Contentrain Bridge turns your WordPress content into editable JSON and Markdown under Tools > Contentrain Bridge. You choose the content, review how it is modelled and which interface text travels, then download a ZIP or send the result to a branch in your own GitHub repository. Both are free.<\/p>\n\n
Media travels with the content: uploads are copied into Want a working Astro website instead of files? Contentrain Migrate, a separate paid service, connects to this plugin with a key you create and builds a complete Astro site from your content: https:\/\/migrate.contentrain.io\/?utm_source=wordpress-org&utm_medium=readme<\/p>\n\n The plugin contacts no host other than this site unless you choose GitHub delivery. Two options read this site's own pages over HTTP, the way a visitor would, and send nothing elsewhere: \"Also read the text your pages render\" (the home page, a post, a page, search and not-found) and, with it, the connected-services check (the home page's script hosts).<\/p>\n\n GitHub<\/strong> \u2014 used only when you enter a repository and a token in step 3 and start the delivery. The plugin then calls the GitHub REST API at api.github.com to read the target repository's default branch (or the base branch you name) and file list, upload the exported files, and create one new branch holding them. What is sent: the exported content files you reviewed, a commit message, and the token you supplied. Nothing is sent to Contentrain or to any other host, and no analytics or telemetry is collected. The token is used for those requests only and is never stored in the database or in the export. Delivery never writes to your default branch and never overwrites a file you edited in Git. GitHub's terms: https:\/\/docs.github.com\/site-policy\/github-terms\/github-terms-of-service \u2014 privacy policy: https:\/\/docs.github.com\/site-policy\/privacy-policies\/github-privacy-statement<\/p>\n\n REST export API (inbound)<\/strong> \u2014 the plugin adds routes under robots.txt (only when you turn it on)<\/strong> \u2014 Tools > Contentrain Bridge has a switch, off by default, \"Let Contentrain Migrate read my pages and media\". It changes only the robots.txt WordPress itself serves, through WordPress's The plugin stores export ownership and a source revision marker. It sends nothing anywhere on its own; an export leaves the site only when you download it, deliver it to GitHub, or authorize a program to read it through the REST export API with an administrator's application password or a Contentrain Migrate connection key. For a connection key the plugin stores a fingerprint of the key (never the key), the administrator who created it, the Migrate order it is paired with, the list of exports it started, and the time and IP address of its last use; creating a new key or revoking it, and uninstalling the plugin, removes them. A request made with the key runs with no WordPress user. Export files are written to a private, per-site directory outside the web root that only the server can read, are removed on uninstall, and expire after a day. An export can contain site content, authors' display names and WordPress usernames, selected post metadata and, if you or the program you authorized chose it, privacy-minimized comments of every status (approved, pending, spam and trash) and draft, pending, scheduled, private and password-protected posts (never the password). A program authorized through the REST API chooses the scope; Contentrain Migrate asks for private content. Treat a downloaded export as you would a WordPress export file. If you deliver to GitHub, the exported content is sent to GitHub under the account whose token you provide; choose a private repository when the export includes draft or private content.<\/p>\n\n\n Updates arrive through WordPress like any other plugin's, from the WordPress.org directory. A ZIP installed from a GitHub release is updated by uploading the newer release ZIP the same way; WordPress replaces the installed version. Export snapshots are temporary and are not affected.<\/p>\n\n\n No. Modelling, validation, the ZIP download and GitHub delivery are all local and free. Migrate is an optional later step if you want an Astro website.<\/p><\/dd>\n No. It collects no analytics and contacts no Contentrain server. The only request to another host is to the GitHub API, when you start a GitHub delivery yourself.<\/p><\/dd>\n Yes, when you include the Media type. Each upload and its generated sizes are copied into A way for Contentrain Migrate to read this site's content when your host blocks application passwords (some hosts strip the Authorization header they travel in). Create it under Tools > Contentrain Bridge and paste it into Migrate.