WP-CLI commands that save the most time on a WordPress site

Q: How do I back up the database with WP-CLI?

The wp db export command makes a copy of the whole database in one file, taking the connection details from wp-config.php so you type no password. Name a file in your home folder, not in public_html, because a file there can be downloaded from the internet. The database is restored with wp db import, but an import returns it to the state of the dump and deletes everything added since, orders and comments included.

Q: How do I get the admin back when a plugin has broken it?

In the site's folder run wp plugin deactivate with the plugin's name from the name column of wp plugin list. If WP-CLI itself fails with the same error, add --skip-plugins so the plugin is not loaded for that command. Without WP-CLI you can do the same in File Manager by renaming the plugins folder to plugins.hold, which deactivates all plugins at once.

Q: How do I create a new administrator if I cannot log in to WordPress?

Use wp user create with the administrator role, and if you give no password WP-CLI makes one up and shows it on screen. For a new password for an existing user there is wp user reset-password, which emails the user about the change by default. Do not type the password into the command with --user_pass=, because it may stay in the command history.

Q: How do I change the site address in the database with WP-CLI?

With wp search-replace, which changes the old address everywhere at once and understands serialized data that a manual replacement breaks. The command has no undo, so take a dump with wp db export first and then run a trial with --dry-run. Add --skip-columns=guid, because the WordPress documentation advises never changing the contents of the guid column.

Q: How do I check whether WordPress files have been changed?

wp core verify-checksums compares the core files with the checksums from WordPress.org, and wp plugin verify-checksums --all does the same for plugins from the directory. Both only read, and paid plugins outside the directory are skipped because there is nothing to compare them with. A changed file does not necessarily mean an infected site, but a changed core file you did not touch is a reason to look closer.

Q: Why are my scheduled WordPress posts late?

Often because WP-Cron is not running. wp cron test checks that WP-Cron starts the way it should, and wp cron event list shows the waiting events and when the next run is. If something has been waiting a long time, run whatever is due.

# TagscPanel

The WPhost team16 Sep 202614 min read

When the WordPress admin will not open, or when you need to update many things at once, clicking through the browser gets slow. WP-CLI is the command line for WordPress and does the same thing with one command, no browser needed.

In this guide you will check whether WP-CLI is available on your hosting and go through the commands that save the most time. The ones that only read come first, then the ones that change something, and every risky one has a warning in front of it.

What is WP-CLI, and is it on your hosting?

With WP-CLI you update the core, plugins and themes, create users, change addresses in the database and check files, all from the command line. Not every hosting provides it. Terminal in cPanel appears only if the provider has turned it on for your account, and WP-CLI must be installed on the server too. Check for yourself.

Open cPanel, find Terminal in the Advanced section and go to the site's folder, the one that holds the wp-config.php file. The main site is usually in public_html.

Bash

# cPanel > Terminal
cd ~/public_html
ls wp-config.php
wp --info

If you see the WP-CLI and PHP versions, you are ready. wp --info is the same as wp cli info and works even when you are not in a WordPress folder. The PHP version it shows is the one Terminal uses, and it may differ from the site's version.

If you get “command not found”, WP-CLI is not available to you on this hosting and you need to ask the provider. If you see “This does not seem to be a WordPress installation”, you are in the wrong folder. Go to the site's folder or add --path= with the path to it.

Dumping and restoring the database

wp db export makes a dump, meaning a copy of the whole database in one file, and wp db import restores the database from such a file. WP-CLI takes the connection details from wp-config.php, so you do not type a password. Name a file in your home folder, not in public_html, because a file there can be downloaded from the internet.

Bash

# cPanel > Terminal, in the site's folder
wp db export ~/db-before-change.sql
ls -lh ~/db-before-change.sql

If you do not name a file, WP-CLI invents a name of the form database name, date and random string, so it is better to choose the name and the place yourself.

Bash

# Restores the dump. Anything newer than the dump is lost.
wp db import ~/db-before-change.sql

Updating WordPress, plugins and themes

The first two commands only read and tell you where you stand. The first shows the installed version, and the second checks for a new one and returns a table with the version, the kind of update (major or minor) and the address it is downloaded from.

Bash

# cPanel > Terminal, in the site's folder
wp core version
wp core check-update

You update with wp core update. With --minor the command updates only to smaller versions with fixes and does not jump to the next big version. That is safer if your plugins have not yet been checked against it.

Bash

# Changes the core files. Dump the database first.
wp core update --minor

The lists of plugins and themes also only read. The table shows the name, the status, whether an update exists and which version is new. Before you update, see what would be updated. --dry-run shows the plugins that would be updated and changes nothing.

