Back to All Cheatsheet Libraries cheatsheets

WordPress

WP-CLI commands, key hooks and wp-config constants, and a baseline hardening checklist for admins running WordPress in production.

Total Commands: 0

Category	Command	Description
Core	`wp core download`	Downloads WordPress core files into the current directory.
Core	`wp core install --url=<url> --title=<title> --admin_user=<user> --admin_password=<pass> --admin_email=<email>`	Runs the famous 5-minute install non-interactively.
Core	`wp core update`	Updates WordPress core to the latest version.
Core	`wp core version`	Prints the current WordPress version.
Plugins	`wp plugin list`	Lists installed plugins with status, version, and update availability.
Plugins	`wp plugin install <slug> --activate`	Installs a plugin from the WordPress.org repo and activates it.
Plugins	`wp plugin update --all`	Updates every plugin with an available update.
Plugins	`wp plugin deactivate --all`	Deactivates every active plugin at once — the fastest way to isolate a white-screen error.
Themes	`wp theme list`	Lists installed themes and which one is active.
Themes	`wp theme activate <slug>`	Switches the active theme.
Database	`wp db export backup.sql`	Exports the database to a SQL file.
Database	`wp db import backup.sql`	Imports a SQL file into the site's database.
Database	`wp search-replace 'old.com' 'new.com'`	Safely rewrites a domain/URL across all tables, including serialized PHP data.
Database	`wp db optimize`	Runs OPTIMIZE TABLE across the database to reclaim space and defragment.
Users	`wp user list --role=administrator`	Lists all users with the administrator role.
Users	`wp user update <id> --user_pass=<newpass>`	Resets a user's password directly — the standard "locked out of wp-admin" fix.
Users	`wp user create <login> <email> --role=administrator`	Creates a new admin user from the command line.
Maintenance	`wp cache flush`	Flushes the object cache (works with Redis/Memcached backends too).
Maintenance	`wp rewrite flush`	Regenerates permalink rewrite rules — fixes most 404-on-post-URL issues.
Maintenance	`wp transient delete --all`	Clears every transient — useful when cached data has gone stale or corrupt.
Maintenance	`wp cron event run --all`	Manually fires every due WP-Cron event — useful for debugging scheduled tasks.
Security	`wp config set WP_DEBUG true --raw`	Toggles debug mode in wp-config.php from the CLI.
Security	`wp option get siteurl`	Reads any option from wp_options — pair with `wp option update` to fix a wrong site URL without touching wp-admin.

Common Hooks & Filters

Init & Setup

init after_setup_theme widgets_init wp_enqueue_scripts

Content

the_content save_post pre_get_posts the_title

Auth & Users

wp_login wp_logout user_register authenticate

REST & Admin

rest_api_init admin_menu admin_init admin_notices

wp-config.php Constants

WP_DEBUG

Enables PHP error reporting to the debug log. Pair with WP_DEBUG_LOG and WP_DEBUG_DISPLAY to keep errors out of the live page.

WP_MEMORY_LIMIT

Raises the PHP memory ceiling for WordPress specifically, independent of the server's own php.ini value.

DISALLOW_FILE_EDIT

Removes the theme/plugin file editor from wp-admin — a standard hardening step.

WP_AUTO_UPDATE_CORE

Controls automatic core updates: true for all, false for none, or 'minor' for security releases only.

FORCE_SSL_ADMIN

Forces wp-admin and wp-login.php to load over HTTPS even if the rest of the site doesn't.

WP_POST_REVISIONS

Caps how many revisions are kept per post — set a number (or false) to stop unbounded database growth.

Rotate the security keys

Regenerate the AUTH_KEY/SECURE_AUTH_KEY/etc. block in wp-config.php from the official secret-key API whenever a breach is suspected — this invalidates every existing session cookie.

Kill the "admin" username

Create a new administrator with a non-guessable login, reassign content with wp user delete 1 --reassign=<new-id>, then delete the default account.

Disable XML-RPC if unused

XML-RPC is a common brute-force and pingback-flood vector. Block xmlrpc.php at the web server level unless Jetpack or a mobile app depends on it.

