WP-CLI commands

If you know WP-CLI, your assistant can use the same commands on your site, or on many sites at once: plugins, themes and WordPress updates, users, settings, menus, cache, cron and the database. They run through AI Puffer like everything else: as the WordPress user you chose, at your safety level, and in your activity log. There’s no SSH, no server login and no WP-CLI install. It’s on every plan, including Free.

Ask in plain words, or name the command:

Use WP-CLI to check which plugins have updates, then update WooCommerce.

How it runs

• Nothing runs in a shell. AI Puffer reads the command, checks it and carries it out through WordPress’s own functions. There’s no shell expansion, no chaining and no wp eval.
• Your safety level applies. At Standard, every command that changes something waits for your yes; reads don’t. At Trusted, it just runs.
• The user you chose is the ceiling. wp user create needs a user who may create users, wp plugin install one who may install plugins, and so on.
• Passwords and keys stay hidden. They’re never shown in results and can’t be changed, and neither can AI Puffer’s own connection settings.
• Output is JSON. Run wp help to see every supported command and its flags.

Posts, pages, images and comments

Command	What it does
wp post list, wp post get, wp post-type list	Find and read posts, pages and other content.
wp post create, wp post update	Create a post or page (always a draft), or change it. update needs the version from get, so a newer edit is never overwritten.
wp post delete	Move to the trash, or delete for good with --force.
wp post meta get/list/add/update/delete	Custom fields. Hidden fields (starting with _) need --force; fields a plugin registers also follow that plugin’s own permission checks.
wp post term set/add/remove, wp term list/get/create/update/delete, wp taxonomy list	Categories and tags.
wp media list, wp media import, wp media image-size	Find images, add one from a public HTTPS address, list image sizes.
wp comment list/count/create/approve/unapprove/spam/unspam/trash/untrash/delete	Moderate comments.

Menus and widgets

Command	What it does
wp menu list/create, wp menu item list/add-post/add-term/add-custom/update/delete	Classic navigation menus.
wp menu location list/assign	Put a menu in a theme location.
wp sidebar list, wp widget list	See sidebars and widgets.

Settings

Command	What it does
wp option get/list/pluck/add/update/patch/delete	Site and plugin settings stored as options.
wp transient get/list/delete	Temporary cached values.
wp theme mod list/get/set	Customizer settings of the active theme.

Changes to active plugins, the active theme, user roles and scheduled tasks go through their own commands below, not wp option.

Users and roles

Command	What it does
wp user list/get/create/update/delete	Accounts. delete can hand content over with --reassign.
wp user set-role/add-role/remove-role/add-cap/remove-cap	A user’s roles and capabilities.
wp user meta get/list/add/update/delete	User fields.
wp role list/create/delete/reset, wp cap list/add/remove	Roles and what they can do. The administrator role can’t be deleted.

Plugins, themes and WordPress

Command	What it does
wp plugin list/status/get/search	What’s installed, and what’s on WordPress.org.
wp plugin install/activate/deactivate/update/uninstall	Install, switch on or off, update or remove a plugin.
wp plugin auto-updates status/enable/disable, wp plugin verify-checksums	Auto-updates and file checks.
wp theme list/status/get/install/activate/update/delete	Themes.
wp core version/check-update/update/update-db/verify-checksums	WordPress itself.

Installs and updates come from WordPress.org only. Plugins and themes sold elsewhere update the way their vendor provides. Editing theme files is separate and needs a paid plan: see Themes.

Cache, cron and maintenance

Command	What it does
wp cache type/flush, wp rewrite list/flush/structure	Object cache and permalinks.
wp cron event list/run/delete, wp cron test	Scheduled tasks.
wp litespeed-purge, wp sg purge, wp super-cache flush, wp w3-total-cache flush, wp breeze purge, wp elementor flush-css	Clear the cache of LiteSpeed Cache, SiteGround Optimizer, WP Super Cache, W3 Total Cache, Breeze and Elementor.
wp maintenance-mode status	Whether the site is in maintenance mode.

Database

Command	What it does
wp db tables, wp db columns <table>, wp db prefix, wp config get	Look around: tables, including your plugins’ own, and their columns.
wp db query "SELECT …"	Read from WordPress’s tables and your plugins’ tables. Joins, WHERE with AND, OR, IN and BETWEEN, and totals such as COUNT, SUM and AVG. Up to 1,000 rows.
wp db query "UPDATE …" (or INSERT, DELETE)	Change data in a plugin’s table: up to 100 rows in one go, chosen with WHERE, all or nothing. Add --expected-count=<n> to stop if more rows match than you expect. Posts and settings change one exact record at a time.
wp search-replace <old> <new>	Replace text across content and settings, safe for serialized data. Try --dry-run first; large sites go in batches of up to 100 rows.

Queries are read and checked by AI Puffer, never passed to the database as typed. Passwords, keys and AI Puffer’s own tables stay hidden. Schema changes (CREATE, ALTER, DROP) aren’t supported.

Many sites at once

Your assistant can run a list of commands on up to 50 of your connected sites as one background job, up to 50 commands per site.

On all my sites, check which plugins have updates and update Yoast SEO.

• Commands run in order on each site. If one needs your approval, fails or has an unclear outcome, the rest wait on that site; the other sites carry on.
• Each site keeps its own WordPress user, safety level, approvals and allowance.
• Ask for progress at any time, or stop the commands that haven’t started. Stopping never undoes what already ran.
• Each command that succeeds counts as one website action. Starting a job, checking it and stopping it are free.
• A job runs for at most 24 hours. There’s no job dashboard yet: ask your assistant.

Not supported yet

• Database schema changes.
• wp eval, wp shell, wp package and anything that runs code. Unknown commands and flags are refused with a list of what is supported.