Bash

# cPanel > Terminal, in the site's folder
wp plugin list
wp theme list
wp plugin update --all --dry-run

Then update plugins one at a time, not all at once. That way, if something breaks, you know which one broke it. Themes work the same way. You run wp theme update --all --dry-run for a trial and wp theme update THEME_NAME to update.

Bash

# One plugin
wp plugin update PLUGIN_NAME

# All of them except one
wp plugin update --all --exclude=PLUGIN_NAME

How to get the admin back when a plugin has broken it

After an update a plugin can cause a fatal error and the admin will not open. Since version 5.2, WordPress emails the administrator a link to recovery mode, but if the message does not arrive or you do not want to wait, WP-CLI is a faster way.

Bash

# cPanel > Terminal, in the site's folder
wp plugin list --status=active
wp plugin deactivate PLUGIN_NAME

The name comes from the name column and usually matches the plugin's folder name in wp-content/plugins.

If WP-CLI itself breaks with the same error before it can deactivate the plugin, tell it not to load that plugin for this command.

Bash

# When WP-CLI itself breaks because of the plugin
wp plugin deactivate PLUGIN_NAME --skip-plugins=PLUGIN_NAME

--skip-plugins skips loading only for this command. Must-use plugins are always loaded. If the theme is at fault, --skip-themes does the same for it, and wp theme activate THEME_NAME switches the active theme to another one from wp theme list.

Without WP-CLI the same can be done in File Manager. WordPress documentation describes how to rename the plugins folder to plugins.hold, which deactivates all plugins at once. After you get into the admin, you rename it back and switch the plugins on one by one.

Users, a new administrator and a new password

The first command only reads and is a good security check. An administrator you do not recognize is a reason to take a closer look.

Bash

# cPanel > Terminal, in the site's folder
wp user list --role=administrator \
  --fields=ID,user_login,user_email,user_registered

If you cannot get into the admin, create a new administrator. When you do not give a password, WP-CLI makes one up and shows it on the screen.

Bash

# New administrator, the password is shown on the screen
wp user create spareadmin info@primer.bg --role=administrator

For a new password for an existing user there is reset-password. By default the command sends the user an email about the change. With --skip-email it does not, and with --show-password it shows the new password on the screen.

Bash

# New password, shown on the screen
wp user reset-password USERNAME --show-password

Changing the address in the database with search-replace

When a site changes its address, for example from http to https or from a test domain to the real one, the old address sits in many places in the database. wp search-replace changes them everywhere at once. It also understands serialized data, which stores the length of the text and which a manual replacement breaks.

Bash

# 1. Dump of the database, outside the site's folder
wp db export ~/db-before-change.sql

# 2. Trial run, changes nothing
wp search-replace 'http://primer.bg' 'https://primer.bg' \
  --skip-columns=guid --dry-run

# 3. The real command, the same without --dry-run
wp search-replace 'http://primer.bg' 'https://primer.bg' \
  --skip-columns=guid

--dry-run does the whole job as a rehearsal and shows how many replacements the command would make. --skip-columns=guid leaves the guid column alone. WordPress documentation advises never changing its contents.

How to find changed files

Two commands compare the site's files with the checksums from WordPress.org. Both only read.

Bash

# cPanel > Terminal, in the site's folder
wp core verify-checksums
wp plugin verify-checksums --all

The first checks the core files. It does not load WordPress, so it works on a broken site too. When something differs it prints a warning “File doesn't verify against checksum” with the file name, and when nothing differs it ends with “Success”.

The second does the same for plugins from the WordPress.org directory. A plugin outside the directory, a paid one for example, has nothing to compare with and the command skips it.

A changed file does not necessarily mean an infected site. You may have edited it yourself, or an update may have stopped halfway. But a changed core file that you did not touch is a reason to look closer. A scanner such as ImunifyAV looks for malware, if your host has one, and these two commands are a quick check you can run yourself.

If a plugin has changed files and you do not know why, put back a clean copy from WordPress.org. The command installs the latest stable version, so it may be newer than the current one.

Bash

# Copy the plugin's folder, then a clean install
cp -r wp-content/plugins/PLUGIN_NAME ~/plugin-copy
wp plugin install PLUGIN_NAME --force

Cron and cache

A scheduled post that runs late often means WP-Cron is not running. Two commands only read.

Bash

# cPanel > Terminal, in the site's folder
wp cron test
wp cron event list

wp cron test checks that WP-Cron starts the way it should, and wp cron event list shows the waiting events and when the next run is. If something has been waiting for a long time, run whatever is due.

Bash

# Runs the events whose time has come
wp cron event run --due-now

Three commands clear the cache at different levels.