Automate backups off-server

Schedule wp db export plus a full file sync to remote storage (S3, a second droplet) — a local-only backup doesn't survive the server it's backing up.

Limit login attempts

Rate-limit or lock out repeated failed logins at the application or reverse-proxy level — wp-login.php is the single most-attacked URL on any public WordPress install.

Quick Tips

Object cache first

A persistent object cache (Redis/Memcached) fixes more WordPress performance complaints than any plugin — page caching alone still hits the database on every uncached request.

uploads.ini for large media

If media uploads fail silently, it's almost always upload_max_filesize/post_max_size in PHP, not a WordPress setting.Check phpinfo(), not just Settings → Media.

Staging before major updates

Clone to a staging copy before a major core/PHP version bump — plugin compatibility breaks are the #1 cause of a bad-update emergency call.

Theme Directory Structure

/wp-content/themes/your-theme/

Every theme is its own folder here — the folder name is the theme's slug used throughout WordPress.

style.css

Required. A comment header block (Theme Name, Author, Version...) is what makes WordPress recognize the folder as a theme at all — the rest of the file is optional CSS.

functions.php

Auto-loaded on every request. Registers theme supports, enqueues assets, defines widget areas and nav menus — the theme's bootstrap file.

index.php

Required. The universal fallback template — if no more specific template matches, this is what renders.

screenshot.png

1200×900 preview shown in Appearance → Themes — optional but expected for any theme meant to be selected visually.

template-parts/

Convention (not required) for reusable chunks pulled in via get_template_part() — content cards, loop items, header/footer variants.

Template File Conventions

Classic (PHP) Theme

index.php + template hierarchyThe Loop

Block Theme (FSE)

theme.json + HTML templatesNo PHP required

Template Parts

get_template_part()Reusable component chunks

Child Theme

style.css Template: headerSafely overrides a parent

Create the folder and style.css header

The comment block at the top of style.css is the only truly required file content — WordPress parses it to list the theme in Appearance → Themes.

/* Theme Name: My Theme Author: Your Name Version: 1.0 */

Register theme supports in functions.php

Opt into core features — add_theme_support('title-tag'), 'post-thumbnails', 'html5' — rather than hand-coding what core already provides.

Build index.php as the fallback

Start with the one template every theme must have, using The Loop (have_posts() / the_post()) to output content.

Split out header, footer, sidebar

Move shared chrome into header.php/footer.php/sidebar.php, pulled in via get_header()/get_footer()/get_sidebar() — see the Theme Builder tab for the full pattern.

Add more specific templates as needed

Layer in single.php, page.php, archive.php etc. only where the fallback isn't enough — WordPress's template hierarchy picks the most specific match automatically.

Theming Tips

Never edit a theme you didn't build

Direct edits to a downloaded/purchased theme vanish on its next update — create a child theme instead, or a separate custom theme if going further than minor tweaks.

Enqueue, never hardcode, assets

CSS/JS belongs in wp_enqueue_style()/wp_enqueue_script() hooked to wp_enqueue_scripts — hand-written <link>/<script> tags skip WordPress's dependency management and cache-busting.

Escape everything you output

esc_html(), esc_attr(), esc_url() around any dynamic value printed in a template — the most common real-world theme security bug is skipping this.

Setting Up a New Theme

Create the theme folder

Under /wp-content/themes/ — the folder name becomes the theme's slug everywhere in WordPress.

Add the style.css header block

This comment block is what WordPress actually parses to register the theme — everything below it is normal CSS (or nothing at all, if styles are enqueued separately).

/* Theme Name: My Custom Theme Theme URI: https://example.com Author: Your Name Description: A custom theme. Version: 1.0 Text Domain: my-theme */

Declare theme support in functions.php

Each add_theme_support() call opts into a core feature rather than reimplementing it.

function my_theme_setup() { add_theme_support( 'title-tag' ); add_theme_support( 'post-thumbnails' ); add_theme_support( 'html5', array( 'search-form', 'comment-form' ) ); add_theme_support( 'custom-logo' ); } add_action( 'after_setup_theme', 'my_theme_setup' );

Classic theme vs. Block theme (FSE)

A classic theme uses PHP template files and the template hierarchy below. A block theme replaces most PHP templates with HTML files under /templates/ and a root theme.json — see the last sub-tab for its config shape.

