About this plugin
Contentrain Bridge turns your WordPress content into editable JSON and Markdown under Tools > Contentrain Bridge. You choose the content, review how it is modelled and which interface text travels, then download a ZIP or send the result to a branch in your own GitHub repository. Both are free.
- Advanced Custom Fields groups and repeaters become their own models with their own named fields, not one anonymous bag of values.
- Free software under GPL-2.0-or-later. No account, subscription or paid service is required for either delivery.
- Your WordPress site is not modified. The plugin reads content and source files; it never patches a theme or plugin. The one exception is opt-in: a switch, off by default, that adds a group for Contentrain Migrate to the robots.txt WordPress serves (see External services).
- Every export step is started by a logged-in administrator through a nonce-protected request, or, over the REST export API, by a program that administrator authorized with an application password or a connection key (see External services).
- Exports run in bounded steps and can be resumed, so large sites do not depend on one long request.
- Comment archiving is off by default. When enabled, email addresses, IP addresses and comment metadata are excluded.
- Metadata that looks like a password, token, key, credential or personal identifier is never exported, including inside selected fields.
- Exported site data remains the site owner’s data and is not placed under the plugin’s GPL license merely by being exported.
Media travels with the content: uploads are copied into media/ and the content is relinked to them, so the delivered repository does not depend on this site for images. A file over 8 MB, or one missing from the uploads directory, keeps its WordPress URL and is named in the coverage report. Dynamic WordPress and plugin output is not rendered during a source scan.
These limits are written into the coverage report rather than implied to be complete.
Want a working Astro website instead of files? utm_source=wordpress-org&utm_medium=readme
io/developer/mcp-cloud). None of them is required to use this plugin.
External services
The plugin contacts no host other than this site unless you choose GitHub delivery. Two options read this site’s own pages over HTTP, the way a visitor would, and send nothing elsewhere: “Also read the text your pages render” (the home page, a post, a page, search and not-found) and, with it, the connected-services check (the home page’s script hosts).
GitHub — used only when you enter a repository and a token in step 3 and start the delivery. com to read the target repository’s default branch (or the base branch you name) and file list, upload the exported files, and create one new branch holding them. What is sent: the exported content files you reviewed, a commit message, and the token you supplied.
Nothing is sent to Contentrain or to any other host, and no analytics or telemetry is collected. The token is used for those requests only and is never stored in the database or in the export. Delivery never writes to your default branch and never overwrites a file you edited in Git.
com/site-policy/privacy-policies/github-privacy-statement
REST export API (inbound) — the plugin adds routes under /wp-json/contentrain-bridge/v1/ that let a program you authorize start an export and read its files. The plugin sends nothing by itself: the program asks, with an application password of an administrator who has the export and manage_options capabilities, or with a Contentrain Migrate connection key (below). io/privacy-policy).
The program that starts an export chooses its scope: Migrate asks for private content (drafts, pending, scheduled, private and password-protected posts, never the password) and for comments, and the exported files carry each post’s own status. These routes only read: no remote call creates, edits or deletes posts, settings, files, users, plugins or themes; the plugin writes only its own temporary export files outside the web root and its own bookkeeping options.
Revoke the application password in your profile (or the connection key on the Bridge screen) to end that access; exports expire after a day.
txt (only when you turn it on) — Tools > Contentrain Bridge has a switch, off by default, “Let Contentrain Migrate read my pages and media”. txt WordPress itself serves, through WordPress’s robots_txt filter, and contacts no host. txt gives every crawler ( User-agent: * ), without the lines that close the whole site (a Disallow matching / ), followed by Allow lines for the REST API ( /wp-json/ ), your uploaded media ( /wp-content/uploads/ ) and /.
txt’s longest-match rule those Allow lines open only those paths: a rule such as Disallow: /wp- still keeps wp-admin closed. txt exactly as before. Turning it off removes the group, and uninstalling the plugin removes the setting.
txt file from disk, WordPress cannot change it: the switch stays off and the screen shows the lines to add yourself.
Privacy
The plugin stores export ownership and a source revision marker. It sends nothing anywhere on its own; an export leaves the site only when you download it, deliver it to GitHub, or authorize a program to read it through the REST export API with an administrator’s application password or a Contentrain Migrate connection key.
For a connection key the plugin stores a fingerprint of the key (never the key), the administrator who created it, the Migrate order it is paired with, the list of exports it started, and the time and IP address of its last use; creating a new key or revoking it, and uninstalling the plugin, removes them. A request made with the key runs with no WordPress user.
Export files are written to a private, per-site directory outside the web root that only the server can read, are removed on uninstall, and expire after a day. An export can contain site content, authors’ display names and WordPress usernames, selected post metadata and, if you or the program you authorized chose it, privacy-minimized comments of every status (approved, pending, spam and trash) and draft, pending, scheduled, private and password-protected posts (never the password).
A program authorized through the REST API chooses the scope; Contentrain Migrate asks for private content. Treat a downloaded export as you would a WordPress export file. If you deliver to GitHub, the exported content is sent to GitHub under the account whose token you provide; choose a private repository when the export includes draft or private content.