October DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsWindows FixRecommendedWindows errors stealing your time? Find the fix fastScan stability, cleanup and performance issues.Fix NowOctober DealsAmazon USDeal season is back - check today's better picksAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
World desk10 min

How to Run a Search and Replace on a WordPress Database Safely

A practical, serialization-safe guide to changing URLs in a WordPress database. Use backups, WP-CLI dry runs, careful table scope, multisite options, and thorough verification instead of risky blanket SQL.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Use a serialization-aware tool—preferably WP-CLI’s wp search-replace—to change a WordPress URL or other repeated value. Back up the database first, run a dry run, limit the tables and columns you actually need, review the report, then execute and test the site. A plain SQL REPLACE() across the database can corrupt PHP-serialized options, widgets, and plugin settings when the replacement text has a different length.

What a WordPress database search and replace actually changes

A migration commonly involves replacing every occurrence of an old domain, such as https://old.example, with a new one. The value may be stored in several places:

As an Amazon Associate I earn from qualifying purchases.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • Site and home settings: the WordPress address and site address are stored in the options table.
  • Post content and excerpts: links, image sources, embeds, and shortcodes can contain the old value.
  • Metadata: custom fields and plugin data often retain absolute URLs.
  • Theme, widget, and plugin settings: these frequently use PHP-serialized arrays or objects.
  • Custom tables: plugins may create tables that are not part of WordPress’s registered table list.

The visible URL is not the only concern. WordPress can store a value in a serialized string that includes its character count. If the old and new values differ in length, changing only the text leaves the stored length incorrect. PHP may then fail to unserialize the value, causing missing widgets, broken options, or plugin errors.

Back up first and preserve a rollback path

Do not begin a replacement until you have a database backup that you can restore independently of the live site. Keep the backup outside the database server and record when it was made. If the migration also changes files, preserve the current uploads and configuration files separately.

  • Confirm that the backup completed and is not an empty or truncated export.
  • Know how your host or administrator restores a database before making changes.
  • Record the current domain, table prefix, and whether the installation is single-site or multisite.
  • Schedule the change when you can test the front end and administrator login immediately afterward.
  • For a high-risk migration, copy the database to a staging installation and rehearse the same command there.

A rollback is a database restore, not another search and replace in the opposite direction. Reverse replacements can miss values created during the migration and cannot repair serialized data that was already damaged.

Choose a method that understands serialized data

Method Serialized-data handling Preview or dry run Scope controls Multisite and custom tables Access needed
WP-CLI wp search-replace Serialization-aware; adjusts PHP serialized values --dry-run reports changes without writing Tables, included or skipped columns, skipped tables, precise processing, and regex mode --network, --all-tables-with-prefix, --all-tables, or explicit table names SSH or another shell with WP-CLI
Better Search Replace Uses WordPress database functions and is based on the open-source Search Replace DB script Preview or dry-run capability is available; confirm the preview before applying Select the tables and replacement values in the dashboard Suitable when the required tables are selectable; verify custom-table coverage WordPress administrator access
Manual SQL Not safe for serialized values unless you use a specialist script that recalculates lengths Possible with separate SELECT checks, but no built-in serialization protection Whatever tables and columns you write into the query Only what you explicitly address Database client or hosting control panel

The WordPress Advanced Administration Handbook warns that blanket URL replacement can create serialization problems and points administrators toward serialization-aware tools such as Better Search Replace, Velvet Blues Update URLs, WP-CLI search-replace, or a specialist database script. Manual SQL is appropriate only when you understand the field’s format and have a tested rollback.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Run the replacement with WP-CLI

WP-CLI is the most explicit option for repeatable migrations. Its command documentation states that search and replace “intelligently handles PHP serialized data, and does not change primary key values.” Run commands from the WordPress installation directory, using an account that can read the site’s configuration and connect to its database.

1. Search before changing anything

First identify where the old value exists. A broad search is useful for discovery, but it does not alter data:

wp db search 'old.example' --all-tables

Review the results and decide whether the value appears in production content, staging references, email addresses, API endpoints, or a plugin table that should not be changed. Searching for the hostname without the scheme can reveal both http and https variants; run a separate search for each exact form you intend to replace.

