In short. An administrator sends an export request, waits for email confirmation, then emails the visitor a link to the personal data archive.
Definition: WordPress's Export Personal Data tool creates a downloadable ZIP archive of personal data held by WordPress and participating plugins. The verified workflow combines the visitor's email confirmation with an administrator's action to send the download link.
Key facts
As of 17 October 2026, WordPress documents these features:
- The Plugin Handbook identifies email address as the export key, including for visitors without registered accounts.
- The Export Personal Data screen documentation describes a request changing from Pending to Confirmed after the recipient follows the confirmation link.
- The archive-generation reference shows both
index.htmlandexport.jsoninside the ZIP archive. - The export-expiration reference gives a default file lifetime of 3 days, with deletion handled by a scheduled cleanup job.
How does the verified request work?
According to WordPress's screen instructions, an administrator opens Tools > Export Personal Data, enters the visitor's username or email address, and selects Send Request. The request appears as Pending in the requester table.
The visitor follows the link in the confirmation email. The request then becomes Confirmed, and Email Data appears under Next Steps. The administrator selects that button to send an email containing the archive download link. The email includes an expiry date for the file.
WordPress's privacy guidance recommends email validation to protect against requests made by someone impersonating another person. Confirmation and the administrator's delivery action are separate parts of the process.
What does the visitor download?
The archive-generation code reference packages the reports under these filenames:
index.html
export.json
The HTML file is the readable report; the JSON file contains structured export data. The same reference shows an About group with the recipient's email address, site name, site URL and report generation time.
The expiration hook reference documents wp_privacy_export_expiration, which controls the file lifetime. Its default is 3 days. The starting screen guide gives a different duration; the developer reference supplies the default used here.
Which data does the archive cover?
WordPress's privacy guidance limits collection to WordPress and participating plugins. It identifies external analytics and newsletter services as examples of data sources that may require additional handling.
The Plugin Handbook explains that participating plugins register exporters, which collect data associated with the requested email address. The archive's coverage therefore depends on which exporters provide data for that address.
Related terms
- Where is the search engine visibility setting in WordPress?
- Where is the built-in WordPress XML sitemap?
- How do I change a WordPress permalink structure?
FAQ
Can I export data for someone without a WordPress account?
Yes. The Plugin Handbook explicitly includes unregistered visitors, such as logged-out commenters, because exports use an email address as their key.
How can I resend the confirmation email or download the archive myself?
In the Export Personal Data screen instructions, you select the request checkbox, choose Resend email under Bulk Actions, and select Apply. To download the archive yourself, hover over the requester's email address and select Download Personal Data.
Sources
- WordPress.org, "Tools Export Personal Data screen", updated 8 June 2024
- WordPress.org, "WordPress Privacy", updated 5 April 2026
- WordPress Developer Resources, "Adding the Personal Data Exporter to Your Plugin", updated 17 November 2022
- WordPress Developer Resources, "wp_privacy_generate_personal_data_export_file()", accessed 17 October 2026
- WordPress Developer Resources, "wp_privacy_export_expiration", accessed 17 October 2026
Check how a page reads to answer engines. Open the GEO score analyzer