I have been tasked to import an older, offline wordpress site. I have the XML export file and a tar-ball of the file tree.

Nothing has given me reason to worry, but does WP check the contents of the XML file as it imports it? Does it attempt to clean anything such as XSS attempts or anything suspicious?

I'm looking to sanitize the entirety of an exported XML from a site that I did not manage or control. The last admin was less then prompt when applying updates. I may be paranoid but I want to ensure the import file is clean before bringing into a server I manage.

Does the community recommend any practice to scan the XML file before input?

  • As far as I can see, no.
    – matthew
    Sep 11, 2015 at 17:25

1 Answer 1


From quick look at the code the post data mostly goes straight into wp_insert_post(), which is a low level function and serves to just store whatever you give it.

If you want to enforce the check you could make use of wp_import_post_data_raw filter and probably wp_kses_post().

  • In creating code, I'll remember this. Upvote for sure, but
    – Rick
    Sep 12, 2015 at 12:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.