v1.3.5 — Free unlimited WordPress migration, with automatic URL, path and table-prefix conversion

Install by downloading open-migration-1.3.5.zip below, then Plugins → Add New → Upload Plugin in WordPress.

Full documentation: https://dicecodes.com/open-migration/

---

What this release is

A free WordPress migration and backup plugin with no upload size limit. Export a whole site to a single .zip and restore it onto any other WordPress install — including a brand new, empty one.

Restoring onto a fresh install needs no preparation. The plugin converts:

• Site URLs — including inside PHP-serialised option values, JSON-escaped block markup, URL-encoded links and protocol-relative references
• Absolute server paths stored by page builders and cache plugins
• The database table prefix — wp_oldsite_ into wp_, including the prefixed keys inside options and usermeta

Serialised values are unserialised, replaced and re-serialised so string length prefixes stay valid. A plain find-and-replace corrupts these.

Security fixes

This release fixes two file-write vulnerabilities in the import routine. Upgrading is strongly recommended.

• Arbitrary file write — import identifiers were not restricted to safe characters. sanitize_text_field() leaves ../ intact and was not sufficient on its own.
• Zip slip — archive entries were extracted without validation. Entries are now checked one by one and rejected, not sanitised, if they would escape wp-content.
• Publicly reachable database dump — database.sql was extracted into the web root. It now goes to a private working directory.
• Session key at rest — only a SHA-256 hash is stored, so reading the session file cannot yield a usable credential.
• Backup downloads — streamed through WordPress behind a capability and nonce check rather than relying on .htaccess, which Nginx ignores entirely.
• Address validation — esc_url_raw() sanitises rather than validates, so htp://typo.com was silently accepted as https://htp//typo.com. Committing that would have rewritten the whole database to an address that does not resolve.

Correctness fixes

• Exports no longer include the backup directory itself, which previously made each export absorb every earlier backup.
• Search and replace now uses the full primary key. Only the last key column was used, which could overwrite unrelated rows in tables with a composite key such as wp_term_relationships.
• Queries are scoped to this site's table prefix rather than the whole database, which matters on shared databases.
• Paginated queries use a stable ORDER BY, so a write during an export cannot cause rows to be skipped or duplicated.
• Database batches are sized from the table's average row length instead of a fixed 500 rows, which could exhaust memory on sites with very large post content.
• Failed SQL statements are surfaced instead of the import reporting success regardless.

New

• Change Domain tab — switch the site address after DNS is pointed at the new server, or move from http to https. Includes a DNS pre-flight check that proves the new address really resolves to this server before anything is written. Changing the address too early is the one mistake that takes a site offline at both domains.
• Table prefix conversion during import.
• Drag and drop upload, which the interface described but never actually implemented.
• Accessible confirmation dialogs replacing native browser alerts. Cancel takes focus by default, so Enter cannot destroy anything, and the dialog names exactly what is about to change.
• Server check on the Export tab: ZipArchive, PHP version, folder permissions, database size and free disk space.
• Transients are excluded from exports, and a warning appears before importing an archive built on a newer WordPress or PHP version.

Requirements

• WordPress 5.6 or newer, tested up to 7.0
• PHP 7.2 or newer with the ZipArchive extension
• Single-site installs — multisite is detected and refused rather than partially migrated

Licence

GPLv2 or later. Free and open source, with no paid tier, no premium extensions and no data collection of any kind.