WordPress
Using WP-CLI on Your WordPress Site
KPanel includes a WP-CLI console that runs commands against your WordPress site from the browser, with no SSH client and no server login. This guide covers where to find it, exactly which commands are permitted and why, the shortcuts built into the screen, and what to do when you need something the console will not run.
Opening the Console
- Sign in to KPanel and click Websites in the left sidebar.
- Click your WordPress site.
- Open the WordPress tab, then the Console section.
The input already starts with a fixed wp, so you type only what comes after it. plugin list, not wp plugin list. Press Enter or click Run.
Console is one of the sections that appear on managed plans. On other plans the tab strip ends with a +8 on Managed link instead. Every action described here that is not a raw command has an equivalent button elsewhere in KPanel, so nothing is out of reach: the console is a faster way to reach the same engine.
Commands run as your site's own system user, inside your site's directory. They cannot see or touch any other site.
What the Console Will and Will Not Run
The console uses an allowlist. Only the command prefixes below are accepted, and anything else is rejected before it reaches the server with a message naming the command it refused.
| Area | Permitted |
|---|---|
| Core | core version, core check-update, core update, core is-installed, core verify-checksums |
| Plugins | plugin list, plugin update, plugin install, plugin activate, plugin deactivate, plugin status, plugin get, plugin delete, plugin verify-checksums |
| Themes | theme list, theme update, theme install, theme activate, theme status, theme get, theme delete |
| Users | user list, user get, user create, user update, user set-role, user delete, user reset-password, user add-cap, user remove-cap, user generate |
| Database | db size, db tables, db optimize, db repair, db check |
| Cache and transients | cache flush, cache get, cache set, cache add, cache delete, transient get, transient set, transient delete |
| Rewrite rules | rewrite flush, rewrite list, rewrite structure |
| Cron | cron event list, cron event run, cron schedule list |
| Config | config get, config list, config has, config shuffle-salts |
| Maintenance mode | maintenance-mode activate, maintenance-mode deactivate, maintenance-mode status |
| Read only inspection | option get, option list, post list, post get, comment list, comment get |
| Media and language | media regenerate, language core install, language core update |
| Search and replace | search-replace |
The deliberate exclusions matter more than the inclusions:
evalandshellare blocked. Arbitrary PHP and arbitrary shell would make the console equivalent to a root prompt in a browser tab.db import,db export,db drop,db queryanddb resetare blocked. Import and reset destroy a database with no confirmation step;db queryis an unrestricted SQL prompt. Use phpMyAdmin instead: Accessing Your Database With phpMyAdmin.config setandconfig deleteare blocked. A badwp-config.phpwrite takes the site offline. Read the values here, change them through the file manager.option updateandoption deleteare blocked. Editing options blind is a common way to break a site beyond recovery.
The console takes no backup for you, on any command. Only the buttons on the Quick Actions section do that. Before search-replace, core update, plugin update, theme update, db optimize or db repair, take a backup yourself from the site's Backups tab. See Taking a Backup.
Working in the Console
The screen does more than accept one command at a time.
Preset buttons. Grouped shortcuts sit above the prompt: Performance (flush cache, clear transients, flush rewrites, autoload check), Database (optimize, check, repair, size), Diagnostics (WP version, check updates, verify core, cron events), Content (list plugins, themes, users, run cron now), Security (admin users, plugin checksums, reset salts, wp-config) and Maintenance (maintenance mode on and off, regenerate thumbnails, status). One click runs the command.
History. Press the up and down arrows in the prompt to move through your last 50 commands on this site.
Snippets. Click the bookmark icon next to a command to save it with a name, so a long invocation you use every month is one click next time.
Environment card. Above the prompt, a card shows the site's PHP version, WordPress version, memory limit, memory currently used, upload maximum and execution time limit, with a Copy for support button that puts all of it plus your active plugin list on the clipboard. Paste that into a support ticket and you have saved a round trip.
Copy output. Every result block has copy and clear buttons.
Output streams back as the command runs, so a long operation shows progress rather than sitting silent.
Commands Worth Knowing
Diagnosis
core version
core verify-checksums
plugin verify-checksums --all
plugin list --status=active --format=table
db size --tables
option list --autoload=yes
verify-checksums compares your core and plugin files against the official published copies and reports anything modified. It is the fastest first check on a site you suspect has been tampered with.
option list --autoload=yes lists every option WordPress loads on every single request. A bloated autoload table is one of the most common causes of a site that is slow for no visible reason.
Housekeeping
cache flush
transient delete --all
rewrite flush
db optimize
cron event list
cron event run --due-now
Users
user list --role=administrator --format=table
user create jo jo@example.com --role=editor
user update 4 --user_pass='a-long-unique-password'
Anything typed here is recorded in your account's activity log, including passwords. Change a password you set this way once you have signed in. Full detail on account recovery is in Resetting a Lost WordPress Admin Password.
Search and Replace
search-replace 'http://old-domain.co.nz' 'https://old-domain.co.nz' --all-tables --dry-run
Always dry run first. The full walkthrough, including why a raw SQL replace corrupts a WordPress database, is in Running a Search and Replace.
Console or Quick Actions?
Both run the same WP-CLI underneath. Choose on this basis:
| Task | Better route |
|---|---|
| Flush cache, update plugins, regenerate media | Quick Actions, one click and it backs up first |
| Search and replace with a preview by table | Quick Actions, the Search & Replace card |
| Anything needing a specific flag | Console |
| Listing, inspecting, diagnosing | Console |
| Running one overdue cron event | Console |
Editing wp-config.php or importing a database | Neither. Use the file manager or phpMyAdmin |
When You Need More Than the Allowlist
For unrestricted WP-CLI, connect over SSH and run wp directly from your site's directory. SSH uses key authentication only, so add your public key first from the site's Files, then SSH Keys tab. The connection details, including the exact host, port and username, are shown on that same screen. See Adding SSH Keys and Connecting Over SFTP.
Troubleshooting
"'x y' is not in the allowed command list." The command is not on the allowlist. Check the table above for the nearest permitted equivalent, or use SSH.
"No results returned. Check that WP-CLI is available." The command ran but printed nothing. Usually correct behaviour for a query with no matches.
The command times out. Console commands are capped at 60 seconds. Long operations such as regenerating a large media library should be run from Quick Actions, which uses a longer limit, or over SSH.
Nothing runs and the buttons are disabled. Your Kapsule account role is read only for this site. Ask an account owner to raise it.