---
title: "All-in-One WP Migration"
description: "All-in-One WP Migration free or paid: restore, upload limit, recommended export options and the 2026 flaws, so you can plan your migration well."
language: "en"
locale: "en-US"
type: "plugin-sheet"
canonical: "https://www.wp-masquerade.com/features/camouflaged-plugins/all-in-one-wp-migration/"
published: "2026-11-04T08:00:00+00:00"
modified: "2026-11-05T20:57:58+00:00"
translations:
  en-US: "https://www.wp-masquerade.com/features/camouflaged-plugins/all-in-one-wp-migration/index.md"
  fr-FR: "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/all-in-one-wp-migration/index.md"
  es-ES: "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/all-in-one-wp-migration/index.md"
  de-DE: "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/all-in-one-wp-migration/index.md"
  it-IT: "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/all-in-one-wp-migration/index.md"
  pt-BR: "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/all-in-one-wp-migration/index.md"
  nl-NL: "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/all-in-one-wp-migration/index.md"
---

# All-in-One WP Migration

All-in-One WP Migration moves an entire WordPress site in a single file that you export, then import. Our take on what the free version really covers, the export options to check, the archives to delete and the flaws fixed in 2026.

## The essentials

- Best for switching hosts or copying a site to staging, all in a single file.
- Main caveat: one-click restore and getting past your host’s upload limit cost extra.
- Free; Unlimited Extension is $69 a year for 50 sites, Pro is $99 a year with cloud storage.

## What All-in-One WP Migration does on your site

All-in-One WP Migration packs an entire WordPress site into a single `.wpress` file: database, media library, themes and plugins. Under All-in-One WP Migration > Export, you pick “Export Site To > File” and download the archive. On the destination site, the Import screen takes that file by drag and drop and rewrites the old URLs and paths automatically, serialized data included. The plugin can also move a site from MySQL or MariaDB to SQLite and back.

Every export also lands on the Backups page, which reads the `wp-content/ai1wm-backups` folder. The plugin drops an `index.php` and an `.htaccess` file there to block directory listing, but an archive can still be downloaded from its URL: the file name holds the domain, the date, the time and a random 12-character suffix. An import only replaces what the archive contains; everything else on the destination site stays in place.

The vendor, ServMask Inc., funds the free plugin with paid add-ons. The Unlimited Extension ($69 per year for 50 sites) adds one-click restore from the Backups page, uploads that get around your host’s file-size limit, WP-CLI commands and Reset Hub. All-in-One WP Migration Pro ($99 per year) adds more than 15 cloud storage providers (Google Drive, Dropbox, Amazon S3, OneDrive and more), scheduled backups and import from a URL.

![Diagram: All-in-One WP Migration works on wordpress, database and files, external services. Public traces: no known public trace.](https://www.wp-masquerade.com/media/wpm-sheets/ai1wm/diagram-en.svg?v=bf7d7289)

## Which sites All-in-One WP Migration suits

The plugin is built to move a site from A to B without touching FTP or phpMyAdmin:

- **Switching hosts or domains**: one file to export, one file to import, and URLs are rewritten during the import.
- **Copying to a staging site or a local install**: handy for trying an update or a theme on a faithful replica of the live site.
- **A one-off backup before a risky change**, as long as you download the file and can upload it again under your host’s upload limit.
- **Agencies and freelancers** who migrate often: one Unlimited license covers up to 50 sites.

It is the wrong tool for regular, automatic backups on a zero budget: scheduling and off-site storage are paid features, while [UpdraftPlus](https://www.wp-masquerade.com/features/camouflaged-plugins/updraftplus/) includes both in its free version.

## All-in-One WP Migration strengths and limitations

### Strengths

- **One file per migration.** The archive holds the whole site, with no separate SQL export.
- **Automatic URL replacement.** URLs and paths are rewritten on import, serialized data included.
- **Free encryption.** The free version can password-protect an archive with AES-256.
- **No export size cap.** The free version exports sites of any size; only the upload for import depends on your host.

### Limitations

- **One-click restore costs extra.** The Restore button on the Backups page needs the Unlimited Extension; on the free plan you download the archive and upload it again.
- **Your host’s upload limit.** An archive larger than that limit will not go through the free Import screen.
- **No scheduling or off-site storage for free.** Automatic backups and cloud destinations require Pro.
- **Archives inside the web root.** By default, .wpress files sit in `wp-content` and can be reached by URL.
- **Several serious flaws in 2026.** Four vulnerabilities were published between July and September 2026, three of them exploitable without an account.

