InstaMigrate changelog and version history

202619 releases

1. InstaMigrate 1.9.1Latest

   Oct 29, 2026
   • Fix: extracting a .tar or .tar.gz no longer loses files whose path is longer than 100 characters. Archives written in the common PAX format (Python, bsdtar, macOS tar) used to drop those files silently, and a plugin missing one of its files could take the whole site down. Every tar archive is now c…
   • Fix: an extraction that leaves any file missing now fails with the list of missing files instead of reporting success. This applies to zip archives too.
   • Fix: archives that contain paths outside the destination folder are refused before anything is written.
   • Improvement: archives created by the plugin now keep files with very long paths (over 255 characters) instead of leaving them out.
   • New: a safe-activate endpoint that switches on a plugin, theme, must-use plugin or drop-in, checks the site still loads, and switches it off again automatically if it does not.
   • Improvement: the status endpoint reports which archive formats the server supports.
   • Fix: on PHP 8 hosts that disable set_time_limit, ini_set or ignore_user_abort, database and file routes no longer fail with a server error.

2. InstaMigrate 1.9.0

   Oct 27, 2026
   • Fix: migrations now work on sites that use a plugin to restrict the REST API to logged-in users.
   • Improvement: bridge mode is more reliable on those sites.
   • Improvement: better handling of malformed requests.

3. InstaMigrate 1.8.9

   Oct 12, 2026
   • Compatibility: now runs on PHP 5.6 and newer (was 7.0). Sites still on PHP 5.6 — common on older shared hosting — could not run the plugin at all, so they could not be migrated. Newer-PHP syntax was rewritten to its PHP 5.6 equivalent with identical behaviour on every version; error handling also c…

4. InstaMigrate 1.8.8

   Oct 12, 2026
   • Compatibility: now runs on PHP 7.0 and newer (was 7.4). The plugin used nothing that needs 7.4, so sites on PHP 7.0–7.3 could not install it for no reason; it is now tested on PHP 7.0 with WordPress 6.5.
   • Fix: Search-replace no longer rewrites email addresses when it is given a bare domain to replace. Replacing old.com with a new host used to also change every address ending in @old.com — contact addresses, the admin address, notification senders, addresses stored by payment plugins — because the do…

5. InstaMigrate 1.8.7

   Sep 21, 2026
   • Fix: /disk-usage reported a size that did not match the site. It delegated to WordPress core’s Site Health size calculation, which caches each directory’s size for ten years and only clears that cache on multisite installs — so on an ordinary single-site install the figure was measured once and the…
   • Fix: a site too large to measure inside the time limit returned no size at all. It now returns the amount measured so far, flags the answer as partial, and lists the directories it did not reach, so a caller gets a usable floor instead of nothing.
   • New: exclude accepts the same paths and patterns as /files/archive, so a caller that is skipping part of a site gets a size with those paths taken out, reported separately under excluded.
   • New: budget caps how long the measurement may run (default 20 seconds).
   • Scope is unchanged and deliberate: this is the whole install, wp-admin and wp-includes included, because those occupy disk. Only the paths a caller asks to exclude are left out.
   • Robustness: an unreadable directory, a broken symlink, a symlink loop, or a file deleted while the site is being measured now skips that one entry and is reported under unmeasured, instead of failing the request or silently lowering the total.

6. InstaMigrate 1.8.6

   Aug 18, 2026
   • Fix (data integrity): /search-replace could overwrite every row sharing a meta_key with a single row’s value. Rows were updated using only the LAST column MySQL reports as PRI, which is correct for standard WordPress (postmeta has PRIMARY KEY (meta_id)) but wrong wherever the primary key spans seve…
   • Updates are now matched on the complete primary key, with each value’s type taken from the column definition rather than guessed from the value, so numeric-looking text keys can no longer mismatch a row. Sites with the standard single-column key are unaffected and behave exactly as before.
   • Safeguard: any single update that would affect more than one row now aborts the request with a clear error instead of proceeding, so this class of problem cannot fail quietly again.
   • The response now reports the key columns used per table, and any table skipped for having no primary key, making an unusual schema visible while the migration runs.

