Title: Website Recovery Importer
Author: edison72
Published: October 10, 2026
Last modified: October 10, 2026
---
Search plugins
# Website Recovery Importer
By [edison72](https://profiles.wordpress.org/edison72/)
[Download](https://downloads.wordpress.org/plugin/website-recovery-importer.1.2.5.zip)
* [Details](https://wordpress.org/plugins/website-recovery-importer/#description)
* [Reviews](https://wordpress.org/plugins/website-recovery-importer/#reviews)
* [Installation](https://wordpress.org/plugins/website-recovery-importer/#installation)
* [Development](https://wordpress.org/plugins/website-recovery-importer/#developers)
[Support](https://wordpress.org/support/plugin/website-recovery-importer/)
## Description
Website Recovery Importer takes a **recovery package** (a WXR file plus the site’s
images) and imports it into your WordPress site. It is designed for the packages
produced by **Tesora** from the Internet Archive’s Wayback Machine, but it will
import any package that follows the same simple layout (a `manifest.json`, one or
more `wxr/part-*.xml` files, and a `media/` folder).
**Important:** this plugin does **not** crawl or scrape the Wayback Machine itself.
It imports a package that was prepared beforehand. It just does the WordPress side—
reliably and safely.
What it does:
* **Bulk import in batches** via AJAX, so large sites don’t hit PHP time or memory
limits.
* **Everything as DRAFT by default** — you review before anything goes live. It
never auto-publishes.
* **Sanitizes third-party HTML** with an explicit `wp_kses` allow-list — scripts,
iframes and inline event handlers are stripped, regardless of your role.
* **Places the images** and keeps the content pointing at them.
* **Rewrites internal links** from the old domain to your site, for every host
variant (http/https, with/without www).
* **Page vs post** respected from the package, with a switch to force everything
to Pages or Posts.
* **Idempotent** — re-importing the same package updates instead of duplicating(
stable per-page identity).
* **Two ways in** — upload the package as a ZIP, or drop it by FTP into `wp-content/
uploads/tesora-import/`.
The content comes from third parties (archived pages). **Review copyright, trademarks
and content before publishing.** You use it at your own responsibility — which is
exactly why everything lands as a draft.
## Screenshots
[⌊Upload a recovery package (ZIP). The import screen with the English / Spanish
switch and the light/dark theme toggle.⌉⌊Upload a recovery package (ZIP). The import
screen with the English / Spanish switch and the light/dark theme toggle.⌉[
Upload a recovery package (ZIP). The import screen with the English / Spanish switch
and the light/dark theme toggle.
[⌊Package preview before importing: the detected domain and how many pages and images
were found.⌉⌊Package preview before importing: the detected domain and how many
pages and images were found.⌉[
Package preview before importing: the detected domain and how many pages and images
were found.
[⌊Batch import in progress, with a live progress bar and a Stop button.⌉⌊Batch import
in progress, with a live progress bar and a Stop button.⌉[
Batch import in progress, with a live progress bar and a Stop button.
[⌊Everything is created as a draft — nothing is published without your review.⌉⌊
Everything is created as a draft — nothing is published without your review.⌉[
Everything is created as a draft — nothing is published without your review.
[⌊Dark mode.⌉⌊Dark mode.⌉[
Dark mode.
## Installation
1. In WordPress go to **Plugins Add New Upload Plugin** and choose the plugin ZIP,
then **Activate**. (Or copy the `website-recovery-importer` folder into `wp-content/
plugins/`.)
2. Go to **Tools Website Recovery Importer**.
3. Either **upload a package ZIP**, or drop the package folder by FTP into `wp-content/
uploads/tesora-import//` and it will be detected.
4. Choose the type behaviour (respect the package / force Pages / force Posts) and
press **Import**. Everything is created as a draft.
## FAQ
### Does it download pages from the Wayback Machine?
No. It imports a package that was already prepared (for example by Tesora). This
plugin only handles the WordPress import side.
### Will it publish my drafts automatically?
No. Everything is imported as a draft by default. You decide what to publish.
