Update plugins with WP-CLI

Vulnerable, outdated plugins are the most common way into a WordPress site. Keeping them updated is the single most important security measure — and WP-CLI makes it fast, predictable and scriptable.

See what needs updating

Start by listing plugins that have updates available. Nothing changes — you’re just looking.

wp plugin list --update=available

Update one — or all

Update a specific plugin by its folder name (slug), or run them all at once.

wp plugin update woocommerce      # one plugin
wp plugin update --all            # everything with an update

Dry-run if you’re unsure

Want to see what --all would do before you pull the trigger? Add --dry-run.

wp plugin update --all --dry-run

Want only safe, smaller updates (patch/minor) and to avoid big version jumps? Use --minor.

wp plugin update --all --minor

Activate, deactivate, install

wp plugin deactivate some-plugin
wp plugin activate some-plugin
wp plugin install wordpress-seo --activate   # install + activate at once

Verify afterwards

An update can occasionally break something. Load the homepage to check no fatal error appeared, and confirm no updates are left hanging:

wp plugin list --update=available   # should now be empty
curl -I https://your-site.com        # should return 200 OK

Back up before big updates

Before a major update, export the database first (wp db export) so you can roll back quickly. See part two for how backups and SSH fit together.

The full WP-CLI series

• Terminal basics: getting around with cd and ls
• SSH into your server and run search-replace
• Update plugins with WP-CLI
• Update your theme with WP-CLI
• The most important WP-CLI commands

Rather not do it yourself? At Kepler, WP-CLI and SSH access are part of Managed WordPress — we keep core, themes and plugins updated for you. And you can always SSH into your own cloud server and run the commands above whenever you like.