About this plugin
LUX Content Migration is installed on both sides of a WordPress-to-WordPress migration: On the old (source) site , it builds a self-contained export file in this plugin’s own format (.wpmpx), with an automatic split into numbered parts if your hosting’s upload limit is small. On the new (destination) site , it imports that .wpmpx file category by category, bringing over posts, pages, comments (including reply/parent structure), and authors (automatically matched by username when the same login exists on the destination site). This plugin is fully functional with no limits on the number of posts, pages, or sites – there is no license key, no usage cap, and no locked feature anywhere in this codebase. What this plugin does Export from the source site (including automatic splitting into parts if needed) and import into the destination site, both unlimited. Comments (including reply/parent structure), author linking, and custom field / ACF relational ID reconnection. Dry-run preview — see exactly how many posts, comments, and images an import will involve before you run it, without creating anything. Rollback — undo a finished category or page import, deleting the posts it created (downloaded images are left in place since other posts may still reference them). Images referenced in migrated content keep pointing at the old site’s own URLs rather than being re-downloaded – so the old site needs to stay online for those images to keep displaying. A separate add-on plugin (distributed outside WordPress.org, see the plugin’s own site for details) adds actual image rehosting, redirect/404 management, background processing, and full media embedding on top of this plugin via standard WordPress filters/actions – this base plugin works completely on its own without it. Security notes Uploaded .wpmpx files are verified by a fixed signature and checksum before being parsed, and legacy WXR/XML uploads are parsed with a hardened XML reader (any <!DOCTYPE> declaration is stripped before parsing and external entity/network loading is disabled) to prevent XXE-style attacks from a malicious export file. File uploads are validated against the request’s own upload metadata via is_uploaded_file() and moved through the WordPress Filesystem API into a non-listable, non-executable private folder that is cleared automatically after each file is processed. External services This plugin does not connect to any external service. All processing (reading the export file, creating posts/pages/comments/authors, custom field reconnection) happens entirely on your own WordPress site’s server.