 She is a WordPress engineer at XWP and she also works for the WordPress project as a documentation lead. She's also been documentation lead for WordPress 5.8 release and she's also working on documentation for the next releases. And today she will use and show you how to use and not talk about WPCLI which is a common tool, line common tool for WordPress. So please give a welcome to Milana. Thank you for coming and thank you to everyone who's going to watch this later. I was going to, come in, come in please. I was going to wow you with my bad Italian but we don't have time for that. I'm usually, I need more than 30 minutes so we're going to squeeze in. So WPCLI is command line interface for WordPress and today when we have so many command line tools like Git and NPM and Docker and Composer, do we really need another one? Of course we do, yeah, because it's, yeah we need, because it's fun. And WPCLI is not only the most powerful tool you can use to do things to WordPress. It's also very fun and not scary. I'm going to show you. So the great thing about WPCLI and all CLI tools is you don't have to use it. Come, come. You don't have to use it right away like a pro. You can start low. You can start with few commands. So there are levels that you can, you know, go up. So the way I see using WPCLI is like first level. When you install WordPress fresh without any plugins, just default. Anything you can do in dashboard. You can do in WPCLI as well. So everything the same you can do. And this first level I like to call gilfoil level. But then you want to do more. You want to list Chrome jobs. Everybody does. You want to import, export database. In dashboard you need plugin to do that. You can't do it just out of box. But with WPCLI you don't need any plugin. You can do it just out of box. So now you see it's the same. It's not competition. Okay. So this level I like to call, see, Piper level. But then you want to do more. You maybe want to export just parts of database. I needed that. I need to export only posts and only published in past six months. And nothing else. No options. No users. Nothing. There is no plugin to do that. But with WPCLI you can do that. And there's another thing you can do with WPCLI. You can use a command scaffold with which you can create plugins. You can scaffold plugins. You can scaffold themes and taxonomies and post types and many other things. We will see that later. So there is no plugin for that. There is no way to do that in dashboard at all. And with WPCLI you can do that with just one line. So you see it's still the same, right? Yeah. Okay. And this level is your level. And now you think, okay, so we came to the level where you can't do anything in dashboard and you can do it with WPCLI and you think that's all? No. With WPCLI you can scaffold your own custom WPCLI command. And some very smart plugin authors and hosting companies are doing this for years. So imagine you get a new project. You log into new hosting and you dig around and oh my God, you have SSH access. But then you look further and you see, oh, there is WPCLI available. Now you're flirting. Stop it. But then you search even further and you find that this hosting company has their own custom WPCLI commands to do stuff in their servers fast and just in seconds. Now that new level of awesomeness is Mr. Robot level. Now I convinced you you want to use it. Okay. I'm totally with you. And I don't have computer or server without it. So I cannot show you how to install it. But there is a very good documentation about it. Okay. Let me just write. So what you need is three and a half commands. But really what you need is one command, this one. With this one, you download WPCLI and it's working. With this half of command, you check if it's working. But you don't want to type PHPWPCLI par every time you want to run commands. So what you do, you make it executable and then after that you move it to a place from where you can execute it. And that's somewhere in your path and you can call it like this. This determines how you call it, sorry, WP. The end of that is WP. That determines how you call it and you can call it whatever you want. Just keep in mind that once you install it, you will do a lot of copy pasting from Stack Overflow and documentation and it's going to start with WP. So, you know, you've been warned. And now we can start using it. So if you type WPINFO, you get all the info. Can you see it? You get all the info about your system. So I have Linux, I have PHP 8.2 and you get the part of all the things and my WPCLI version is 2.7. There will be 2.8 in May. So, I usually get a lot of things like well, you have to memorize the command. No, you don't. There is help. And with every CLI tool, you don't have to memorize anything. There is help. There is also tab completion. So if you start typing, I say WP and tab and I have all the commands that I can use. Okay, so that argument is off. Also, there is argument like well, you have to type it correctly. Well, you have to type PHP command correctly. So let's stop there as well. Okay, so how to memorize things easier? With WPCLI, you have WP or whatever you call it, I recommend WP. Then you have none. And this is the entity that you want to work with. There are a lot of entities. After that, you have verb. Now, you will find that a lot of entities have the same verb like add, create, remove, generate, and you will learn at least, the list is very useful as well. So you will learn this by using it. And if this is not enough for you, if this is too generic, then we have flags which are actually parameters or arguments and you don't really have to use, to memorize any of that because every time with every command, with every sub-command you have help at any moment available. So you can see all the parameters and you can see the whole documentation in your terminal. You don't have to go, you don't