{
    "title": "WordPress Importer",
    "seo_title": "WordPress Importer: review, settings and limitations",
    "h1": "WordPress Importer",
    "description": "WordPress Importer: what it imports from a WXR file, its limits (media, memory, settings), the options to pick and the vulnerability fixed in 0.8.4.",
    "lead": "WordPress Importer, the official WordPress importer, rebuilds the content of a WXR export file on a site: posts, pages, comments, terms, menus and authors. What it really transfers, what it leaves out, and the choices that get media, authors and links across correctly.",
    "language": "en",
    "locale": "en-US",
    "type": "plugin-sheet",
    "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/wordpress-importer/",
    "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/wordpress-importer/",
    "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/wordpress-importer/index.md",
    "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/wordpress-importer/index.json",
    "published": "2026-11-04T08:00:00+00:00",
    "modified": "2026-11-05T21:31:35+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "WordPress Importer",
            "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/wordpress-importer/",
            "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/wordpress-importer/index.md",
            "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/wordpress-importer/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "WordPress Importer",
            "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/wordpress-importer/",
            "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/wordpress-importer/index.md",
            "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/wordpress-importer/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "WordPress Importer",
            "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/wordpress-importer/",
            "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/wordpress-importer/index.md",
            "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/wordpress-importer/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "WordPress Importer",
            "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/wordpress-importer/",
            "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/wordpress-importer/index.md",
            "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/wordpress-importer/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "WordPress Importer",
            "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/wordpress-importer/",
            "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/wordpress-importer/index.md",
            "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/wordpress-importer/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "WordPress Importer",
            "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/wordpress-importer/",
            "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/wordpress-importer/index.md",
            "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/wordpress-importer/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "WordPress Importer",
            "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/wordpress-importer/",
            "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/wordpress-importer/index.md",
            "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/wordpress-importer/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "WordPress Importer"
        },
        {
            "level": 2,
            "text": "What WordPress Importer does during a migration"
        },
        {
            "level": 2,
            "text": "When WordPress Importer is the right tool"
        },
        {
            "level": 2,
            "text": "WordPress Importer strengths and limitations"
        },
        {
            "level": 3,
            "text": "Strengths"
        },
        {
            "level": 3,
            "text": "Limitations"
        },
        {
            "level": 2,
            "text": "The settings we recommend for a WordPress import"
        },
        {
            "level": 2,
            "text": "WordPress Importer security: one admin-only vulnerability"
        },
        {
            "level": 2,
            "text": "WordPress Importer FAQ",
            "id": "faq"
        }
    ],
    "body": "## The essentials\n\n- Best for moving posts, pages, comments and menus to a fresh install or another site.\n- Main caveat: no settings, widgets or theme, and media must stay online on the old site.\n- Free with no paid version, published by WordPress.org.\n\n## What WordPress Importer does during a migration\n\nWordPress Importer reads a WordPress export file in WXR format (WordPress eXtended RSS) and rebuilds its content on the site where you install it: posts, pages and custom post types, comments and their metadata, custom fields, categories, tags, custom taxonomy terms and navigation menu items. You create that file on the source site under Tools > Export, with the “Download Export File” button.\n\nYou start the import from Tools > Import, WordPress row, then “Run Importer”. Once the file is uploaded, a screen asks you to map each author in the file to an existing user or a new one, offers to download attachments from the source site and, since version 0.9.1, to rewrite source-site URLs found in the content. Content that already exists, with the same title, date and post type, is skipped rather than duplicated.\n\nThis is the official importer, published by WordPress.org and completely free. It does not copy a whole site: a WXR file holds no settings, widgets, theme or theme options, plugins, or the media files themselves, only their URLs. The `wp import` command in [WP-CLI](https://www.wp-masquerade.com/glossary/wp-cli/) relies on this same plugin for command-line imports.\n\n![Diagram: WordPress Importer works on visitors and bots, wordpress, database and files. Public traces: no known public trace.](https://www.wp-masquerade.com/media/wpm-sheets/wordpress-importer/diagram-en.svg?v=3a5dfb04)\n\n## When WordPress Importer is the right tool\n\nThe plugin moves content, not an entire site. It fits these cases:\n\n- **Rebuilding on a fresh install**: you are switching themes or structure and want a clean start that keeps only the content.\n- **Merging or splitting sites**: combine two blogs, or move one section to a new site, using the export filters (author, category, dates, status).\n- **Demo content**: some themes ship a WXR file you import to reproduce their demo.