Your data

Delete Your Data & Revoke Access

How to disconnect MigratePress from a storage account, delete the backups it created, and remove every trace of it from your site.

Last updated: 24 August 2026

MigratePress runs on your server and stores your backups in your own storage account, so you can remove everything yourself, without asking us. Here is each step.

1. Disconnect the destination in the plugin

In WordPress, open MigratePress → Storage, find the destination and press Disconnect (or Delete to remove it entirely). This erases the stored access token and refresh token from your WordPress database immediately.

2. Revoke the app's access at the provider

Google: open Google Account → Data & privacy → Third-party apps & services, select MigratePress and choose Remove access.
Dropbox: open Dropbox → Settings → Connected apps and disconnect MigratePress.
Microsoft / OneDrive: open Microsoft account → Privacy → Apps and services and remove MigratePress.
S3, B2, Wasabi, Spaces, R2, Nextcloud, FTP: delete or rotate the access key or password you gave the plugin, inside that provider's console.

After revoking, any token that still existed anywhere becomes useless.

3. Delete the backup files

Your backup archives live in your own storage. Deleting the connection does not delete them — that is deliberate, so you never lose a backup by accident.

From the plugin: MigratePress → Backups, select the archives and delete them.
Or directly in the provider: open the migrate-press folder (or the folder you configured) in Google Drive, Dropbox, OneDrive or your bucket, and delete its contents. Empty the provider's trash afterwards if you want them gone immediately.

4. Remove the plugin's own data

Deactivating and deleting MigratePress from Plugins removes its settings, its job history and its local working files from your site. Local backup archives kept on your server are in wp-content/uploads/migrate-press/; delete that folder if you want the local copies gone too.

5. What we hold, and how to have it erased

Our sign-in service keeps no tokens: a finished sign-in is deleted as soon as your site collects it, and in any case within five minutes. What can remain is a short log line — the host name of your site, the provider, the outcome and the time — kept briefly for support and abuse handling.

To have that log line removed, or to ask what we hold about you, email [email protected] from an address associated with the site and we will action it within 30 days.

Nothing else to delete. We never receive your website content, your database, your files or your visitors' data, so there is no copy of them on our side to erase.