Description

Wahab Migration Vault creates a single native .usm backup containing the WordPress database and wp-content data, and restores it with an engine built so that every operation is checkpointed, resumable and integrity-checked, with rollback procedures designed to reduce restore risks. Hosting limits and database privileges affect results.

The live database is modified by exactly one atomic RENAME TABLE; WordPress never sees a missing table.
Live files are moved (never deleted) into a journaled rollback area until the final health check passes.
Restore failures are handled by recovery and rollback workflows; verify recovery on a staging site before relying on it for production.
A private maintenance marker is used during site restore.
Keyset search/replace with no LIKE ‘%needle%’ scans, binary-safe columns, no-primary-key table support and oversized-value handling.
Streamed oversized rows, views/triggers, generated columns, exactly-once transactional import, destination privilege/packet/collation/storage preflight.
Per-chunk SHA-256 uploads with resumable server-side verification (no size cut-off).
Selective restore, mirror mode, orphan cleanup, WP-CLI commands and a fault-injection test matrix.

Supported formats:
* .usm — recommended native compact streaming backup with per-entry integrity checks and database integrity metadata
* .zip — legacy/native-compatible archive import
* .wpress — classic uncompressed compatibility mode; newer compressed/encrypted variants may not be supported

Human-readable source and build instructions

The complete, human-readable original JavaScript source is included in src/admin.js. The
matching authored stylesheet is src/admin.css. Both files are included in this ZIP and
neither is produced from private, inaccessible source. No third-party bundled/minified
JavaScript libraries are distributed, and no npm, Composer or webpack dependencies are
required. Readable developer source is maintained in src/admin.js and src/admin.css. The
plugin serves the whitespace-compacted assets/js/admin.min.js and
assets/css/admin.min.css files in production, and the original readable sources
when SCRIPT_DEBUG is enabled. Both sets are shipped in the plugin ZIP.

The build is reproducible without npm dependencies: run
python3 tools/build_assets.py
from the plugin root. This removes only redundant line indentation and empty
lines; it does not rewrite JS tokens or change string contents. The readable
assets/js/admin.js and assets/css/admin.css are retained as compatibility copies.
Serving the compact asset is an admin-only optimization (not a measured improvement
to public-site page load speed).

Security and performance notes

Only users with manage_options and a valid AJAX nonce can start ordinary migration operations.
During a database restore, migration-specific bearer tokens can authorize the remaining checkpoint calls because the restored database can invalidate the original WordPress login.
Backup deletion is restricted to supported archive filenames physically located in this plugin’s backup directory (no symlinks).

Migration and restore deliberately execute multiple SQL statements per batch and read large fields in bounded slices so PHP memory, database packet limits, journal semantics and resume checkpoints remain safe. These are not normal frontend page-load queries and cannot safely be merged into one bulk query.
Similarly, uncached HTTP probes are intentional: a fresh status check is needed on each migration/rollback, and cached responses would risk releasing broken sites.
The admin-only JS/CSS is loaded only on Site Migrator screens, not the public frontend or other admin screens.

Installation

Upload and activate the plugin.
Open Site Migrator -> System Status.
Use Export Site to create a backup, or Import Site to restore one.

FAQ

Which archive formats are supported?: The native .usm format is recommended. The plugin also has .zip archive import and a classic, uncompressed .wpress compatibility mode. Some newer or encrypted .wpress archives are not supported.
Can I restore on a different server?: The plugin is designed for migration and restore, but the destination requires sufficient database permissions, free storage, and compatible PHP/MySQL settings. Test on staging and keep an independent backup.
Does the plugin contact a third-party service?: Off-site Managed Recovery is optional, disabled unless configured by an administrator, and sends backup archives to the HTTPS endpoint the administrator chooses. Backup archives may contain personal and sensitive data. Review the destination service’s privacy and retention arrangements before enabling this option.
What is stored on my server?: Backups, logs, migration checkpoints, rollback files and diagnostic reports are stored inside the private uploads/wahab-migration-vault/ directory (resolved with wp_upload_dir()). The plugin creates access-control files where supported. Treat the archive contents as sensitive data; only operate through authenticated administrator actions and securely remove backups when no longer required.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“Wahab Migration Vault” is open source software. The following people have contributed to this plugin.

wahab133

Translate “Wahab Migration Vault” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

6.1.9

Removed the redundant Plugin URI header to resolve WordPress.org duplicate Plugin URI/Author URI rejection; kept the developer Author URI.
No backup format or database schema change.

