=== Urumi Cloner ===
Contributors: urumi, vedjain
Tags: backup, migration, clone, s3, gcs
Requires at least: 6.2
Tested up to: 6.9
Requires PHP: 7.4
Stable tag: 0.0.11
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Seamless WordPress site migration plugin supporting cloud storage (GCS, S3). Keep all migration data under your control.

== Description ==

Urumi Cloner makes WordPress site migration effortless and fully privacy compliant using any S3-compatible storage. It uploads your WordPress site to your choice of S3 storage, and downloads it on your destination server. We won't store any data in our servers. Tested with site sizes up to 100GB on slow servers.

**Important: This is a Service Plugin**

Urumi Cloner is a backup and migration service that requires you to configure your own S3-compatible cloud storage (Amazon S3, Google Cloud Storage, Wasabi, DigitalOcean Spaces, etc.).

**What the Plugin Connects To**: The plugin only connects to YOUR configured cloud storage to upload/download backups. You provide the credentials and endpoint URL. No data passes through Urumi servers unless you're explicitly migrating to Urumi hosting.

**Key Features:**

* **WP-CLI Support** - Complete command-line interface for automation, scripting, and cron jobs
* **Cloud Storage Support** - Works with Google Cloud Storage (GCS), Amazon S3, and any S3-compatible storage (Wasabi, DigitalOcean Spaces, Backblaze B2, etc.)
* **Full Infrastructure Control** - Backup happens to your choice of S3-compatible storage, with no request ever hitting our servers (unless migrating to our servers)
* **No upsells** - This is a free plugin with no premium version, no review nags, and no admin notices. Keep your admin area clean.
* **Real-time Progress Tracking** - Monitor backup and restore progress (both web UI and CLI)
* **Secure** - Credentials embedded in encrypted migration key
* **Large Site Support** - Handles sites of any size with efficient multipart uploads
* **Resumable Transfers** - Both backups and restores are resumable; network failures won't interrupt your migration
* **No Server-to-Server Transfers** - Direct upload/download from cloud storage

**Perfect For:**

* Migrating WordPress sites between hosts
* Creating development/staging copies
* Site cloning and duplication
* WordPress backups to cloud storage
* Moving from shared hosting to cloud hosting

**How It Works:**

1. Configure your cloud storage (S3, GCS, or compatible)
2. Create a backup - generates a migration key
3. Install plugin on destination site
4. Paste migration key and restore
5. Done! Your site is cloned

== Installation ==

**Automatic Installation:**

1. Log in to your WordPress admin panel
2. Navigate to Plugins > Add New
3. Search for "Urumi Cloner"
4. Click "Install Now" and then "Activate"

**Manual Installation:**

1. Download the plugin ZIP file
2. Log in to your WordPress admin panel
3. Navigate to Plugins > Add New > Upload Plugin
4. Choose the downloaded ZIP file and click "Install Now"
5. Click "Activate Plugin"

**Requirements:**

* WordPress 6.2 or higher
* PHP 7.4 or higher
* WP-Cron must be enabled, OR a system cron job configured to call wp-cron.php regularly
* Sufficient disk space for temporary files during restore (at least 2x your site size recommended)

**Configuration:**

1. Go to Urumi Cloner in your WordPress admin menu
2. Choose "Create Backup" to start the wizard
3. Enter your cloud storage credentials (S3 or GCS)
4. Click "Start Backup"
5. Copy the migration key when complete

**WP-CLI Usage:**

Urumi Cloner supports WP-CLI for programmatic backups and restores. Perfect for automation and scripts!

```bash
# Create a backup
wp urumi backup create \
  --bucket=my-backups \
  --access-key=YOUR_ACCESS_KEY \
  --secret-key=YOUR_SECRET_KEY \
  --endpoint=https://s3.amazonaws.com \
  --region=us-east-1 \
  --wait

# Restore from migration key
wp urumi restore start --key=urumi_xxxxx --wait

# Check status
wp urumi backup status
wp urumi restore status

# Parse migration key
wp urumi key parse urumi_xxxxx

# Validate credentials
wp urumi validate \
  --bucket=my-bucket \
  --access-key=xxx \
  --secret-key=yyy \
  --endpoint=https://s3.amazonaws.com

# Clean up old temp files
wp urumi cleanup
```

Run `wp help urumi` for full command documentation.

== Frequently Asked Questions ==

= What cloud storage providers are supported? =

The plugin supports any S3-compatible storage including but not limited to:
* Google Cloud Storage (GCS)
* Amazon S3
* DigitalOcean Spaces
* Wasabi
* Backblaze B2
* MinIO
* Cloudflare R2

= Do I need a plugin on both sites? =

Yes, install the plugin on both the source site (to create backup) and destination site (to restore).

= Will this work with large sites? =

Yes! The plugin uses multipart uploads and can handle sites of any size. It efficiently compresses data and uploads in chunks.