Bash

# Object cache, expired transients, permalink rules
wp cache flush
wp transient delete --expired
wp rewrite flush

wp cache flush clears the object cache. On a busy site be careful, because the cache fills up again and the first requests are slower. wp transient delete --expired removes expired temporary records from the database, and wp rewrite flush refreshes the rules for permalinks.

Checklist

wp --info works and I know which folder I run the commands in.
Before every change I have a fresh database dump, saved outside public_html.
I run plugin and theme updates with --dry-run first.
I know how to deactivate a plugin with wp plugin deactivate if the admin will not open.
I run wp search-replace with --dry-run first and with --skip-columns=guid.
I review the administrators with wp user list --role=administrator.
I check the files with wp core verify-checksums and wp plugin verify-checksums --all.
I do not run wp db reset, wp db clean and wp db drop on a site I need.

If you would rather not do it yourself

You do not need WP-CLI if you have one site and its admin works. It is for the day you are in a hurry or the admin will not open.

If your hosting has no Terminal but has WP Toolkit in cPanel, it gathers all your WordPress sites in one place, updates them from there and checks their security, notifying you as soon as it finds a risk. How to use it is described in the WP Toolkit guide.

If you would rather not run commands at all, monthly maintenance takes over the site's monitoring, updates, vulnerabilities and backups every month, wherever it is hosted.

Frequently asked questions

What is WP-CLI?

WP-CLI is the command line for WordPress. With it you update the core, plugins and themes, create users, change addresses in the database and check files with one command, no browser needed. It helps when the admin will not open or you need to change many things at once.

How do I check whether my hosting has WP-CLI?

Open Terminal in the Advanced section of cPanel, go to the site's folder, the one holding wp-config.php, and run wp --info. If you see the WP-CLI and PHP versions, you are ready. "command not found" means WP-CLI is not available on this hosting, while "This does not seem to be a WordPress installation" means you are in the wrong folder.

How do I back up the database with WP-CLI?

The wp db export command makes a copy of the whole database in one file, taking the connection details from wp-config.php so you type no password. Name a file in your home folder, not in public_html, because a file there can be downloaded from the internet. The database is restored with wp db import, but an import returns it to the state of the dump and deletes everything added since, orders and comments included.

How do I get the admin back when a plugin has broken it?

In the site's folder run wp plugin deactivate with the plugin's name from the name column of wp plugin list. If WP-CLI itself fails with the same error, add --skip-plugins so the plugin is not loaded for that command. Without WP-CLI you can do the same in File Manager by renaming the plugins folder to plugins.hold, which deactivates all plugins at once.

How do I create a new administrator if I cannot log in to WordPress?

Use wp user create with the administrator role, and if you give no password WP-CLI makes one up and shows it on screen. For a new password for an existing user there is wp user reset-password, which emails the user about the change by default. Do not type the password into the command with --user_pass=, because it may stay in the command history.

How do I change the site address in the database with WP-CLI?

With wp search-replace, which changes the old address everywhere at once and understands serialized data that a manual replacement breaks. The command has no undo, so take a dump with wp db export first and then run a trial with --dry-run. Add --skip-columns=guid, because the WordPress documentation advises never changing the contents of the guid column.

How do I check whether WordPress files have been changed?

wp core verify-checksums compares the core files with the checksums from WordPress.org, and wp plugin verify-checksums --all does the same for plugins from the directory. Both only read, and paid plugins outside the directory are skipped because there is nothing to compare them with. A changed file does not necessarily mean an infected site, but a changed core file you did not touch is a reason to look closer.

Why are my scheduled WordPress posts late?

Often because WP-Cron is not running. wp cron test checks that WP-Cron starts the way it should, and wp cron event list shows the waiting events and when the next run is. If something has been waiting a long time, run whatever is due.

Sources

# TagscPanel

ShareFacebook X LinkedIn

WP-CLI commands that save the most time on a WordPress site

What is WP-CLI, and is it on your hosting?

Dumping and restoring the database

Updating WordPress, plugins and themes

How to get the admin back when a plugin has broken it

Users, a new administrator and a new password

Changing the address in the database with search-replace

How to find changed files

Cron and cache

Checklist

If you would rather not do it yourself

Frequently asked questions

What is WP-CLI?

How do I check whether my hosting has WP-CLI?

How do I back up the database with WP-CLI?

How do I get the admin back when a plugin has broken it?

How do I create a new administrator if I cannot log in to WordPress?

How do I change the site address in the database with WP-CLI?

How do I check whether WordPress files have been changed?

Why are my scheduled WordPress posts late?

Sources

Read next