Marathon Migration

Marathon Migration is the official migration plugin for Marathon Hosting. Once installed, it exposes a small authenticated transfer endpoint on your current WordPress site that the receiving Marathon server uses to pull your files and database directly — no shell access, no packaging, no on-disk archives.

How it works:

1. Generate a migration token from your Marathon Hosting client portal
2. Install and activate this plugin on your current WordPress site
3. Go to Marathon Migration in your WordPress admin and paste the token
4. Click Start Migration — the plugin handles the rest

When you start a migration the plugin (1) validates your token with the Marathon Hosting Gateway, (2) generates a one-time signing secret unique to this migration, and (3) tells the Gateway the URL of your site and that signing secret. The receiving Marathon server then connects to your site and pulls many files and database rows per request over a single high-throughput streaming endpoint — exactly the same architectural pattern used by other well-known migration plugins. URLs are automatically rewritten on the destination, file permissions are set, and the Marathon Hosting plugin is deployed — all without you lifting a finger.

What gets transferred:

• Your complete database
• All WordPress core files (exact version — no forced upgrades)
• All themes, plugins, uploads, and media
• Must-use plugins (mu-plugins)

What gets left behind:

• Server-specific configuration (wp-config.php, .htaccess — the receiving server provides its own)
• Dropin replacements (wp-content/object-cache.php, wp-content/advanced-cache.php, wp-content/db.php — Marathon Hosting provides its own)
• Cache plugin output directories (wp-content/cache/, wp-content/uploads/cache/, W3 Total Cache config, WP Rocket config)
• Host-specific platform code (WP Engine’s wpe-common mu-plugins, Kinsta’s kinsta-mu-plugins, Cloudways and SiteGround migrator helpers — these are part of the source host, not your site)
• Log files (debug.log, WooCommerce wc-logs, error_log, php_errorlog, anything ending in .log under uploads)
• Backup archives from other backup plugins
• OS and developer junk (.DS_Store, Thumbs.db, __MACOSX/, .git/, .svn/, .hg/, node_modules/)
• The migration plugin itself (automatically removed after transfer)

Security:

• All transfers use a one-time token tied to your specific Marathon Hosting account
• Every request from the Marathon server is signed with a per-migration HMAC-SHA256 secret that lives only in memory on the receiving server and the marathon_migration_auth_secret WordPress option on yours
• The plugin’s transfer endpoint rejects any request without a current, correctly-signed signature — the signing secret is wiped from your database the moment the migration completes or fails
• Multisite installs are detected and refused before any data is transferred (multisite migrations are not yet supported)

External services

This plugin connects to the Marathon Hosting Gateway (the “Service”), operated by Marathon Hosting, to coordinate site migrations into Marathon Hosting. The Service is required for the plugin to function — without it the plugin cannot validate a token, register itself for pull-based transfer, or report progress back to your dashboard.

The plugin contacts the Gateway only after you paste a migration token and start a migration. The base URL of the Gateway is supplied by Marathon Hosting at validation time and stored in the WordPress option marathon_migration_gateway_url.

The following requests are sent to the Gateway:

1. Token validation — when you paste a token and start a migration, the plugin sends the token and the public URL of your current WordPress site (get_site_url()) to the Gateway so it can verify the token belongs to your account and learn where to pull from.
2. Ready notification — once the plugin has generated its per-migration signing secret, it sends the token, the URL of your WordPress site, the signing secret, and your current WordPress and PHP versions to the Gateway so the receiving Marathon server can begin pulling.
3. Status polling — while the migration is in progress, the plugin periodically requests the migration status from the Gateway using the token (in the URL).

Once the Gateway has the signing secret, it hands it to the receiving Marathon server. That Marathon server then connects directly to your site (<your-site>/?marathon_migration=1) and pulls your files and database live over a signed streaming endpoint. No database contents, file contents, or database credentials are sent to the Gateway itself.

This service is provided by Marathon Hosting:

• Terms of Service: https://marathonhosting.com/tos.html
• Privacy Policy: https://marathonhosting.com/pp.html