The Template Hierarchy

For any given request, WordPress walks a fixed priority order and renders the first matching file it finds in the theme — everything eventually falls back to index.php.

Priority	Template File	Used For
1	`front-page.php`	The site's homepage, when a static front page is set — takes priority over home.php.
2	`home.php`	The main blog listing page (whether that's the homepage or a separate "Posts page").
3	`single.php`	A single post. `single-{post-type}.php` (e.g. single-product.php) overrides it for a specific custom post type.
4	`page.php`	A static Page. `page-{slug}.php` or a Page Template assigned in the editor overrides it.
5	`archive.php`	Post type/date/author archives. `category.php`, `tag.php`, `taxonomy.php` take priority for their own contexts.
6	`search.php`	Search results listing.
7	`404.php`	No matching content — always worth a real, styled 404.php rather than the fallback.
Last	`index.php`	The universal fallback — the only template file WordPress actually requires a theme to have.

<?php get_header(); ?> <main id="main-content"> <?php if ( have_posts() ) : ?> <?php while ( have_posts() ) : the_post(); ?> <article id="post-<?php the_ID(); ?>" <?php post_class(); ?>> <h2><a href="<?php the_permalink(); ?>"><?php the_title(); ?></a></h2> <?php the_excerpt(); ?> </article> <?php endwhile; ?> <?php the_posts_pagination(); ?> <?php else : ?> <p><?php esc_html_e( 'No content found.', 'my-theme' ); ?></p> <?php endif; ?> </main> <?php get_sidebar(); get_footer(); ?>

Sidebar & Reusable Template Parts

A widget area is registered once in functions.php, then rendered wherever sidebar.php is included.

// functions.php function my_theme_widgets() { register_sidebar( array( 'name' => 'Primary Sidebar', 'id' => 'sidebar-1', 'before_widget' => '<div class="widget">', 'after_widget' => '</div>', ) ); } add_action( 'widgets_init', 'my_theme_widgets' ); // sidebar.php <aside class="sidebar"> <?php if ( is_active_sidebar( 'sidebar-1' ) ) : ?> <?php dynamic_sidebar( 'sidebar-1' ); ?> <?php endif; ?> </aside>

get_sidebar()

Includes sidebar.php (or sidebar-{name}.php when called with a name argument) — the sidebar equivalent of get_header()/get_footer().

get_template_part('parts/card')

Includes template-parts/parts/card.php — the standard way to reuse a chunk of markup (a post card, a CTA block) across templates.

get_template_part('parts/card', 'featured', $args)

The optional second/third arguments pick a variant file (card-featured.php) and pass data into it via $args, readable inside the part.

register_sidebar()

Can be called multiple times for multiple widget areas (footer widgets, shop sidebar) — each needs its own unique 'id'.

Always guard with is_active_sidebar()

Wrapping dynamic_sidebar() avoids rendering an empty <aside> shell when no widgets have been added yet.

Template parts can nest

A template part can itself call get_template_part() for a smaller piece — keep each part scoped to one UI chunk, same discipline as a component library.

Header, Footer & Navigation Menus

Function / Hook	Belongs In	Purpose
`get_header()`	Any template	Includes header.php — opens the <html>/<head> and site branding/nav.
`wp_head()`	header.php, before </head>	Fires the wp_head action — where enqueued styles, SEO plugins, and analytics tags inject their output. Omitting it breaks plugins silently.
`wp_body_open()`	header.php, right after <body>	Modern equivalent of wp_head() for body-start injections (e.g. Google Tag Manager's noscript tag).
`wp_nav_menu()`	header.php or footer.php	Renders a menu assigned in Appearance → Menus to a registered location.
`register_nav_menus()`	functions.php	Declares the named locations (e.g. 'primary', 'footer') that show up in the Menus admin screen.
`get_footer()`	Any template	Includes footer.php — closes out markup and calls wp_footer().
`wp_footer()`	footer.php, before </body>	Fires the wp_footer action — where enqueued scripts print. Just as required as wp_head().