have to be online. You see all of that and you see also some covered examples there, how to actually command examples, how to use it. So everything is here. And now we can start. I will show you also the most favorite global parameter in the world. It's the best. You're going to love it. And it makes you not memorize anything. Now, you get a pattern that I don't memorize anything. So, let's start. I want to talk about today about doing some administration, making it faster and fun, also security and also some development. So we're going to start with administration. So, imagine this scenario, you had a client, they didn't call, didn't write for a long time. But then they said, they send you email and they said they can't access their WordPress install. They tried to, they can't login. So they tried WP admin, they tried login, they tried everything, and they can't access it. It just keeps sending them to 404 page. And this is because you're smart and you changed the login URL, right? Because you wanted to, you know, just increase security. But you said to your client when you, like, quitting your, when you were finishing the project, you said, okay, change it again so that even I don't know it. Let's pretend they did it. Okay. So they changed it and nobody in the world knows what is login URL. And now, after so many months, you have to find that login URL. So you have two options. You can go and search through database if you have access, which is pouring, or you can run one WPC-like command because we live in a perfect world where every server has WPC-LI available and you have SSH access to it, right? Okay. So you can use alias for that. And how can I know if I have this alias? Well, I can type WPC-LI alias list. Now, you see list, that's a verb. Now, alias is not a command connected to any WordPress install you have in your local WordPress. It is your CLI configuration. So what you configure on your computer, that alias you have on this computer. So if I list it, I have here my client. And I can show you right away like going SSH and Milana at Milana.dev and minus p. So you could do this, like 5, 5, 6, 5, 6. And I go there, yes, this is my imaginary client and if I... Let me put this up. If I go here, info, right, I have... It's a bit old version, but it's going to work. Now, that's possible as well, but the problem is I don't memorize things. I don't know that port number. I don't know even where is the file of that port number, right? I don't know if I have that file. And you can't really log time and, you know, put on your invoice like I've been searching for password for two hours. You can't do that. So you can use alias and I show you how to list alias. So you saw that I used the same thing to log in to my server. So connection here is what is important and what I'm not going to show you, which is like basic administration. I have created a pair of SSH keys, I've written public on my computer. I connected it to the server, which is my imaginary client. So there's public key and we did the first shake and that's it. So now I have connection and now I can create alias with WPCLI. So how do you use alias? Let me show you again that list of alias. So here's at client. And you see this one? It's created right away when you create first custom alias. So if you want to run commands in bulk, but please don't overdo it, you know, you don't want to do. But you can actually create alias for a group of websites. So if you have like local production and staging and you might want to update core at the same time. So you can do that or, you know, whatever, Roxy or both. So I have client. I have these, the connection that is created. So what I'm going to do is WPCLiant. So you have WPC alias name and then type command as you would without alias. So let's check the core version while we are there. Oh, it's outdated, right? So we have to update it now. I'm going to say WPCLiantCoreUpdate. Now, if I wanted a different, a specific version, I would say dash dash version and then equals which version. And if I was going backward from the, what is currently the latest version, I would have to say force. But I don't have to. And I can show you that later. So let's just update this one. Look ma, no hands. You don't even have to go there. But I would suggest you go. Right. So this is updated. Let me show you how you would do with the different version. So let's say version equals maybe I want 5.9. I don't want to break it too much. And because I'm going backwards, I say force. Look ma, I broke it. Right. So it's successfully updated to the lower version. Here it is. Okay. But we are not here to do this. We are here to find that login URL. You forgot already. Okay. So what I'm going to use is a command. I use too many times to admit I love it. It's evil. And it's not evil. And what it does, it executes arbitrary PHP wherever you type it. So I'm going to say echo. And I happen to know what is the function for getting the WordPress login URL. It's called WP login URL. And this is enough. What I'm going to add here is just a new line so that you can see this nicely. You should have asked Milana. So this is my imaginary client. And this is how 5.9 looks like. Okay. So this task could take a lot of time. It could take, you know, you replying to email, oh, I don't have the login. And then clients say, I don't have either. And then you start looking. And then after two hours, they send you, oh, I found it. And then you log in. But then you see you have to open ticket with support. It's frustrating. It's useless. You are wasting time that you cannot take money for. But if you start adding aliases now, for every website, you work on, you don't need to memorize anything. You see the pattern? Don't memorize anything. Your config file is where every, all credentials are there. Every website is there. And you will love yourself in two years. Trust me. Okay. So