Update plugins with WP-CLI

Vulnerable, outdated plugins are the most common way into a WordPress site. Keeping them updated is the single most important security measure, and WP-CLI makes it fast, predictable and scriptable.

See what needs updating

Start by listing plugins that have updates available. Nothing changes. You’re just looking.

wp plugin list --update=available

Update one, or all

Update a specific plugin by its folder name (slug), or run them all at once.

wp plugin update woocommerce      # one plugin
wp plugin update --all            # everything with an update

Dry-run if you’re unsure

Want to see what --all would do before you pull the trigger? Add --dry-run.

wp plugin update --all --dry-run

Want only safe, smaller updates (patch/minor) and to avoid big version jumps? Use --minor.

wp plugin update --all --minor

Activate, deactivate, install

wp plugin deactivate some-plugin
wp plugin activate some-plugin
wp plugin install wordpress-seo --activate   # install + activate at once

Verify afterwards

An update can occasionally break something. Load the homepage to check no fatal error appeared, and confirm no updates are left hanging:

wp plugin list --update=available   # should now be empty
curl -I https://your-site.com        # should return 200 OK

Back up before big updates

Before a major update, export the database first (wp db export) so you can roll back quickly. See part two for how backups and SSH fit together.

The full WP-CLI series

• Terminal basics: getting around with cd and ls
• SSH into your server and run search-replace
• Update plugins with WP-CLI
• Update your theme with WP-CLI
• The most important WP-CLI commands

Rather not do it yourself? At Celestio, WP-CLI and SSH access are part of Managed WordPress. We keep core, themes and plugins updated for you. And you can always SSH into your own cloud server and run the commands above whenever you like.