6.1.8

Sanitize and validate all admin form checkbox flags at a single input boundary.
Make dashboard headings sequential and keep the sidebar appearance.
Read post-migration site URLs in one prepared query and reuse table metadata within a verification run.
Remove several condition assignments and empty archive drain loops.
Correct the readme license identifier; retain the last verified WordPress compatibility declaration.

6.1.7

Validate backup filenames, extensions, real paths and symlinks before any file mutation.
Use literal allowlisted admin views instead of dynamic includes.
Restrict hash checkpoint object deserialization and use safer restore health-check HTTP probes.
Reduce extra database metadata queries, repeated file-stat calls and redundant loop length calculations.
Improve input/accessibility labels, link names and heading levels in the admin UI.
Supply full GPL license text, admin-script handle prefix and additional security documentation.

6.1.6

Use dynamically resolved WordPress AJAX and file locations instead of assumed paths.
Migrate runtime identifiers, actions and options to the wahamiva prefix.
Route managed-recovery uploads through the WordPress HTTP API with scoped transport streaming.
Include fully readable JavaScript/CSS sources and reproducible asset instructions.
Preserve the native .usm archive format and migrate completed legacy backup archives.

6.1.4

Keep migration job bearer tokens AES-256-GCM encrypted on disk, with server-configured AUTH_KEY as key material. Convert safe-restore markers to store token hashes, not plaintext tokens.
Restrict imported SQL commands to intended staging tables and supported session settings; reject account/database modification commands in imported backups.
Bind dynamic search/replace SQL table and column names with WordPress %i placeholders.
Check PHP-uploaded chunk streams with is_uploaded_file().
Make AJAX nonce verification explicit via check_ajax_referer() for administrator actions.
Retain streaming archive formats and recoverable checkpoints.

6.1.3

Improve SQL identifier placeholders for database metadata, staging, export and URL replacement.
Reject traversal and symlink destinations when resolving archive entries.
Strengthen remote recovery URL validation and generic fatal error responses.
Update uninstall cleanup and storage location documentation.
Preserve original migration archive format and streaming APIs.

6.1.2

Add translator notes to placeholders reported by Plugin Check.
Reject invalid database checkpoint table identifiers.
Sanitize the archive format selector.
Document why binary backup streaming must not be HTML-escaped.
Preserve backup formats, migration flow, hooks, and stored identifiers.

6.1.1

Use a literal translation domain in gettext calls to improve WordPress.org string extraction.
Update plugin authorship and documentation while preserving migration data formats and internal identifiers.

6.1.0

Faster bounded backup/restore workers reduce round-trips while keeping timeout head-room and durable checkpoints.
Larger streaming windows improve large-site export/import throughput without loading whole files into PHP memory.
Faster journaled file activation and adaptive 2-4 worker Turbo Upload on capable hosts.
Integrity checks, shadow database staging, rollback protection and final health verification remain enabled.

6.0.1

Added optional administrator-enabled Managed Recovery Bridge for off-site backup copies.
Recovery uploads are asynchronous, HTTPS-only, and streamed to avoid loading full archives into PHP memory.
No recurring admin notice or popup is added; disclosure and controls are in Settings.

6.0.0

Production-hardened engine: bounded, resumable, exactly-once database import; atomic shadow activation; journaled exactly-once file commit; resumable rollback and cleanup.
Search/replace rewritten around primary-key keyset scanning (no LIKE ‘%needle%’), unique-index/natural-scan fallbacks for tables without a primary key, binary column protection and oversized-value handling.
Streamed export of oversized rows, views/triggers, generated-column awareness, DEFINER stripping.
Destination preflight: privileges via disposable probe tables, max_allowed_packet vs largest statement, sql_mode, collation/charset/engine mapping plan, real storage estimate.
Per-chunk SHA-256 upload integrity with resumable on-disk verification for backups of any size.
Comprehensive health check (core tables, roles/capabilities, prefix keys, uploads, theme/plugins, media, fatals, home, wp-admin, admin-ajax, REST) before rollback data is released.
Private non-blocking maintenance; theme neutralisation and update blocking during activation; persistent cache purge after the swap.
Mirror mode, selective restore, orphan cleanup, single-active-restore lock, recovery cron, WP-CLI commands.
Regression tests for the resumable CRC false failure, live-table destructive restore, serialized replace timeout, .maintenance deadlock and interruption recovery, plus a SIGKILL fault-injection matrix.

