Supported plugins and settings

A source (the code calls it a provider) is one named group of settings. Exports, snapshots and diffs are made of sources, and --sources selects them by id.

Most sources read settings from explicit lists, with plain names and checks for each setting. One source, Other plugin and theme settings, saves every other option on your site that is safe to save, so the settings of any plugin or theme can be kept too. In total there are 18 built-in sources, plus any that other plugins register, such as the WellTend Site and Admin Toolkit and WellTend Health Monitor.

Plugin sources appear only while the plugin is active. Use the id with --sources, or a group: core, plugin, toolkit, health, plugin.woocommerce, other.

WordPress settings#

(env) means an environment setting: left out of exports and ignored on import unless you include environment settings (--include-env).

(secret) means always redacted.

Some of these are checked more strictly on import. Page and category settings (page_on_front, page_for_posts, wp_page_for_privacy_policy, default_category, default_email_category) are skipped if the page or category does not exist on the target. default_role must be a role that cannot manage the site, and it and users_can_register raise a security warning. Details are in Diff and restore.

Changing core.permalinks also clears WordPress's rewrite rules so they are rebuilt.

Active theme#

Theme settings are only applied if the file was exported from the same theme as the one active on the target. Two runtime items are not exported and are kept on import: custom_css_post_id and nav_menu_locations. If the logo in the file does not exist in your media library, your current logo is kept.

Plugins#

Each plugin source is available only while the plugin is active. Plugin sources store each plugin's own option values as they are, without checking individual fields, and apply the major-version check described in Diff and restore.

Notes:

• Yoast SEO: runtime state such as indexing progress, activation timestamps, installed version and site-specific permalink caches is not exported and is preserved on import.
• WP Mail SMTP: the user name, password and every mail service's credentials are redacted. The mailer choice, sender name and address, and smtp.auth are kept.
• WellTend Site and Admin Toolkit: the SMTP user name and the custom login URL slug are redacted.
• WooCommerce: every setting is stored under the option name woocommerce_<name>, for example woocommerce_currency. Only those five groups are covered. Payment gateway settings, shipping zones and methods, orders, products and customers are never captured.

WooCommerce settings by group#

Option names are shown without the woocommerce_ prefix.

• General: store_address, store_address_2, store_city, default_country, store_postcode, allowed_countries, all_except_countries, specific_allowed_countries, ship_to_countries, specific_ship_to_countries, default_customer_address, calc_taxes, enable_coupons, calc_discounts_sequentially, currency, currency_pos, price_thousand_sep, price_decimal_sep, price_num_decimals.
• Products: cart_redirect_after_add, enable_ajax_add_to_cart, weight_unit, dimension_unit, enable_reviews, review_rating_verification_label, review_rating_verification_required, enable_review_rating, review_rating_required, manage_stock, hold_stock_minutes, notify_low_stock, notify_no_stock, stock_email_recipient, notify_low_stock_amount, notify_no_stock_amount, hide_out_of_stock_items, stock_format, file_download_method, downloads_require_login, downloads_grant_access_after_payment, downloads_deliver_inline, downloads_add_hash_to_filename.
• Tax: prices_include_tax, tax_based_on, shipping_tax_class, tax_round_at_subtotal, tax_classes, tax_display_shop, tax_display_cart, price_display_suffix, tax_total_display.
• Accounts and privacy: enable_guest_checkout, enable_checkout_login_reminder, enable_signup_and_login_from_checkout, enable_myaccount_registration, registration_generate_username, registration_generate_password, erasure_request_removes_order_data, erasure_request_removes_download_data, allow_bulk_remove_personal_data, registration_privacy_policy_text, checkout_privacy_policy_text, delete_inactive_accounts, trash_pending_orders, trash_failed_orders, trash_cancelled_orders, anonymize_refunded_orders, anonymize_completed_orders, and the endpoint names checkout_pay_endpoint, checkout_order_received_endpoint, myaccount_add_payment_method_endpoint, myaccount_delete_payment_method_endpoint, myaccount_set_default_payment_method_endpoint, myaccount_orders_endpoint, myaccount_view_order_endpoint, myaccount_downloads_endpoint, myaccount_edit_account_endpoint, myaccount_edit_address_endpoint, myaccount_payment_methods_endpoint, myaccount_lost_password_endpoint, logout_endpoint.
• Emails: email_from_name, email_from_address, email_reply_to_enabled, email_reply_to_name, email_reply_to_address, email_header_image, email_header_image_width, email_header_alignment, email_font_family, email_footer_text, email_base_color, email_background_color, email_body_background_color, email_text_color, email_footer_text_color, email_auto_sync_with_theme.