2. Perform a dry run

Use the exact old and new strings, including the scheme, subdirectory, port, or trailing slash when those characters are part of the stored value:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
wp search-replace 'https://old.example' 'https://new.example' --dry-run

--dry-run performs the operation and reports what would change without saving it. Treat the report as a scope review, not as proof that every occurrence is correct. An unexpectedly high count can indicate that you searched too broadly; an unexpectedly low count can mean that the site stores another URL variant.

3. Restrict the operation when possible

By default, WP-CLI works on the tables registered to WordPress’s $wpdb object. Narrowing the command reduces the chance of changing unrelated data. You can name tables after the two replacement values, include only selected columns, skip sensitive columns, or omit entire tables.

wp search-replace 'https://old.example' 'https://new.example' wp_posts wp_postmeta --dry-run
wp search-replace 'https://old.example' 'https://new.example' --include-columns=post_content,meta_value --dry-run
wp search-replace 'https://old.example' 'https://new.example' --skip-columns=guid --dry-run
wp search-replace 'https://old.example' 'https://new.example' --skip-tables=wp_logs,wp_cache --dry-run

Use the actual table names from your installation; prefixes are not always wp_. If a plugin’s table stores URLs in a serialized column, do not exclude it merely because it is custom—use a serialization-aware run and confirm the plugin’s data is intended to move.

4. Decide deliberately how to handle guid

Post GUIDs are identifiers, not ordinary display links. During a domain migration, administrators often leave them unchanged and use WP-CLI’s documented --skip-columns=guid example. Whether to update them depends on your migration plan, feed history, and canonical-URL strategy. Make this an explicit decision rather than allowing a blanket replacement to change every GUID automatically.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

5. Execute only after reviewing the report

When the dry-run scope and counts are correct, run the same command without --dry-run:

wp search-replace 'https://old.example' 'https://new.example'

Keep the terminal output or log with the backup record. If you need a reviewable SQL artifact instead of immediate in-place writes, use the export form:

wp search-replace 'https://old.example' 'https://new.example' --export=database.sql

Inspect the exported SQL and apply it only through a process you understand. An export is useful for change review, but it does not replace the original backup.

6. Use precise or regex processing only for a reason

--precise forces PHP processing across columns. The WP-CLI documentation describes it as slower but more thorough, so reserve it for cases where the normal processing path does not identify the structures you need to change. Regex mode is substantially slower—documented as roughly 15–20 times longer—and should be used only when a pattern-based transformation is genuinely required. A literal replacement is easier to audit and less likely to affect unintended text.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Multisite, custom tables, and table scope

Single-site installations

The default command targets tables registered to the current WordPress installation. This is usually the right starting point for a normal site, followed by a separate review of any plugin tables that store URLs outside the registered list.

Multisite networks

Without an additional network option, the command operates on the current site’s scope. Add --network when the replacement must cover all registered tables across the multisite network:

wp search-replace 'https://old.example' 'https://new.example' --network --dry-run

Test each affected site afterward. A network can contain different domains, paths, and site-specific content; replacing one domain across every site may be wrong if only one site is moving.

Plugin tables and unregistered tables

Use --all-tables-with-prefix to include unregistered tables sharing the WordPress table prefix. Use --all-tables to search every table in the database, including tables with another prefix. The broadest option also increases the chance of changing unrelated application data, so inspect the dry-run results carefully. Naming custom tables explicitly is safer when you know exactly which plugin data belongs to the migration.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Use Better Search Replace from the dashboard

Better Search Replace is listed in the official WordPress.org Plugin Directory. Its listing says it is based on the open-source Search Replace DB script and uses WordPress native database functions; activating it adds a page under the WordPress Tools menu.

  1. Install and activate the plugin from the WordPress administrator.
  2. Open Tools and then the plugin’s search-and-replace page.
  3. Enter the exact old and new strings, including http or https and any path.
  4. Select only the tables that should change. Include plugin tables when they are part of the migration, and do not assume every table belongs to WordPress.
  5. Run the preview or dry-run option and review the number of rows and fields affected.
  6. After confirming the scope and keeping your backup, run the replacement without preview mode.
  7. Save the result or log, then complete the verification checks below.

