Guide

WordPress XML-RPC Export Manual

6 min read 1030 words Updated 14 August 2026

Overview

The wpxmlrpc tool provides an alternative method for exporting WordPress content using the XML-RPC protocol. This is particularly useful when the REST API is disabled or when you need to access content that requires authentication.

Prerequisites

• WordPress site with XML-RPC enabled
• Valid WordPress username and password
• Administrative or editor privileges on the WordPress site

Installation

Homebrew (macOS / Linux)

1brew install tradik/tap/wpexporter

Snap (Linux)

1sudo snap install wpexporter

From Source

1git clone https://github.com/tradik/wpexporter.git
2cd wpexporter
3make build

The XML-RPC client will be built as build/wpxmlrpc.

Using Go Install

1go install github.com/tradik/wpexporter/cmd/wpxmlrpc@latest

Basic Usage

Command Structure

1wpxmlrpc export --url <wordpress-url> --username <username> --password <password> [options]

Required Parameters

Optional Parameters

Examples

Basic Export

1wpxmlrpc export --url https://myblog.com --username admin --password mypassword

Export to Specific Directory

1wpxmlrpc export \
2  --url https://myblog.com \
3  --username admin \
4  --password mypassword \
5  --output ./my-blog-backup

Export as Markdown

1wpxmlrpc export \
2  --url https://myblog.com \
3  --username admin \
4  --password mypassword \
5  --format markdown \
6  --output ./markdown-export

Using Configuration File

Create a config.yaml file:

1url: "https://myblog.com"
2output: "./xmlrpc-export"
3format: "json"
4verbose: true

Then run:

1wpxmlrpc export --username admin --password mypassword --config config.yaml

Security Considerations

Password Security

• Never hardcode passwords in scripts or configuration files
• Use environment variables for sensitive data:

  1export WP_USERNAME="admin"
  2export WP_PASSWORD="mypassword"
  3wpxmlrpc export --url https://myblog.com --username $WP_USERNAME --password $WP_PASSWORD
  

HTTPS Requirement

• Always use HTTPS URLs when possible to encrypt credentials in transit
• Avoid using XML-RPC over unencrypted HTTP connections

Application Passwords (WordPress 5.6+)

For enhanced security, use WordPress Application Passwords:

1. Go to your WordPress admin → Users → Your Profile
2. Scroll to "Application Passwords"
3. Create a new application password
4. Use the generated password instead of your regular password

XML-RPC Methods Used

The tool uses the following WordPress XML-RPC methods:

Troubleshooting

XML-RPC Disabled

If you get an error about XML-RPC being disabled:

1. Check if XML-RPC is enabled:

   1curl -X POST https://yoursite.com/xmlrpc.php \
   2  -H "Content-Type: text/xml" \
   3  -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName></methodCall>'
   

2. Enable XML-RPC in WordPress: Add to your theme's functions.php:

   1add_filter('xmlrpc_enabled', '__return_true');
   

3. Check for security plugins that might block XML-RPC

Authentication Errors

• Verify username and password are correct
• Check if two-factor authentication is enabled (may require app passwords)
• Ensure the user has sufficient privileges

Connection Issues

• Verify the WordPress URL is correct
• Check if the site is behind a firewall or CDN
• Try increasing timeout in configuration

Large Sites

For sites with many posts/pages:

• The tool automatically handles pagination
• Consider using the REST API client (wpexportjson) for better performance
• Monitor memory usage for very large exports

Output Formats

JSON Format

Exports all data as a single JSON file with the following structure:

 1{
 2  "site": { ... },
 3  "posts": [ ... ],
 4  "pages": [ ... ],
 5  "media": [ ... ],
 6  "categories": [ ... ],
 7  "tags": [ ... ],
 8  "users": [ ... ],
 9  "stats": { ... },
10  "exported_at": "2024-01-07T12:00:00Z"
11}

Markdown Format

Creates a directory structure:

output/
├── README.md           # Site information
├── posts/             # Individual post files
│   ├── 2024-01-01-post-title.md
│   └── ...
├── pages/             # Individual page files
│   ├── 2024-01-01-page-title.md
│   └── ...
├── media/             # Downloaded media files
│   ├── image1.jpg
│   └── ...
└── metadata.json      # Categories, tags, users, etc.

Comparison with REST API Client

Configuration File Reference

 1# WordPress site URL (required via CLI)
 2url: "https://your-wordpress-site.com"
 3
 4# Output directory or file path
 5output: "./xmlrpc-export"
 6
 7# Export format: json or markdown
 8format: "json"
 9
10# Download media files (images, videos, etc.)
11download_media: true
12
13# Number of concurrent downloads
14concurrent: 5
15
16# HTTP request timeout in seconds
17timeout: 30
18
19# Number of retries for failed requests
20retries: 3
21
22# User agent string for HTTP requests
23user_agent: "WordPress-XML-RPC-Export/1.0"
24
25# Enable verbose output
26verbose: false

Advanced Usage

Batch Processing

Process multiple sites:

1#!/bin/bash
2sites=("site1.com" "site2.com" "site3.com")
3for site in "${sites[@]}"; do
4  wpxmlrpc export --url "https://$site" --username admin --password "$WP_PASSWORD" --output "./exports/$site"
5done

Automated Backups

Create a cron job for regular backups:

1# Add to crontab (crontab -e)
20 2 * * 0 /usr/local/bin/wpxmlrpc export --url https://myblog.com --username admin --password "$WP_PASSWORD" --output "/backups/$(date +\%Y-\%m-\%d)"

API Reference

The XML-RPC client can be used programmatically:

 1package main
 2
 3import (
 4    "github.com/tradik/wpexporter/internal/config"
 5    "github.com/tradik/wpexporter/internal/xmlrpc"
 6)
 7
 8func main() {
 9    cfg := config.DefaultConfig()
10    cfg.URL = "https://example.com"
11
12    client, err := xmlrpc.NewClient(cfg, "username", "password")
13    if err != nil {
14        panic(err)
15    }
16
17    posts, err := client.GetPosts()
18    if err != nil {
19        panic(err)
20    }
21
22    // Process posts...
23}

Support and Contributing

• Report issues: GitHub Issues
• Documentation: Project README
• Contributing: See Contributing Guidelines