This is how I started to update WordPress daily:

cat <<-"CRON_DAILY" > /etc/cron.daily/nses_cron_daily
    for dir in /var/www/html/*/; do cd "$dir" && /usr/local/bin/wp plugin update --all --allow-root; done
    for dir in /var/www/html/*/; do cd "$dir" && /usr/local/bin/wp core update --allow-root; done
    for dir in /var/www/html/*/; do cd "$dir" && /usr/local/bin/wp theme update --all --allow-root; done
    chown www-data:www-data /var/www/html/* -R
    find /var/www/html/* -type d -exec chmod 755 {} \;
    find /var/www/html/* -type f -exec chmod 644 {} \;
chmod +x /etc/cron.daily/nses_cron_daily

I create the file with the heredocument, change permissions, and run daily.

Is there a shorter, pluginless way to update (less rows, hahaha)?


I didn't change basically anything inside wp-config.php besides database credentials.

up vote 2 down vote accepted

If you have this statement (by default) in your wp-config file

define( 'WP_AUTO_UPDATE_CORE', true );

Then WP core files are automatically updated for you. This assumes that you have traffic to your site (if nobody ever visits your site, the updates won't happen.)

So your solution is actually causing more work by the server, and is sort of redundant and repetitive. By default WP will check for core updates all on it's own.

  • Thx Rick. I guess only one line can go down - wp core update, but the other lines aren't redundant. – Arcticooling Jan 10 at 20:24
  • Actually, you can enable/disable core/theme/plugin updates via wp-config settings. See . So you could get rid of three commands if you wanted. Since I have multiple WP sites that I maintain, I use the excellent Infinite WP plugin to manage all the sites; I can check/install updates on all sites from one screen. – Rick Hellewell Jan 10 at 20:32
  • While the WordPress architecture might change tomorrow, WP-CLI architecture is less likely to change, I think, or at most, it will suite itself to a new WP architecture fast. Thus, I think the WP-CLI approach is good even when I remove the core wp core update that you have shown to be redundant. Given I use a good VPS in DigitalOcean for 5$ and that's the only site, I don't think it weighs much on the server, even daily. Just a humble thought... – Arcticooling Jan 10 at 21:36
  • Although the WP architecture might change, I very much doubt that the changed would be so major as to make the wp-config file commands obsolete. But, if you are more comfortable with the WP-CLI process (which could itself change), then that's OK. I just note that there is a way to automate updates without needing to delve into WP-CLI. – Rick Hellewell Jan 10 at 22:16
  • Yes, sorry I can't edit, I should have written "while the architecture of both WordPress and WP-CLI might change tomorrow, I feel intuitively that it's less likely that WP-CLI architecture's will". haha :) Thanks Rick! – Arcticooling Jan 11 at 3:54

Some notes about the code the OP posted up:

I wouldn't do updates as root myself - I use "sudo -u webuser /usr/local/bin/wp..." commands instead. If you have each VirtualHost run as a different user (httpd.itk for Apache), then you'll need to pick up the user from the Web config to run wp as well.

The big, big downer about all WP updates (whether left to the automatic WP updates or done via WP-CLI) is that there is no automatic DB/Web backup or automatic rollback if the updates fail.

It's why I had to write a pretty mammoth script to do WP updates for the 100+ sites I manage in a "safe way" - it does a Web/DB backup, a load of pre-update and post-update checks and if the post-update checks fail, it restores the Web/DB immediately. I also added features like being able to hold back updates for known problematic plugins/themes. One big advantage is that I can exactly schedule when our dev, UAT and live sites are updated (i.e. it's not left to whenever an update comes down the pipe).

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.