{"id":288571,"date":"2026-04-03T06:39:29","date_gmt":"2026-04-03T06:39:29","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/instamigrate\/"},"modified":"2026-04-03T06:39:17","modified_gmt":"2026-04-03T06:39:17","slug":"instamigrate","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/instamigrate\/","author":20510789,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.5.0","stable_tag":"1.5.0","tested":"6.9.4","requires":"5.0","requires_php":"7.4","requires_plugins":null,"header_name":"InstaMigrate","header_author":"InstaWP","header_description":"Migration helper for WordPress site transfers. Provides secure REST API endpoints for database import, file transfer, and search-replace. REMOVE THIS PLUGIN AFTER MIGRATION.","assets_banners_color":"","last_updated":"2026-04-03 06:39:17","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/wordpress.org\/plugins\/instamigrate\/","header_author_uri":"https:\/\/instawp.com\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":33,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.5.0":{"tag":"1.5.0","author":"instawp","date":"2026-04-03 06:39:17"}},"upgrade_notice":[],"ratings":[],"assets_icons":[],"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.5.0"],"block_files":[],"assets_screenshots":[],"screenshots":[],"jetpack_post_was_ever_published":false},"plugin_section":[],"plugin_tags":[151,2814,153,4155,10745],"plugin_category":[59],"plugin_contributors":[212275],"plugin_business_model":[],"class_list":["post-288571","plugin","type-plugin","status-publish","hentry","plugin_tags-backup","plugin_tags-clone","plugin_tags-database","plugin_tags-migration","plugin_tags-transfer","plugin_category-utilities-and-tools","plugin_contributors-instawp","plugin_committers-instawp"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/instamigrate.svg","icon_2x":false,"generated":true},"screenshots":[],"raw_content":"<!--section=description-->\n<p>InstaMigrate provides authenticated REST API endpoints that enable full WordPress site migrations between servers. It handles database export\/import with binary-safe hex encoding, file archiving and transfer, and serialization-aware search-replace for domain changes.<\/p>\n\n<p><strong>Features:<\/strong><\/p>\n\n<ul>\n<li>Database export with binary-safe hex encoding (preserves serialized PHP data)<\/li>\n<li>Database import with streaming line-by-line parsing (handles large dumps)<\/li>\n<li>File upload, download, archiving (tar.gz\/zip), and extraction<\/li>\n<li>Serialization-aware search-replace for domain migrations<\/li>\n<li>Dual authentication: API key header or WordPress Application Passwords<\/li>\n<li>WP-CLI detection (informational, reported in status endpoint)<\/li>\n<li>Admin UI showing API key and endpoint documentation<\/li>\n<\/ul>\n\n<p><strong>Important:<\/strong> This plugin grants full database and filesystem access via its REST API. Deactivate and delete it immediately after your migration is complete.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>insta-migrate<\/code> folder to <code>\/wp-content\/plugins\/<\/code><\/li>\n<li>Activate the plugin through the 'Plugins' menu in WordPress<\/li>\n<li>Go to Tools &gt; InstaMigrate to find your API key<\/li>\n<li>Use the API key in the <code>X-Insta-Key<\/code> header for all REST API requests<\/li>\n<li><strong>Remove the plugin after migration is complete<\/strong><\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"where%20do%20i%20find%20my%20api%20key%3F\"><h3>Where do I find my API key?<\/h3><\/dt>\n<dd><p>Go to Tools &gt; InstaMigrate in your WordPress admin. The API key is displayed there and can be regenerated if needed.<\/p><\/dd>\n<dt id=\"is%20this%20plugin%20safe%20to%20leave%20active%3F\"><h3>Is this plugin safe to leave active?<\/h3><\/dt>\n<dd><p>No. This plugin exposes powerful migration endpoints. Always deactivate and delete it after your migration is complete.<\/p><\/dd>\n<dt id=\"does%20it%20handle%20serialized%20data%20during%20search-replace%3F\"><h3>Does it handle serialized data during search-replace?<\/h3><\/dt>\n<dd><p>Yes. The search-replace engine correctly unserializes PHP data, performs replacements recursively, then re-serializes with updated byte counts.<\/p><\/dd>\n<dt id=\"what%20authentication%20methods%20are%20supported%3F\"><h3>What authentication methods are supported?<\/h3><\/dt>\n<dd><p>Two methods: (1) <code>X-Insta-Key<\/code> header with the plugin API key, or (2) WordPress Application Passwords via HTTP Basic Auth (requires admin privileges).<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.5.0<\/h4>\n\n<ul>\n<li>Internal version alignment (header and constant now both report 1.5.0)<\/li>\n<li>No functional changes from 1.4.0<\/li>\n<\/ul>\n\n<h4>1.4.0<\/h4>\n\n<ul>\n<li>Security: Permission callbacks now require <code>manage_network<\/code> (super admin) on multisite, instead of <code>manage_options<\/code> which subsite admins may have<\/li>\n<li>Security: File concat (<code>\/files\/concat<\/code>) output restricted to plugin temp directory only<\/li>\n<li>Security: File search-replace (<code>\/files\/search-replace<\/code>) restricted to uploads directory only<\/li>\n<li>Security: File upload (<code>\/files\/upload<\/code>) destination restricted to uploads directory only<\/li>\n<li>Security: File search-replace now uses WP_Filesystem for reads and writes instead of direct PHP file functions<\/li>\n<li>Change: Temp directory moved from <code>wp-content\/insta-migrate-tmp\/<\/code> to <code>wp-content\/uploads\/insta-migrate-tmp\/<\/code> per wp.org guidelines<\/li>\n<\/ul>\n\n<h4>1.3.0<\/h4>\n\n<ul>\n<li>Removed all exec()\/shell_exec() calls per wp.org plugin guidelines<\/li>\n<li>Removed <code>\/wp-cli<\/code> REST endpoint (required exec)<\/li>\n<li>Archive creation and extraction now use PharData\/ZipArchive exclusively<\/li>\n<li>Binary detection (has_wp_cli) now uses hardcoded path checks only<\/li>\n<\/ul>\n\n<h4>1.2.0<\/h4>\n\n<ul>\n<li>New: <code>\/db\/fix-prefix<\/code> endpoint \u2014 fixes usermeta meta_key and options option_name values after a migration where the table prefix changed. Prevents users losing roles\/capabilities when the sed prefix-rewrite missed single-quoted values.<\/li>\n<\/ul>\n\n<h4>1.1.0<\/h4>\n\n<ul>\n<li>New: <code>\/files\/concat<\/code> endpoint \u2014 concatenate chunked file uploads on the server (for large archives exceeding PHP upload limit)<\/li>\n<li>New: <code>\/files\/search-replace<\/code> endpoint \u2014 search-replace strings within static files on disk (CSS\/JS\/JSON), used for Elementor CSS domain replacement after DB search-replace<\/li>\n<li>Fix: Numeric columns (INT, BIGINT, DECIMAL, etc.) now exported as plain numbers, not hex-encoded. Prevents MySQL from misinterpreting hex literals as integers.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release<\/li>\n<li>Database export\/import with hex encoding<\/li>\n<li>File upload, download, archive, extract<\/li>\n<li>Serialization-aware search-replace<\/li>\n<li>Dual authentication (API key + Application Passwords)<\/li>\n<li>WP-CLI detection in status endpoint<\/li>\n<li>Admin UI with API key management<\/li>\n<\/ul>","raw_excerpt":"Secure REST API endpoints for WordPress site migration \u2014 database export\/import, file transfer, and search-replace.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/288571","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=288571"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/instawp"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=288571"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=288571"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=288571"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=288571"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=288571"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=288571"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}