Export and import

An export is one JSON file holding your site's settings. You can keep it in git, send it to a colleague, or import it on another site, for example from staging to live.

Export from the dashboard#

1. Open AllWPCare → WellTend Snapshots → Export / Import.
2. Under Export, choose which areas to include (WordPress settings, Theme, Plugins, and WellTend Site and Admin Toolkit modules when it is active). Everything is ticked by default.
3. Leave Include environment settings off unless you mean to move them. See below.
4. Click Download JSON, or Copy JSON.

From the terminal:

wp awc config export --file=settings.jsonwp awc config export --sources=core,plugin.yoast > seo.json

--sources takes provider ids or groups; see Supported plugins and settings.

Safe to commit#

• Deterministic. Keys are sorted, the output is pretty-printed, numbers and booleans have stable types, and nothing time-dependent is written. If your settings did not change, the file is byte-for-byte identical, so git diff shows only real changes.
• No secrets. Passwords, API keys, tokens and similar values are replaced with the marker __awc_redacted__. See Secrets and redaction.
• No environment settings by default. The site URL, home URL, admin email and uploads paths are left out, so a staging file cannot break the live site. Tick Include environment settings (or pass --include-env) to include them.

The file format#

This is a trimmed export from a real test site, produced with wp awc config export. Long lists are cut down to a few entries; everything else is exactly as the command prints it.

{    "format_version": 1,    "generator": "0.4.0",    "site": {        "home_url": "http://local.testplugins.com",        "php_version": "8.2.30",        "plugins": {            "seo-by-rank-math": "1.0.280",            "welltend-snapshots": "0.4.0",            "wp-mail-smtp": "4.10.2"        },        "wp_version": "7.1.3"    },    "source_versions": {        "core.general": "7.1.3",        "core.writing": "7.1.3",        "toolkit.heartbeat_control": "0.1.0",        "plugin.rankmath": "1.0.280"    },    "sources": {        "core.general": {            "WPLANG": "",            "blogdescription": "",            "blogname": "testplugins",            "date_format": "F j, Y",            "default_role": "subscriber",            "gmt_offset": 0.0,            "start_of_week": 1,            "time_format": "g:i a",            "timezone_string": "",            "users_can_register": false        },        "core.writing": {            "default_category": 1,            "mailserver_login": "__awc_redacted__",            "mailserver_pass": "__awc_redacted__",            "mailserver_url": "mail.example.com"        },        "toolkit.heartbeat_control": {            "disable_frontend": true,            "enabled": false,            "interval": "60"        },        "plugin.rankmath": {            "rank-math-options-general": {                "google_api_key": "__awc_redacted__",                "nofollow_external_links": "off",                "strip_category_base": "off"            }        }    }}

Sources with nothing stored are left out. A source for a plugin that is not active on the exporting site is never present.

Import from the dashboard#

1. Open AllWPCare → WellTend Snapshots → Export / Import.
2. Under Import, choose the JSON file.
3. Read the preview. It lists each change in plain language, which areas will be skipped and why, any warnings, and any secrets that stay as they are.
4. Untick any area you do not want, then apply.

A safety copy of your current settings is taken first, and the result screen offers Undo.

From the terminal:

wp awc config import settings.json --dry-run   # preview, change nothingwp awc config import settings.json --yes       # apply without asking

What the importer checks#

Importing never runs code from the file. In order:

1. Size. Files over 5 MB (5,242,880 bytes) are refused. A developer can change the limit with the awc_scm_max_import_bytes filter.
2. JSON only. The file is decoded as JSON, to arrays, nested at most 64 levels deep. Nothing is ever unserialised.
3. No PHP objects. If any value looks like a serialised PHP object, or any key is a class marker (__PHP_Incomplete_Class_Name, __class, @class, __type), the whole file is rejected.
4. Format. format_version must be a whole number from 1 up to the version this plugin understands, and sources must be present.
5. Known sources and settings. A source this site does not know is skipped with a warning. Within a source, setting names the plugin does not declare are ignored with a warning, so a file cannot write arbitrary options.
6. Value types. Every value is checked against the type its setting declares (text, whole number, on/off, email, http(s) URL, one of an allowed list). Any invalid value stops the whole import; nothing is changed.
7. Things that must exist. A setting that points at a page or category (such as the homepage page or the default post category) is skipped with a warning if that page or category does not exist on this site. Page and category numbers differ between sites.
8. Environment settings. Site URL, home URL, admin email and uploads paths are skipped unless you choose to include them.

The importer then follows the same steps as a restore: see Diff and restore.