Move WordPress without touching a file
Install one plugin on your current site and paste a token. Hostney reads your database and files across on its own schedule, checksums every piece, and rewrites the config on arrival. No SSH, no FTP, no export archive, no downtime.
14 days free. No credit card. No commitment.
No SSH needed
Works on shared hosting
No renewal trap
Renews at the regular price
99.99%
Uptime, last 12 mo
Daily
Backups kept up to 30 days
210+
Tasks Ellie handles
In their words
What people say about hosting with us
“As a non-technical user who has had to stand up many web pages for projects [...] I was very pleasantly surprised with Hostney. The AI assistant Ellie was a tremendous help.”
“Hostney has been a great experience from the start. Anytime something comes up they're on it fast, no waiting around or getting bounced between support reps.”
“Amazing service! Company went above and beyond to help us get set up and functioning.”
“I host multiple websites with Hostney and the ease of management is what does it for me.”
“Hostney feels like the future. The entire process of setting up hosting was seamless, painless and quick.”
“Excellent, reliable service at reasonable prices.”
How it works
Five steps, and you do the first three
Two of them happen in your Hostney panel, one in your WordPress admin. The rest is ours.
Generate
Pick the destination in your panel and generate a migration token. It is valid for 24 hours.
Install
Search for Hostney Migration in your WordPress plugin directory, install it, and activate. It appears under Tools.
Connect
Paste the token. The plugin checks its own environment and registers with Hostney.
Pull
Start the migration from the panel. Our worker reads your database and files in batches.
Live
We create the database, rewrite wp-config, fix the URLs, and your site answers on Hostney.
The token is short-lived on purpose
The plugin checks all of this before it connects
Pull, not push
Why nothing runs on your server
Most migration plugins package your site up and send it. This one exposes a set of read-only endpoints and lets us come and get it. That single difference removes most of the ways a migration goes wrong.
Your host never builds an archive
Export-based plugins zip your entire site on your own server first. That is the step that runs out of disk, runs out of memory, or dies on a PHP timeout at 80%. Nothing is ever packaged here - we read what we need, when we need it.
Nothing has to run on your side
The transfer is driven entirely from ours. Your site does not need a working cron, a background worker, or a browser tab left open. It answers requests, which is the one thing it is already good at.
Your site stays up, and stays untouched
The plugin reads your site and leaves your content alone: no file, post or table row of yours is modified, moved or deleted at any point. The only things it writes or removes are its own settings, such as the connection token it deletes when the migration ends. Visitors see no difference while it runs.
A dropped connection is not a lost migration
Work is tracked per table batch and per file chunk, so a failure resumes from that point rather than from the beginning. One unreadable file does not take the other forty thousand with it.
What your host is asked to do
The entire surface the plugin exposes is six endpoints. Five are reads, and the sixth ends the connection by deleting the plugin's own token. Nothing here writes to your content, deletes it, or runs anything on your site.
- Health checkConfirms versions and the table prefix
- List tablesNames, row counts, sizes, structure
- Read rowsOne batch of one table
- Scan filesPaths, sizes and timestamps only
- Read a chunkOne slice of one file
- DisconnectDeletes the plugin's own token
The plugin is GPL, it is published in the WordPress plugin directory, and its source is public. None of this has to be taken on trust.
The difficult bits
Built for hosts that fight back
Migrations rarely fail because moving data is hard. They fail because the host in the middle is actively getting in the way - and every item below is a specific thing we hit and had to design around.
Getting past the host
Firewalls that block your own data
A WAF - ModSecurity, Wordfence, Imunify, Cloudflare - inspects response bodies, and a response full of SQL statements or PHP source looks exactly like an attack. It gets blocked, and the migration fails for a reason nobody can see. The plugin base64-wraps the whole response when we ask it to, so the firewall sees harmless text. The same works in reverse for request bodies.
Rate limits, respected on purpose
We pace the requests deliberately rather than pulling as fast as the link allows. Going flat out on shared hosting gets you throttled or temporarily banned, and the migration that finishes second is the one that finishes.
Retry rounds, not one retry
Files that failed are collected and retried in rounds with a growing pause between them - thirty seconds, then a minute, and up. That gives a rate limiter time to cool off instead of hammering it with the request it just refused.
Getting the data out cleanly
Keyset pagination, not LIMIT/OFFSET
Rows come back 200 at a time, ordered by primary key, with each request continuing from the last ID. OFFSET pagination makes the database re-count every row it is skipping, so page 5,000 of a large table is thousands of times slower than page one. Tables with no numeric key fall back to offsets, because correctness beats speed there.
