# Using WP-CLI on Your WordPress Site

Source: https://support.kapsulehost.com/en-us/wordpress-wp-cli

KPanel includes a WP-CLI console that runs commands against your WordPress site from the browser, with no SSH client and no server login. This guide covers where to find it, exactly which commands are permitted and why, the shortcuts built into the screen, and what to do when you need something the console will not run.

## Opening the Console

1. Sign in to [KPanel](https://kpanel.kapsulehost.com) and click **Websites** in the left sidebar.
2. Click your WordPress site.
3. Open the **WordPress** tab, then the **Console** section.

![WP-CLI console on a WordPress site in KPanel](https://support.kapsulehost.com/help/screenshots/wordpress-wp-cli.c3f61741.webp)

The input already starts with a fixed `wp`, so you type only what comes after it. `plugin list`, not `wp plugin list`. Press Enter or click **Run**.

> **Note:** **Console** is one of the sections that appear on managed plans. On other plans the tab strip ends with a **+8 on Managed** link instead. Every action described here that is not a raw command has an equivalent button elsewhere in KPanel, so nothing is out of reach: the console is a faster way to reach the same engine.

Commands run as your site's own system user, inside your site's directory. They cannot see or touch any other site.

## What the Console Will and Will Not Run

The console uses an allowlist. Only the command prefixes below are accepted, and anything else is rejected before it reaches the server with a message naming the command it refused.

| Area | Permitted |
|---|---|
| Core | `core version`, `core check-update`, `core update`, `core is-installed`, `core verify-checksums` |
| Plugins | `plugin list`, `plugin update`, `plugin install`, `plugin activate`, `plugin deactivate`, `plugin status`, `plugin get`, `plugin delete`, `plugin verify-checksums` |
| Themes | `theme list`, `theme update`, `theme install`, `theme activate`, `theme status`, `theme get`, `theme delete` |
| Users | `user list`, `user get`, `user create`, `user update`, `user set-role`, `user delete`, `user reset-password`, `user add-cap`, `user remove-cap`, `user generate` |
| Database | `db size`, `db tables`, `db optimize`, `db repair`, `db check` |
| Cache and transients | `cache flush`, `cache get`, `cache set`, `cache add`, `cache delete`, `transient get`, `transient set`, `transient delete` |
| Rewrite rules | `rewrite flush`, `rewrite list`, `rewrite structure` |
| Cron | `cron event list`, `cron event run`, `cron schedule list` |
| Config | `config get`, `config list`, `config has`, `config shuffle-salts` |
| Maintenance mode | `maintenance-mode activate`, `maintenance-mode deactivate`, `maintenance-mode status` |
| Read only inspection | `option get`, `option list`, `post list`, `post get`, `comment list`, `comment get` |
| Media and language | `media regenerate`, `language core install`, `language core update` |
| Search and replace | `search-replace` |

The deliberate exclusions matter more than the inclusions:

- **`eval` and `shell`** are blocked. Arbitrary PHP and arbitrary shell would make the console equivalent to a root prompt in a browser tab.
- **`db import`, `db export`, `db drop`, `db query` and `db reset`** are blocked. Import and reset destroy a database with no confirmation step; `db query` is an unrestricted SQL prompt. Use phpMyAdmin instead: [Accessing Your Database With phpMyAdmin](https://support.kapsulehost.com/en-us/sites-phpmyadmin).
- **`config set` and `config delete`** are blocked. A bad `wp-config.php` write takes the site offline. Read the values here, change them through the file manager.
- **`option update` and `option delete`** are blocked. Editing options blind is a common way to break a site beyond recovery.

> **Warning:** The console takes no backup for you, on any command. Only the buttons on the **Quick Actions** section do that. Before `search-replace`, `core update`, `plugin update`, `theme update`, `db optimize` or `db repair`, take a backup yourself from the site's **Backups** page. See [Taking a Backup](https://support.kapsulehost.com/en-us/taking-a-backup).