Dashboard tools are practical when SSH is unavailable, but the same safety rules apply: backup first, preview before writing, and verify serialized settings, media, login, and multisite behavior.

Why a blanket SQL replacement can break the site

A query such as the following changes text without understanding PHP serialization:

UPDATE wp_posts
SET post_content = REPLACE(post_content, 'https://old.example', 'https://new.example');

This may be acceptable for a field that is known to contain only ordinary text, but it is not a safe database-wide migration strategy. Serialized data stores lengths alongside strings. If a stored value changes from one character count to another, a plain SQL replacement leaves stale metadata. The result can be an unserialization warning, a widget that disappears, a plugin setting that resets, or an otherwise blank option value.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Editing an exported SQL file with a text editor has the same problem: it changes the characters but does not recalculate serialized lengths. Use manual SQL only for narrowly understood, non-serialized fields, and test the exact field with a restorable copy before applying it to production.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Verify the site after the replacement

Do not treat a successful command exit as the end of the migration. Work through these checks while the rollback backup is still available:

  1. Review the command report. Confirm that the affected table and row counts match the dry run and that no unexpected table was included.
  2. Search for leftovers. Run wp db search for the old hostname or URL forms you intended to remove, using the same table scope where appropriate.
  3. Open the home page and representative content. Test posts, pages, archives, navigation, forms, and any content type that uses custom fields.
  4. Inspect media. Load images, downloadable files, galleries, and generated thumbnails. Check both page source and browser requests for old-domain URLs.
  5. Sign in to /wp-admin. Confirm that authentication, redirects, the dashboard, and editor screens work.
  6. Inspect options and widgets. Look at theme settings, menus, sidebars, and major plugin configuration pages for missing or reset values.
  7. Test each affected multisite domain. Visit the network dashboard and representative pages on every site included in a network replacement.
  8. Check integrations. Review feeds, webhooks, REST endpoints, caching rules, and any external service that may still expect the old hostname.

If serialized settings are missing or a plugin reports invalid data, stop making further replacements and restore the pre-change database. Then repeat the migration with a serialization-aware method and a narrower scope.

Common failure modes and fixes

The dry run reports zero changes

Check the exact scheme, hostname, path, port, and trailing slash. Search for the hostname alone, then for alternate forms such as http://, escaped URLs, or a subdirectory. Confirm that WP-CLI is connected to the intended database and that you are running it from the correct WordPress installation.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Some old URLs remain

The missed values may be in unregistered plugin tables, a different table prefix, or a column excluded by your filters. Search with --all-tables-with-prefix or explicit custom-table names, and compare the result with your original inventory. Do not immediately run an unrestricted replacement until you know why the values were omitted.

The site shows broken widgets or plugin settings

This is consistent with serialized data being edited without length correction. Restore the backup rather than attempting to repair individual strings manually. Re-run with WP-CLI search-replace or another tool that explicitly handles PHP serialization.

A multisite migration changed too much

A network-wide command may have affected sites that use different domains or paths. Restore if necessary, then target the specific site tables or run a network command only after classifying each site’s intended URL. Test every domain separately.

The command is too slow

Reduce the table and column scope, avoid regex unless required, and use --precise only when its additional processing is justified. Large databases may be better handled in a maintenance window or on a staging copy first. Slowness alone is not a reason to switch to unsafe text replacement.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

A safe decision sequence

  1. Identify every old URL form and the sites that should change.
  2. Make and verify a restorable database backup.
  3. Choose WP-CLI when you have shell access and need detailed automation; choose Better Search Replace when a dashboard workflow is more practical.
  4. Inventory registered, custom, and multisite tables before selecting scope.
  5. Run a dry run or preview with the narrowest useful scope.
  6. Decide explicitly whether guid and other special columns belong in the migration.
  7. Execute the reviewed operation and retain its report.
  8. Search for leftovers, test content and media, sign in, inspect settings, and check every affected site.
  9. Restore the backup if the result is incomplete or serialized data is damaged; do not attempt an improvised reverse replacement.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
PC Slower Than It Used to Be?Free scan - under a minute
Outdated Drivers Are Slowing You DownFree scan - exact matches

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.