= What gets backed up? =

The plugin backs up:
* Complete database (all tables)
* All wp-content files (themes, plugins, uploads)
* Site configuration

It does NOT back up WordPress core files (these are reinstalled on the destination).

= Is the migration key secure? =

The migration key contains your cloud storage credentials encoded in base64. Treat it like a password - don't share it publicly. Only share with trusted parties via secure channels.

= Can I restore to a different domain? =

Yes! The plugin automatically updates siteurl and home in the database to match your new domain during restore.

= What if my backup or restore fails midway? =

The plugin supports resumable transfers for both backups and restores. If interrupted due to network issues or timeouts, the process can resume from where it left off. Downloads use HTTP Range requests to resume from the last completed chunk, and uploads use multipart upload resumption.

= Do I need technical knowledge? =

Basic knowledge of cloud storage (getting access keys) is helpful, but the wizard guides you through the entire process step-by-step.

= Why is WP-Cron required? =

The plugin uses WP-Cron to run backup and restore operations in the background. This allows large transfers to continue across multiple requests without timing out. If you have disabled WP-Cron (`DISABLE_WP_CRON = true`), you must configure a system cron job to call wp-cron.php regularly (every minute recommended).

= Does this work with multisite? =

Currently, the plugin is designed for single WordPress installations. Multisite support may be added in future versions.

= Can I use this from the command line? =

Yes! Urumi Cloner includes comprehensive WP-CLI support for automation and scripting. Use commands like `wp urumi backup create`, `wp urumi restore start`, and more. Run `wp help urumi` for full documentation.

= Can I automate backups with cron? =

Absolutely! Use WP-CLI commands in your cron jobs:

```bash
# Daily backup at 2 AM
0 2 * * * cd /path/to/wordpress && wp urumi backup create --bucket=backups --access-key=xxx --secret-key=yyy --endpoint=https://s3.amazonaws.com --region=us-east-1 --porcelain >> /var/log/urumi-backup.log 2>&1
```

== Screenshots ==

1. Wizard Step 1 - Choose backup or restore
2. Wizard Step 2 - Configure cloud storage credentials
3. Wizard Step 3 - Real-time progress tracking
4. Migration key display after successful backup
5. Restore preview showing backup information

== Privacy Policy ==

Urumi Cloner does not collect, store, or transmit any user data to external servers. All backup data is stored in your configured cloud storage bucket. The plugin only:

* Stores cloud storage credentials locally in your WordPress database
* Creates temporary files locally during backup/restore operations
* Communicates directly with your configured cloud storage provider

Your data never passes through Urumi servers. You maintain complete control of your backups.

== Changelog ==

= 0.0.11 =
First release on WordPress.org. Includes the unreleased 0.0.9 / 0.0.10 work plus
a round of restore-reliability and safety fixes found during live end-to-end
migration testing.

* **SECURITY:** Backups no longer include the plugin's own settings. Previously a
  backup could carry the source site's encrypted storage credentials into the
  archive, and a restore would install them on the destination. The plugin's own
  options and transients are now excluded from the export and purged after an
  import.
* **FIXED:** Restores between two different sites now correctly update the site
  URL. The destination's home/siteurl are captured before the import and
  reapplied afterwards, instead of being read after the source database had
  already overwritten them.
* **FIXED:** The file-copy phase is now crash-safe and works across filesystems.
  Staged content is copied into a same-filesystem sibling directory and swapped
  in with renames only, with rollback and recovery if the process is interrupted
  mid-swap. Previously a cross-device copy could fail and leave the destination
  directory deleted.
* **FIXED:** Restore progress is tracked in a dedicated table rather than an
  options row, so importing the source database can no longer destroy the
  restore's own state mid-run and cause a phase to repeat.
* **FIXED:** The restore lock moved to the same import-immune table, making lock
  acquisition atomic and stale-lock takeover safe against races.
* **FIXED:** A restore no longer overwrites the copy of this plugin that is
  running it, which previously caused the restore to revert its own code
  mid-migration.
* **FIXED:** Read-only platform drop-ins (db.php, object-cache.php,
  advanced-cache.php) and a bind-mounted mu-plugins directory are skipped during
  the copy instead of aborting the restore.
* **IMPROVED:** Hardened the SQL validation gate on database restore with a
  comment-, quote- and identifier-aware scanner, a bounded SET allow-list,
  word-boundary statement matching, and rejection of stacked statements.
* **IMPROVED:** Disk-space check before the copy phase to fail early rather than
  part-way through.

