I'd like to run wp-cli for a bunch of WP installs that live in separate cPanel accounts, all under a WHM with root. System is CentOS6. I'd rather not give the user accounts shell access.

Wp-cli recommends not running it as root. So I created a new user:

# useradd awpcli
# passwd awpcli
# usermod -a -G foouser,nobody awpcli

Adding the nobody group is needed because the user public_html directories look like:

drwxr-x---  7 foouser nobody        4096 Aug  8 10:02 ./
drwx--x--x 18 foouser foouser      4096 Dec 14  2016 ../
-rw-r--r--  1 foouser foouser      5458 Aug  8 10:01 wp-activate.php
drwxr-xr-x  9 foouser foouser      4096 Nov 16  2017 wp-admin/

With that done, I can use wp-cli commands that only read but not write. So no updating plugins.

# su - awpcli
$ wp plugin list --path=/home/foouser/public_html


$ wp plugin update jetpack --path=/home/foouser/public_html

Does not work.

Warning: Could not create directory.
| name    | old_version | new_version | status |
| jetpack | 6.4         | 6.4.2       | Error  |

I tried some ACL stuff but that didn't work either. And my awpcli user may be a bad idea because it gives WP running under wp-cli file read access to the other WP's. It does protect system files, unless they are group "nobody."

Maybe there is a way to leverage how cPanel allows SFTP without shell access??

I'll run a script to grant shell access temporarily if I can't find another solution.

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.