// functions.php register_nav_menus( array( 'primary' => __( 'Primary Menu', 'my-theme' ), 'footer' => __( 'Footer Menu', 'my-theme' ), ) ); // header.php <?php wp_nav_menu( array( 'theme_location' => 'primary', 'container' => false, ) ); ?>

Enqueueing Assets Correctly

function my_theme_assets() { wp_enqueue_style( 'my-theme-style', get_stylesheet_uri(), array(), '1.0' ); wp_enqueue_script( 'my-theme-main', get_template_directory_uri() . '/js/main.js', array(), '1.0', true ); } add_action( 'wp_enqueue_scripts', 'my_theme_assets' );

Common Theme Hooks

Hook	Type	Fires
`after_setup_theme`	Action	Early — the right place for add_theme_support() and register_nav_menus() calls.
`widgets_init`	Action	When widget areas should be registered via register_sidebar().
`wp_enqueue_scripts`	Action	Front-end asset registration — wp_enqueue_style()/wp_enqueue_script() belong here.
`the_content`	Filter	Transforms post content before output — where plugins like shortcode processors and embeds hook in.
`body_class`	Filter	Adds/removes classes from the array passed to body_class() in the template.
`template_redirect`	Action	Just before WordPress decides which template file to load — useful for custom redirects/overrides.

theme.json (Block Themes / FSE)

A block theme replaces most PHP templates with HTML files under /templates/ and /parts/, configured centrally by a root theme.json instead of scattered add_theme_support() calls.

{ "$schema": "https://schemas.wp.org/trunk/theme.json", "version": 2, "settings": { "color": { "palette": [ { "slug": "primary", "color": "#1e293b", "name": "Primary" } ] }, "typography": { "fontSizes": [ { "slug": "medium", "size": "1rem", "name": "Medium" } ] } }, "styles": { "color": { "background": "#ffffff", "text": "#1e293b" } } }

Classic and block themes can mix

A "hybrid" theme keeps PHP templates but adds a theme.json for editor styling controls — full FSE isn't all-or-nothing.

templates/index.html is the FSE fallback

In a block theme, /templates/index.html plays the same universal-fallback role that index.php plays in a classic theme.

Common Hooks & Filters

Init & Setup

Content

Auth & Users

REST & Admin

wp-config.php Constants

WP_DEBUG

WP_MEMORY_LIMIT

DISALLOW_FILE_EDIT

WP_AUTO_UPDATE_CORE

FORCE_SSL_ADMIN

WP_POST_REVISIONS

Baseline Hardening Checklist

Rotate the security keys

Kill the "admin" username

Disable XML-RPC if unused

Automate backups off-server

Limit login attempts

Quick Tips

Theme Directory Structure

/wp-content/themes/your-theme/

style.css

functions.php

index.php

screenshot.png

template-parts/

Template File Conventions

Classic (PHP) Theme

Block Theme (FSE)

Template Parts

Child Theme

Building a Custom Theme, Start to Finish

Create the folder and style.css header

Register theme supports in functions.php

Build index.php as the fallback

Split out header, footer, sidebar

Add more specific templates as needed

Theming Tips

Comprehensive WordPress Theme Builder

Setting Up a New Theme

Create the theme folder

Add the style.css header block

Declare theme support in functions.php

Classic theme vs. Block theme (FSE)

The Template Hierarchy

A minimal index.php using The Loop

Sidebar & Reusable Template Parts

Register + render a widget area

get_sidebar()

get_template_part('parts/card')

get_template_part('parts/card', 'featured', $args)

register_sidebar()

Header, Footer & Navigation Menus

Registering and rendering a menu location

Enqueueing Assets Correctly

functions.php

Common Theme Hooks

theme.json (Block Themes / FSE)

A minimal theme.json