5.2.1

Shadow-database restore: source SQL imports into private temporary tables first, so live WordPress core tables are never dropped between AJAX requests.
Atomic database activation swaps the fully verified shadow DB into the destination prefix with one RENAME TABLE statement while preserving original tables for rollback.
Atomic database rollback swaps the original destination tables back if any later file/plugin/health-check step fails.
SQL rollback fallback now runs every DDL/DML checkpoint to completion in the same PHP process instead of incorrectly treating the first partial checkpoint as a completed rollback.
Destination DB health preflight blocks a new migration when required core tables are already missing.
Source prefix rewriting now supports a private physical staging prefix while WordPress role/capability option/meta keys are repaired to the final destination prefix.
Destination siteurl/home and migrator activation are written into the shadow options table before atomic activation.

5.0.1

Fix false resumable database CRC failures caused by stale checkpoint keys.
Persist exact durable job state so completed DB/file/export stages cannot be resurrected on the next request.
Recover stale v5.0.0 database and staged-file checkpoints; verify completed files directly before reporting corruption.
Preserve incomplete rollback state instead of falsely reporting a successful rollback.
Normalize native export format labels to usm/usm-native.

5.0.0

Resumable byte-range extraction for very large database and site files.
Durable state-file integrity checks and seven-day paused-job recovery window.
Native v6 database chunk integrity metadata for new backups; older native backups remain import-compatible.
Fast async import initialization with orphan-job recovery after browser/proxy disconnects.
Destination write preflight and safe single-site/multisite compatibility blocking.
Maintenance-marker ownership protection and active-job-aware temp/rollback cleanup.
Retains Turbo Upload, Import from Server, Migration Doctor, staged rollback, DB compatibility and serialization-safe URL/path replacement.

4.4.0

Added Migration Doctor with downloadable redacted JSON support reports for export, upload and import troubleshooting.
Added durable structured migration traces plus browser-side error capture so failures that never reach PHP logs are still recorded.
Added deep backup validation for native .usm CRC and database SHA-256 integrity.
Added Turbo Upload with up to three concurrent resumable upload parts for large browser uploads.
Added Import from Server for multi-GB backups already stored in Site Migrator -> Backups.
Clarified that the dashboard upload value is a per-request chunk limit, not the total backup size.

4.2.0

New compact native .usm streaming container with dramatically lower per-file overhead.
Native .usm CRC is written as a trailer, eliminating per-file seek-back writes.
8 MiB streaming buffers for backup and restore.
Database SHA-256 is calculated during the same pack/extract stream instead of re-reading the full SQL file.
Faster 10,000-row database export pages with keyset pagination on numeric primary keys.
Larger bounded database import and serialization-safe replacement batches.
Faster staging and journaled file commit batches while preserving rollback safety.
Existing v4 .usm/.wpress and older ZIP-based .usm imports remain supported.
Live throughput is shown during file export and staging.

4.1.1

Fixed browser-side upload aborts on slow hosts with adaptive chunk sizing, longer timeout, server checkpoint verification, resumable retries, and upload logging.

4.1.0

Native .usm exports use a fast append-only streaming container instead of repeatedly reopening ZIP archives.
Added per-entry CRC32 integrity plus database SHA-256 metadata.
Added per-job execution locks, durable status polling and resume after refresh/network interruption.
Network loss no longer automatically cancels and rolls back a healthy migration job.
Added bounded row-level database export and larger adaptive file/import batches.
Default upload chunk is 32MB where hosting limits allow it.
Old ZIP-based .usm backups remain import-compatible.

3.1.0

Added staged file restore and journaled file rollback.
Added a temporary MU safe-boot guard and protected runtime health check before releasing imported plugins/themes.
Added automatic isolation/quarantine handling for plugins that fatal during the protected trial.
Preserved destination hosting drop-ins rather than importing source-host cache/database drop-ins blindly.
Split long restore/search/commit work into bounded resumable requests.
Reduced network retry delays and trigger rollback after repeated connection failure.
Avoided re-reading database.sql during .wpress file extraction.
Existing v3.0.x .usm backups remain import-compatible; no re-export is normally required.

3.0.1

Added destination-aware MySQL/MariaDB collation compatibility.
MySQL 8 utf8mb4_0900_* collations are automatically mapped to a supported destination collation during restore.
Added utf8mb3/charset portability and unsupported storage-engine fallback.
Existing native v3 .usm backups remain import-compatible.

3.0.0

Rebuilt native .usm migration flow.
Added strict database/import error handling and automatic database rollback attempt.
Fixed skipped URL replacements caused by OFFSET pagination.
Added table-prefix role/capability repair.
Added native integrity metadata and SHA-256 database validation.
Added durable migration job state and restore authorization token.
Moved backups outside the plugin directory.
Prevented the migrator from overwriting/deactivating itself during restore.
Added resumable chunk uploads and byte-range backup downloads.