7. InstaMigrate 1.8.5

   Aug 14, 2026
   • New: /cache/clear clears the caches that still hold the OLD site’s state after a migration, in one call — the object cache, page-builder caches, rewrite rules, and optionally expired transients, the PHP opcode cache, and plugin caches that hardcode the previous server’s paths. Callers pick what to…
   • Fix: page-builder caches are now reachable at all. A builder’s generated CSS has the source site’s domain baked into its asset URLs, and Divi keeps its copy in wp-content/et-cache/ — outside the uploads folder, where the existing search-replace endpoint is confined. Migrated Divi sites could theref…
   • Each builder’s own documented clear function is preferred over deleting files, with the file cleanup applied only to whatever the builder left behind. Cache deletion is confined to wp-content and refuses to follow symlinks out of it; the object cache is flushed through WordPress’s own API, never by…

8. InstaMigrate 1.8.4

   Aug 7, 2026
   • New: /migration-details records the migration on the destination site in the same place the InstaWP Connect plugin has always written it (instawp_last_migration_details) — the migration’s id, the engine that ran it, and its status. Tools and dashboards built against the older migration flow keep wo…

9. InstaMigrate 1.8.3

   Jul 28, 2026
   • Feature: New /disk-probe endpoint so a migration can check, before it starts copying files, whether the destination actually has room for the incoming site — including on hosts where a per-account disk quota isn’t visible to the normal free-space check. It briefly writes and then deletes a test fil…

10. InstaMigrate 1.8.1

    Jul 21, 2026
    • New: /theme/activate switches the active theme, installing it from wordpress.org first if it isn’t present. Defaults to Twenty Twenty-One, which supports WordPress 5.3 and newer — a single theme that works across the whole supported range. This matters before a core change: WordPress ships a theme…
    • New: /core/update updates WordPress core to a requested version. Intended for the case where the site you’re copying from runs a newer WordPress than the site you’re copying to — a migration replaces plugins, themes and the database, but not WordPress itself, so without this the destination keeps i…
    • New: /plugins/deactivate-plugin deactivates plugins without deleting them, so the change can be undone — the response returns the previous active-plugin list as a restore point. Pass all_except_self to deactivate everything except InstaMigrate in one call (useful before a core update). Network-acti…
    • Fix: /files/search-replace no longer crashes the site when the extensions value is sent as plain text (for example txt) rather than a list. It previously produced a “critical error” page with no usable error message; it now accepts a list, a comma-separated string, or a JSON array, and always retur…
    • Fix: /files/mkdir now keeps new directories inside wp-content, matching every other file endpoint. Previously it would create a directory anywhere the site’s user could write. A path given relative to wp-content still works exactly as before — it is simply anchored there instead of to an undefined…
    • Fix: the plugin-install, plugin-delete, plugin-deactivate, theme-activate, core-update and file-search-replace endpoints now always return a structured JSON error when something unexpected goes wrong. Previously an error raised outside the guarded section — including from another plugin’s own activ…

11. InstaMigrate 1.8.0

    Jun 30, 2026
    • New: skip files and folders during a migration. /files/archive now honors an exclude parameter (a JSON array or CSV of wp-content-relative paths/globs) — matched files and whole directories are left out of the archive. Default (no exclude) is byte-identical to before.
    • New: /files/list endpoint lists a wp-content directory one level at a time, with file and directory sizes, so a migration UI can show what’s on the site and let you choose what to skip. Confined to wp-content (no access outside it).
    • Fix: archive and database-dump temp files now use a unique name (not just a per-second timestamp), so two exports of the same directory in the same second can’t collide on one filename and have a CDN serve a stale copy.

12. InstaMigrate 1.7.9

    Jun 15, 2026
    • New: added a disk-usage endpoint that reports how much space the site uses (files plus database).
    • New: the status endpoint now also returns the site’s admin email address.

