Move your setup, not your API keys
Set up export settings WordPress agencies can move across sites with one ZIP. TheOneWP packages the configuration from its own panel, not WordPress core settings. In addition, it deliberately excludes AI keys and runtime logs. During import, it uploads referenced images to the new site and remaps their URLs automatically.
- 11 explicit TheOneWP option groups exported, not WordPress core settings.
- AI API keys and runtime logs never leave the site.
- Referenced images move to the new site and every URL updates automatically.
- The importer checks for path traversal before extracting any file.
Export Settings
- All module on/off settings
- Role Manager rules
- Uploaded images (logo, favicon, login background)
Import Settings
Export settings WordPress: whose settings, exactly?
This is what export settings WordPress sites get with TheOneWP. It is not a WordPress core feature, so it does not touch settings such as permalinks or general site options. Instead, TOWP_Import_Export provides an "Export Settings" and "Import Settings" tab inside TheOneWP's own admin panel. It bundles eleven specific TheOneWP option groups, including module toggles, Role Manager rules, Access Manager lists, robots.txt content and more. In addition, it includes every locally uploaded image those settings reference. However, AI module settings, notification logs, menu ordering and other explicitly excluded groups never enter the archive. During import, TheOneWP uploads images into the destination Media Library and rewrites their old URLs. Finally, the importer merges settings instead of blindly replacing them. As a result, excluded values such as existing AI API keys remain intact.
Cloning a TheOneWP setup usually means redoing it manually
Rebuilding the same TheOneWP configuration on a second site usually means opening the plugin settings again and repeating every choice by hand. For example, agencies may need to recreate access rules, custom columns and login page branding across multiple websites.
A generic export risks moving secrets it shouldn't
A backup or generic export tool may dump every option indiscriminately. As a result, it can carry API keys and access logs somewhere they were never meant to go.
Image references break the moment they move sites
A logo or login background often relies on its original URL. Therefore, moving only the setting can leave the destination site pointing to a file that no longer exists there.
An allowlist, not a dump of everything
The module exports exactly what belongs in a portable settings file. Therefore, unrelated or sensitive data does not enter the archive accidentally.
Explicit option groups, by name
The exporter includes eleven specific keys. As a result, unrelated settings cannot slip into the archive simply because they exist.
Secrets excluded by policy
TheOneWP strips AI API keys before it creates the export. Therefore, those secrets never enter the ZIP in the first place.
Images that actually work on arrival
Referenced images travel with the export. Then, TheOneWP uploads them to the destination site and updates their URLs automatically.
The complete export settings WordPress feature set
Every capability below appears directly in the class's export and import handlers. Therefore, the page describes the implementation rather than assumed behavior.
11 explicit option groups
The export covers core settings, Custom Content Columns, Role Manager, Admin Bar and Dashboard Widget visibility, Backend Page Generator pages, Access Manager lists, robots.txt, and the default media category.
AI keys and runtime data stripped
The exporter removes every ai_-prefixed setting and the Notifications Generator config before export. In addition, menu order, drag-and-drop sort state and activity logs never enter the export list.
Bundled, uploaded and relinked
Logo, favicon and login-page images travel inside the ZIP. Then, TheOneWP inserts them into the destination Media Library and generates their attachment metadata and thumbnails.
Format-version compatibility check
The importer compares the archive format with the version it supports. Therefore, it refuses exports from newer incompatible plugin versions instead of applying them only partially.
Excluded settings survive import
The importer merges towp_options with the site's current values instead of replacing everything. As a result, existing AI keys and other excluded settings remain intact.
Type, size and content checked
The importer checks the extension, MIME type, 50 MB ZIP limit and 10 MB per-image limit before processing files. Therefore, oversized or invalid uploads stop early.
Move export settings WordPress configuration in four steps
First, verify the destination site's own sensitive settings. Then, import the portable configuration on top of them.
Download the export ZIP
First, download the archive. One click bundles the eleven option groups and their referenced images into a single file.
Confirm the destination site's own AI keys are set
Next, check the destination site's AI configuration. The import will preserve existing keys, but it will not create missing ones.
