Managed WordPress hosts (GoDaddy, WP Engine historically, Bluehost Managed) sometimes deny SSH or SFTP access to their customers. You own your domain and your content, but extracting it without the host's cooperation requires specific tactics. Here is how to pull your site via the WordPress REST API, via database export through phpMyAdmin, and via plugin-based export — plus what to expect from a host that does the right thing.
Key Takeaways
- Managed WordPress often denies SSH, SFTP, or cPanel-level file access.
- "Migration assistance" fees ($150–$500) are often a bypass fee, not a service.
- All-in-One WP Migration, Duplicator, or UpdraftPlus work without server-level access.
- GDPR and US state data-portability laws may require hosts to provide data exports.
- LaunchPad Host provides full SSH + SFTP + backup download on every plan.
What migration lock-in looks like
You decide to move your WordPress site from GoDaddy Managed WordPress to a new host. Expected: download backup, upload at new host, update DNS, done.
What actually happens:
- Your dashboard has a "Backups" tab. The backups are taken but you cannot download them — the button is labeled "Restore" only.
- There is no SSH or SFTP option on managed WordPress plans.
- cPanel is not available — managed WordPress uses a custom dashboard without file-system access.
- Support says migration is a "Pro Services" engagement at $150–$500.
- You are told the only way to move the site is to pay for migration.
This is documented in r/WordPress complaints and the WHT migration thread.
The technical reality: you have WordPress admin access. That is enough.
Method 1: plugin-based export (easiest)
If your WordPress admin works, you can export from inside WordPress itself:
- Install "All-in-One WP Migration" — free plugin, ubiquitous.
- Plugins → All-in-One WP Migration → Export. Choose "File" as destination.
- Wait for the export to complete — typically 5–30 minutes depending on site size.
- Download the .wpress file. This is a complete archive: database, wp-content, uploads, theme files, plugin files.
- At the new host, install WordPress fresh, install All-in-One WP Migration, and import the .wpress file.
Alternative plugins: Duplicator (more manual), UpdraftPlus (backup-focused), Migrate Guru (hosting-aware, sometimes requires a free account).
Caveat: some managed WordPress hosts ban these plugins specifically. WP Engine has a published banned-plugin list including backup and migration plugins. If your host blocks these, proceed to Method 3.
Tired of slow, overcrowded shared hosting?
LaunchPad Host runs on NVMe SSDs + LiteSpeed with free migration, free SSL, daily backups, and crypto payments. 30-day money-back guarantee.
See Hosting PlansMethod 2: database export + wp-content scrape
If phpMyAdmin is available but SSH is not:
- phpMyAdmin → your WordPress database → Export. Method: Quick. Format: SQL. Click Go. Save the .sql file.
- wp-content scrape via WordPress admin: There is no built-in download. If the dashboard exposes a "Media" export, use that; otherwise, use Tools → Export to get at least the XML (posts, pages, comments, categories, tags). This XML does not include media files themselves — only URLs.
- Download media manually: use a site-scraper tool like
wgetagainst your live URLs:wget -r -l 1 -A jpg,jpeg,png,gif,webp -nc https://yoursite.com/wp-content/uploads/. This pulls all media that is publicly-linked. - At the new host: install WordPress, import the database via phpMyAdmin, import the XML, re-upload media into wp-content/uploads/ preserving the date-folder structure (/2023/01/).
This is slower and less complete (plugin files and theme customizations may need reinstall), but works without any file-system access at the origin.
Method 3: WordPress REST API scrape (last resort)
If even plugins and phpMyAdmin are not available — possible on Squarespace-managed WordPress or similar — you can scrape the site via the WordPress REST API:
curl https://yoursite.com/wp-json/wp/v2/posts?per_page=100 > posts.json curl https://yoursite.com/wp-json/wp/v2/pages?per_page=100 > pages.json curl https://yoursite.com/wp-json/wp/v2/media?per_page=100 > media.json
This retrieves public content as JSON. Combine with the XML export from the WordPress Tools menu, and you have a reasonably complete content dump — though without plugin state, theme customizations, or private data.
Re-import at the new host via the WP-CLI wp post create bulk commands or an importer plugin that accepts JSON.
Your legal rights to your data
Under GDPR (EU users, or US companies with EU traffic), you have a right to data portability — the host must provide your data in a commonly-used machine-readable format on request. That does not strictly require cPanel backups, but it does require some extract method. Refusing export is a GDPR violation.
Under California CCPA (2020), similar portability rights apply to California residents.
Outside these jurisdictions, your rights are contractual — whatever the TOS says. Many TOS are silent or ambiguous on export.
Practical advice: do not depend on legal escalation. Use the technical methods above. They work regardless of jurisdiction and regardless of host goodwill.
LaunchPad Host provides:
- Full cPanel access on every shared plan
- SSH on every shared plan (not just VPS)
- SFTP on every plan
- Full-account backups via cPanel or JetBackup, downloadable as .tar.gz
- On-demand migration assistance — free, not a $150 "Pro Services" line item
Frequently Asked Questions
Under GDPR (EU) and CCPA (California), no. In most other jurisdictions, it depends on the TOS. Practically, the technical methods above work regardless.
Most commonly the issue is PHP memory or execution time limits on free tier. Either bump the PHP settings (if your dashboard allows) or break the export into smaller chunks using Duplicator or UpdraftPlus.
Site with <1GB data: 1–2 hours end to end, including DNS propagation. Larger sites with extensive media: can take a day. Plan DNS TTL reduction in advance (set to 300 seconds 48 hours before cutover).
Only if you migrate email at the same time. Keep email on the old host for 30 days after web cutover, then migrate separately.
Yes — SiteGround, Cloudways, Kinsta, WP Engine (for incoming), Rocket.net, and LaunchPad Host all provide tools for outgoing migration. The hostile-to-outgoing hosts are specifically the budget-bundle providers and legacy managed-WordPress.
Zero. Incoming migration is free for the first site; multi-site migrations are $20/site after the first. No "Pro Services" tier.
Separate process, but usually done simultaneously. Request auth code from old registrar, start transfer at new registrar. 5–7 days total. See our dedicated migration guide for the coordination sequence.
Ready for hosting that just works?
NVMe + LiteSpeed hosting with free migration, crypto payments accepted, and a 30-day money-back guarantee.
See Hosting PlansRelated tools, articles & authoritative sources
Hand-picked internal pages and external references from sources Google itself considers authoritative on this topic.
Related free tools
- DNS Propagation Checker Check DNS propagation across 12 global resolvers in real time.
- DNS History Checker Historical DNS, SSL certificates, subdomains & Wayback snapshots for any domain.
- WHOIS Lookup Registrar, creation date, expiry, nameservers, DNSSEC status — for any domain.
Offshore & privacy hosting
- Offshore WordPress Hosting LiteSpeed + NVMe + EU jurisdiction
- Offshore Hosting EU jurisdiction, privacy-first, from $3.99/mo