Batches that shrink under pressure
If a batch trips the memory limit, the plugin halves it and tries again, up to three times. A handful of enormous rows - a page builder's layout data, a serialized options blob - would otherwise stop the whole export dead.
Chunked reads with a checksum each
Files come across in 2MB pieces, each carrying its byte offset, its length and an MD5 of the chunk. Silent truncation is the classic way a migrated site ends up with subtly broken media, and a per-chunk checksum is what catches it.
Binary columns survive the trip
BLOB and binary values are base64-encoded before they go into JSON and decoded on arrival. Anything that skips this quietly mangles the bytes.
Before you switch
Look at the whole site before you move a single DNS record
The scariest part of a migration is the cutover, so we take it out of the critical path.
The config we generate makes WordPress answer on whichever hostname the request actually arrived on. Your migrated site is therefore fully usable on its Hostney address the moment the import finishes - log in, click through the admin, check your theme, run your plugins, place a test order.
When you eventually point your domain at us, the same site keeps working on the real hostname with nothing else to change. No second search-replace, no half-migrated state, and none of the redirect-back-to-the-old-domain misery that makes people attempt migrations at two in the morning.
And the URLs are rewritten properly
Your old address is search-replaced to the new one across the database as part of the import, so links, image sources and serialized option values all follow. That runs before you ever see the site, not as a cleanup task afterwards.
The transfer
What comes across, and what we leave
A migration that copies everything is not thorough, it is slow. These exclusions are the difference between moving your site and moving your old host's junk drawer.
Comes across
Everything under the WordPress root
Core, themes, plugins - active and inactive - your uploads library, and anything else sitting in the directory.
Every database table
Not just the WordPress ones. Tables a plugin created for itself come too, with the table prefix preserved.
Your authentication keys and salts
Lifted out of your old wp-config and carried into the new one, so logged-in sessions survive the move instead of everyone being signed out.
Your original wp-config, kept
We write a clean config with the new database credentials and keep the old one beside it as wp-config.migrated.php. Any custom constant you had defined is still there to copy across.
Deliberately left behind
Caches and logs
Cache directories and log files are skipped. They rebuild themselves and they are frequently the largest thing on a site.
Other backup plugins' archives
UpdraftPlus, All-in-One WP Migration and friends keep gigabytes of old exports inside wp-content. Copying those across would move your backups of your old host to your new one.
Build artefacts and version control
node_modules and .git directories, plus .DS_Store, Thumbs.db and the rest of the operating-system litter.
While it runs
You can see exactly where it is
Five states, live logs, and a history entry that survives long after the migration finishes.
Awaiting plugin
The token exists and is waiting to be pasted in. Nothing has connected yet.
Plugin connected
Your site registered successfully. The panel now shows its WordPress version, PHP version and a size estimate, and the Start button is live.
Pulling
Tables and files are being read across. This is the long part, and the only phase you can pause.
Importing
The database goes in, wp-config is rewritten, and the URLs are search-replaced.
Completed
Your site is answering on Hostney and the migration stays in your history with its full log.
A live log, not a spinner
The log streams as it happens, so a slow migration and a stuck one look different. If something does fail, the message tells you which table or which file.
Pause and resume
Stop the pull during a busy period on your old host and pick it up later. It continues from where it stopped rather than starting again.
Two per account
An account can have two migrations under way. The server runs migrations one at a time, so the second waits its turn and then starts on its own - queue it before you walk away.
Kept in your history
Every migration stays listed with its method, its runtime and its full log, so you can answer "what happened on that one" weeks later.
Security
What you are putting on your site
You are putting a plugin with a read path to your database on a production site. That deserves specifics rather than reassurance.
Every single request is signed
HMAC-SHA256 over the timestamp and the request body, checked on every call. The signing key is derived from your token with a domain-separated hash rather than being the token itself.
A five-minute replay window
Requests carry a timestamp and are refused outside that window, so a captured request cannot be replayed later. Token and signature comparisons are constant-time.
The token is a 96-character secret
We store it encrypted, never in plain text. It has to be used within 24 hours, and until the migration starts you can revoke it from the panel.
The endpoints exist only while connected
No token stored means no routes registered. The plugin deletes the token when the migration is over, and in any case 7 days after you connect. Disconnecting revokes it at once, and deactivating the plugin clears the credentials with it.
Reads cannot leave the WordPress root
Every requested path is rejected for traversal sequences and null bytes, then resolved and confirmed to sit inside your WordPress directory before anything is read.
What connecting sends us
When you paste the token, the plugin registers your site with Hostney. That first call carries the token, a short description of your site, and nothing else:
- Site URL
- WordPress version
- PHP version
- Plugin version
- Size estimate
- Multisite or not
- Folder layout check
No file contents and no database rows are sent at that step - those only move once you press Start in the panel, and they move because we asked for them.