= 0.0.8 =
* **IMPROVED:** Consolidated duplicate phpcs:ignore comments using phpcs:disable/enable blocks
* **IMPROVED:** Added comprehensive security documentation for database restore operations
* **FIXED:** Added PluginCheck.Security.DirectDB.UnescapedDBParameter exclusions with justification
* Cleaner, more maintainable code with reduced comment duplication
* Plugin check now shows only 1 legitimate warning (schema change for backup/restore)

= 0.0.7 =
* **BREAKING CHANGE:** Minimum WordPress version increased from 5.0 to 6.2
* **IMPROVED:** Database queries now use WordPress 6.2+ %i placeholder for secure identifier escaping
* **IMPROVED:** Memory management now uses wp_raise_memory_limit() instead of ini_set()
* **IMPROVED:** Fixed global variable naming in wizard UI (prefixed with urumi_cloner_)
* **IMPROVED:** Enhanced phpcs comments with detailed justifications for filesystem operations
* Better compliance with WordPress.org coding standards
* All phpcs checks now passing with proper documentation

= 0.0.6 =
* **FIXED:** Errors during backup/restore now display in the UI instead of failing silently
* Added error tracking to both backup and restore processes
* Improved error visibility for troubleshooting permission and configuration issues

= 0.0.5 =
* Version bump for testing

= 0.0.4 =
* **NEW: WP-CLI Support** - Complete command-line interface for automation (backup, restore, validate, cleanup)
* **BREAKING CHANGE:** Moved temp directory from wp-content to uploads directory per WordPress.org guidelines
* **Improved PHP limits handling:** Removed set_time_limit() calls, ensured memory_limit is always restored after operations
* **Replaced cURL with WordPress HTTP API:** All HTTP requests now use wp_remote_request() for better compatibility
* **Added SQL validation layer:** Whitelist safe operations and block dangerous SQL during database restore
* **Removed PCLZIP_TEMPORARY_DIR definition:** Let PclZip use system temp for its internal files (avoids changing global behavior)
* **Added explicit comments:** Clarified all file_put_contents calls write to uploads directory (not plugin directory)
* Enhanced External Services section with comprehensive details about cloud storage connections
* Added clarification that URLs in plugin interface are documentation examples only (not remote file calls)
* Added explanatory comments for PclZip loading (WordPress core utility class)
* Added comprehensive security documentation explaining why SQL dumps cannot use $wpdb->prepare()
* Added comments explaining legitimate WP_CONTENT_DIR usage for backup/restore operations
* Added clear documentation that PHP limits are only modified during backup/restore operations (not global)
* Improved documentation to meet WordPress.org plugin guidelines
* Added prominent note in Description explaining this is a service plugin

= 0.0.3 =
* Documented external services section in readme
* Fixed grammatical issues in readme.txt
* Added comprehensive requirements section (WP-Cron, disk space)
* Made zip and unzip processes resumable and chunkable for really large sites
* Fixed bug where restore would fail with "A restore is already in progress" error
* Added vedjain as contributor

= 0.0.2 =
* Improved archiving performance with adaptive three-tier approach (native zip/ZipArchive/PclZip)
* Enhanced large site support with optimized file handling
* Fixed temporary file permissions for chunked archiving
* Improved error handling and logging
* Code cleanup and optimization

= 0.0.1 =
* Initial release
* Support for GCS and S3-compatible storage
* Backup and restore functionality with resumable transfers
* Migration key based transfers
* Chunked downloads using HTTP Range requests
* WP-Cron based background processing

== External Services ==

**Service Type**: Cloud Storage Backup & Migration

**Required External Connection**: This plugin requires you to configure an S3-compatible storage service of your choice. The plugin connects directly to your configured storage endpoint to:

* Upload WordPress site backups (database + files)
* Download backups for restoration
* Store migration data under your complete control

**Supported Storage Providers** (you must have your own account):

* **Amazon S3** - https://aws.amazon.com/s3/ (Terms: https://aws.amazon.com/service-terms/)
* **Google Cloud Storage** - https://cloud.google.com/storage (Terms: https://cloud.google.com/terms)
* **Any S3-compatible service** - Wasabi, DigitalOcean Spaces, Backblaze B2, Cloudflare R2, MinIO, etc.

**Data Flow**:

* Source site → Your cloud storage bucket
* Your cloud storage bucket → Destination site
* No data passes through Urumi servers (unless explicitly migrating to Urumi hosting)

**Account Required**: Yes, you must have your own account with your chosen storage provider and provide:

* Access credentials (access key & secret key)
* Bucket name
* Endpoint URL (e.g., https://storage.googleapis.com)
* Region (e.g., us-central1)

**Privacy**: All backup data remains under your control in your storage bucket. Urumi Cloner does not collect, store, or access your data.

**Important Note About URLs**: Any URLs you see in the plugin interface (such as "https://s3.amazonaws.com" or "https://storage.googleapis.com") are documentation examples only to help you identify the correct endpoint URL for your storage provider. The plugin does NOT load any CSS, JavaScript, images, or other files from these URLs. These are configuration examples, similar to showing "smtp.gmail.com" in an email plugin.

== Support ==

For support, documentation, and feature requests:

* Website: https://urumi.ai
* Email: support@urumi.ai
