Preserve admin username when cloning

I’ve seen this question asked before, but I didn’t see an answer I like, so, 🙂

My use case is that I want to create a complete website design with “to do” placeholder text and have someone use WPVivid to import it to their newly created WordPress installation.

I would very much prefer to do this without having to also supply a username and password for them to re-login to the site after your plugin overwrites their original login information. The problem I have with this, aside from the extra work of having the importing user change the password and/or create an alternate admin account, is that it means I have to publish a username and password along with the zipped package, that will actually work to access the site as an administrator.

This is a security exposure because some users will DEFINITELY neglect to change that password, leaving themselves open to hacking with authentication information that’s published along with the zipped backup file. They will also fail to update the email address associated with the admin ID, making it impossible for them to do a password reset because they can’t read the mail account to get the password reset email.

Can you not adjust your plugin so that it retains any accounts — especially admin accounts and especially the one that’s running the restore task — and recreates these after the restore is complete? Of course the download must still contain an admin ID, but the user doing the restore doesn’t need to have the password for it — they can keep using the login they set up during the installation.

I know this may be impossible if the user has used a security plugin to change the hash key on the users table, but you could still recreate the admin ID with its original other details so the user could request a password reset in that case.