Urumi Cloner makes WordPress site migration effortless and fully privacy compliant using any S3-compatible storage. It uploads your WordPress site to your choice of S3 storage, and downloads it on your destination server. We won't store any data in our servers. Tested with site sizes up to 100GB on slow servers.
Important: This is a Service Plugin
Urumi Cloner is a backup and migration service that requires you to configure your own S3-compatible cloud storage (Amazon S3, Google Cloud Storage, Wasabi, DigitalOcean Spaces, etc.).
What the Plugin Connects To: The plugin only connects to YOUR configured cloud storage to upload/download backups. You provide the credentials and endpoint URL. No data passes through Urumi servers unless you're explicitly migrating to Urumi hosting.
Key Features:
- WP-CLI Support - Complete command-line interface for automation, scripting, and cron jobs
- Cloud Storage Support - Works with Google Cloud Storage (GCS), Amazon S3, and any S3-compatible storage (Wasabi, DigitalOcean Spaces, Backblaze B2, etc.)
- Full Infrastructure Control - Backup happens to your choice of S3-compatible storage, with no request ever hitting our servers (unless migrating to our servers)
- No upsells - This is a free plugin with no premium version, no review nags, and no admin notices. Keep your admin area clean.
- Real-time Progress Tracking - Monitor backup and restore progress (both web UI and CLI)
- Secure - Credentials embedded in encrypted migration key
- Large Site Support - Handles sites of any size with efficient multipart uploads
- Resumable Transfers - Both backups and restores are resumable; network failures won't interrupt your migration
- No Server-to-Server Transfers - Direct upload/download from cloud storage
Perfect For:
- Migrating WordPress sites between hosts
- Creating development/staging copies
- Site cloning and duplication
- WordPress backups to cloud storage
- Moving from shared hosting to cloud hosting
How It Works:
- Configure your cloud storage (S3, GCS, or compatible)
- Create a backup - generates a migration key
- Install plugin on destination site
- Paste migration key and restore
- Done! Your site is cloned
Automatic Installation:
- Log in to your WordPress admin panel
- Navigate to Plugins > Add New
- Search for "Urumi Cloner"
- Click "Install Now" and then "Activate"
Manual Installation:
- Download the plugin ZIP file
- Log in to your WordPress admin panel
- Navigate to Plugins > Add New > Upload Plugin
- Choose the downloaded ZIP file and click "Install Now"
- Click "Activate Plugin"
Requirements:
- WordPress 6.2 or higher
- PHP 7.4 or higher
- WP-Cron must be enabled, OR a system cron job configured to call wp-cron.php regularly
- Sufficient disk space for temporary files during restore (at least 2x your site size recommended)
Configuration:
- Go to Urumi Cloner in your WordPress admin menu
- Choose "Create Backup" to start the wizard
- Enter your cloud storage credentials (S3 or GCS)
- Click "Start Backup"
- Copy the migration key when complete
WP-CLI Usage:
Urumi Cloner supports WP-CLI for programmatic backups and restores. Perfect for automation and scripts!
```bash
Create a backup
wp urumi backup create \
--bucket=my-backups \
--access-key=YOUR_ACCESS_KEY \
--secret-key=YOUR_SECRET_KEY \
--endpoint=
https://s3.amazonaws.com \
--region=us-east-1 \
--wait
Restore from migration key
wp urumi restore start --key=urumi_xxxxx --wait
Check status
wp urumi backup status
wp urumi restore status
Parse migration key
wp urumi key parse urumi_xxxxx
Validate credentials
wp urumi validate \
--bucket=my-bucket \
--access-key=xxx \
--secret-key=yyy \
--endpoint=
https://s3.amazonaws.com
Clean up old temp files
wp urumi cleanup
```
Run
wp help urumi for full command documentation.
0.0.11
First release on
WordPress.org. Includes the unreleased 0.0.9 / 0.0.10 work plus
a round of restore-reliability and safety fixes found during live end-to-end
migration testing.
- SECURITY: Backups no longer include the plugin's own settings. Previously a
backup could carry the source site's encrypted storage credentials into the
archive, and a restore would install them on the destination. The plugin's own
options and transients are now excluded from the export and purged after an
import.
- FIXED: Restores between two different sites now correctly update the site
URL. The destination's home/siteurl are captured before the import and
reapplied afterwards, instead of being read after the source database had
already overwritten them.
- FIXED: The file-copy phase is now crash-safe and works across filesystems.
