Backups, transfers and developer reference
Configuration backup versus portable transfer
| Detail | Same-site backup — both editions | Portable export/import — Pro |
|---|---|---|
| Format | panelkind-backup | wp-adminer retained for compatibility |
| Purpose | Restore this installation's configuration | Transfer configuration between installations |
| Scope | Published configuration, with user references | Configuration with personal identities removed |
| Signature | Bound to site URL, blog ID and authentication salt | Not a same-site signed backup |
| Individual View/access assignments | Retained | Removed |
| Individual widget/page audience IDs | Retained | Removed; user-only selected audiences become owners-only rather than public/all-users |
| Owner/delegate identities | Present in backup data; current destination settings retained during restore | Removed from export; destination settings retained |
| Native roles, users, media and content | Not backed up as site data | Not migrated |
| Import action | Validate and preview; then save/review/publish | Validate and preview; then save/review/publish |
Keep same-site backups private because they contain user references. Editing the payload or changing site URL/authentication salts can invalidate signatures. Restores/imports preserve current settings, including owners, delegates and retention. Referenced native users/roles/content types must exist. For portable transfer, create matching native role IDs, check plugin destinations, replace site-specific links/logo/media URLs and recreate any desired individual assignments.
An export does not preserve unsaved edits or act as a full-site backup. Source-side exports use published/active configuration. Import preview is non-mutating; review before saving and publishing. Current entitlements apply, including to historical exports and revisions.
Implementation map
| Component inside the installable ZIP | Responsibility |
|---|---|
wp-adminer.php | Plugin metadata, SDK initialisation, autoloading and hooks |
includes/class-plugin.php | Services, activation and management capabilities |
includes/class-defaults.php | Neutral Free seed, appearances and upgrade defaults |
includes/class-schema.php | Validation, content/URL sanitisation, references and limits |
includes/class-store.php | Shared draft, snapshots, active revision, locking and audit |
includes/class-policy.php | Native capability ceiling, assignment and policy precedence |
includes/class-entitlements.php | Free caps, paid fields and downgrade-preserving validation |
includes/class-license.php | Installation-specific SDK entitlement and updates |
includes/class-roles.php | Linked native-role management and synchronisation |
includes/class-registry.php, class-enforcement.php | Resource discovery, capability/REST mappings and guards |
includes/class-navigation.php, class-sections.php | Menus, section context and contextual dashboards |
includes/class-content.php | Private guides, widgets, summaries and checklist rendering |
includes/class-appearance.php, class-themes.php | Validated admin styling and twelve-palette catalogue |
includes/class-preview.php | Request identity, sessions, write blocking and auto-draft cleanup |
includes/class-backup.php, class-api.php | Signed backups and authorised management routes |
includes/class-uninstall.php | Freemius after-uninstall cleanup |
assets/admin.js, client.js, preview.js | Management UI, client interactions and preview controls |
vendor/freemius/ | Bundled SDK, including its own license |
Configuration uses non-autoloaded snapshots with an active-version pointer rather than public custom post types. Checklist state uses site-scoped user metadata or options. Configuration activity uses a dedicated audit table. Native role definitions are stored outside revisions. Installed PHP/CSS/JS load directly, with no frontend build dependency.
API and extension points
The namespace remains wp-adminer/v1. Authenticated, authorised routes include state/license, native-role listing/mutations, draft save, publish/discard/restore, backup/export/import preview, user search, preview start/access inspection, owner recovery and checklist completion. API writes retain role/area checks and entitlement validation; the checklist route also verifies item access. There is no API for arbitrarily granting a paid tier.
Management capabilities are wpa_manage_views, wpa_manage_access, wpa_manage_content, wpa_manage_settings, wpa_publish and wpa_export. A delegate's permitted area is not a blanket owner grant.
Use normal WordPress menu registration so pages can be discovered. Integration hooks are:
wpa_resources: resource descriptions, native capability andscreen/actionscoverage.wpa_capability_resource: map custom requested capabilities to resources.wpa_rest_resource: map REST requests to resources.wpa_section_dashboard_before/wpa_section_dashboard_after: authorised server-rendered section dashboard content, receiving section ID, View and user.
An adapter must check every relevant operation before advertising action coverage; REST mapping does not automatically protect AJAX/admin-post/XML-RPC endpoints. Escape rendered content, check additional capabilities and avoid side effects in render callbacks because preview invokes them too.
Development handoff
The repository uses a pinned project-local Node 24 runtime and WordPress Playground for PHP/SQLite execution. Commands in a full development checkout are npm install, npm run dev, npm run check, npm test, npm run test:themes and npm run package. Tests and development dependencies are not installed by the included plugin ZIP. WPA_DEMO=0 selects a clean Free development setup instead of the disposable Pro demo fixture.
Packaging uses an explicit production allowlist. Do not add a root uninstall.php; cleanup is registered through the Freemius after_uninstall hook. The plugin is GPL-2.0-or-later; the SDK has its own included license. See source evidence for the files used to verify this handoff.