Move WordPress without touching a file
Install one plugin on your current site and paste a token. Hostney reads your database and files across on its own schedule, checksums every piece, and rewrites the config on arrival. No SSH, no FTP, no export archive, no downtime.
14 days free. No credit card. No commitment.
No SSH needed
Works on shared hosting
Same price
On renewal, every year
99.99%
Uptime, last 12 mo
Daily
Backups kept up to 30 days
190+
Tasks Ellie handles
How it works
Five steps, and you do the first three
Two of them happen in your Hostney panel, one in your WordPress admin. The rest is ours.
Generate
Pick the destination in your panel and generate a migration token. It is valid for 24 hours.
Install
Search for Hostney Migration in your WordPress plugin directory, install it, and activate. It appears under Tools.
Connect
Paste the token. The plugin checks its own environment and registers with Hostney.
Pull
Start the migration from the panel. Our worker reads your database and files in batches.
Live
We create the database, rewrite wp-config, fix the URLs, and your site answers on Hostney.
The token is short-lived on purpose
The plugin checks all of this before it connects
Pull, not push
Why nothing runs on your server
Most migration plugins package your site up and send it. This one exposes a set of read-only endpoints and lets us come and get it. That single difference removes most of the ways a migration goes wrong.
Your host never builds an archive
Export-based plugins zip your entire site on your own server first. That is the step that runs out of disk, runs out of memory, or dies on a PHP timeout at 80%. Nothing is ever packaged here - we read what we need, when we need it.
Nothing has to run on your side
The transfer is driven entirely from ours. Your site does not need a working cron, a background worker, or a browser tab left open. It answers requests, which is the one thing it is already good at.
Your site stays up, and stays untouched
Every endpoint the plugin exposes is a read. Nothing on your source site is modified, moved or deleted at any point, and visitors see no difference while it runs.
A dropped connection is not a lost migration
Work is tracked per table batch and per file chunk, so a failure resumes from that point rather than from the beginning. One unreadable file does not take the other forty thousand with it.
What your host is asked to do
The entire surface the plugin exposes is five endpoints, and every one of them is a read. There is nothing here that writes, deletes, or runs anything on your site.
- Health checkConfirms versions and the table prefix
- List tablesNames, row counts, sizes, structure
- Read rowsOne batch of one table
- Scan filesPaths, sizes and timestamps only
- Read a chunkOne slice of one file
The plugin is GPL, it is published in the WordPress plugin directory, and its source is public. None of this has to be taken on trust.
The difficult bits
Built for hosts that fight back
Migrations rarely fail because moving data is hard. They fail because the host in the middle is actively getting in the way - and every item below is a specific thing we hit and had to design around.
Getting past the host
Firewalls that block your own data
A WAF - ModSecurity, Wordfence, Imunify, Cloudflare - inspects response bodies, and a response full of SQL statements or PHP source looks exactly like an attack. It gets blocked, and the migration fails for a reason nobody can see. The plugin base64-wraps the whole response when we ask it to, so the firewall sees harmless text. The same works in reverse for request bodies.
Rate limits, respected on purpose
We pace the requests deliberately rather than pulling as fast as the link allows. Going flat out on shared hosting gets you throttled or temporarily banned, and the migration that finishes second is the one that finishes.
Retry rounds, not one retry
Files that failed are collected and retried in rounds with a growing pause between them - thirty seconds, then a minute, and up. That gives a rate limiter time to cool off instead of hammering it with the request it just refused.
Getting the data out cleanly
Keyset pagination, not LIMIT/OFFSET
Rows come back 200 at a time, ordered by primary key, with each request continuing from the last ID. OFFSET pagination makes the database re-count every row it is skipping, so page 5,000 of a large table is thousands of times slower than page one. Tables with no numeric key fall back to offsets, because correctness beats speed there.
Batches that shrink under pressure
If a batch trips the memory limit, the plugin halves it and tries again, up to three times. A handful of enormous rows - a page builder's layout data, a serialized options blob - would otherwise stop the whole export dead.
Chunked reads with a checksum each
Files come across in 2MB pieces, each carrying its byte offset, its length and an MD5 of the chunk. Silent truncation is the classic way a migrated site ends up with subtly broken media, and a per-chunk checksum is what catches it.
Binary columns survive the trip
BLOB and binary values are base64-encoded before they go into JSON and decoded on arrival. Anything that skips this quietly mangles the bytes.
Before you switch
Look at the whole site before you move a single DNS record
The scariest part of a migration is the cutover, so we take it out of the critical path.
The config we generate makes WordPress answer on whichever hostname the request actually arrived on. Your migrated site is therefore fully usable on its Hostney address the moment the import finishes - log in, click through the admin, check your theme, run your plugins, place a test order.
When you eventually point your domain at us, the same site keeps working on the real hostname with nothing else to change. No second search-replace, no half-migrated state, and none of the redirect-back-to-the-old-domain misery that makes people attempt migrations at two in the morning.
And the URLs are rewritten properly
Your old address is search-replaced to the new one across the database as part of the import, so links, image sources and serialized option values all follow. That runs before you ever see the site, not as a cleanup task afterwards.
