Tporret API Data Importer Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
tporret API Data Importer gives WordPress teams an enterprise-grade ETL pipeline for importing external API data with confidence.
The plugin ships readable source for its generated admin assets. JavaScript and CSS source files are included in the src/ directory, compiled assets are in build/, and the maintained public source repository is available at https://github.com/tporret/enterprise-api-importer.
This readme is written for WordPress administrators and site owners evaluating or using the plugin from the Plugins screen.
Use tporret API Data Importer to run clean, repeatable import workflows without sacrificing flexibility:
- Multi-Connection Job Manager for organizing and scaling imports
- React Tabbed Import Job Workspace (Source/Auth, Data Rules, Mapping/Templating, Automation)
- Advanced JSON array traversal and pre-stage data filtering to remove noise before insertion
- Twig Templating Engine for complex logic, loops, and nested object mapping without drag-and-drop limitations
- Twig-powered Post Title Templates with safe sanitization and fallback handling
- Optional templates for new jobs (start with connection setup, add templates later)
- Multiple API auth modes: none, bearer token, custom API-key header, and basic auth
- Per-import Target Post Type selection (posts, pages, and public custom post types)
- Per-import Default Target Settings (post status, post author, comment status, pingback/trackback status)
- Per-import editing lock toggle for imported posts (allow editing or enforce read-only)
- Time-aware batch processing via WP-Cron to reduce timeout and memory-risk scenarios
- Multisite support with per-site importer dashboards and an optional Network Admin summary dashboard when the plugin is also active on the primary site
- [New v1.2] Tableau-Style Reporting Dashboard: Real-time metrics on environment health, security posture, and API performance with interactive charts, status indicators, and audit activity feed
- [New] Credential Encryption & REST Masking:
- AES-256-CBC encryption at rest for auth_token and auth_password fields
- REST GET responses mask credentials; boolean flags indicate stored state
- Blank credential fields on update preserve existing encrypted values
- React UI shows saved-credential indicators with placeholder text
- apply_filters no longer exposes raw tokens to third-party hooks
- [New] Import Pipeline Sanitization:
- Twig-rendered post content sanitized via wp_kses_post before wp_insert_post
- Custom meta values sanitized via sanitize_text_field before update_post_meta
- Admin menu pages restricted to manage_options capability (was read)
- [New] Enterprise-Grade Security Hardening:
- Dedicated template management capability with multisite support
- Twig template security validation (disallowed tags, size/complexity limits, syntax checking)
- Template change audit logging with before/after hashes and actor metadata
- SSRF prevention via hostname and CIDR allowlisting with DNS resolution
- Twig strict variables mode enabled by default for better error visibility
- Imported items locked read-only (no editing, deletion, or quick-edit)
Whether you import catalogs, directory records, listings, events, or custom business data, tporret API Data Importer provides a scalable framework for structured API-to-WordPress ETL.
Built for real-world production workflows:
- Title templates are rendered via Twig and sanitized before save
- Target post type safely falls back to post if invalid or unavailable
- Attachment is excluded by default from target post type selection
- Default target post settings are validated and applied at load time for consistent publishing/discussion behavior
- Imports are staged and processed in queue batches for safer long-running jobs
- Imported items are cryptographically linked to their origin import (read-only)
- Template configuration changes are audit-logged with full actor context
- Endpoints validated against configurable SSRF allowlists and HTTPS enforcement
- Inline API connection testing, sample payload preview, and template dry-run rendering from the edit workspace
Development
To rebuild generated admin assets from source:
- Install Node.js dependencies:
npm install - Build production assets:
npm run build(uses@wordpress/scripts/ webpack) - For a watch/dev build:
npm start
- JavaScript/CSS source lives in
src/ - Production assets are generated into
build/ - The public source repository is https://github.com/tporret/enterprise-api-importer
External services
This plugin connects to external APIs that you configure in each import job.
- What service is used: Your configured API endpoint URL.
- What data is sent: Request headers (including optional Bearer token) and normal HTTP request metadata.
- When data is sent: During endpoint tests, dry-run template previews, and scheduled/manual import runs.
- Why data is sent: To fetch remote JSON payloads for preview, transform, and import workflows.
Security policy notes:
- Configure only trusted API endpoints that you control or explicitly trust.
- HTTPS is required by default for all endpoints (can be disabled via code filter for development).
- Private/internal network hosts are blocked by default (RFC1918 ranges and loopback). Enable only if you need to import from internal APIs in controlled environments.
- Hostname allowlisting: Restrict imports to specific domains (exact or wildcard subdomains). Configure at Settings Allowed Endpoint Hosts.
- CIDR allowlisting: Restrict imports to specific IPv4/IPv6 network ranges. Configure at Settings Allowed Endpoint CIDR Blocks.
- Endpoint validation: All endpoints are validated before request execution.
- Audit logging: All endpoint changes and template modifications are logged with full actor context.
The plugin does not hardcode any third-party API vendor. Data destination, terms, and privacy practices depend on the endpoint(s) you configure.
Screenshots
The Twig Mapping Interface for transforming JSON data.
The Schedules and Logs Health Dashboard.
API Connection and Data Filtering rules.