Upload and import the ZIP
Then, upload the archive. TheOneWP adds images to the Media Library and updates every transferred image reference automatically.
Spot-check the imported settings
Finally, confirm that Role Manager rules, Access Manager lists and images look correct before considering the migration complete.
Where portable settings save real setup time
The module fits any situation where the same configuration needs to exist on more than one site. For example, agencies can reuse a standard setup without repeating every setting manually.
Agencies standardizing client sites
Export a known-good configuration once. Then, use it as the starting point for every new client site.
Staging-to-production configuration sync
Move Role Manager rules and Access Manager lists to production. As a result, you avoid entering the same configuration twice.
A known-good settings snapshot
Export before a major configuration change. Therefore, you keep a lightweight snapshot of the previous setup separate from a full site backup.
Portable, without portable secrets
Every design choice in the verified code favors safe configuration sharing. Therefore, the exporter moves only the data that belongs in a portable settings file.
A single request, bounded in size
The implementation focuses on a fast, one-shot settings operation rather than a long-running migration job. In addition, strict size limits keep the workload predictable.
Settings only, not full site data
The exporter processes a specific option allowlist rather than posts, media libraries or the full database. Therefore, both export and import can complete in one request.
Hard size limits keep it fast
The 50 MB ZIP cap and 10 MB per-image cap bound the workload. As a result, unexpectedly large files cannot turn a settings import into an uncontrolled operation.
Temporary files always cleaned up
After the operation, TheOneWP removes the generated export ZIP or extracted import directory. It performs this cleanup after both successful and failed operations.
Every ZIP entry checked before extraction
The importer treats every uploaded ZIP as untrusted input. Therefore, validation continues beyond the initial file-type check.
Path traversal blocked per entry
Before extraction, the importer checks every file inside the ZIP for ".." sequences and absolute paths. Therefore, a crafted archive cannot write files outside the intended destination folder.
manage_options and a verified nonce
Both export and import require the manage_options capability. In addition, each operation verifies a dedicated nonce through check_admin_referer().
SVG deliberately excluded from image import
The importer accepts only supported raster image formats. In contrast, it excludes SVG because SVG files can contain embedded script content.
MIME type verified, not just the file extension
When PHP's fileinfo extension is available, the importer checks the file's actual MIME type against a specific allowlist. Therefore, simply naming a file with a ".zip" extension is not enough.
Uses WordPress's own media and sanitization pipeline
The supplied code routes imported data through core WordPress functions and the plugin's own settings pipeline. Therefore, this page makes no compatibility claim beyond the verified implementation.
Real Media Library attachments
TheOneWP creates real Media Library attachments through wp_insert_attachment() and wp_generate_attachment_metadata(). As a result, WordPress generates attachment metadata and thumbnails instead of merely receiving loose files in the uploads directory.
TOWP_Settings_Sanitization
Before saving imported settings, the importer passes the merged array through the plugin's own settings sanitizer. Therefore, imported values follow the same sanitization rules as values entered manually.
PHP's ZipArchive extension
Both export and import first check whether the host provides ZipArchive. If it does not, TheOneWP stops and shows a clear, specific error message.
TheOneWP versus common alternatives
Compare this export settings WordPress implementation with a full-site backup or a generic options export. Although all three can move data, they solve very different problems.
| Capability | TheOneWP Export Settings | Other common solutions |
|---|---|---|
| Scope | An explicit allowlist of configuration, not full site data | A full backup moves everything, including data you may not need for configuration portability |
| Secret handling | AI API keys never enter the export file | A generic options dump may carry keys along with the rest of the settings |
| Image portability | Bundled, uploaded and relinked automatically | Some approaches leave settings pointing to URLs from the original site |
| Destination protection | Merge behavior keeps excluded settings intact | A blind overwrite may erase configuration that already exists |
| ZIP safety | The importer checks every entry for path traversal before extraction | Validation varies between import tools |
| Speed | Single-request, settings-only scope | A full backup performs much more work when you only need configuration |
Move configuration without surprises
A few habits keep an export and import round trip predictable. In addition, they help separate portable configuration from site-specific data.