Staged content is copied into a same-filesystem sibling directory and swapped
in with renames only, with rollback and recovery if the process is interrupted
mid-swap. Previously a cross-device copy could fail and leave the destination
directory deleted.
- FIXED: Restore progress is tracked in a dedicated table rather than an
options row, so importing the source database can no longer destroy the
restore's own state mid-run and cause a phase to repeat.
- FIXED: The restore lock moved to the same import-immune table, making lock
acquisition atomic and stale-lock takeover safe against races.
- FIXED: A restore no longer overwrites the copy of this plugin that is
running it, which previously caused the restore to revert its own code
mid-migration.
- FIXED: Read-only platform drop-ins (db.php, object-cache.php,
advanced-cache.php) and a bind-mounted mu-plugins directory are skipped during
the copy instead of aborting the restore.
- IMPROVED: Hardened the SQL validation gate on database restore with a
comment-, quote- and identifier-aware scanner, a bounded SET allow-list,
word-boundary statement matching, and rejection of stacked statements.
- IMPROVED: Disk-space check before the copy phase to fail early rather than
part-way through.
0.0.8
- IMPROVED: Consolidated duplicate phpcs:ignore comments using phpcs:disable/enable blocks
- IMPROVED: Added comprehensive security documentation for database restore operations
- FIXED: Added PluginCheck.Security.DirectDB.UnescapedDBParameter exclusions with justification
- Cleaner, more maintainable code with reduced comment duplication
- Plugin check now shows only 1 legitimate warning (schema change for backup/restore)
0.0.7
- BREAKING CHANGE: Minimum WordPress version increased from 5.0 to 6.2
- IMPROVED: Database queries now use WordPress 6.2+ %i placeholder for secure identifier escaping
- IMPROVED: Memory management now uses wp_raise_memory_limit() instead of ini_set()
- IMPROVED: Fixed global variable naming in wizard UI (prefixed with urumi_cloner_)
- IMPROVED: Enhanced phpcs comments with detailed justifications for filesystem operations
- Better compliance with WordPress.org coding standards
- All phpcs checks now passing with proper documentation
0.0.6
- FIXED: Errors during backup/restore now display in the UI instead of failing silently
- Added error tracking to both backup and restore processes
- Improved error visibility for troubleshooting permission and configuration issues
0.0.5
0.0.4
- NEW: WP-CLI Support - Complete command-line interface for automation (backup, restore, validate, cleanup)
- BREAKING CHANGE: Moved temp directory from wp-content to uploads directory per WordPress.org guidelines
- Improved PHP limits handling: Removed set_time_limit() calls, ensured memory_limit is always restored after operations
- Replaced cURL with WordPress HTTP API: All HTTP requests now use wp_remote_request() for better compatibility
- Added SQL validation layer: Whitelist safe operations and block dangerous SQL during database restore
- Removed PCLZIP_TEMPORARY_DIR definition: Let PclZip use system temp for its internal files (avoids changing global behavior)
- Added explicit comments: Clarified all file_put_contents calls write to uploads directory (not plugin directory)
- Enhanced External Services section with comprehensive details about cloud storage connections
- Added clarification that URLs in plugin interface are documentation examples only (not remote file calls)
- Added explanatory comments for PclZip loading (WordPress core utility class)
- Added comprehensive security documentation explaining why SQL dumps cannot use $wpdb->prepare()
- Added comments explaining legitimate WP_CONTENT_DIR usage for backup/restore operations
- Added clear documentation that PHP limits are only modified during backup/restore operations (not global)
- Improved documentation to meet WordPress.org plugin guidelines
- Added prominent note in Description explaining this is a service plugin
0.0.3
- Documented external services section in readme
- Fixed grammatical issues in readme.txt
- Added comprehensive requirements section (WP-Cron, disk space)
- Made zip and unzip processes resumable and chunkable for really large sites
- Fixed bug where restore would fail with "A restore is already in progress" error
- Added vedjain as contributor
0.0.2
- Improved archiving performance with adaptive three-tier approach (native zip/ZipArchive/PclZip)
- Enhanced large site support with optimized file handling
- Fixed temporary file permissions for chunked archiving
- Improved error handling and logging
- Code cleanup and optimization
0.0.1
- Initial release
- Support for GCS and S3-compatible storage
- Backup and restore functionality with resumable transfers
- Migration key based transfers
- Chunked downloads using HTTP Range requests
- WP-Cron based background processing