How to Migrate from X-Cart to WooCommerce: A Complete Guide

Step 2: Database Extraction and Schema Normalization

Do not attempt direct live database queries. Export the X-Cart database via mysqldump, sanitize the output, and stage it on your WordPress server under a distinct database prefix (`xcart_`).

# Dump legacy X-Cart database
mysqldump -h legacy-db.internal -u xcart_user -p xcart_production > xcart_backup.sql

# Import into staging MySQL instance
mysql -u root -p -e "CREATE DATABASE xcart_migration;"
mysql -u root -p xcart_migration < xcart_backup.sql

Step 3: Programmatic Product Migration Script

Write a custom WP-CLI execution script or PHP CLI script to parse the normalized X-Cart tables and inject them directly into WooCommerce using the native WC_Product API. This ensures all internal metadata hooks, tax calculations, and inventory indices fire correctly.

<?php
/
 * X-Cart to WooCommerce Product Migration CLI Script
 * Execute via: wp eval-file migrate-products.php
 */

if (!defined('ABSPATH')) {
    exit;
}

global $wpdb;
$offset = 0;
$batch_size = 100;

while (true) {
    // Query X-Cart products table with pagination to prevent memory exhaustion
    $xcart_products = $wpdb->get_results(
        $wpdb->prepare(
            "SELECT p.*, d.descr, d.fulldescr FROM xcart_products p 
             LEFT JOIN xcart_products_lng_en d ON p.productid = d.productid 
             LIMIT %d OFFSET %d",
            $batch_size,
            $offset
        )
    );

    if (empty($xcart_products)) {
        break;
    }

    foreach ($xcart_products as $row) {
        // Check if product already exists via SKU to maintain idempotency
        $existing_id = wc_get_product_id_by_sku($row->productcode);
        if ($existing_id) {
            $product = wc_get_product($existing_id);
        } else {
            $product = new WC_Product_Simple();
        }

        $product->set_name(sanitize_text_field($row->product));
        $product->set_slug(sanitize_title($row->product));
        $product->set_sku(sanitize_text_field($row->productcode));
        $product->set_regular_price(floatval($row->price));
        $product->set_stock_quantity(intval($row->avail));
        $product->set_manage_stock(true);
        $product->set_description(wp_kses_post($row->fulldescr));
        $product->set_short_description(wp_kses_post($row->descr));
        
        $product_id = $product->save();
        WP_CLI::log("Migrated product ID: {$product_id} - SKU: {$row->productcode}");
    }

    $offset += $batch_size;
    // Clear object cache to free memory
    wp_cache_flush();
}

WP_CLI::success("Product migration completed successfully.");

<?php
/
 * Hook into WordPress authentication to handle legacy X-Cart password hashes
 */
add_filter('check_password', function($check, $password, $hash, $user_id) {
    if ($check) {
        return true;
    }

    $user = get_userdata($user_id);
    if (!$user) {
        return false;
    }

    // Retrieve legacy MD5 salt hash stored in user meta during migration
    $legacy_salt = get_user_meta($user_id, '_xcart_legacy_salt', true);
    if ($legacy_salt) {
        $computed_hash = md5(md5($password) . $legacy_salt);
        if (hash_equals($hash, $computed_hash)) {
            // Upgrade password to native WordPress hashing algorithm immediately
            wp_set_password($password, $user_id);
            delete_user_meta($user_id, '_xcart_legacy_salt');
            return true;
        }
    }

    return $check;
}, 10, 4);

Step 5: URL Structure Redirection

To preserve SEO equity, map X-Cart's product detail URL patterns to WooCommerce permalinks using Nginx rewrite maps or Apache .htaccess rules.

# Nginx configuration for legacy X-Cart product URL redirection
location ~* ^/product\.php {
    if ($arg_productid) {
        # Map legacy product ID to new WooCommerce slug via mapping database or map file
        return 301 https://yourdomain.com/shop/new-product-slug/;
    }
    return 301 https://yourdomain.com/shop/;
}

Production Hardening & Edge Cases

Executing the migration script is only half the battle. Production environments hosting high-volume WooCommerce stores demand rigorous post-migration hardening to defend against brute-force attacks, SQL injections, and infrastructure degradation.

A frequent edge case encountered during platform migrations involves database bloat caused by orphaned postmeta and transient entries generated during bulk CSV or CLI imports. Run regular database cleanup routines via WP-CLI to prune transients and optimize table indexes:

# Clean up expired transients and optimize database tables
wp transient delete --expired
wp db optimize

Filesystem permissions must be strictly locked down. Ensure that the WordPress root directory is owned by the system user, with write permissions restricted exclusively to wp-content/uploads.

# Secure WordPress file permissions
sudo chown -R www-data:www-data /var/www/html/
sudo find /var/www/html/ -type d -exec chmod 755 {} \;
sudo find /var/www/html/ -type f -exec chmod 644 {} \;
sudo chmod 600 /var/www/html/wp-config.php

Caching conflicts represent another major hazard. WooCommerce relies heavily on session cookies (such as woocommerce_items_in_cart and wp_woocommerce_session_). If your full-page caching mechanism (such as Varnish, Nginx FastCGI cache, or a server-side caching plugin) caches these requests globally, users will experience broken checkout states, cross-contamination of shopping carts, and exposure of private user data. Configure cache bypass rules for all URIs containing checkout, cart, or my-account endpoints.

Diagnostic Verification & Checklist

Before switching DNS records to point traffic to the new WooCommerce instance, execute the following verification matrix to guarantee zero data loss and optimal security posture.

Continuously monitor your Nginx error logs, PHP-FPM slow logs, and MySQL process lists during the initial 72 hours post-launch to catch asynchronous database queries, unindexed meta keys, or residual timeout bottlenecks before they impact customer transactions.