A setting that your site has not stored yet is simply absent from the export. Settings that WooCommerce adds in later versions are not picked up until the plugin's list is extended.

WellTend Site and Admin Toolkit#

WellTend Site and Admin Toolkit registers one source per module through the same awc_scm_providers filter that any plugin can use, with the id toolkit.<module id>. Its on/off state and options travel with snapshots and exports like any other setting, and its passwords and API keys are marked secret. The sources appear only while the Toolkit is active. WellTend Snapshots itself has no modules: it only reads, compares and restores settings.

The full module list is on the Toolkit page.

WellTend Health Monitor#

WellTend Health Monitor registers one source, health.settings, through the same awc_scm_providers filter. It holds the plugin's settings and nothing else: history, scores, error samples, snoozes and the email test are never read or exported. It appears only while WellTend Health Monitor is active.

The report switch, the alert switch, the recipients and the log path are marked (env). They differ per environment, so they are left out of exports unless you include environment settings, and a staging copy never starts emailing the owner of the live site. Nothing in this source is secret.

Other plugin and theme settings#

This is how WellTend Snapshots keeps the settings of any plugin or theme, including ones it has never heard of. A setting it has no name for is shown by its option name, for example my_plugin_settings, with a guess of the plugin it belongs to.

Restoring is always your choice, one setting at a time. "Restore everything" and a plain import never write these settings. In the snapshot screen you tick the ones you want; from the terminal you name them with --only=other.options:<option name> or take all of them with --all-other. Each one counts as a security-sensitive change, so you also confirm the risk (--accept-risky). WellTend Snapshots cannot know what another plugin's setting does, so only change the ones you understand.

Safety rules:

• Never deleted. A restore or an undo never deletes an option. An option that exists now but not in the snapshot stays. An option in the snapshot that no longer exists is created, but only when you tick it.
• Never saved: payment settings (anything named like a payment method or gateway, such as PayPal or Stripe) and where WooCommerce stores orders; transients, caches, locks, queues, sessions, logs, counters, timestamps and migration markers; WordPress internals (scheduled tasks, rewrite rules, active plugins and themes, theme folders, user roles, site address, a pending change of the admin email, recovery keys, database version and similar); automatic update choices for WordPress, plugins and themes (auto_update_*), so a restore never turns automatic updates on or off; version and install markers of plugins (names ending in _version, _db_version, _installed, _install_date, or containing _activation or _first_install), because restoring an old one can make a plugin run its upgrade again; secret keys and salts; widgets (widget_* and sidebars_widgets, which only work as a set); theme Customizer settings (the active theme's are in theme.mods; those of inactive themes are not saved anywhere); and the AllWPCare plugins' own options.
• Names must match exactly. An option name with spaces, or one that differs from an existing option only in capital letters or accents (such as Default_Role next to default_role), is never written: the database would treat it as that other option.
• Secrets are hidden like everywhere else: an option or a value inside it that looks like a password, key or token is redacted and your site keeps its own value.
• Nothing runs while reading. Values that hold PHP objects, are damaged, or cannot be written as JSON are not saved, and the snapshot says how many.
• Size limits, never silent. An option larger than 256 KB is not saved. A snapshot holds at most 2,000 of these settings and about 3 MB of them; options are taken in alphabetical order and the rest are left out. The snapshot screen and the "What to include" list say how many were too large, unsafe or left out.
• Code needs the right to save HTML, as for every plugin setting: a value with markup, or a setting with a word like code, script, html, css or js in its name (but not data such as zip_code or currency_code), is skipped for users who may not save unfiltered HTML.
• Only this site. On a network each site's own options are read; network-wide options are not. Only the network admin can restore or import these settings on a network, and the site's allowed themes and upload space are never saved.
• New options are not loaded on every page. An option a restore creates is added with autoload off.
• Scheduled snapshots leave them out by default, because many plugins change their own options all the time. Turn on Also save other plugin and theme settings under Settings to include them.

Developers can tune the rules with filters: awc_scm_other_options_exclude (more names or * patterns to leave out), awc_scm_other_options_include (names the default rules leave out but you want saved; it cannot allow WordPress internals), awc_scm_other_options_covered (names your own source already saves), awc_scm_other_options_max_bytes, awc_scm_other_options_max_count, awc_scm_other_options_max_total_bytes and awc_scm_other_options_chunk_size.

Adding your own#

Other plugins can be added without changing WellTend Snapshots: see For developers to register your own source.