## Working in the Console

The screen does more than accept one command at a time.

**Preset buttons.** Grouped shortcuts sit above the prompt: Performance (flush cache, clear transients, flush rewrites, autoload check), Database (optimize, check, repair, size), Diagnostics (WP version, check updates, verify core, cron events), Content (list plugins, themes, users, run cron now), Security (admin users, plugin checksums, reset salts, wp-config) and Maintenance (maintenance mode on and off, regenerate thumbnails, status). One click runs the command.

**History.** Press the up and down arrows in the prompt to move through your last 50 commands on this site.

**Snippets.** Click the bookmark icon next to a command to save it with a name, so a long invocation you use every month is one click next time.

**Environment card.** Above the prompt, a card shows the site's PHP version, WordPress version, memory limit, memory currently used, upload maximum and execution time limit, with a **Copy for support** button that puts all of it plus your active plugin list on the clipboard. Paste that into a support ticket and you have saved a round trip.

**Copy output.** Every result block has copy and clear buttons.

Output streams back as the command runs, so a long operation shows progress rather than sitting silent.

## Commands Worth Knowing

### Diagnosis

```
core version
core verify-checksums
plugin verify-checksums --all
plugin list --status=active --format=table
db size --tables
option list --autoload=yes
```

`verify-checksums` compares your core and plugin files against the official published copies and reports anything modified. It is the fastest first check on a site you suspect has been tampered with.

`option list --autoload=yes` lists every option WordPress loads on every single request. A bloated autoload table is one of the most common causes of a site that is slow for no visible reason.

### Housekeeping

```
cache flush
transient delete --all
rewrite flush
db optimize
cron event list
cron event run --due-now
```

### Users

```
user list --role=administrator --format=table
user create jo jo@example.com --role=editor
user update 4 --user_pass='a-long-unique-password'
```

Anything typed here is recorded in your account's activity log, including passwords. Change a password you set this way once you have signed in. Full detail on account recovery is in [Resetting a Lost WordPress Admin Password](https://support.kapsulehost.com/en-us/wordpress-reset-password).

### Search and Replace

```
search-replace 'http://old-domain.co.nz' 'https://old-domain.co.nz' --all-tables --dry-run
```

Always dry run first. The full walkthrough, including why a raw SQL replace corrupts a WordPress database, is in [Running a Search and Replace](https://support.kapsulehost.com/en-us/wordpress-search-replace).

## Console or Quick Actions?

Both run the same WP-CLI underneath. Choose on this basis:

| Task | Better route |
|---|---|
| Flush cache, update plugins, regenerate media | **Quick Actions**, one click and it backs up first |
| Search and replace with a preview by table | **Quick Actions**, the Search & Replace card |
| Anything needing a specific flag | Console |
| Listing, inspecting, diagnosing | Console |
| Running one overdue cron event | Console |
| Editing `wp-config.php` or importing a database | Neither. Use the file manager or phpMyAdmin |

## When You Need More Than the Allowlist

For unrestricted WP-CLI, connect over SSH and run `wp` directly from your site's directory. SSH uses key authentication only, so add your public key first from the site's **Settings**, then **SSH Keys** tab. The connection details, including the exact host, port and username, are shown on that same screen. See [Adding SSH Keys](https://support.kapsulehost.com/en-us/adding-ssh-keys) and [Connecting Over SFTP](https://support.kapsulehost.com/en-us/sftp-access).

## Troubleshooting

**"'x y' is not in the allowed command list."** The command is not on the allowlist. Check the table above for the nearest permitted equivalent, or use SSH.

**"No results returned. Check that WP-CLI is available."** The command ran but printed nothing. Usually correct behaviour for a query with no matches.

**The command times out.** Console commands are capped at 60 seconds. Long operations such as regenerating a large media library should be run from **Quick Actions**, which uses a longer limit, or over SSH.

**Nothing runs and the buttons are disabled.** Your KapsuleHost account role is read only for this site. Ask an account owner to raise it.