<\/p>\n\n What it allows: Migrate can ask this site to prepare a content export and download it \u2014 published posts, pages and custom post types with their fields and metadata (secret-looking keys are always left out); if Migrate asks for it, draft, pending, scheduled, private and password-protected content too (never the password itself); media records (the files only if requested); categories, tags and menus; comments without email addresses or IP addresses; SEO, redirect and permalink settings; theme design settings; the names and versions of active plugins and the theme; and the number of published entries per content type.<\/p>\n\n What it cannot do: it runs with no WordPress user and cannot change anything on this site \u2014 no post, setting, file, user, plugin or theme is written. It does not open the WordPress REST API, wp-admin or application passwords; it works only on the plugin's own export routes. The key is valid only while the administrator who created it still has the export and manage_options capabilities.<\/p>\n\n Revoking: revoke it on the same screen at any time; creating a new key retires the old one, and revoking removes the exports it prepared. It is shown once and only a fingerprint of it is stored. Paste it into Migrate within an hour; once Migrate has used it, it works for that one move until 14 days after it was created, until Migrate closes it when the move is done, or until you revoke it or create a new one. It can only be created and used over HTTPS. Nothing is sent from your site to Contentrain when you create it.<\/p><\/dd>\n Contentrain Migrate respects robots.txt. If yours closes the site to crawlers (for example with \"Discourage search engines from indexing this site\"), Migrate cannot read your pages and media to move them. The switch opens the site to the ContentrainMigrate crawler only, keeps what you close for every crawler closed to it as well (it drops only the lines that close the whole site, and opens the REST API and your uploaded media), and changes nothing for other crawlers. It is off until you turn it on, and you can turn it off at any time.<\/p>\n\n If Cloudflare (or another CDN) serves your robots.txt, for example Cloudflare's managed robots.txt, WordPress's robots.txt never reaches visitors and the switch cannot change it: add the lines the screen shows in that service's settings instead.<\/p><\/dd>\n Only when explicitly selected: author name, URL, content, status, dates and relationships. Comments of every status are included (approved, pending, spam and trash), each with its status, so you can leave out the ones you do not want to keep. Email addresses, IP addresses, user-agent values and comment metadata are excluded.<\/p><\/dd>\n The active theme and child theme, and optionally the source files of active plugins. It reads PHP, HTML and JavaScript text to find interface strings, never executes them, skips vendor and dependency directories, and stops at 10,000 files. Every string it finds is a candidate you review before it becomes content.<\/p><\/dd>\n\n<\/dl>\n\n\nmedia\/<\/code> and the content is relinked to them, so the delivered repository does not depend on this site for images. A file over 8 MB, or one missing from the uploads directory, keeps its WordPress URL and is named in the coverage report. Dynamic WordPress and plugin output is not rendered during a source scan. These limits are written into the coverage report rather than implied to be complete.<\/p>\n\nExternal services<\/h4>\n\n
\/wp-json\/contentrain-bridge\/v1\/<\/code> that let a program you authorize start an export and read its files. The plugin sends nothing by itself: the program asks, with an application password of an administrator who has the export and manage_options capabilities, or with a Contentrain Migrate connection key (below). Contentrain Migrate uses these routes when you give it such a password or key to migrate this site; what Migrate then does with the content is governed by Contentrain's terms (https:\/\/contentrain.io\/terms-of-service) and privacy policy (https:\/\/contentrain.io\/privacy-policy). The program that starts an export chooses its scope: Migrate asks for private content (drafts, pending, scheduled, private and password-protected posts, never the password) and for comments, and the exported files carry each post's own status. These routes only read: no remote call creates, edits or deletes posts, settings, files, users, plugins or themes; the plugin writes only its own temporary export files outside the web root and its own bookkeeping options. Revoke the application password in your profile (or the connection key on the Bridge screen) to end that access; exports expire after a day.