How to Export and Import WordPress Users and WooCommerce Customers

WordPress has no user exporter — Tools › Export carries only the authors of the posts it exports, with no passwords and no roles. For a list of customers, WooCommerce Analytics has a download. For moving accounts so people can still log in, you need either WP-CLI, the database, or a plugin that understands password hashes.

What core actually exports

Tools › Export writes a WXR file for content. For each author of the exported posts it includes login, email, display name, first and last name, so the importer can map posts to users. It does not include:

• users who have never authored content — which on a shop is nearly every customer;
• passwords, in any form;
• roles and capabilities;
• user meta, which is where WooCommerce keeps billing and shipping addresses.

It is a content export with author labels, not a user export.

WooCommerce customers: the Analytics download

Analytics › Customers › Download gives one row per customer:

It includes guest customers, built from their orders. For a mailing list, a CRM import or a sales review, it is enough. For a migration it is not: no street addresses, no passwords, and WordPress cannot import it as users.

WP-CLI: the quickest export with roles

If you have shell access, WP-CLI exports and imports users without a plugin:

# Export users with their roles
wp user list --fields=ID,user_login,user_email,display_name,roles --format=csv > users.csv

# Import on the new site (reads user_login, user_email, display_name, roles)
wp user import-csv users.csv

import-csv creates or updates users matched by email or login. Users created without a user_pass column get a random password; a user_pass column is treated as a plain password and hashed, which is exactly the problem described below. Meta, including WooCommerce addresses, is not part of either command.

Passwords: move the hash, never a password

WordPress stores a hash in user_pass. Nobody, including you, can export the passwords themselves, so the choices are:

1. Copy the hash unchanged. Any import route that writes user_pass directly — a SQL export of wp_users, or a tool with a "keep password hash" option — lets people log in with their existing password.
2. Import without passwords and have everyone reset. Simple, and a guaranteed wave of support emails — and a test of whether password reset emails actually arrive.

The trap is mixing them: putting the hash into a column the importer treats as a password. It gets hashed again, and nobody can log in.

Hash formats matter when versions differ. WordPress 6.8 and later create bcrypt hashes beginning with $wp$2y$; older versions used phpass ($P$) and very old installs MD5. A current WordPress checks all three and upgrades old hashes at the next login. An older WordPress cannot check $wp$ hashes at all, so importing users from a 6.8+ site into an older one breaks every login. Update the destination first.

Where the built-in tools stop

Core and WooCommerce give you author labels and a customer report; WP-CLI gives you users and roles. None of them exports users together with their meta — billing and shipping addresses, custom profile fields — in a file the other site can import while keeping password hashes. That gap is what dedicated import/export plugins fill. Import Export Suite is one option: it handles users and WooCommerce customers alongside orders and products, in CSV, XML, TSV or Excel, and can run on a schedule when a CRM or membership system needs a regular feed. Whatever tool you pick, confirm on staging that it writes the existing hash rather than hashing it again.

Import order on a store migration

1. Users and customers first, matched on email.
2. Products, matched on SKU — see exporting WooCommerce products.
3. Orders last, so each links to the right customer — see exporting WooCommerce orders.

User IDs will differ on the new site. Anything that references users by ID — orders, posts, memberships — must be remapped by email during import, or content ends up attached to the wrong account.

Roles are a quiet risk: a custom role that does not exist on the destination leaves imported users with no role and no access. Recreate roles first, and read the user roles overview before giving anyone more than Customer or Subscriber.

Personal data

A user export is a file of emails, names, phone numbers and password hashes. Keep it off email and shared drives, delete working copies after the import, and list it in your data inventory as described in WordPress GDPR compliance. Hashes are not passwords, but a leaked table of them is still a breach.

Common mistakes

• Relying on Tools › Export and finding customers missing.
• Importing hashes as passwords, so every login fails.
• Moving users from WordPress 6.8+ into an older install.
• Forgetting user meta, so customers arrive without addresses.
• Importing orders before customers, which attaches orders by stale IDs.

Verify

Before switching over, log in on the new site as three test users — one created years ago, one recent, one customer with orders. Each should log in with the old password, see the right role, and, on a store, see their addresses and order history under My Account.