## The All-in-One WP Migration settings we recommend

The plugin has no settings screen: you choose options on each export, under All-in-One WP Migration > Export, by expanding “Advanced options.” Everything below is available in the free version.

| Setting | Recommended value | Why |
| --- | --- | --- |
| **Encrypt this backup with a password**  All-in-One WP Migration > Export > Advanced options > Security Options | On, with a long password kept off the site | The archive contains the whole database, user accounts and customer data included. The destination server needs OpenSSL to decrypt it. |
| **Exclude spam comments**  Same screen, Database Options | On | No point in moving spam: the archive gets lighter and the import faster. |
| **Exclude post revisions**  Same section | On for a migration, off for a safety backup | Revisions bloat the database; keep them only if you want your content history. |
| **Do not replace email domain**  Same section | On for a test copy, off (default) for a real domain change | By default, addresses at @old-domain become @new-domain on import, which skews user accounts on a local or staging copy. |
| **Exclude media library**, **Exclude themes**, **Exclude plugins**  Same screen, File Options | Off (default) | A full migration needs them; check a box only if the destination already has identical files. |
| **Search for / Replace with**  All-in-One WP Migration > Export, top of the screen | Empty unless you have a specific need | The URL change is already automatic; a badly chosen replacement applies to the whole database. |
| **Delete**, for each old archive All-in-One WP Migration > Backups | After every successful migration | An archive left in `wp-content/ai1wm-backups` is a full copy of the site sitting on the server. |
| **Automatic updates**  Plugins > Installed Plugins | On | The 2026 flaws were fixed across successive releases, from 7.106 to 7.111. |

- Before importing, compare the archive size with the limit shown on the destination site’s Import screen.
- After the import, log in with the exported site’s credentials: its database replaced the tables with the same names, users included.
- Save your permalinks again under Settings > Permalinks, then clear the site and hosting caches.
- Once an old archive is deleted, open its URL in a private window: you should get a 404 error (see our guide to exposed sensitive files).

## All-in-One WP Migration security: a busy 2026

A plugin that reads and writes the entire site is a prime target. The advisories worth knowing:

- **CVE-2024-10942, fixed in 7.90**: unauthenticated PHP object injection, triggered when an administrator exports and then restores a backup (CVSS 7.5).
- **CVE-2026-12898, fixed in 7.106**: without an account, an attacker could create or append to a log file outside the intended folder through path traversal.
- **CVE-2026-17533, fixed in 7.108**: on multisite, the administrator of a single subsite could run PHP code across the whole network through the REST API import.
- **CVE-2026-19949, fixed in 7.110**: unauthenticated SQL injection during a restore that could lead to code execution (CVSS 8.8).
- **CVE-2026-89064, fixed in 7.111**: the plugin stored in the database, merely base64-encoded, the HTTP Basic credentials sent to `/wp-admin/` by any request.

Run 7.111 or later and turn on automatic updates. If an outside service logs in to your admin with an application password, rotate it after updating. The full timeline is in our article on [All-in-One WP Migration vulnerabilities](https://www.wp-masquerade.com/all-in-one-wp-migration-security-vulnerabilities/), and the SQL injection case in our [CVE-2026-19949 alert](https://www.wp-masquerade.com/all-in-one-wp-migration-cve-2026-19949-probed/). All-in-One WP Migration adds nothing known to your public pages; the box below shows what WP Masquerade covers for it.

## All-in-One WP Migration frequently asked questions

**Is restoring really free?**

Yes, through the Import screen: you download the archive, then upload it again. The limit comes from your host, which sets the maximum upload size; the Restore button on the Backups page, on the other hand, needs the Unlimited Extension.

**My archive is over the upload limit. What can I do without paying?**

Raise the PHP values `upload_max_filesize` and `post_max_size` (or `client_max_body_size` on Nginx), or ask your host to do it. You can also slim the archive down by excluding spam, revisions or files the destination already has.

**Should I keep the plugin once the migration is done?**

If you only use it to migrate, delete the archives on the Backups page, then deactivate and delete the plugin.

**All-in-One WP Migration, UpdraftPlus or Duplicator?**

For a one-off migration, All-in-One WP Migration is the simplest. For scheduled backups to off-site storage at no cost, UpdraftPlus is the better fit; [Duplicator](https://www.wp-masquerade.com/features/camouflaged-plugins/duplicator/) is the other big migration tool, built around an archive plus an installer. To set up your routine, see our guide to the [3-2-1 backup strategy](https://www.wp-masquerade.com/wordpress-backups-3-2-1-strategy/).

## Key facts

- Category: Backup and site management
- Vendor: ServMask Inc.
- Price: Free; Unlimited Extension costs $69 per year for 50 sites
- Active installations (wordpress.org): 5 000 000+
- Version: 7.113
- Official page: https://wordpress.org/plugins/all-in-one-wp-migration/

## What WP Masquerade hides

- Handled by the free version of WP Masquerade