How to Move Your WordPress Site to Kinsta or WP Engine and Manage It Yourself

Most small businesses pay a developer an hourly rate to do jobs their hosting account already does for free. Backups, security scanning, staging, a CDN and a firewall are all included with a managed WordPress host. You are paying for a middleman to click buttons.

This is the guide I send people who ask me to manage their hosting and security. I would rather you own it. It costs you less, it removes me as a single point of failure, and you will sleep better knowing exactly where your backups live and how to restore them.

Here is how to move to Kinsta or WP Engine, switch on backups you can actually restore, and lock the site down with Wordfence and two-factor authentication. No command line needed.

One thing worth knowing before you start, and it matters if you are in Perth or anywhere in Western Australia: managed hosts staff support around the clock, so a problem at 9pm AWST is not a wait until tomorrow morning.

Why moving is a no-brainer

The reason people put this off is the migration. They assume moving a website means days of work and a real chance of breaking something. With Kinsta or WP Engine, it is neither. Their teams do the work, and they do it at no cost.

• The migration is free, and you do not do it. Kinsta includes unlimited migrations carried out by their own migrations team. WP Engine supplies a free Site Migration plugin and migration specialists who will run the move for you.
• Your total involvement is usually under an hour. Sign up, hand over access, then click through the new site before anything goes live. For a typical small business site that is 45 to 60 minutes of your time, not days of it.
• There is no downtime. Your live site keeps serving customers while the copy is built and tested on a temporary address.
• Nothing else about the site changes. Same domain, same content, same URLs, same rankings.
• It replaces hourly developer work with one flat fee. Backups, staging, a CDN, a firewall, updates and round the clock support arrive as a single bundle for $30 to $70 a month.

Here is the whole move, broken down by who does what:

Migration task	Who does it	Your time
Copy files, database, plugins and media	The host's migration team	None
Check pages, forms, images and checkout	You	20 to 30 minutes
Point DNS using the records they give you	You or your domain registrar	10 minutes
Confirm HTTPS, email and sitemap after the switch	You, with their support team on hand	15 minutes

An hour of your time, once, and you never pay someone to manage hosting for you again.

Why move off cheap or hand-managed hosting?

If your site sits on a $10 a month shared plan, it shares a server with hundreds of other sites. When one of them gets a traffic spike or gets hacked, yours is affected. That is the main reason small business sites go down, and the main reason they get compromised.

If your site sits on a server that a freelancer set up and only they understand, you have a different problem. You cannot get in, you cannot get backups, and you cannot leave. I have been that freelancer. It is a bad deal for you.

A managed WordPress host fixes both problems. You get a dashboard you control, automatic backups, staging to test changes, server-level caching, a firewall and support you can reach. You stop needing a person in the loop for routine work.

Kinsta vs WP Engine: which should you pick?

Both are serious managed hosts. Both include free migrations, daily backups, staging environments and caching. Both are a step up from anything you would set up yourself on a budget server.

	Kinsta	WP Engine
Where it runs	Google Cloud, every plan	AWS and other providers
Free migration	Yes, their team migrates it	Yes, plugin or their team
Backups	Daily automatic, 14 to 30 days retention	Daily automatic with one-click restore
Staging	Yes, one click	Yes, one click plus dev environments
Security	Cloudflare CDN, WAF and DDoS protection included	Managed patching, plus Global Edge Security add-on
Entry price	From about $35 per month	From about $28 to $30 per month
Best for	Speed and simplicity	Agencies and larger content sites

Pick Kinsta if you want the simplest account and the fastest setup out of the box. Pick WP Engine if you want more plan choices or you run several sites. For one small business site, either is a good home for years.

One caveat worth knowing: managed hosts are tuned for WordPress. If you rely on an unusual plugin that needs raw server access, or applications built on other platforms, check compatibility before you move.

How do you move a WordPress site to Kinsta or WP Engine?

You do not need to touch a database, a file manager or a command line. You sign up, hand over access, and their team copies your files, database, plugins and media to a temporary address so you can test everything before your live site changes.

Step 1: Sign up and let their team do the migration for free

Expect to spend about 15 minutes here. Buy the plan, request the migration, hand over access through the secure form the host provides, and let them work. Kinsta includes unlimited migrations done by their team, requested from the MyKinsta dashboard. WP Engine provides a free Site Migration plugin that pulls the site across from almost any host, and their specialists will take over if anything looks complicated.

One rule while you wait: do not touch your DNS yet. Your live site should stay exactly where it is until you have tested the new one.

The host will copy your files, your database, your plugins and your media, then hand you a temporary address to inspect the site on. Your real domain is untouched at this point, which is why there is no downtime.

Step 2: Test before you switch

Never change DNS the day you migrate. Use the temporary host address and click through everything:

• The homepage and a few deep pages
• Any contact or enquiry forms, and confirm the emails arrive
• Login to the WordPress admin
• Images and downloads
• Any shop, booking or membership features
• Checkout and payment flows if you sell online

Run a speed test on the temporary address too. If something is broken, fix it now, while your real site is still serving customers.

Step 3: Clean up on the way in

Moving is the perfect moment to shed weight. Routine, but it pays off:

• Delete plugins you do not use. A lean plugin list is faster and safer.
• Remove any caching plugin. Kinsta and WP Engine handle caching at the server level, and a second caching plugin causes more problems than it solves.
• Remove backup plugins that duplicate the host's backups, or keep one and point it at offsite storage.
• Set up transactional email with WP Mail SMTP or Fluent SMTP, or your contact form messages may never send from the new server.
• Check that Sendgrid, Stripe or any other integration still has the right keys.

