Update Serialized Data Safely in WordPress (PRO)

A plain database search and replace corrupts serialized data — the packed strings that page builders, theme options, and widget settings store in your database. Update URLs handles this by unpacking serialized values, replacing inside them, and repacking them correctly, so URLs inside your saved settings update without breaking the site.

What serialized data is

WordPress stores many complex settings as serialized strings — a single text value that packs an array or object. A serialized string records the byte length of every string it contains, for example:

a:1:{s:3:"url";s:23:"https://old-domain.com/";}

The s:23: means "a string of 23 bytes follows." That length prefix is what makes serialized data fragile.

Why a naive search and replace corrupts it

If you run a direct SQL REPLACE() (or a plain find-and-replace tool) that changes https://old-domain.com/ to https://new-domain.example/, the text inside the string changes but the s:23: length prefix does not. PHP now reads a string whose declared length no longer matches its actual bytes, fails to unserialize it, and the setting is lost — often silently, until a page builder or theme option comes back empty or a widget disappears.

The longer or shorter your replacement is than the original, the more length prefixes are wrong. This is why raw SQL search-and-replace across a WordPress database is dangerous.

How Update URLs handles it

Update URLs never edits the packed string blindly. Instead it:

1. Unserializes the value into its real array or object structure.
2. Replaces your search term inside each string value.
3. Re-serializes the structure, so every length prefix is recalculated correctly.

PRO serialized handling

Update URLs PRO uses a careful recursive unserialize-and-replace across all selected tables:

• It skips values that contain no raw match before doing any work, avoiding needless churn (for example reformatting floats) on rows that would not change.
• It unserializes with allowed_classes => false, so untrusted objects are not instantiated — a safe way to walk the structure.
• It recurses through nested arrays and objects, replacing inside every string it finds, then re-serializes with correct lengths.

Matching escaped URLs in JSON

Some page builders and directory plugins store URLs as JSON with escaped slashes, like https:\/\/old-domain.com\/. With the Match escaped URLs in JSON data toggle turned on (its default), Update URLs PRO also matches these JSON-escaped-slash variants as literals, so URLs buried in JSON blobs are replaced too.

Free serialized handling

The free version includes a simpler serialized-data handler that recursively unserializes, replaces, and re-serializes — but it is applied only to custom fields (post meta) when you tick the Custom target. Serialized values in other tables are not covered on the free tier.

Recommended workflow

1. Enable Match escaped URLs in JSON data if your builder stores JSON (it is on by default in PRO).
2. Run a Dry Run first to preview the serialized matches.
3. Apply the changes, then confirm your builder pages and theme options still load.
4. If anything looks wrong, undo the run from History.

Conclusion

Serialized data breaks under a naive search and replace because its length prefixes stop matching the text. Update URLs unpacks, replaces, and repacks the structure so those prefixes stay correct — and PRO extends that to every selected table plus JSON-escaped URLs. Always preview serialized changes with a Dry Run before writing.

FAQs

Why does a normal search and replace break serialized data?

Serialized strings store the byte length of each string, like s:23:. A plain find-and-replace changes the text but not that length count, so PHP can no longer unserialize the value and the setting is lost. Update URLs avoids this by unserializing first, replacing inside the structure, then re-serializing so every length prefix is recalculated.

Does the free version handle serialized data?

Partly. The free version's serialized handler runs only on custom fields (post meta) when you select the Custom target. It recursively unserializes, replaces, and re-serializes those values. Serialized data stored in other tables is not covered on the free tier — for that you need Update URLs PRO.

What does "Match escaped URLs in JSON data" do?

It makes Update URLs PRO also match JSON-escaped-slash URL variants such as https:\/\/example.com\/, which page builders and directory plugins store inside JSON blobs. The toggle is on by default. With it enabled, URLs buried in JSON are replaced alongside normal and serialized values.

Will Update URLs change values that do not contain my search term?

No. Update URLs PRO checks each value for a raw match before touching it and skips anything that would not change. This prevents needless rewrites — such as reformatting numbers inside a serialized blob — on rows that do not contain your search term, keeping runs faster and cleaner.

How can I be sure serialized replacements are safe before writing?

Run a Dry Run first. It previews every match, including inside serialized and JSON data, without writing anything. After applying, if a builder page or option looks wrong you can undo the run from History, which restores the original serialized values from its journal.