### Is the imported HTML safe?
The HTML is third-party content, so it is always passed through a strict `wp_kses`
allow-list before being saved — scripts, iframes and event handlers are removed
even for administrators.
### What if I import the same package twice?
It won’t duplicate. Each page has a stable identity, so a second import updates
the existing draft instead of creating a copy (unless you’ve edited it, in which
case your edits are kept).
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“Website Recovery Importer” is open source software. The following people have contributed
to this plugin.
Contributors
* [ edison72 ](https://profiles.wordpress.org/edison72/)
[Translate “Website Recovery Importer” into your language.](https://translate.wordpress.org/projects/wp-plugins/website-recovery-importer)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/website-recovery-importer/),
check out the [SVN repository](https://plugins.svn.wordpress.org/website-recovery-importer/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/website-recovery-importer/)
by [RSS](https://plugins.trac.wordpress.org/log/website-recovery-importer/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 1.2.5
* Security: the nonce and capability check is now written out in full inside each
AJAX handler, instead of living in a helper method. Same behaviour, but static
analysers and reviewers can see it. Removed the file-wide PHPCS suppression that
was hiding it, and narrowed the two remaining suppressions to the exact lines,
with the reason spelled out.
#### 1.2.4
* Compatibility: marked as tested up to WordPress 7.1.
#### 1.2.3
* Compatibility: marked as tested up to WordPress 7.0.
#### 1.2.2
* Code quality: passes the official Plugin Check. Documented the direct filesystem
use in the streaming ZIP extractor (WP_Filesystem has no streaming API and would
prompt for FTP credentials mid-import), prefixed the uninstaller’s global variables,
and corrected the “Tested up to” header.
* The admin screen now shows the plugin version in a small footer.
#### 1.2.1
* Fix: the legal notice no longer crowds the header. It now shows as a full-width
band under the title (added the standard WordPress `wp-header-end` marker so
admin notices are placed below the header instead of inside it).
#### 1.2.0
* New: language switch (English / Spanish) and a light/dark theme toggle on the
import screen.
* New: package preview before importing — it shows the domain and how many pages
and images were detected, so you confirm before anything is created.
* New: a Stop button during a running import, with resume from where it left off.
#### 1.1.0
* Renamed to “Website Recovery Importer”.
* Hardening: the WXR reader now rejects DOCTYPE / external entities (XXE), the
ZIP extractor caps the decompressed size (zip-bomb guard) with real-byte accounting,
media files are validated as real images before being copied, the job lock is
now atomic, and a failing (“poison”) item is retried only a bounded number of
times.
* Import errors are now reported incrementally instead of only at the end.
* More robust internal-link rewriting (word-boundary aware) and a domain-independent
stable identity for safer idempotent re-imports.
#### 1.0.1
* Extraction now uses an allow-list (images + manifest.json + WXR + .txt). Other
bundled assets such as .js/.css from the archived site are skipped instead of
rejecting the whole package, which fixes an import error on packages that carried
the dead site’s scripts or styles. Dangerous file types (php, svg, html, js)
are still never written to disk.
#### 1.0.0
* Initial release: batch import (ZIP or FTP), draft-by-default, HTML sanitizing,
media placement, internal-link rewriting, idempotent re-import, page/post switch.
## Meta
* Version **1.2.5**
* Last updated **2 days ago**
* Active installations **Fewer than 10**
* WordPress version ** 5.8 or higher **
* Tested up to **7.1.3**
* PHP version ** 7.4 or higher **
* Tags
* [archive](https://wordpress.org/plugins/tags/archive/)[import](https://wordpress.org/plugins/tags/import/)
[migration](https://wordpress.org/plugins/tags/migration/)[recovery](https://wordpress.org/plugins/tags/recovery/)
[WXR](https://wordpress.org/plugins/tags/wxr/)
* [Advanced View](https://wordpress.org/plugins/website-recovery-importer/advanced/)
## Ratings
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/website-recovery-importer/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/website-recovery-importer/reviews/)
## Contributors
* [ edison72 ](https://profiles.wordpress.org/edison72/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/website-recovery-importer/)