Step 4: Point the DNS and switch over

Follow your host's DNS instructions. Usually that means updating an A record or a CNAME at whoever manages your domain. If your domain is on Cloudflare, make sure the records are set correctly for the new host.

Propagation is usually fast but can take a few hours in the worst case. Once it is live, force HTTPS, submit your sitemap in Google Search Console, and click through the forms one more time on the real domain. Keep the old host running for two weeks, then cancel it.

Your getting started checklist

Print this and work through it in order. This is the entire move on one page, and most of it is ticking boxes rather than doing work.

Before you buy anything

• Take a full backup of your current site and download it somewhere you control
• Confirm where your domain DNS is managed, whether that is your registrar, Cloudflare or your current host
• Check where your email actually lives by looking at your MX records, because moving DNS can break email if it points at the old host
• Get WordPress administrator access, or ask your current developer for it
• Collect logins for anything connected to the site: payments, analytics, booking tools, email marketing

On migration day

• Buy the plan and request the free migration
• Hand over access through the secure form the host provides
• Wait for the temporary address, then click through every page, form, image and checkout flow
• Fix anything broken while your live site is still serving customers

Switching over

• Point DNS using the records the host gives you
• Force HTTPS and confirm the padlock appears
• Send a test contact form and confirm the email arrives
• Submit your sitemap in Google Search Console
• Keep the old host running for two weeks, then cancel it

Your first week on the new host

• Install Wordfence and run the first scan
• Turn on two-factor authentication for every administrator account
• Confirm daily backups are running, then restore one into staging to prove it works
• Set a recurring calendar reminder for the monthly maintenance routine below

Do Kinsta and WP Engine include backups?

Yes. Kinsta and WP Engine both take automatic daily backups and let you restore from their dashboard in a couple of clicks. Kinsta's backup documentation spells out retention per plan. Retention is typically 14 to 30 days depending on your plan, so a problem you notice three weeks later may already be outside the window.

Three habits make backups actually useful:

• Take a manual backup before every update. Both dashboards have a one-click option. Ten seconds of work, and an easy rollback if a plugin update breaks the site.
• Test a restore once. A backup you have never restored is a hope, not a plan. Restore into staging and check it works.
• Keep an offsite copy. Host backups live with the host. Kinsta offers an external backups add-on, or you can point UpdraftPlus at Google Drive or Amazon S3 for a few dollars a month. If the host itself has a bad day, your data survives it.

How do you secure a WordPress site after moving hosts?

Your new host protects the server. Wordfence protects the site. It is free, it takes about 15 minutes to set up, and it covers the two things that catch most small business sites: bots trying to log in and malicious files that slip through.

Set up Wordfence

1. In WordPress, go to Plugins, Add New, search for Wordfence Security, install and activate.
2. Enter your email to get alerts, then run the first scan.
3. Open Wordfence, Firewall and turn on the firewall. If you have a paid licence, also enable extended protection.
4. Go to Login Security and set a limit on failed login attempts, then enable CAPTCHA on the login page.
5. Turn on alerts so you get an email if the scan finds something, rather than finding out when Google flags your site.

Turn on two-factor authentication

2FA used to be a premium feature. Wordfence now includes it in the free plugin, using an authenticator app rather than SMS, which is much harder to intercept. Their two-factor authentication guide covers the settings in detail.

1. In Wordfence, go to Login Security, then Settings, and turn on two-factor authentication.
2. Choose which user roles must use 2FA. At minimum, administrators and editors.
3. Each user then goes to their WordPress profile, opens the Wordfence 2FA section, and clicks to configure it.
4. Scan the QR code with Google Authenticator, Authy, Microsoft Authenticator or any other TOTP app.
5. Save the backup codes somewhere offline. If you lose your phone, they get you back in.

If you only want the login hardening and not the full firewall, there is also a lighter Wordfence Login Security plugin that covers 2FA, CAPTCHA and XML-RPC protection.

Other basics that matter just as much

• Use long, unique passwords, and never reuse your WordPress admin password anywhere else.
• Do not keep a user account called "admin". It is the first username every bot tries.
• Delete unused user accounts and give people only the access they need.
• Turn off file editing in the WordPress admin and remove XML-RPC if nothing uses it. Wordfence handles the XML-RPC part for you.
• Let WordPress apply minor core security updates automatically, but test plugin and theme updates on staging first.

What maintenance does a WordPress site actually need?

Fifteen minutes a month keeps a small business site healthy:

• Apply plugin, theme and core updates to staging first, check the site, then push to production
• Take a backup before updates
• Read the Wordfence scan summary and clear anything flagged
• Confirm a recent backup exists and spot check a restore occasionally
• Review the user list
• Run a speed test and check the contact form

If you can do those six things, you do not need to pay anyone a monthly retainer for routine hosting management.

Is it cheaper than paying a developer?

Yes, by a wide margin. Here is the same work priced both ways.

What it covers	Managed hosting	Developer retainer
Backups, restores and offsite copies	Included	30 to 60 minutes a month
Security scanning, firewall and 2FA	Included with Wordfence	30 to 60 minutes a month
Plugin, theme and core updates	You run them from staging	1 to 2 hours a month
Caching, CDN and server support	Included	Rarely included
Typical monthly cost	$30 to $70	$250 to $500 at $125 an hour

The maths is not close. Pay for hosting, run the checklist above, and keep your developer for actual work: builds, fixes, integrations and problems that need judgement rather than button clicks.

If something breaks, or you would rather hand the whole thing to someone, that is what I do. Quick fix WordPress support in Perth covers urgent problems, and ongoing WordPress maintenance in Perth is available if you want a safety net without the retainer trap. Otherwise, get in touch and I will point you at the right host for your site.

If you would rather have a developer own the whole stack, see Freelance WordPress Developer Perth for hands-on help.