Content Management that can withstand the plundering hoards

WordPress importing

For the browser migration checklist see the WordPress guide. Use this reference to plan content conversion, image copying and database access.

Import WordPress offers two sources: a WordPress Tools → Export XML (WXR) file, or a direct MySQL/MariaDB connection. Both produce the same reviewable plan and create Markdown drafts. No source WordPress data is changed.

Review and apply

Choose the source and inspect it. Published posts and pages are selected by default. Draft, pending and private entries are included only when explicitly requested. Since Viking publishes the complete draft site, included private or unpublished WordPress content becomes public on the next Publish too.

The review table shows titles, WordPress status, suggested URLs, collisions and conversion notes. Unselect unwanted pages or edit their destination URLs before Import selected drafts. Existing destination pages are never overwritten, even if they appear after inspection. The result reports created drafts, skipped paths, failed paths and image-copy warnings. Retry skips paths already created. Each draft is individually durable; an interrupted import can leave a completed subset. Publication snapshots wait for an active batch to finish.

The converter preserves headings, emphasis, links, content images, lists, quotations, code, strikethrough and tables. Classic WordPress paragraph spacing is expanded before conversion. Gutenberg HTML is converted from its saved markup. Executable/embedded content is removed. Review shortcode text and recreate dynamic blocks using Viking pages and blocks. Plan the migration around post/page content, links and content images; retain your WordPress backup for other source records. Choose a native Viking theme for the new site's presentation.

Valid exported permalink paths are retained. Otherwise the plan suggests a path from the slug and page hierarchy, with a diagnostic. Database imports also resolve the configured front page and common post permalink tokens (post name/ID and date/time). Taxonomy or plugin permalink tokens need URL review. Unsupported Unicode/encoded/reserved paths receive a safe suggestion. Links matching selected pages’ exported/reconstructed permalinks are remapped to their destination URLs. Links to pages omitted from the plan retain their old URLs. Arrange redirects on the old site or web server as part of your cutover.

Images

The XML contains image URLs and attachment metadata, not the image bytes. Keep the original public image host available while copying. Featured images stored outside post content are not migrated automatically; upload them and select them in page properties.

Opt into Copy public images to fetch content image URLs into Viking's media library. References to successfully copied images use durable local asset URLs; publishing includes those bytes in the release. Failed downloads retain their original URLs and produce diagnostics. External image URLs may not display inside the CMS because its editor CSP permits same-origin images; copy public images or upload replacements for dependable editing and previews.

Downloads support the existing safe raster-image allowlist. They permit only HTTP/HTTPS without URL credentials, validate redirected destinations, resolve and pin public IP addresses, and reject private/local/link-local destinations. No environment HTTP proxy is used. Private WordPress media needs manual upload; the MySQL connection can still target an explicitly supplied private database.

Limits: 32 MiB XML, 6 MiB converted inspection plan, 64 KiB database connection request, 1000 eligible pages per XML import (database inspection reads at most 1000 posts/pages, including unpublished entries), 1 MiB source per page, 8 MiB apply request, 100 image URLs, 20 MiB per image, 64 MiB total copied images and a 20-second image-copy time budget. Inspect and import smaller exports when those bounds are exceeded.

Database access

Use a dedicated account with SELECT access to <prefix>options and <prefix>posts. Supply the host, port (3306 by default), database, user, password and table prefix (wp_ by default). TLS is selected in the UI by default and verifies the database certificate; disable it explicitly only for a source that requires plaintext. Server-side connection/query timeouts bound inspection. The prefix is restricted to letters, digits and underscores.

Queries run in a read-only transaction that is rolled back. No WordPress configuration, tables, credentials or data is changed. Connection details are request-only, never saved to source documents or releases. The UI clears the password after inspection or closing; server responses do not expose driver errors or credentials. Destination writes require authentication and CSRF as usual.

Check the imported site

Review the import results and open representative drafts, including long articles, tables, nested pages and image-heavy content. Check rewritten links and menu placement, choose a Viking theme, and preview at desktop and mobile widths. Arrange old-to-new URL redirects with the administrator before changing DNS. Publish only after reviewing all saved pages and uploads, then test the public site as a visitor. Follow the migration checklist for the browser steps.