WP Options Importer

The default options are core options, or those which a plugin has indicated
are safe to import. You can choose “Specific Options” when importing to
manually select those which you need to import.

No, but you can! We provide a filter, options_import_allowlist for you to add
your options to the default list. Here’s an example one might add to their
plugin:

function my_awesome_plugin_options( $options ) {
    $options[] = 'my_awesome_plugin';
    return $options;
}
add_filter( 'options_import_allowlist', 'my_awesome_plugin_options' );

Similarly, if you don’t want someone to ever import an option, you can add it
to the denylist using the options_import_denylist filter. As above, it
would look something like this:

function my_awesome_plugin_denylist_options( $options ) {
    $options[] = 'my_awesome_plugin_edit_lock';
    return $options;
}
add_filter( 'options_import_denylist', 'my_awesome_plugin_denylist_options' );

You have two options for both exports and imports.

Imports

First, you can use the options_import_denylist filter
and add any options to that array (which is empty by default). If your users
have access to theme or plugin code, this isn’t 100% safe, because they could
override your denylist using the same filter. In those cases, there’s an
emergency ripcord where you can disable options from ever being imported. To
use this, define the constant WP_OPTION_IMPORT_DENYLIST_REGEX (you’ll
probably want to do this in an mu-plugin) and set it to a regular expression.
Anything matching this expression will be skipped. For example:

define( 'WP_OPTION_IMPORT_DENYLIST_REGEX', '/^(home|siteurl)$/' );

Exports

Exactly the same as with imports. The filter is options_export_denylist,
and the constant is WP_OPTION_EXPORT_DENYLIST_REGEX.