that's a little bit of administration. Let's talk about security. Hmm. I have some local here. Okay. And this is freshly installed WordPress like two days ago. Okay. It's 6.2. And let's see what users we have here. User list. So you see WP non-verb user list. I have admin, admin. I went with the stereotype. And it's administrator. I'm going to show you now what this administrator see. Not because I think you don't know this because it's obvious. I know that you know this, but I want to make a point. So now I'm going to use command WP admin. This command doesn't come with WP CLI right away. You have to download it. It's just one command to download it. And what it does, it opens your login URL. So why didn't we use it before? Well, it doesn't behave as expected with remote servers. So you can use it in local and I do it. And I don't know any of my local URLs anymore. So let me log in here. And this admin, this is all the things you know. So this admin has posts and categories and tags and media pages. And a team and editor, site editor, they removed better. So it's kind of safe now, right? I hope there are plugins, users, tools and team file editor, plugin file editor in 2023 from dashboard. You can edit PHP files on your servers. No, thank you. And settings and everything. Okay. And then when we go to the front end. So this is by default when you install WordPress. There is Hello World published. And default teams always show your administrator username. The same administrator that has the access to edit PHP files from dashboard. So all we need now is password, right? And WordPress website gets hacked a lot. It's not a secret. I like to think that's because we are popular. But you don't want to measure your popularity with clients' website, right? Yeah. And if we were talking about this in 2009, we could say, well, yeah, WordPress is a security home server. That's not the time anymore. Now it's code is much more secure. It's tied up and we still get hacked. It's human. Oh my God. I have 10 minutes. Okay. It's human error, right? We have easy passwords. We have clients who saw some shiny new plugin that is doing sharing to all social networks. And the plugin was like Xbox here, but they found it for free. And we know what that means and they installed it. So it's usually the human thing. And the solution is obvious here. Just remove the human, right? No, we can't remove human. We are making websites for the users. And what we can do, we can go around them. So I'm going to go around this user right now. I'm going to demote this user. So let me show you what we can do with users. Help. We can add capability, add role. And here comes the same verbs, like create, delete, generate, list, meta, remove, capability, spam, term, update. With update, you can change the password of the user. So if you want to have some fun, you know, I'm not judging. So what I'm going to do is WP user. Remove role. And now I have to tell to WP CLI which user. I can use username, email address or ID. And I have only one user, so it's ID one. And now we have no role. What that means. Let me watch this. So here we have this admin bar. And now if I want to go to dashboard, there's no dashboard because WordPress doesn't know what to do with you when you have no role. And I would suggest just keeping this password very strong because you want to keep your hackers amused. You don't want to disappoint there. And now this website is secured. Yay. But nothing can happen inside, right? And your client, well, you need someone who can write posts. So let's create user who can write posts. Create. And now there are a number of parameters that I don't know. I know I practiced this, but I don't want to know. I don't want to memorize. And I can use the most beautiful global parameter in the world. It's prompt. And it will prompt you with every parameter there is. You don't have to type anything. You don't have to think about typos. You don't have to memorize what you need. You just type what you need. So I'm going to say author. This is the user name. Then this is not important because it's local. Role default is subscriber. But I'm going to say author because I want author. And user password. Now this should be very strong password. But I have to log in with this user in a minute. So bear with me. It's going to be author. Now I'm going to install it. I'm going to install it on Windows. Next, next, next. Okay. Yeah, we have user. So let's see what this user can do. Oh. They can write posts. But they cannot edit other people's posts. They had never heard about categories or tags. No pages. No editing files in dashboard. Nothing. So I'm going to install. And the other user has no access at all. And look what I can do from WPC li. I can say WPC plug-in. Install. Activate. And I'm going to say simple history. Hmm. So this little plug-in will show you everything that happened in your WordPress install. And you can see this list in dashboard. Well, not in this dashboard. I have no user who can see that. But you see this plug-in author was smart. And they said WPC simple history list, you see. Verb list, yeah, none. Okay. I see everything from SSH. You can do things that are dangerous. You can do things that will change anything that clients shouldn't change. Right? And you can do this in dashboard. Nobody can install plug-in. But this author, if it was your client, they would want more access, right? Yeah. They should have more access. So let's give them access. I can say WPC user add capability. And now I need another parameter, user ID or email or user name. And I can say manage categories. And what this does is it will give them access to categories and tags. I think everybody who writes posts should be able to create tags, right? Then I'm going to say switch teams and the same thing for plug-ins. It's important activate plug-ins. It's important to notice that this doesn't