\n- **Scripted migrations**: with `wp import`, the same imports run again on several sites, with a CSV file that maps authors.\n\nIt is the wrong tool for moving a site as is to a new host: settings, widgets, theme and plugins would all need redoing. A full migration plugin such as [All-in-One WP Migration](https://www.wp-masquerade.com/features/camouflaged-plugins/all-in-one-wp-migration/) or Duplicator moves the database and files in a single archive.\n\n## WordPress Importer strengths and limitations\n\n### Strengths\n\n- **Official and free.** Published by WordPress.org, with no paid version, and offered right from Tools > Import.\n- **Selective imports.** Paired with the export filters, it brings only the content you want into an existing site.\n- **Control over authors.** Each author in the file is mapped to an existing user or recreated, your call.\n- **URLs rewritten.** Links to the old site, including in block attributes and images, can point to the new one (WordPress 6.7 or later).\n\n### Limitations\n\n- **Content only.** Settings, widgets, theme, theme options and plugins are not part of a WXR file.\n- **Media fetched remotely.** Attachments are downloaded from the source site, so it must stay online and reachable during the import.\n- **Struggles with big files.** A large export can exceed your host’s PHP memory limit; you then have to split it into several files.\n- **Accounts need cleanup.** New users get a random password and the site’s default role, which you fix by hand.\n\n## The settings we recommend for a WordPress import\n\nWordPress Importer has no settings page: you make your choices on the screen that follows the upload, and a few WordPress settings matter around it. Back up the destination site first (see our [3-2-1 backup strategy](https://www.wp-masquerade.com/wordpress-backups-3-2-1-strategy/)), since a failed import can leave partial content behind.\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **New User Default Role**  Settings > General | Subscriber, before the import | Users created by the import get this role; anything higher hands too many rights to accounts you have not checked. |\n| **Choose what to export**  Tools > Export (source site) | All content, or one export per content type if the file is heavy | Several small files fit better than one big file under the memory limit and the “Maximum size” shown for uploads. |\n| **Assign Authors**  Tools > Import > WordPress, after the upload | “assign posts to an existing user” on a single-author site | Avoids needless accounts; only create a new user for an author who will keep publishing. |\n| **Download and import file attachments**  Same screen, Import Attachments section | Checked if the source site is online (unchecked by default) | Without it, images stay hosted on the old site and will vanish with it. |\n| **Change all imported URLs that currently link to the previous site…**  Same screen, Content Options section | Checked (default) | Links and images in your content point to the new site; ignored before WordPress 6.7. |\n| **Enable auto-updates**  Plugins > Installed Plugins | On for as long as the plugin stays installed | The only known security fix shipped in a regular update. |\n| **Deactivate, then Delete**  Plugins > Installed Plugins | After the import | The plugin is only needed while importing; removing it cuts the code exposed on the site. |\n\n- Compare the number of posts, pages and comments between the old and new sites.\n- Open a few posts with images: image URLs should belong to the new site, not the old one.\n- Under Users, check the role of every imported account and have their passwords reset, as the final import screen reminds you.\n- In Appearance > Menus or the Site Editor, assign imported menus to their locations: the theme and its settings are not in the file.\n- If old-domain URLs remain elsewhere (options, widgets), a search and replace with [Better Search Replace](https://www.wp-masquerade.com/features/camouflaged-plugins/better-search-replace/) fixes them, after a backup.\n\n## WordPress Importer security: one admin-only vulnerability\n\nOnly one vulnerability has been published for the plugin: **CVE-2024-13889**, a PHP object injection through [deserialization](https://www.wp-masquerade.com/glossary/insecure-deserialization/) of untrusted data, affecting versions up to 0.8.3 and fixed in 0.8.4 (CVSS 7.2 according to Wordfence). It requires an administrator account, and the advisory notes the plugin alone contains no usable gadget chain: the impact depends on another plugin or theme being installed.\n\nThe real risk lies mostly in the imported file: it creates accounts and content, and can trigger file downloads. Only import exports whose origin you know, keep the plugin updated with automatic plugin updates, and delete it once the migration is done. WordPress Importer adds nothing to your public pages; the box below shows what WP Masquerade covers for it.\n\n## WordPress Importer FAQ\n\n**Why weren’t my images imported?**\n\nEither the “Download and import file attachments” box was not checked (it is off by default), or the source site was no longer reachable: the plugin downloads each file from its original URL.\n\n**What should I do about a memory error or a blank screen?**\n\nThe file exceeds the PHP memory limit. Ask your host to raise it temporarily, or split the export into several files (by content type or by date) and import them one after another.\n\n**Does running an import again create duplicates?**\n\nNot for content that already exists: an item with the same title, date and post type is skipped. After an interrupted import, still check for partial content before you run it again.\n\n**Does WordPress Importer transfer settings and the theme?**\n\nNo. A WXR file holds only content, terms, menus and authors. For a complete site, use a migration or backup plugin that copies the database and files.\n\n## Key facts\n\n- Category: Utilities\n- Vendor: WordPress.org\n- Price: Free, no paid version\n- Active installations (wordpress.org): 2 000 000+\n- Version: 0.9.7\n- Official page: https://wordpress.org/plugins/wordpress-importer/\n\n## What WP Masquerade hides\n\n- Handled by the free version of WP Masquerade",
    "catalog": "wordpress-importer",
    "essentials": [
        "Best for moving posts, pages, comments and menus to a fresh install or another site.",
        "Main caveat: no settings, widgets or theme, and media must stay online on the old site.",
        "Free with no paid version, published by WordPress.org."
    ],
    "format": "application/json"
}