The transfer
What comes across, and what we leave
A migration that copies everything is not thorough, it is slow. These exclusions are the difference between moving your site and moving your old host's junk drawer.
Comes across
Everything under the WordPress root
Core, themes, plugins - active and inactive - your uploads library, and anything else sitting in the directory.
Every database table
Not just the WordPress ones. Tables a plugin created for itself come too, with the table prefix preserved.
Your authentication keys and salts
Lifted out of your old wp-config and carried into the new one, so logged-in sessions survive the move instead of everyone being signed out.
Your original wp-config, kept
We write a clean config with the new database credentials and keep the old one beside it as wp-config.migrated.php. Any custom constant you had defined is still there to copy across.
Deliberately left behind
Caches and logs
Cache directories and log files are skipped. They rebuild themselves and they are frequently the largest thing on a site.
Other backup plugins' archives
UpdraftPlus, All-in-One WP Migration and friends keep gigabytes of old exports inside wp-content. Copying those across would move your backups of your old host to your new one.
Build artefacts and version control
node_modules and .git directories, plus .DS_Store, Thumbs.db and the rest of the operating-system litter.
While it runs
You can see exactly where it is
Five states, live logs, and a history entry that survives long after the migration finishes.
Awaiting plugin
The token exists and is waiting to be pasted in. Nothing has connected yet.
Plugin connected
Your site registered successfully. The panel now shows its WordPress version, PHP version and a size estimate, and the Start button is live.
Pulling
Tables and files are being read across. This is the long part, and the only phase you can pause.
Importing
The database goes in, wp-config is rewritten, and the URLs are search-replaced.
Completed
Your site is answering on Hostney and the migration stays in your history with its full log.
A live log, not a spinner
The log streams as it happens, so a slow migration and a stuck one look different. If something does fail, the message tells you which table or which file.
Pause and resume
Stop the pull during a busy period on your old host and pick it up later. It continues from where it stopped rather than starting again.
Two at a time
You can run two migrations concurrently per account, which is what you want when you are moving a handful of client sites in an evening.
Kept in your history
Every migration stays listed with its method, its runtime and its full log, so you can answer "what happened on that one" weeks later.
Security
What you are putting on your site
You are putting a plugin with a read path to your database on a production site. That deserves specifics rather than reassurance.
Every single request is signed
HMAC-SHA256 over the timestamp and the request body, checked on every call. The signing key is derived from your token with a domain-separated hash rather than being the token itself.
A five-minute replay window
Requests carry a timestamp and are refused outside that window, so a captured request cannot be replayed later. Token and signature comparisons are constant-time.
The token is a 96-character secret
We keep only a hash of it. It expires after 24 hours, and you can revoke it from the panel at any point.
The endpoints exist only while connected
No token stored means no routes registered. Disconnecting revokes the token, and deactivating the plugin clears the credentials with it.
Reads cannot leave the WordPress root
Every requested path is rejected for traversal sequences and null bytes, then resolved and confirmed to sit inside your WordPress directory before anything is read.
What connecting sends us
When you paste the token, the plugin registers your site with Hostney. That first call carries four things and nothing else:
- Site URL
- WordPress version
- PHP version
- Size estimate
No file contents and no database rows are sent at that step - those only move once you press Start in the panel, and they move because we asked for them.
Other ways in
The plugin is not the only route
It is the right one for most WordPress sites. These two exist for when it is not.
Migrate over SSH
If you have shell access to your current server, we can connect directly, find your WordPress installations for you, and transfer without installing anything at all. Faster, and it does not care how locked down wp-admin is.
Have us do it
Included on every paid plan. Send us the details and our team moves your sites, checks them over, and tells you when to switch DNS. The right answer for a large media library, for anything unusual about your setup, and for anyone who would simply rather not.
Pricing
Simple, transparent pricing
Every plan includes managed WordPress, SSH access, daily backups, and enterprise-grade security. Start with a 14-day free trial.
Startup
Great for growing businesses
$94.99 billed annually
- 1 website
- 10 GB storage
- ~10,000 visits/month
- 5 MySQL databases
- 250,000 inodes
- 5 FTP users
What's included:
SSL & Domain
- Free SSL certificate
- Free starter domain
Apps & CMS
- 1-click WordPress
- Managed WordPress
- WordPress staging
Advanced
For professional websites
$179.99 billed annually
- 5 websites
- 20 GB storage
- ~110,000 visits/month
- 10 MySQL databases
- 500,000 inodes
- 10 FTP users
Everything in Startup, plus:
Backups
- 14 days of backup history
Performance
- Memcached
Pro
Maximum performance and features
$274.99 billed annually
- 10 websites
- 40 GB storage
- ~200,000 visits/month
- 20 MySQL databases
- 750,000 inodes
- 20 FTP users
Everything in Advanced, plus:
Deployment
- 2 SSR applications
Backups
- 30 days of backup history
Migration is free
Bring your WordPress site across
Generate a token, install the plugin from the WordPress plugin directory, and bring your site across. Nothing on your current host changes until you decide to point your domain at us.
Questions