13. InstaMigrate 1.7.8

    Jun 4, 2026
    • Fix: /files/archive (tar.gz) no longer 500s on large uploads//plugins/ directories. It now streams a POSIX ustar tar straight into a gzip sink one file at a time (constant memory, single pass) instead of building the whole tar in memory and re-reading it to compress (two passes that OOM’d as an unc…
    • Fix: archiving a directory that contains the plugin’s own temp dir (e.g. uploads/, which holds uploads/instamigrate/) no longer self-includes the half-written archive — the temp dir is skipped during the walk. This removes a runaway-growth timeout and the long-standing silently-ignored exclude beha…

14. InstaMigrate 1.7.7

    Jun 1, 2026
    • Security: hardened the source_url SSRF guard. IP validation now normalizes addresses with inet_pton and tests an explicit CIDR denylist instead of PHP’s range filter flags — closing bypasses via IPv4-mapped IPv6 (e.g. ::ffff:169.254.169.254), NAT64 (64:ff9b::/96) and CGNAT (100.64/10). The host is…
    • Fix: /db/import now deletes a source_url-pulled temp dump on every exit path (no orphaned gz left in uploads/instamigrate/), and guards the magic-byte read against an unreadable file (clean 500 instead of a fatal).
    • Fix: /db/export skip_regenerable no longer over-matches — it uses a Wordfence allowlist (never skips wfconfig/wfls_* config + 2FA secrets) and skips only Elementor telemetry (e_events), never form submissions. ignore_tables now also accepts suffix-only table names.
    • Improvement: /files/fetch-probe caps the body it buffers (origins that ignore Range can return a full body), avoiding a memory spike on large artifacts.

15. InstaMigrate 1.7.6

    Jun 1, 2026
    • New: Server-to-server pull. /db/import and /files/extract accept a source_url param and fetch the artifact directly from the source site (SSRF-guarded: http/https only, blocks loopback/private/reserved/link-local targets), so a destination can pull large archives straight from the source instead of…
    • New: /db/export can skip the data of regenerable/log tables (opt-in via skip_regenerable=1 and/or an explicit ignore_tables CSV) to shrink huge dumps — the DROP+CREATE schema is still emitted so dependent plugins don’t fatal, only the rows are skipped. Default behavior is unchanged.
    • New: /files/extract accepts verify=1 to count any archive entries missing after extraction and report complete:false + missing — surfacing silent ZipArchive/Phar truncation on very large file trees instead of a false success.

16. InstaMigrate 1.7.5

    Jun 1, 2026
    • Performance: /db/export now compresses the SQL dump inline in a single pass at gzip level 1, instead of writing the full uncompressed dump to disk and then re-reading and re-compressing it at level 9. This removes a second full pass over the dump and the most CPU-intensive step of the export — on l…

17. InstaMigrate 1.7.4

    Jun 1, 2026
    • New: /insta-migrate/v1/plugins/install-activate-plugin endpoint. Installs a plugin from a URL (or .zip) via WordPress’s Plugin_Upgrader and activates it. Powers App-driven post-migration plugin actions, so an integrating App can request specific plugins be installed on the destination as part of th…
    • New: /insta-migrate/v1/plugins/delete-plugin endpoint. Accepts a plugin_files array, deactivates each plugin and removes it via delete_plugins(). InstaMigrate is filtered out of the request (both instamigrate/insta-migrate.php and insta-migrate/insta-migrate.php directory variants) so the endpoint…

18. InstaMigrate 1.7.3

    May 6, 2026
    • New: Bridge auto-discover. Plugin polls the tracker every 5 minutes (and on every visit to the InstaMigrate admin page) to see if a bridge migration has been assigned to this site, and starts itself automatically. Removes the need for site owners to copy/paste tracker URL, migration ID, and shared…

19. InstaMigrate 1.5.0

    Apr 3, 2026
    • Internal version alignment (header and constant now both report 1.5.0)
    • No functional changes from 1.4.0