Call for feedback: Introducing settings import/export with Blueprints

Setting up a WooCommerce store often involves configuring the same settings over and over again. In WooCommerce 9.9, we’ve introduced beta import/export tooling for WooCommerce settings to significantly reduce the time spent configuring settings. We’re asking for your feedback as we continue to iterate on this feature.

With Blueprint import and export, you’ll be able to:

• Start a new store quickly with a predefined Blueprint configuration.
• Share Blueprints rapidly across a team and use version control.
• Easily change WooCommerce settings in the WP admin or via WC-CLI when testing a new feature.
• The Blueprint import/export supports WooCommerce settings, plugins, and themes, not content-related data like products, orders, or customers.

Woo Blueprints are powered by the WordPress Playground blueprint JSON data format.

How it works

Export settings

Save a configuration by choosing which WooCommerce settings, plugins, and themes to include from the current store, then exporting them as a blueprint file.

Import settings

Upload a blueprint file to quickly apply a previously saved configuration. You will be warned about the changes to be made before it proceeds.

Blueprint format

A blueprint is a standard format used by WordPress Playground to define a site’s configuration. With this standard, the blueprint files exported by WooCommerce can even be imported elsewhere. 

Want to try the file in WordPress Playground? Go right ahead!

WC-CLI

You can also test the feature using WP-CLI using the wp wc blueprint command. See available parameters in the CLI documentation.

Extensibility

You can extend Blueprint by adding custom exporters, importers, or steps. This allows you to support new data types or custom site logic. Extension developers can read the developer documentation for examples.

Security

To ensure Blueprints are safe and reliable, we conducted a thorough security audit and implemented several protections across both the feature and its underlying infrastructure:

Strict schema validation

All Blueprint files are validated against a strict JSON schema before being applied. We’ve tightened the schema to reject unexpected fields and enforce stricter typing where possible.

Permission checks for every step

Only authorized users can import or export Blueprints. All REST API endpoints and background processes include permission checks to prevent unauthorized access.

Option restrictions

To mitigate risk, Blueprint imports enforce a blacklist that blocks updates to sensitive or high-risk WordPress options, such as:

• Site URLs (siteurl, home)
• User management and system–related settings

This allows most site configurations to be portable while protecting critical options from being unintentionally or maliciously overwritten.

Enhanced SQL execution safety

Blueprints support applying SQL changes as part of the import process. To ensure safety, only specific query types are allowed (INSERT, UPDATE, and REPLACE INTO), and each query is carefully validated before execution. Safeguards include:

• Blocks unrecognized or unsafe SQL commands
• Detects SQL injection patterns
• Prevents writes to protected tables

These protections apply when executing imports, reducing the risk of unsafe or unexpected database changes.

Import is restricted to the Coming Soon mode

Blueprint imports are only allowed when the store is in Coming Soon mode to reduce the risk of accidental or unauthorized imports on production sites. This acts as a safeguard to prevent destructive configuration changes on live environments. If you’re developing locally or need to override this restriction (e.g., for staging/testing purposes), you can allow imports in live mode by defining a constant in your wp-config.php file:

define( 'ALLOW_BLUEPRINT_IMPORT_IN_LIVE_MODE', true );

Audit logging

Blueprint import and export operations are logged for traceability. You can view logs under WooCommerce > Status > Logs. Look for logs with the source wc-blueprint.

⚠️ Security Best Practices: Even with safeguards in place, we recommend reviewing Blueprint files before importing, especially if they come from a third party. Ensure the content looks as expected and avoid applying changes you don’t fully trust.

Try it out

The feature is available now in WooCommerce 9.9. Once installed, go to WooCommerce > Settings > Advanced > Blueprints to try importing or exporting a settings blueprint. You can also test the feature using WP-CLI.

Tell us what you think!

We would love to hear your thoughts! If you have any questions or suggestions, please leave your feedback in our GitHub Discussion, or drop by the WooCommerce Community Slack #developer-chat channel and let us know what you think.

Not a member of our Community Slack? Join here now.