Other ways in
The plugin is not the only route
It is the right one for most WordPress sites. These two exist for when it is not.
Migrate over SSH
If you have shell access to your current server, we can connect directly, find your WordPress installations for you, and transfer without installing anything at all. Faster, and it does not care how locked down wp-admin is.
Have us do it
Included on every paid plan. Send us the details and our team moves your sites, checks them over, and tells you when to switch DNS. The right answer for a large media library, for anything unusual about your setup, and for anyone who would simply rather not.
Pricing
Simple, transparent pricing
Every plan includes managed WordPress, SSH access, daily backups, and enterprise-grade security. Start with a 14-day free trial.
Black Friday30% off up to 3 years with code BLACKFRIDAY30Ends Cyber Monday, November 30
Startup
Great for growing businesses
$7.89
$66.29 a year for up to 3 years, then $94.70/yr
- 1 website
- 10 GB storage
- ~10,000 visits/month: Approximate maximum monthly visits when all hosted sites use our built-in Nginx and Memcached caching
- 5 MySQL databases
- 250,000 inodes: Files, folders, etc.
- 5 FTP users
What's included:
SSL & Domain
- Free SSL certificate
- Free starter domain: A free Hostney address that goes live with your account, so you can build straight away and connect your own domain whenever you are ready
- 2 mailboxes: Shared across every domain on the account rather than counted per domain. Aliases are unlimited and free; a shared mailbox is a real mailbox, so each one uses a slot.
- 3 GB per mailbox: Storage for each mailbox, separate from your account storage.
- Webmail, IMAP and SMTP: Webmail in the browser at mail.hostney.com, plus IMAP and SMTP for Apple Mail, Outlook or any standard mail app. Two-step verification and per-device app passwords are included.
Advanced
For professional websites
$14.97
$125.79 a year for up to 3 years, then $179.70/yr
- 5 websites
- 20 GB storage
- ~110,000 visits/month: Approximate maximum monthly visits when all hosted sites use our built-in Nginx and Memcached caching
- 10 MySQL databases
- 500,000 inodes: Files, folders, etc.
- 10 FTP users
Everything in Startup, plus:
- 5 mailboxes: Shared across every domain on the account rather than counted per domain. Aliases are unlimited and free; a shared mailbox is a real mailbox, so each one uses a slot.
- 5 GB per mailbox: Storage for each mailbox, separate from your account storage.
Backups
- 14 days of backup history: How far back you can restore, download, or browse a backup on this plan. Older snapshots stay stored - upgrading unlocks them.
Performance
- Memcached object cache: In-memory object caching for database queries and sessions, with a cache browser in the panel. Memcached and Redis are the two engines available - an account runs one at a time and can switch between them.
- Redis object cache: Redis object caching with per-key expiry, LRU eviction, and a key browser in the panel. Redis runs instead of Memcached rather than alongside it, so switching engines is one click and the cache rebuilds itself on the next requests.
Pro
Maximum performance and features
$22.89
$192.29 a year for up to 3 years, then $274.70/yr
- 10 websites
- 40 GB storage
- ~200,000 visits/month: Approximate maximum monthly visits when all hosted sites use our built-in Nginx and Memcached caching
- 20 MySQL databases
- 750,000 inodes: Files, folders, etc.
- 20 FTP users
Everything in Advanced, plus:
- 10 mailboxes: Shared across every domain on the account rather than counted per domain. Aliases are unlimited and free; a shared mailbox is a real mailbox, so each one uses a slot.
- 10 GB per mailbox: Storage for each mailbox, separate from your account storage.
Deployment
- 2 SSR applications: Run server-rendered Node.js, Python, or Ruby apps in their own container - Next.js, Nuxt, Django, Rails, and more
Backups
- 30 days of backup history: How far back you can restore, download, or browse a backup on this plan - the full window we keep backups for.
Monitoring
- 1 minute between checks: How often we request the page. Two consecutive failures open an incident and a single success closes it, so you hear within roughly twice this interval.
For new customers on annual plans. Enter the code at checkout, or when you upgrade a free trial before the sale ends. The 30% comes off every year you pay for up front, 1 to 3 years; after that, renewals are at the plan's regular price. Ends 11:59 p.m. Eastern on Monday, November 30.
Migration is free
Bring your WordPress site across
Would it be a bad idea to copy your site across and click through it on its Hostney address before you move anything? Generate a token, install the plugin from the WordPress plugin directory, and nothing on your current host changes until you point your domain at us.
Questions