WP Manifestindependent plugin directory
manifest / updates / iwp-migration-helper

InstaWP Migration Helper WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

PoC Plugin for Hosting Companies (on destination website)

★ 1stars
1.1.9latest · 1mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/instawp/iwp-migration-helper/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

This plugin is aimed to be a companion plugin which acts as a bridge b/w Destination WP site (where the plugin is supposed to be installed) and IntaWP Migration service.

You can take the entire code and adopt it in your plugin, if you wish you.

Configuration

You need to set these values in iwp-migration-helper.php file:

  1. API Key can be generated from API Token page here - https://app.instawp.io/user/api-tokens, use the read-only + read-write key.
  2. API Domain should be https://app.instawp.io
  3. If you don't know the slug yet, you can just use the value migrate for INSTAWP_MIGRATE_ENDPOINT
defined( 'INSTAWP_API_KEY' ) || define( 'INSTAWP_API_KEY', '<api key>' );

defined( 'INSTAWP_API_DOMAIN' ) || define( 'INSTAWP_API_DOMAIN', 'https://app.instawp.io' );

defined( 'INSTAWP_MIGRATE_ENDPOINT' ) || define( 'INSTAWP_MIGRATE_ENDPOINT', 'migrate/<slug>' );

WP_CLI commands

Migrate Demo Site

wp instawp-migration-helper init --instawp_api_key=<api-key>

OPTIONS

--instawp_api_key=<key> Your Instawp API key used to authenticate requests.

--instawp_api_domain=<url>: The base URL of the Instawp API.

--instawp_migrate_endpoint=<endpoint>: Endpoint path used for site migration, e.g., migrate/<slug>.

--instawp_migrate_language_slug=<slug>: Language slug used to display the migration progress page in a specific language.

--demo_site_url=<url>: URL of the demo site from which data will be fetched.

--instawp_migrate_email_check_off: Set this flag to disable the admin email check when fetching demo site details.

--admin_email=<email>: Admin email of the demo site.

Walkthrough

https://www.youtube.com/watch?v=8yY1UBSas0M

Auto Migration

1. Enabling auto migration

To enable auto migration please set this constant as true define( 'INSTAWP_AUTO_MIGRATION', true );

2. Customizing the demo site details box

To customize the texts, colors and to apply any custom css please use the following constant.

define( 'IWP_AM_SETTINGS', '{"text_heading":"We have detected a website <span>{demo_site_url}</span> which you used to create a demo site at {demo_created_at}.","text_desc":"Transfer or Migrate the site here?","transfer_btn_text":"Transfer Site","transfer_btn_style":"background#11BF85; border-color#11BF85; color#fff;","transfer_btn_style_hover":"background#14855f; border-color#14855f;","custom_css":".iwp-auto-migration h3.iwp-text-header > span { color#14855f; }"}' );

Changelog

1.1.8 - 09 March 2026

  • ENHANCE - Demo migration no longer creates InstaWP Connect connections.

1.1.7 - 23 Jan 2026

  • UPDATE - Dependency packages

1.1.6 - 24 Sep 2025

  • ADD - WP CLI command to initiate migration.
  • ADD - Setting to hide the migration section
  • ADD - Setting for demo site admin email
  • ENHANCE - Error Logging

1.1.5 - 19 Sep 2025

  • ADD - Support for translation slug.
  • UPDATE - Dependency packages

1.1.4 - 12 August 2025

  • FIX - Already connected website issue.

1.1.3 - 06 August 2025

  • ADD - Support for the Migration API Token type.

1.1.2 - 04 July 2025

  • ADD - Support for end-to-end migration without connects.

1.1.1 - 25 June 2025

  • ADD - Setting to input a custom demo site URL.
  • ADD - Support for site migration using dynamic demo site URL.

1.1.0 - 16 June 2025

  • ADD - Auto migration using demo site URL.

1.0.9 - 07 May 2025

  • FIX - Updated composer dependencies.

1.0.8 - 06 February 2025

  • NEW - Added demo site error counter to prevent infinite api hits.
  • FIX - Fixed Extendify redirection check inside WordPress dashboard only.

1.0.7 - 03 December 2024

  • FIX - Added fix for redirection to Extendify.
  • FIX - Added require setting constants check.
  • FIX - Fixed wp-config table prefix issue in the migration flow.

1.0.6 - 20 November 2024

  • FIX - Added missing plugin main file.

1.0.5 - 11 Nov 2024

(no need for version bump)

  • Added a sample plugin for migration settings which can be independently installed while the main plugin keeps updating.

1.0.5 - 29 October 2024

  • NEW - The system now automatically checks for updates.

1.0.4 - 11 September 2024

  • NEW - Added translation support.
  • FIX - Fixed timezone issue for the demo site creation.

1.0.3 - 17 July 2024

  • NEW - Added reset demo site details button.
  • FIX - Fixed auto migration demo site identification.

1.0.2 - 09 July 2024

  • FIX - Fixed auto migration demo site identification.

1.0.1 - 12 April 2024

  • FIX - Fixed hosting migration.

1.0.0 - 22 January 2024

  • NEW - Initial Release.

Releases

16 releases.

Tag
Published
1.1.9 latest
Sep 22, 2026 1mo ago
Mar 9, 2026 7mo ago
Jan 23, 2026 9mo ago
Sep 24, 2025 1 year ago
Sep 19, 2025 1 year ago
Aug 12, 2025 1 year ago
Aug 6, 2025 1 year ago
Jul 4, 2025 1 year ago
Jun 25, 2025 1 year ago
Jun 16, 2025 1 year ago
May 7, 2025 1 year ago
Mar 6, 2025 1 year ago
Dec 3, 2024 1 year ago
Nov 20, 2024 1 year ago
Oct 29, 2024 1 year ago
Sep 11, 2024 2 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

InstaWP Migration Helper 1.1.8 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.1.8
Findings
1
Worst severity
high
Content hash
11939917f4eb404606dbdcdb…

Findings

  • high Migration AJAX gated by nonce only; nonce localized on all admin screens

    missing_capability

    iwp_set_data_install_plugin, iwp_set_api_key, iwp_initiate_migration, and iwp_reset_side_data verify iwp_mig_nonce / reset_nonce but never current_user_can. admin_scripts() enqueues and localizes the nonce on every admin_enqueue_scripts for any user who can access wp-admin (Author/Editor/Contributor), enabling plugin install and migration initiation.

    includes/class-ajax.php:29-127

    Recommendation

    Add current_user_can('manage_options') (or install_plugins) beside nonce checks; only localize nonce on migration screens for admins.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.