<\/p>\n\nrobots_txt<\/code> filter, and contacts no host. When you turn it on, robots.txt gains one group for the ContentrainMigrate<\/code> crawler: the rules your robots.txt gives every crawler (User-agent: *<\/code>), without the lines that close the whole site (a Disallow matching \/<\/code>), followed by Allow<\/code> lines for the REST API (\/wp-json\/<\/code>), your uploaded media (\/wp-content\/uploads\/<\/code>) and \/<\/code>. By robots.txt's longest-match rule those Allow lines open only those paths: a rule such as Disallow: \/wp-<\/code> still keeps wp-admin closed. Paths you keep closed, such as wp-admin, stay closed to it, and every other crawler sees robots.txt exactly as before. Turning it off removes the group, and uninstalling the plugin removes the setting. If your site serves a robots.txt file from disk, WordPress cannot change it: the switch stays off and the screen shows the lines to add yourself.<\/p>\n\nPrivacy<\/h3>\n\n
\n
contentrain-bridge.zip<\/code> from the latest GitHub release (https:\/\/github.com\/Contentrain\/wordpress-bridge\/releases\/latest), the same archive, and install it with Plugins > Add New > Upload Plugin.<\/li>\n\n
Is Contentrain Migrate or Studio required?<\/h3><\/dt>\n
Does the plugin send telemetry?<\/h3><\/dt>\n
Are media files exported?<\/h3><\/dt>\n
media\/<\/code> in the export, and content that pointed at a WordPress upload URL is rewritten to that path, so images keep working after this site is gone. Media records also keep the original URL. Files larger than 8 MB, files missing from disk, and anything past the export's total media budget keep their WordPress URL instead of being half-copied; the coverage report lists them. The 8 MB ceiling exists because GitHub delivery has to hold a file in memory to upload it.<\/p><\/dd>\nWhat is the Contentrain Migrate connection key?<\/h3><\/dt>\n
Why would I let Contentrain Migrate read my pages and media in robots.txt?<\/h3><\/dt>\n
Which comment data is exported?<\/h3><\/dt>\n
What does the source scan read?<\/h3><\/dt>\n
0.8.5<\/h4>\n\n
\n
utm_source=bridge<\/code> so visits from the plugin can be counted. The link sends no site data.<\/li>\n<\/ul>\n\n0.8.4<\/h4>\n\n
\n
0.8.3<\/h4>\n\n
\n
admin<\/code> directory, and minified scripts. JavaScript literals that are one lowercase word or a BEM class name (\"fade\", \"collapsing\", \"pswp__img\") are code. Each is still listed in bridge\/hardcoded-text.json with its reason; the same words in a template a visitor sees stay a candidate.<\/li>\n0.8.2<\/h4>\n\n
\n
0.8.1<\/h4>\n\n
\n
0.8.0<\/h4>\n\n
\n
0.7.1<\/h4>\n\n
\n
0.7.0<\/h4>\n\n
\n
0.6.5<\/h4>\n\n
\n
0.6.4<\/h4>\n\n
\n
0.6.3<\/h4>\n\n
\n
0.6.2<\/h4>\n\n
\n
0.6.1<\/h4>\n\n
\n
label<\/code>, url<\/code>), not ACF's internal keys (field_5f3a\u2026<\/code>), so they match what the REST API gives and the migrated fields are readable in Studio. Fields on posts and options pages are both affected. A key no field owns is kept as it is and reported.<\/li>\n<\/ul>\n\n0.6.0<\/h4>\n\n
\n
[protected]<\/code>; the password itself never leaves WordPress. The plugin's behaviour is unchanged: the scope is chosen by whoever starts the export, and exports you start yourself are unaffected.<\/li>\n<\/ul>\n\n0.5.0<\/h4>\n\n
\n
.htaccess<\/code> and Simple 301 Redirects are exported, 410 and 451 \"gone\" rules are kept, and Redirection's query, case and trailing-slash options are respected. A rule that depends on a cookie, header, IP or role is reported without its condition data.<\/li>\n?p=<\/code> link typed with or without www.<\/code> is recognised as the same site.<\/li>\n0.4.0<\/h4>\n\n
\n
[protected]<\/code> instead of an empty password, so a reader keeps it off the public site; the password itself still never leaves WordPress.<\/li>\nGET \/about<\/code> says which sign-in a reader can use; POST \/exports\/{id}\/read<\/code> reads a snapshot for a caller whose key travels in the request body; DELETE \/key<\/code> lets Migrate close its own key.<\/li>\n<\/ul>\n\n0.3.1<\/h4>\n\n
\n
0.3.0<\/h4>\n\n
\n
POST \/exports<\/code>, reused per scope, max_age<\/code>\/fresh<\/code>), list, and advance an export with an application password; read any snapshot file in 8 MiB chunks. Administrator permissions only.<\/li>\nbridge\/rawir.json<\/code>. GitHub delivery never includes it.<\/li>\nmedia_files: false<\/code> (REST, and a checkbox on the export screen): attachment records without their files; content keeps the WordPress upload URLs.<\/li>\n0.2.1<\/h4>\n\n
\n
0.2.0<\/h4>\n\n
\n
media\/<\/code> and content is relinked to them.<\/li>\n0.1.0<\/h4>\n\n
\n