UserFerry – Export & Import Users

1. 01Upload the userferry folder to /wp-content/plugins/ , or install the plugin through the Plugins screen in WordPress.
2. 02Activate the plugin through the ‘Plugins’ menu in WordPress.
3. 03Go to UserFerry > Export users to export, or UserFerry > Import users to import.

Can I export users’ passwords?

No plugin can export readable passwords, because WordPress only stores a one-way hash. If you are moving users to another WordPress site, an administrator can enable “Allow exporting password hashes” in Settings; the hash keeps working on the new site when you import the file there.

Can I import a file I exported with this plugin?

Yes. Files exported by the plugin in any format are recognised and their columns are matched automatically on the Import users screen.

A custom field I need is not listed.

Custom fields are detected automatically. A meta key exists only after at least one user has a value for it — make sure one user has filled it in, then click “Scan custom fields”. Keys that start with an underscore are listed in the “Hidden & plugin data” group.

Who can export and import users?

Exporting needs the list_users capability (administrators by default). Importing needs create_users and edit_users . Settings and deleting history require manage_options . Developers can change the export capability with the userferry_capability filter.

Where are export files stored?

In a folder inside wp-content/uploads/ whose name ends in a random 24-character code (for example userferry-exports-k3x9… ), with file names that also contain a random 24-character code. Apache, LiteSpeed and IIS block the folder automatically. Nginx ignores those rules, so the plugin tests the folder with an anonymous request to your own site and shows the result under Settings > File storage security and in Tools > Site Health, together with the exact Nginx rule to add. The folder is only reported as protected when the server explicitly refuses access; redirects, errors and other uncertain answers are reported as “could not be verified”.

For the strongest protection, store files outside the web root by adding this to wp-config.php: define( 'USERFERRY_EXPORT_DIR', '/path/outside/public_html/userferry' );

Does the plugin send data anywhere?

No. The plugin never contacts other websites and does not load Gravatar images (the user picker shows initials instead). The only HTTP request it makes is to your own site, to check that the export folder cannot be opened without logging in. The one exception is the video guide on the Documentation screen: it loads from YouTube (youtube-nocookie.com) only when you press its play button.

Are there limits on import files?

Yes, to protect your server’s memory: up to 100,000 rows, 250 columns and 64 KB per cell; JSON files up to 20 MB (JSON is decoded in memory — use CSV for bigger files). Every part of an Excel file is size-checked before anything is read, so oversized or “zip bomb” files are rejected, and Excel text is only loaded within a safe share of your PHP memory limit. A file that breaks a limit is rejected with a clear message — data is never silently cut off. Developers can change the limits with the userferry_import_limits filter.