WP-CLI commands

All commands live under wp pug. They are useful for monitoring, automation and servers where you prefer the terminal. On multisite run them with --url pointing at the main site.

Command	What it does
`wp pug status [–format=table\	json]`	Held updates (with package hashes), open alerts, gated plugins, settings, the quarantine folder, and the last and next check.
`wp pug scan-hidden [–no-alerts] [–format=table\	json]`	Runs the hidden-plugin scan. Exits 1 when something is hidden, so you can use it in monitoring. --no-alerts reports only, without raising alerts or sending notifications.
wp pug check-integrity [<plugin>]	Re-hashes baselined plugins (or one plugin file) and reports files changed without an update. Exits 1 when changes are found.
wp pug approve <plugin> <package-hash> [--trust=<days>] [--no-install]	Approves a held update by its package hash (the full 64 characters, or a unique prefix of at least 12), verifies the quarantined zip and installs it. --trust also trusts the plugin’s update host for that many days. --no-install approves only, so the vendor’s next update goes through. Rejected packages and single-file plugins are approved for the next vendor update instead.
wp pug reject <plugin>	Rejects the plugin’s held update(s) and deletes the quarantined package. The same package is held again if it is offered again.

Examples#

# What is held, what is open, what is gated
wp pug status

# Machine-readable, for dashboards
wp pug status --format=json

# Nightly monitoring: non-zero exit means something is hidden or changed
wp pug scan-hidden && wp pug check-integrity

# Approve a held update after reviewing it in wp-admin
wp pug approve acme-pro/acme-pro.php 60b7920bc435

# Approve and trust the vendor for 60 days
wp pug approve acme-pro/acme-pro.php 60b7920bc435 --trust=60

# Reject it instead
wp pug reject acme-pro/acme-pro.php