mean they can install any new plug-in or team. They can only switch between existing teams and they can activate and deactivate plug-ins. Now, when something goes wrong with a website first thing you will get from support, first thing you will get is from anyone is switch off all plug-ins and switch to default team, right? Everybody should be able to do this. But there will be no code in this install that is not checked by developer, right? You cannot install plug-in without developer seeing it. Now, there's another thing I want to add here. Many plug-ins and almost all teams and even core now is hiding some settings behind edit team options and you will find it here. So with appearance you get this not better anymore editor and many other things. There are a lot of these capabilities. This is what's important but actually gives access in WordPress. It's not roles, it's capabilities. Roles are just group of capabilities. Role means nothing, capability means access and permission. You can see that here. If you go to documentation WordPress.org documentation, article, roles and capabilities you will find all the capabilities and all the roles and everything so you can play with this. You can set the specific access because I think that's our task to find the exact right access for clients so they can really own the website but not break it. I will break it, it's my job and I will then fix it. Okay, I'm out of time. So we didn't see, this was security so we have two options. Do you want to continue or we stop here? Continue, okay, okay, okay. Do you want to see magic or do you want to see scaffold? I would like both, magic. Magic, let's see the magic. I have my magic folder here which is empty completely. And I'm going to say WP install. The database name is magic because everything is magic. Next, next, next. Windows. Site title is magic. Site URL. I hope you see it. Admin user. Admin password, you can't see that. Almost there, it's cooking. I said it's magic. But it's not done yet. Okay, so do we want to release Kraken? We came here to release the Kraken, yes. And this is our Kraken. And yay, it's another WordPress website. Yay, it's not magic, it's just a website. So, obviously this was the Bash script that you can use to make things more fun and more faster and easier for you and you noticed I didn't type anything. I just typed my own command. Okay, he's pushy. Okay, so let me show you what's in this. I'm going to use Sublime. What's in this Bash script? Here. This is important. So you start with Shebang and then you tell which shell will be used. So I'm using Bash. Then we have only five WP CLI commands in this script. It's very simple, but you can make it as complicated as you want. So we download core, then we have to create config. So you see I'm using prompt here. You can use prompt for partial prompt. So I know that WP user, WP database user will always be root because it's my local. Then I also know what's my root password, but I don't want to leave it in my Bash history. You never want to leave your passwords in your Bash history. So what you can do here see I'm for password I'm using this really simple Bash script to just hide the input and just take it from the user. Then we have database name because that's going to change from side to side. So I'm taking it here, right? And then I say thank you because I like to talk to myself. Especially through terminal. Then we have WP core install. Again, I don't want to think about this. Is it URL title, admin user, whatever I don't want to think about it. Again, for password we are using hidden input and then I'm using CDIS to just combine database name with admin user name. So I have admin email because I never want to type local admin user. That's just annoying. And then we have rewrite structure. So why is this important? If we go back to this previous site that we were looking at. So here you see URL WPCLI.Lock index PHP. That's what you get when you install WPCLI. But here I'm rewriting structure to make it what we are used to and sorry and here you see this I don't have index.php. Now this is not enough to have ability to use a rewrite command in your local. So what you need is enabled Apache module and then you can use every rewrite command and after that I have some Linux found like steam locomotive and letters and whatever and then I ask myself do I want to release the Kraken and if I want the little cow say hi and open the dashboard if I don't want I have a wonderful day. So this is very very simple and you can add here if you have like installing a lot of websites in Italian you can add it here. If you want a dummy text you can generate with WPCLI posts and users and comments and what not you try it you play with it you can also add some plugins or you know the theme that you are using so you can put all of that and laugh out loud because you are not doing this manually ever again. Now this is we didn't see all and I hope you just saw what you can use in your own projects this is just a little tiny piece of what you can do with WPCLI it's fun it's fast it's making tedious tasks that take days in minutes literally my name is Milana Tzap I'm WordPress engineer at XWP and the loudest member of WordPress documentation team if you want to talk about I'm also classical musician and I was in opera so I speak a little bit Italian so if you want to talk about any of these you can find me there if you have any questions you can find me here or you know just tweet me and thank you very much for your time. I guess we have not much time for questions because we are running out of time and we don't have so much time for the questions because in theory we could release you as a cracker to go outside to do a tour so if you have any questions and you don't feel like doing it in English I can translate it otherwise you are free. No questions? It will be around so you can ask Thank you