tporret API Data Importer

No. It uses native WP-Cron scheduling, but supports CLI triggers.

Yes. Nested objects and arrays can be parsed and transformed through Twig templating.

Yes. Set Payload Format to iCal (.ics) and the importer will expand recurring events into normalized records.

Yes. Set Payload Format to CSV/TSV or XML/RSS. CSV supports delimiter auto-detection (or manual override), and XML/RSS uses a configurable repeating node element (for example, item or entry).

Use pagination where possible. JSON imports are non-streaming and protected by filterable payload and record limits. For very large feeds, CSV/XML streaming is the safer path.

Yes. It supports four modes per import job: none, bearer token, custom API-key header, and basic auth.

Yes. Use Post Title Template with Twig syntax. If left blank, the importer falls back to Imported Item {ID}.

Yes. Select any public post type from Target Post Type. If the selected post type becomes unavailable, imports safely fall back to post.

Imported items are saved as the public tporapdi_item post type. You can list them with a normal archive template such as archive-tporapdi_item.php, or with a WP_Query that sets post_type to tporapdi_item. The plugin does not include a dedicated front-end block for imported-item listings. Example archive template: ```php > No imported items found. ``` Example WP_Query loop: ```php $imported_items = new WP_Query( array( 'post_type' => 'tporapdi_item', 'post_status' => 'publish', 'posts_per_page' => 10, ) ); if ( $imported_items->have_posts() ) { while ( $imported_items->have_posts() ) { $imported_items->the_post(); echo ' ' . esc_html( get_the_title() ) . ''; } wp_reset_postdata(); } ```

Each subsite keeps its own import jobs, schedules, settings, and dashboard. A separate Network Admin dashboard can summarize active subsites when the plugin is also active on the primary site. Activate the plugin per site; Network Activate is intentionally blocked.

Yes. Configure Media Mappings in the Mapping/Templating tab to sideload featured images, gallery attachments, or attachment IDs stored in custom fields. The legacy Featured Image Source Path still works as a fallback when no media mappings are configured.

Yes. For hierarchical target post types, enable Parent Mapping in the Mapping/Templating tab. Parent lookup can use an imported external ID, an existing WordPress post ID, or a post slug. Missing parents can be deferred for later reconciliation, imported as root items, or skipped.

Template configuration requires the tporapdi_manage_templates capability or manage_options role. Multisite super admins always have access. Imported item editing can now be controlled per import job with the "Lock editing of imported posts" setting.

The following Twig tags are disallowed to prevent file inclusion and code injection: include, source, import, from, embed, extends, use, macro.

Yes, but not recommended for production. Go to Settings → Allow Internal Endpoints to permit RFC1918 and loopback addresses. For whitelisting specific hosts/CIDR blocks, use Settings → Allowed Endpoint Hosts and Settings → Allowed Endpoint CIDR Blocks.

The SSRF Hardening check starts in a warning state until you configure Allowed Endpoint Hosts or Allowed Endpoint CIDR Blocks. That warning is there to remind you that outbound API access is still open until you add an allowlist.

Start with Allowed Endpoint Hosts and list only trusted API domains. Leave Allow Internal Endpoints and Retain Raw API Records disabled unless you intentionally need them. Add CIDR blocks only when you need additional IP-range restrictions.

No, not by default. Raw record retention is debug-only and disabled by default. Enabling it stores _tporapdi_raw_record; disabling it purges stored raw records.

All template configuration changes are logged to the wp_custom_import_logs database table with before/after hashes, actor information, and precise timestamps. Review logs via tporret API Data Importer → Manage Imports → Import edit screen.