About this plugin
You are building a new web or mobile application and want to keep the people who already have an account on your WordPress site. NEWTIV Migrate exports, in one file:
- users: username, email, name, registration date, roles, and optionally their password hashes, profile fields, WooCommerce addresses and any other user meta you name;
- content: posts, pages, products and custom post types, with categories, tags, custom fields and author;
- comments (without IP addresses) and the media library list with file addresses.
8 and later), then store it in its own format at the first sign-in. Nobody has to reset their password.
Security first
- The file is always encrypted with a passphrase you choose: key derived with Argon2id, content encrypted with XChaCha20-Poly1305 (libsodium secretstream). Without the passphrase the file cannot be read.
- The file is streamed to your browser and never stored on the server.
- Only administrators can export, and they must type their account password again. Five wrong passwords lock the export for 15 minutes.
- The last 20 exports are listed: who, when, how many records, with or without password hashes.
- Privacy: the export log stores, for each export, the date, the administrator’s username and IP address. It is deleted when the plugin is uninstalled.
- Password hashes are optional: untick them for a content-only export.
Large sites: users and content are read in batches of 200. ntvm (see wp help newtiv-migrate export ).
This plugin does not connect to any external service.
File format
- First line: NTVMIG1.
- Second line: a JSON header with the key derivation parameters ( kdf.alg = argon2id13, kdf.opslimit, kdf.memlimit, kdf.salt in base64) and the secretstream header ( header, base64).
- Then frames: a 4-byte big-endian length followed by the ciphertext of one secretstream message. The last frame has the FINAL tag; a file without it is incomplete.
Key: crypto_pwhash(32, passphrase, salt, opslimit, memlimit, ARGON2ID13). Decrypted, the frames form NDJSON, one record per line, each with a type: meta, user, term, post, media, comment, then end with the counts, to check that nothing is missing.
js), ext-sodium (PHP).
User records carry pass and pass_format ( wp-bcrypt, phpass, bcrypt, md5, argon2 ). Meta values are exported exactly as stored in WordPress (arrays stay PHP-serialized).