WordPress Media Migration — Application Password Setup

Univaultport talks to WordPress via the REST API, authenticating with HTTP Basic and Application Passwords — a feature built into WordPress 5.6 and newer. No plugins required, no OAuth dance, no consumer key/secret pair. This guide covers the full setup and the two gotchas that catch most teams.

Two prerequisites you must check first

Before generating credentials, verify these two things in your WordPress admin. If either is wrong, the integration won't work and the error messages will be cryptic.

1. Permalinks must NOT be set to "Plain"

Go to Settings → Permalinks.

Common Settings:
  ○ Plain          ← will break REST API
  ● Post name      ✓ recommended
  ○ Day and name
  ○ Month and name
  ○ Numeric
  ○ Custom Structure

If "Plain" is selected, the REST API at /wp-json/... returns 404 because URL rewriting is off. Switch to any other option and click Save Changes.

2. The WP user needs the `upload_files` capability

Application Passwords inherit the user's role. To upload to WP from another platform, the user must be at least an Author. Subscribers and Contributors cannot upload — they'll get 403 errors.

Quickest check: Users → All Users → your user → Role. If it says Subscriber or Contributor and you want writes, change it (or create a dedicated migration user with the Author role).

For read-only migrations (WP → another platform), any role works because listing media doesn't require upload_files.

Step 1 — Open your user profile

In WP Admin, click your avatar at the top-right → Edit Profile, or go to Users → Profile.

Scroll all the way down. You'll find a section called Application Passwords.

Step 2 — Generate a new application password

Name the password
Type something descriptive like asset-migrator-prod. This is just a label for your reference — pick something you'll recognize later.
Click 'Add New Application Password'
WordPress generates a 24-character password split into 6 groups of 4 with spaces between them.
Copy immediately
You will not see this password again. Copy it now. If you lose it, you'll have to revoke and generate a new one.

The password looks like this:

abcd EFGH 1234 ijkl MNOP 5678

The spaces are fine — paste it as-is into Univaultport. WordPress accepts the password with or without spaces.

Step 3 — Paste credentials into Univaultport

In the connector wizard:

Site URL
The root URL of your WordPress site. Example: https://mysite.com. Don't include /wp-json or any path — just the origin.
Username
Your WP login username (not your email, unless the username and email are the same).
Application Password
Paste the 24-character password including the spaces.

Click Save & test. Univaultport hits /wp-json/wp/v2/users/me to validate. A green check means everything is wired up correctly.

How WordPress chooses where to upload files

This is the one quirk you cannot work around: WordPress decides the file path itself.

When you migrate a file into WP, the destination URL becomes:

https://mysite.com/wp-content/uploads/2026/05/<filename>
                                       └─ year / month based on upload date

The original folder structure from your source connector is discarded — WP's media library is flat. The destFolderMode: 'new' option in the Univaultport wizard has no effect for WordPress destinations and is silently ignored.

If you need a hierarchical media library, look into plugins like FileBird or Real Media Library — but those plugins use custom taxonomies, not real folders on disk.

File size limits

WordPress upload limits come from three different layers of PHP/WP configuration:

Setting	Where	Default
`upload_max_filesize`	`php.ini`	2 MB on shared hosting, 64 MB on most managed WP
`post_max_size`	`php.ini`	Must be ≥ upload_max_filesize
`WP_MEMORY_LIMIT`	`wp-config.php`	40 MB

If you hit a 413 Payload Too Large, your host's PHP config is the bottleneck. Most managed WP hosts have a "Upload Size Limit" toggle in the control panel. For self-hosted, edit php.ini and restart php-fpm.

For migrations of large video files (>100 MB), confirm the limits before running a job — there's no way for Univaultport to split a single file across multiple requests.

Troubleshooting

Error	Cause	Fix
`401 Unauthorized`	Wrong username, wrong app password, or pasted the regular login password	Re-generate app password; use the username, not email
`403 Forbidden` on upload	User role lacks `upload_files`	Change role to Author or higher
`404 Not Found` on `/wp-json/...`	Permalinks set to Plain	Change to "Post name"
`413 Payload Too Large`	PHP upload limit	Raise `upload_max_filesize` in php.ini
Disabled by security plugin	Wordfence/iThemes blocked Application Passwords	Re-enable in plugin settings

Read-only vs. read-write migrations

The same Application Password works for both directions. The only difference is the user role behind it:

WP → another platform (read-only): any role works
Another platform → WP (write): user must be Author or higher
Both directions on the same connector: Author or higher

We recommend creating a dedicated WP user for migrations (e.g., migration-bot, role Author) so the credentials aren't tied to a real human's account.

Next steps

With WordPress connected, common patterns are:

WP → Cloudinary or S3: offload media to cheaper/CDN-fronted storage
Cloudinary → WP: bring a DAM library into WordPress for a content team
WP → WP: site cloning between staging and prod

How to Connect WordPress to Univaultport with Application Passwords