Has anybody successfully imported Wordpress users, with their passwords?

I am switching from Wordpress to MODx for a site that has hundreds of users (subscribers, set up as WP users). Before I start pounding my head against the problem myself, does anyone have any tips/a magic addon/whatever that might make the job a little easier? I am assuming the big issue would be keeping the existing Wordpress passwords. This isn't 100% required, but I would certainly like to do it if possible.

I suspect that WordPress, like MODX, doesn't store passwords, just one-way hashes for them.

You can probably export the WordPress users to a CSV file and write some custom code to import them (unless someone else has already done it), but their passwords won't work.

If you can get your hands on the WordPress code that validates passwords, it's possible to transfer the hashes and make it work. You need a plugin that validates the users using the WP code, then once they're authenticated, creates a new hash based on the MODX method.

I've done it with Evo users and a third-party forum. It's not a trivial task.

Actually, depending on the hashing method used by your WP installation, it might be possible. If it's a simple MD5 hash, you can change the hash method used by MODX in the System Settings, import the users, change the System Settings back, and there is a plugin to convert each password to the default MODX method upon login.

Good point, unless there's a salt involved. I think Evo uses a salt for MD5 hashing, but I just checked and Revo doesn't.

It's also quite easy to add a custom hash class. It's just a php file named 'mod' + the content of the hash field in the user record + .class.php. Here's the entire MD5 hash class file content:



Then, as you say, all you'd need is the extra that converts the passwords automatically with a plugin and everything would be copacetic. The only issue would be the details of the WP hash method if it's not a straight MD5 hash.

Thanks for the suggestions. I'll refer back to this thread when I'm actually ready to try importing some users. Until then, I'm feeling suitably intimidated. ;-)

Sorry to throw so much at you. I just did a little searching, and it looks like WP has had options for other hashing methods for some time, though I did see a claim that MD5 was still the default as of 2014.

Are you a registered user in the WP database? I ask because an easy first step would be to test your own hash and credentials (or someone else's if you can get them) for MD5 compatibility. That would be much easier than figuring out what WP is using.

In fact, I think this would work as a test.

On some test site:

1. Create a new user
2. In PhpMyAdmin, go to the user's record in the modx_users table
3. Change the hash_class field to hashing.modMD5
4. Important: Make sure the cachepwd and salt fields are empty
5. Paste the WP user's password hash value from the WP DB into the password field
6. Paste the username into the username field

7. See if you can log in.

If you can, you're pretty much home free on the import.

I think I have some code around somewhere that lets you create a list of WP fields and the MODX fields they map to and creates MODX users from a CSV file. IIRC, it's easier if the CSV export contains a header row to give you the field names. It's one of the umpteen extras I plan to create and release someday.

There's an article here about importing WordPress articles into Articles. It's not really what you want, but if you read it carefully, you can see how to export users from WordPress. I suspect they go into a CSV file, but you'd have to try it to find out. It might be a SQL file, but that would be OK too.

BTW, if it's not MD5 and you can't determine what it is, it's theoretically possible to create a login form that asks for the user's username, email, and password. Then you can have a plugin that uses the email as a temporary password and creates a new hash based on the password they enter.




[ed. note: BobRay last edited this post 11 years, 3 months ago.]

I have taken an SQL dump of another app's users, then used search-and-replace on the resulting .sql file to morph it into the MODX table structures. The data was basically the same for the essential fields, just the field names and table names differed.

Since MODX uses two tables, I had to work with two copies of the other app's SQL dump file, but it worked.

If the passwords are salted in WP, you can't copy and reuse them in MODX in most cases. They are just a hash and could not be calculated back (sometimes they can, if they are weak).

Quote from: BobRay at Jun 11, 2015, 11:41 PM

On some test site:

1. Create a new user
2. In PhpMyAdmin, go to the user's record in the modx_users table
3. Change the hash_class field to hashing.modMD5
4. Important: Make sure the cachepwd and salt fields are empty
5. Paste the WP user's password hash value from the WP DB into the password field
6. Paste the username into the username field
7. See if you can log in.

If you can, you're pretty much home free on the import.

Just wanted to post back and let you all know I tried this and failed. I'm pretty sure, in any case, that the password hash from my WP site is not plain-Jane md5. Example hash:



I don't know much about these things, but somehow, that doesn't look like md5 to me.

I am really surprised that there isn't any way to transfer user passwords from WP to MODx; but thankfully, it isn't really a big problem for me due to the particulars of my setup.

Thanks all, esp Bob Ray, for taking the time to try and help.

Revo uses a straight MD5 hash (no salt) when it sees hashing.modMD5 as the hash_class. Was the hash_class set to hashing.MD5 when you did your test? If it was, maybe WP uses a salt.

In that case, you'd need to find the WordPress authentication code and use it in a plugin connected to OnManagerAuthentication and/or OnWebAuthentication to "prevalidate" the users. When you find a valid user, you do this: