugin exposes powerful migration endpoints. Always deactivate and delete it after your migration is complete.
Does it handle serialized data during search-replace?: Yes. The search-replace engine correctly unserializes PHP data, performs replacements recursively, then re-serializes with updated byte counts.
What authentication methods are supported?: Two methods: (1) X-Insta-Key header with the plugin API key, or (2) WordPress Application Passwords via HTTP Basic Auth (requires admin privileges).

Reviews

There are no reviews for this plugin.

Contributors & Developers

“InstaMigrate” is open source software. The following people have contributed to this plugin.

InstaWP

Translate “InstaMigrate” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

1.5.0

Internal version alignment (header and constant now both report 1.5.0)
No functional changes from 1.4.0

1.4.0

Security: Permission callbacks now require manage_network (super admin) on multisite, instead of manage_options which subsite admins may have
Security: File concat (/files/concat) output restricted to plugin temp directory only
Security: File search-replace (/files/search-replace) restricted to uploads directory only
Security: File upload (/files/upload) destination restricted to uploads directory only
Security: File search-replace now uses WP_Filesystem for reads and writes instead of direct PHP file functions
Change: Temp directory moved from wp-content/insta-migrate-tmp/ to wp-content/uploads/insta-migrate-tmp/ per wp.org guidelines

1.3.0

Removed all exec()/shell_exec() calls per wp.org plugin guidelines
Removed /wp-cli REST endpoint (required exec)
Archive creation and extraction now use PharData/ZipArchive exclusively
Binary detection (has_wp_cli) now uses hardcoded path checks only

1.2.0

New: /db/fix-prefix endpoint — fixes usermeta meta_key and options option_name values after a migration where the table prefix changed. Prevents users losing roles/capabilities when the sed prefix-rewrite missed single-quoted values.

1.1.0

New: /files/concat endpoint — concatenate chunked file uploads on the server (for large archives exceeding PHP upload limit)
New: /files/search-replace endpoint — search-replace strings within static files on disk (CSS/JS/JSON), used for Elementor CSS domain replacement after DB search-replace
Fix: Numeric columns (INT, BIGINT, DECIMAL, etc.) now exported as plain numbers, not hex-encoded. Prevents MySQL from misinterpreting hex literals as integers.

1.0.0

Initial release
Database export/import with hex encoding
File upload, download, archive, extract
Serialization-aware search-replace
Dual authentication (API key + Application Passwords)
WP-CLI detection in status endpoint
Admin UI with API key management

Description

Installation

FAQ

Where do I find my API key?

Is this plugin safe to leave active?

Does it handle serialized data during search-replace?

What authentication methods are supported?