What is WP-CLI? The WordPress Command Line explained

WP-CLI is the official command line interface for WordPress. Instead of clicking through wp-admin, you type commands into a terminal on the server: wp core update updates WordPress, wp plugin update --all updates every plugin, wp db export backs up the database, wp search-replace swaps a domain across the whole site without corrupting serialized data. The project was started in 2011 by Andrés Cifuentes and Cristi Burcă, is maintained today as an official WordPress.org project, and has become the standard tool behind professional WordPress maintenance, hosting automation and deployment pipelines. The practical pitch is simple: everything wp-admin does, WP-CLI does faster, plus a long list of things wp-admin cannot do at all, like verifying core files against official checksums after a suspected hack, fixing a site whose admin is unreachable because of a fatal error, or running the same maintenance script across fifty sites before your coffee gets cold.

What is WP-CLI and who maintains it?

WP-CLI is a PHP application that loads WordPress in the terminal and exposes its functionality as commands. Because it boots the actual WordPress installation, it works with your real data, your installed plugins and your configuration, not a simulation of them. The project lives at wp-cli.org and on GitHub, releases are coordinated with the WordPress project, and the command reference in the WordPress developer handbook documents every built-in command.

The requirements are modest: SSH access to the server, PHP on the command line and a UNIX-like environment (Linux, macOS, or Windows via WSL). That first requirement is the only real gatekeeper. On shared hosting without SSH access you cannot use WP-CLI, while most managed WordPress hosts not only allow it but preinstall it.

How to install WP-CLI

Before installing anything, check whether it is already there. On many hosts, typing wp --info in an SSH session answers the question. If not, installation is a two-minute job, because WP-CLI ships as a single Phar file:

curl -O https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
php wp-cli.phar --info
chmod +x wp-cli.phar
sudo mv wp-cli.phar /usr/local/bin/wp

# Verify the installation
wp --info

For local development you rarely need to install it manually, since Local, DDEV, Lando and the official wp-env all bundle WP-CLI. Once installed, commands are run from the WordPress root directory, or from anywhere using the --path flag pointing at the installation.

Essential WP-CLI commands for everyday use

The command structure is always wp, a topic, a subcommand and options. A tour of the ones that carry most real-world maintenance:

# Core: check, update, verify
wp core version
wp core update
wp core verify-checksums

# Plugins: list, install, update everything
wp plugin list
wp plugin install wordpress-seo --activate
wp plugin update --all

# Themes work the same way
wp theme list
wp theme update --all

# Users: create, list, reset a password
wp user list
wp user create anna anna@example.com --role=editor
wp user update admin --user_pass="new-strong-password"

# Database: export before you touch anything
wp db export backup-$(date +%F).sql
wp db size --human-readable

Two details make the list commands more useful than they look. Every list accepts filters and output formats, so wp plugin list --update=available --format=csv gives you a machine-readable report of pending updates. And wp core verify-checksums compares every core file against the official WordPress.org checksums, which turns the vague question has someone modified my core files into a yes or no answer in five seconds. It is one of the first commands worth running on any site you suspect was compromised.

Search-replace: the command that pays for the setup

The single feature that converts most sceptics is wp search-replace. Changing a domain, moving from staging to production or switching to HTTPS all require replacing URLs throughout the database. Doing that with raw SQL breaks WordPress, because themes, plugins and widgets store settings as serialized PHP data, where every string is prefixed with its length. Replace http with https in a serialized string via SQL and the stored length no longer matches, so WordPress silently discards the whole setting. WP-CLI unserializes the data, replaces the value, reserializes it with correct lengths and writes it back:

# Dry run first: shows what would change, changes nothing
wp search-replace 'http://old-domain.com' 'https://new-domain.com' --dry-run

# The real run, with a report per table
wp search-replace 'http://old-domain.com' 'https://new-domain.com' --report-changed-only

The --dry-run flag deserves a permanent place in your muscle memory. It answers what would happen before anything happens, which is exactly the confirmation step the rest of WP-CLI does not have.

WP-CLI for maintenance and troubleshooting

A handful of commands solve problems that are genuinely painful through the browser:

• Broken admin after an update. A plugin fatal error can lock you out of wp-admin entirely. wp plugin deactivate broken-plugin works anyway, because WP-CLI does not need the admin interface to render.
• Cron inspection. wp cron event list shows every scheduled task with its next run time, and wp cron event run --due-now executes overdue ones. Debugging WordPress pseudo-cron without this is guesswork.
• Transient cleanup. wp transient delete --expired removes expired transients that bloat the options table on older sites.
• Cache flush. wp cache flush empties the object cache, useful after deployments when Redis or Memcached serves stale data.
• Rewrite rules. wp rewrite flush fixes the classic 404-after-migration symptom without visiting the permalinks settings page.

Automating WordPress with WP-CLI scripts and aliases

Because every command is scriptable, WP-CLI turns recurring maintenance into files instead of memories. A weekly update routine becomes a short shell script: export the database, update core, plugins and themes, verify checksums, done. The same script runs from a cron job or a CI pipeline, and a loop over a list of installation paths maintains an entire portfolio of sites.

#!/bin/bash
# Minimal weekly maintenance for one site
wp db export ~/backups/backup-$(date +%F).sql
wp core update
wp plugin update --all
wp theme update --all
wp core verify-checksums

For working across environments, WP-CLI supports aliases in a wp-cli.yml file. Define @staging and @production with their SSH details once, then wp @staging plugin list runs remotely from your local terminal. Combined with the --ssh flag, the terminal on your laptop becomes the control room for every WordPress site you manage.

WP-CLI safety tips

The efficiency cuts both ways: commands execute immediately, and there is no undo. A few habits keep the power tool from becoming a power problem:

• Export before destructive commands. wp db export costs seconds and turns a disaster into an inconvenience. Commands like db reset, site empty and search-replace deserve one every time.
• Dry-run where offered. search-replace has --dry-run for exactly this reason.
• Do not run as root. WP-CLI warns loudly, because a root-owned process executes the site's PHP code with full system rights and creates files the web server user cannot touch. Run it as the same user the site runs under.
• Staging first. Any command you have never used before earns its production debut on a copy.

WP-CLI and InspectWP: findings in, fixes out

An InspectWP report tells you what needs attention on a WordPress site: an outdated core version, plugins with pending updates or known vulnerabilities, themes that fell behind. WP-CLI is the fastest way to act on exactly those findings, since wp core update and wp plugin update --all resolve the bulk of them in under a minute, and wp core verify-checksums double-checks integrity when a report raises security concerns. The two make a natural loop for anyone maintaining WordPress sites professionally: scheduled InspectWP reports surface the work, a WP-CLI session clears it, and the next report confirms the fix.