Everything below reflects the current release (v1.0.0). From upload to your first downloaded ZIP is about two minutes.
You need WordPress on PHP 7.4+, an administrator login, and the PHP ZipArchive extension (on by default almost everywhere). One honest note: a tool that packages plugin code is admin-only for a reason, so keep it to the people who already run the site. WPKeyDrop enforces that with a capability check and a signed link on every download, and it never sends your plugins anywhere.
On the home page, add your name and email and we send your free registration key and the download link straight back. The key is only so we can tell you about updates — the plugin never checks it. WPKeyDrop is free under the GPL.
Go to Plugins → Add New → Upload Plugin, choose the wpkeydrop.zip from your email, install and activate. Activation touches nothing on disk: it simply adds a WPKeyDrop item under Tools.
The screen lists every plugin installed on the site — active or not, in the directory or not — with its name, version and status, and a Download ZIP button on each row.
Click Download ZIP on any plugin. WPKeyDrop packages that plugin's folder exactly as it sits on disk, with the correct top-level directory, and streams it to your browser. Single-file plugins are handled the same way.
On the other site, go to Plugins → Add New → Upload Plugin and upload the ZIP you just downloaded. Because the archive keeps the right folder name, it installs cleanly — the same version you were running, moved across.
The behaviours and safeguards you will actually live with.
Only a logged-in administrator with the manage_options capability. The screen lives under Tools where other roles never see it, and there is no public route to a download.
Each Download ZIP link carries a WordPress nonce, so a copied URL cannot be replayed by anyone else or bookmarked for later. The nonce is checked before a single byte is packaged.
The plugin folder as it is on your server right now, including any edits already on disk, wrapped in its correct top-level directory. It is a faithful copy of the running version, not a fresh download from a directory.
A one-file plugin such as hello.php has no folder of its own. WPKeyDrop packages just that file into the archive, so it still uploads and activates normally on the far side.
WPKeyDrop only ever acts on a plugin WordPress reports as installed. Before building the archive it resolves the path with realpath() and confirms it sits inside the plugins directory. A crafted request pointing elsewhere is refused, not served.
There is no server, no API and no telemetry. The ZIP is built in a temp file on your own server, streamed to you, and deleted immediately after. The only thing that ever leaves is the registration email you asked for.
On the rare host with php-zip disabled, the screen says so plainly and disables the buttons rather than half-failing. Ask your host to enable the ZipArchive extension and the downloads light up again.
WPKeyDrop grabs one plugin, or a handful, exactly as installed. It is the thing you reach for before an update, during a migration, or when you inherit a site. It is not a scheduled whole-site backup and does not claim to be.