CodePoint Server-to-Server Migration

CodePoint Server-to-Server Migration moves a WordPress site from one server to

another with the

destination driving the process. This matters when:

• the new site sits on a temporary IP address before you point the domain,

• your own upload bandwidth is limited,

• the hosts involved offer no SSH/WP-CLI access,

• shared-hosting execution limits kill long-running processes.

All transfer happens server-to-server in short resumable chunks — nothing large

ever passes through your own connection, and no single request runs long enough

to hit a typical timeout.

Features

• One-time, expiring connection keys — the old site issues a key valid for

72 hours. Access is granted only by a constant-time comparison of the secret

itself, backed by per-IP and global lockouts. No key exists until you create

one, you can revoke it at any moment, and it is destroyed automatically when

a migration completes or is abandoned.

• Direct file streaming — files transfer straight from the old server into

place on the new one, in resumable 16MB batches. No archive is built, no

extraction step runs, and no double disk space is needed on either side.

• Chunked everything — scanning, transfer, database export, and import all

run in ~6-second increments. Pause, close the tab, resume — even mid-file.

• Safe URL rewriting — serialized PHP data is unserialized, replaced

recursively, and re-serialized; JSON-escaped URL variants are covered; table

prefix differences are reconciled (capabilities, user_roles).

• Staged, atomic switchover — the database imports into staging tables

while the live site keeps working. Finalize swaps every table in a single

statement, so either the whole switch happens or nothing does, and your

previous tables are kept as a rollback backup (prefixed cps2s_old_ after your

g. wp_cps2s_old_options).

• Change domain name — after your domain points to the new site, run a

chunked, serialized-safe search/replace to swap the temporary URL for the

final domain across pages, posts, and settings.

• Pre-flight checks — multisite, WordPress/PHP version mismatches, disk

space, plain-HTTP transport, and same-URL mistakes are flagged before

anything runs.

• Security hardened — capability + nonce checks on every request,

expiring single-use connection keys verified by a constant-time secret

comparison, brute-force lockout on the transfer endpoints, randomized

and access-protected work directory, strict file-path and SQL-identifier

validation.

What it does not do

• WordPress core files (the destination must already be a working install)

• Multisite networks

• wp-config.php and.htaccess

External services

This plugin connects only to the paired WordPress site you configure — the

site whose connection key you paste in. During a migration the new site sends

authenticated requests to the old site’s REST API (namespace codepoint-s2s/v1 )

to prepare and stream files and database content. The data transmitted is your

own site content. No data is sent to the plugin author or to any third-party

service.

Privacy

The plugin transfers your site’s files and database between your own two

servers. Temporary work files are stored in a randomized, access-protected

directory inside wp-content/uploads and are removed when the migration finishes

(or when you press Start over). If the old site is served over plain HTTP, the

transfer is not encrypted in transit — the plugin warns you about this before

you start; using HTTPS on both sites is strongly recommended.

This plugin does not track users, does not phone home, and does not load remote

scripts or analytics.