Bring a TheOneWP setup to a new site in one upload
Set up import settings WordPress agencies can trust with a second site: a ZIP checked entry by entry before anything extracts, images re-uploaded and relinked automatically, and a merge that never erases what the destination already had configured.
- Every ZIP entry checked for path traversal before extraction.
- Images re-uploaded into the destination Media Library, URLs remapped.
- AI keys and other excluded settings survive the import untouched.
- Refuses an export from a newer, incompatible plugin version.
Import Settings
Import settings WordPress: what happens when you upload the file?
This is what import settings WordPress sites get with TheOneWP: uploading a previously exported ZIP runs it through TOWP_Import_Export::handle_import(), which checks every entry inside for path traversal before extracting anything, verifies the export's format version is compatible with the current plugin, re-uploads any bundled images into the destination site's own Media Library, and rewrites every setting field that referenced an old image URL to point at the new one. The eleven TheOneWP option groups the file contains are written to the site, with towp_options specifically merged rather than replaced — so settings that were never part of the export, like AI API keys already configured on the destination, are left exactly as they were.
Applying a saved config to a second site is where things break
Having an exported settings file is only half the job — applying it to another site without breaking image references or wiping out what that site already had configured is the harder part.
A blind overwrite can erase settings the export never touched
Restoring a file that only covers some settings shouldn't mean losing everything else already configured on the destination.
An untrusted ZIP is still a file being extracted on your server
Importing anything means trusting the archive's contents unless something actively checks each entry before it's written anywhere.
Checked first, merged carefully, never assumed safe
The module treats an uploaded export as untrusted input and applies it deliberately, not automatically.
Validated before extraction
Path traversal, file type, and format version are all checked before a single file is written.
Images that work immediately
Re-uploaded and relinked automatically — nothing to fix by hand after the import finishes.
Existing settings protected
A merge, not an overwrite, means the destination site's own excluded settings survive.
The complete import settings WordPress feature set
Every capability below is present in handle_import() or the sanitization it routes through.
Per-entry path-traversal checking
Every file inside the ZIP is checked for ".." sequences or an absolute path before extraction — anything unrecognized is skipped, not fatal.
Format-version guard
An export made with a newer plugin version than the one importing it is refused with a clear message rather than partially applied.
Real Media Library re-upload
Bundled images become genuine attachments via wp_insert_attachment() and wp_generate_attachment_metadata() — thumbnails included, not loose files.
Automatic reference remapping
Every setting field that pointed at an old image URL is rewritten to the new one, checked recursively across the entire imported settings array.
Excluded settings survive
towp_options merges with the site's current values instead of replacing them, so AI keys and other excluded settings already configured stay intact.
Size and type enforced upfront
A 50 MB ZIP limit and a 10 MB per-image cap, both checked before any file is processed.
Import settings WordPress configuration in four steps
Know what the destination already has configured before you overwrite anything.
Confirm the destination's own AI keys are set
They won't be overwritten by the import, but they also won't be created by it — configure them separately first if needed.
Upload the export ZIP
Path traversal, format version, size and file type are all checked automatically before anything is applied.
Let images re-upload and relink
No manual step needed — every reference updates to the new Media Library URLs on its own.
Spot-check the result
Confirm Role Manager rules, Access Manager lists and images look right on the destination site.
Where a checked import saves real setup time
The module fits any situation where a saved configuration needs to land safely on a second site.
Spinning up a new client site
Start from a known-good export instead of reconfiguring every module toggle and rule by hand.
Promoting staging configuration to production
Bring Role Manager rules and Access Manager lists across without risking what production already has set.
Restoring a known-good configuration
Re-apply a snapshot exported before a change, confident the file itself was validated on the way in.
An import that respects what's already there
Every design choice in the verified code favors a careful, additive restore over a blind overwrite.
One request, bounded and predictable
The verified implementation keeps import a fast, single-shot operation.
Settings only, not a full restore
A bounded option allowlist rather than posts, media or the full database means import completes in one request.
Hard size limits keep it fast
The 50 MB ZIP and 10 MB per-image caps keep the whole operation predictable regardless of how many images are bundled.
Extracted files cleaned up immediately
The temporary extraction directory is deleted right after processing, success or failure.
An uploaded ZIP is untrusted, start to finish
Nothing about the file is assumed safe just because it came from TheOneWP's own export feature.
Path traversal blocked per entry
A ".." sequence or an absolute path inside any archive entry gets that entry skipped, not extracted.
manage_options and a verified nonce
Import requires this capability and a dedicated nonce, checked via check_admin_referer() before anything runs.
