Everything on the Export and Import tabs is also available programmatically — same engine, so results are identical. Built for agencies replicating a configuration across many sites.
Three operations: export a profile, import it (a safe dry-run by default), and restore the automatic pre-import backup. Imports are non-destructive until you explicitly apply them, and every apply snapshots the previous settings first.
Every endpoint requires the manage_pys capability. For cross-site automation, use
WordPress Application Passwords (WP admin → Users → Profile → Application Passwords)
and send them as HTTP Basic auth (-u "user:app password"). A browser session
(cookie + X-WP-Nonce) also works.
wp-config.php, or the
filter add_filter( 'wp_is_application_passwords_available', '__return_true' );.";
renderWarningMessage( $message );
?>
| Method | Endpoint | Purpose |
|---|---|---|
GET | /export | Return the site profile as JSON. |
POST | /import | Validate + dry-run diff (default), or apply. |
POST | /restore | Roll back to the last pre-import backup. |
/export · modules | CSV of module slugs (e.g. facebook,ga). Omit for all. |
/export · include_tokens | Include credentials / API tokens. Default false. |
/export · include_automatic_events | Include core Automatic Events. Default true. |
/import · profile | Required. The exported profile object. |
/import · apply | false = dry-run diff only (default); true writes. |
/import · include_tokens | Auto-plan: import credentials. Default false. |
/import · modules | Auto-plan: restrict to these slugs. |
/import · remap | Array of {from,to} URL/domain replacements. |
/import · plan | Explicit granular plan; overrides the auto-plan. |
| Command | Purpose |
|---|---|
wp pys profile export [<file>] | Export to a file or STDOUT. |
wp pys profile import <file> | Dry-run by default; --apply writes. |
wp pys profile restore | Roll back the last import. |
Flags: --modules=<csv>, --include-tokens,
--no-automatic-events (export); --apply, --include-tokens,
--modules=<csv>, --plan=<file>,
--remap-from=<url> --remap-to=<url>, --format=<table|json>,
--yes (import). Run wp help pys profile <command> for the full list.
POST /import and wp ... import only report a diff until you pass apply / --apply.restore rolls them back.include_tokens / --include-tokens.admin_permissions), and the MCP read-only posture (mcp_read_only_enabled) are excluded from every profile — so a shared file can't hand over control of a site.plan, import replicates each module's settings and its main pixel. Use an explicit plan for fine-grained per-pixel control.