Set up AI and Notifications Generator separately
The exporter excludes these settings by design. Therefore, configure them directly on each site instead of expecting the archive to transfer them.
Keep the plugin version aligned across sites
The importer refuses exports that use a newer unsupported format. Therefore, update the destination plugin first if you encounter a version mismatch.
Review Access Manager lists after importing
Blacklists and whitelists often depend on the individual site. Therefore, confirm that those rules still make sense on the destination.
Keep a copy of the export file itself
The ZIP provides a lightweight snapshot of plugin configuration. However, it does not replace a full site backup.
Avoid assumptions the code does not support
The module has a clearly defined scope. Therefore, assumptions outside that scope can create confusion about what the archive actually contains.
Expecting this to be a full site backup
The module moves plugin settings and a limited set of referenced images. It does not move posts, pages, users or the rest of the database. Instead, use Backup Manager when you need a full-site backup or migration.
Expecting AI settings to transfer
The exporter deliberately excludes AI settings. Therefore, configure the AI provider and API key separately on the destination site.
Expecting Snippet Manager or Redirect Manager rules to move
Neither module appears in the exported option list. Therefore, migrate or recreate those rules separately.
Export Settings FAQ
These answers come directly from the verified class and matching UI copy. Therefore, they describe the module's actual behavior rather than assumptions about generic WordPress exports.
Does this export WordPress's own settings, or TheOneWP's?
TheOneWP's. This is an "Export Settings" / "Import Settings" tab inside TheOneWP's own admin panel. Therefore, it never touches WordPress core settings such as permalinks, general options, or reading settings. Everything it moves belongs to this plugin's own configuration.
What exactly gets exported?
The export includes eleven specific option groups: core plugin settings, Custom Content Columns configuration, Role Manager rules, Admin Bar and Dashboard Widget visibility lists, Backend Page Generator pages, Access Manager's blacklist and whitelist, robots.txt content, and the default media category. In addition, it includes any locally uploaded images those settings reference.
Does the export include API keys for the AI modules?
No. The exporter explicitly strips every option key starting with ai_ from towp_options before it creates the archive. In addition, those keys do not appear in the exported option list at all. Therefore, API keys never leave the site through this feature.
What happens to logos, favicons and login page images?
The exporter bundles them into the ZIP under a media/ folder. Then, during import, TheOneWP uploads them into the destination site's own Media Library instead of copying them as loose files. Finally, it updates every setting that referenced the old URL so it points to the new one automatically.
Does importing wipe out AI settings already configured on the destination site?
No. AI settings never enter the export in the first place. Instead of replacing the whole options array, the importer merges the transferred values with the current settings. As a result, an API key already saved on the destination site survives the import.
Is the ZIP file checked before it's extracted?
Yes. Before extraction, the importer checks every archive entry for path traversal, including any ".." sequence or path that starts with a slash. In addition, it accepts only settings.json at the root or files inside media/. It skips anything else.
What if I try to import an export made with a newer version of the plugin?
The importer refuses it and shows a clear message asking you to update first. The export includes a format version number. Therefore, TheOneWP can compare that version with the format the current plugin supports before it changes any settings.
Is there a file size limit on import?
Yes. The ZIP itself can be up to 50 MB. In addition, each image inside the archive can be up to 10 MB before TheOneWP uploads it to the Media Library. The importer checks both limits before processing the archive.
What is explicitly left out of an export?
The export leaves out AI module settings, Notifications Generator settings, Admin Menu Organizer's custom order, Snippet Manager and Redirect Manager data, media category terms, custom content ordering, and Library Importer's library. These groups contain sensitive, runtime, or site-specific data, so they do not belong in a portable settings file.
Stop rebuilding the same settings. Export them once, import them safely.
Use export settings WordPress admins can trust. TheOneWP uses an explicit allowlist, excludes secrets by policy and moves referenced images with their configuration. As a result, your imported setup works on arrival without carrying sensitive data with it.