SVG excluded from re-uploaded images
Only raster formats are accepted, specifically because SVG can carry embedded script content.
MIME type verified, not just the .zip extension
When PHP's fileinfo extension is available, the uploaded file's real MIME type is checked against an explicit allowed list.
Applies changes through WordPress's own pipeline
The supplied code routes imported data through the same functions core WordPress and TheOneWP's own settings screens already use. No compatibility claim beyond the verified implementation is assumed.
wp_insert_attachment() & wp_generate_attachment_metadata()
Imported images become full Media Library attachments, not files copied into the uploads folder outside WordPress's own records.
TOWP_Settings_Sanitization
The merged settings array is re-sanitized through the plugin's own sanitizer before saving — imported values follow the same rules as values entered by hand.
PHP's ZipArchive extension
Checked for availability before import runs, with a clear message if the host doesn't provide it.
TheOneWP versus common alternatives
Compare a real import settings WordPress implementation with manually reconfiguring every setting or restoring a full-site backup for the same goal.
| Capability | TheOneWP Import Settings | Other common solutions |
|---|---|---|
| Setup time | One upload applies eleven option groups at once | Manual reconfiguration means redoing every screen |
| Image handling | Re-uploaded and relinked automatically | Often left broken after a manual copy |
| Existing settings | Merge protects what the import never touched | A full-site restore can overwrite everything |
| Archive safety | Every entry checked for traversal before extraction | Varies; not every import tool validates contents |
| Version safety | Incompatible exports refused outright | Rarely checked at all |
| Scope | Configuration only — fast and predictable | A full backup restore is a much heavier operation |
Import configuration without surprises
A few habits keep an import predictable on the receiving end.
Know what's already configured on the destination
The merge protects excluded settings, but it's still worth knowing what you're layering the import on top of.
Keep the plugin version aligned across sites
An import refused for version mismatch just needs the destination updated first.
Review Access Manager lists after importing
Blacklists and whitelists are site-specific by nature — confirm they still make sense on the new site.
Set up AI and Notifications Generator separately
They're excluded by design — plan to configure them directly on the destination rather than expecting the import to carry them.
Avoid assumptions the code does not support
The module has a defined, verified scope — a few assumptions outside it cause confusion.
Expecting this to restore a full site
It applies TheOneWP's own plugin settings and a handful of referenced images — not posts, pages, users, or the rest of the database. Use Backup Manager for a full restore.
Expecting AI settings to arrive with the import
They're deliberately excluded from every export — the destination needs its own provider and API key configured separately.
Assuming any ZIP file will work
Only a file produced by this module's own export, with a recognized settings.json manifest and compatible format version, imports successfully.
Import Settings FAQ
These answers come directly from the verified handle_import() method and its validation logic.
What does importing actually overwrite on the destination site?
The eleven TheOneWP option groups the ZIP contains — module toggles, Role Manager rules, Access Manager lists and the rest — get written directly. towp_options specifically is merged with the site's current values rather than replaced outright, so settings that were never in the export, like AI API keys, survive the import untouched.
Is the ZIP file trusted as soon as it uploads?
No. Every entry inside it is checked for path traversal — a ".." sequence or an absolute path — before extraction, and only settings.json at the root or files under media/ are accepted. Anything else in the archive is simply skipped, not treated as an error.
What happens if I import an export made with a newer version of the plugin?
It's refused outright, with a message asking you to update first. A format version number travels with every export, and the import compares it against what the current plugin supports before touching anything.
Do logos and login page images come back working, or do I need to re-upload them?
They come back working. Bundled images are re-uploaded into the destination site's own Media Library as real attachments — thumbnails included — and every setting field that referenced the old URL is rewritten to the new one automatically.
Will importing wipe out settings I've already configured on this site?
Only the settings actually included in the file. Anything deliberately excluded from export — AI keys, Notifications Generator config, menu ordering and a few others — is left alone on import because the merge only touches keys that were actually present in the uploaded file.
Is there a size limit on what I can import?
Yes: 50 MB for the ZIP itself, and 10 MB per individual image inside it — both checked before any file is processed, not after.
Can I import the same export file onto more than one site?
Yes. Nothing about handle_import() is tied to a specific destination — the same file can be used as a starting configuration for as many sites as needed.
What if the uploaded file isn't a valid TheOneWP export?
It's rejected. The import expects a settings.json manifest with a recognized structure and format version — a ZIP that doesn't match simply fails validation rather than importing partial or malformed data.
Stop reconfiguring from scratch.Upload once, land safely.
Use import settings WordPress agencies can trust with a second site: validated before extraction, images that just work, and existing configuration that stays protected.