Installing and managing WordPress with WP-CLI, WPScan, and supporting tools

Installing and managing WordPress with WP-CLI, WPScan, and supporting tools

This article explains how to install WordPress 6.7 via WP-CLI 2.11, secure it with WPScan, and support it with tools such as Poedit, Pinegrow, and ThiefMD. It is intended for developers and system administrators who run WordPress in a production environment.

Requirements

- A server with PHP 8.1 or higher and MySQL 8.0 or MariaDB 10.5 - WP-CLI 2.11 or higher — check with `wp --version` - SSH access to the server - A domain that points to the server - WPScan 3.8.22 or higher (optional, for security scans) - Poedit 3.4, Pinegrow 6.5, or ThiefMD 0.3 (optional, depending on your workflow)

Steps

1. Download WordPress with WP-CLI

Navigate to the webroot and download the latest WordPress core files:

cd /var/www/html
wp core download --version=6.7 --locale=nl_NL

This command fetches WordPress 6.7 with Dutch language files. Without `--locale`, you get the default English version.

2. Create the configuration file

Generate `wp-config.php` with database details:

wp config create --dbname=wordpress_db --dbuser=wp_user --dbpass=sterkWachtwoord --dbhost=localhost --dbprefix=wp_ --locale=nl_NL

WP-CLI automatically fills the file with the appropriate salts and keys. Store the database details securely.

3. Run the installation

Install WordPress with the site details:

wp core install --url=https://jouwdomein.nl --title="Mijn Site" --admin_user=admin --admin_password=sterkAdminWachtwoord --admin_email=admin@jouwdomein.nl

This step creates the database tables and sets up the admin account. Use a strong password — weak admin passwords are the main entry point for attackers.

4. Install and activate plugins

Add the plugins you need:

wp plugin install wordpress-seo --activate
wp plugin install woocommerce --activate
wp plugin install wordfence --activate
wp plugin install contact-form-7 --activate

With `wp plugin install`, you can install any plugin from the WordPress repository. The `--activate` flag activates the plugin immediately after installation.

5. Configure permalinks

Set an SEO-friendly URL structure:

wp rewrite structure '/%postname%/' --hard
wp rewrite flush

The first command sets the permalink structure, the second rewrites the rewrite rules. This prevents 404 errors on individual posts and pages.

6. Scan the site for vulnerabilities with WPScan

Run a security scan:

wpscan --url https://jouwdomein.nl --api-token=JOUW_WPSCAN_API_TOKEN

Without an API token, WPScan works in a limited way. You get the free token by creating an account at wpscan.com. The scan checks for outdated plugins, vulnerable themes, and weak passwords.

7. Scan discreetly with stealth mode

For production sites, a conspicuous scan is risky. Use the stealth option:

wpscan --url https://jouwdomein.nl --stealthy --api-token=JOUW_WPSCAN_API_TOKEN

The `--stealthy` flag combines random user agents and passive detection. This makes the scan less visible in the target website's server logs.

8. Set up a maintenance schedule

Automate updates and scans with cron:

crontab -e

Add these lines:

0 3 <em> </em> * wp core update --path=/var/www/html
0 4 <em> </em> 0 wpscan --url https://jouwdomein.nl --stealthy --api-token=JOUW_WPSCAN_API_TOKEN >> /var/log/wpscan.log

The first line runs a WordPress update daily at 03:00. The second scans weekly on Sunday at 04:00. The log is stored in `/var/log/wpscan.log`.

Verification

Check whether the installation works:

wp core check-update
wp plugin list --status=active
wpscan --url https://jouwdomein.nl --api-token=JOUW_WPSCAN_API_TOKEN --format=cli

The first command shows whether WordPress is up to date. The second lists active plugins. The third confirms that the security scan is running.

After that, visit `https://jouwdomein.nl/wp-admin` and log in with the admin account you created in step 3.

Common issues

1. "Error establishing a database connection"

Cause: incorrect database details in `wp-config.php`. Fix this:

wp config set DB_PASSWORD 'nieuwWachtwoord'

Then check whether the database itself is reachable:

mysql -u wp_user -p -h localhost wordpress_db

2. WPScan reports "API token required"

Cause: you are using WPScan without a token. Create a free account at wpscan.com and paste the token into the command. Without a token, WPScan only scans for a limited set of vulnerabilities.

3. Permalinks give 404 errors after installation

Cause: the Apache or Nginx configuration does not allow URL rewriting. For Apache:

a2enmod rewrite
systemctl restart apache2

For Nginx, add this to the server block:

location / {
    try_files $uri $uri/ /index.php?$args;
}

Translations with Poedit

For multilingual WordPress sites, you use Poedit 3.4 to edit PO files. PO files contain the translations of themes and plugins. Poedit reads the source text from PHP files, displays the translations in a list, and writes the translations back to MO files that WordPress reads. The program also supports XLIFF, the exchange format for translation programs. Poedit is developed by Václav Slavík and falls under the MIT license — you may freely use and distribute it, including in commercial projects, as long as you retain the original attribution.

Visual development with Pinegrow

Pinegrow 6.5 is a visual editor for HTML, CSS, SASS, and frameworks such as Bootstrap 5 and Tailwind CSS. You drag elements onto the canvas, edit properties in the side panel, and work directly with standard web files. You export the result as a theme for WordPress. Pinegrow does not write its own file format — you work with the same files you later put on the server.

Markdown publishing with ThiefMD

For authors who write in Markdown, ThiefMD 0.3 is an option. The tool organizes long texts such as books and scripts and exports to ePub, PDF, HTML, and Office documents. ThiefMD publishes directly to WordPress via the REST API. You do not need to open the WordPress editor — you write locally and publish with a single command.

Licenses and legal aspects

WordPress falls under the GNU General Public License (GPL) version 2 or newer. This license gives everyone the right to use, modify, and distribute the source code. The condition is that modified versions are also released under the same GPL license. This also applies to themes and plugins that you develop and distribute yourself — they must be GPL-compatible. That does not mean you have to give your work away for free, but the code must remain available to others under the GPL.

These license terms also determine how you use tools such as Poedit, Pinegrow, and ThiefMD. Poedit is MIT-licensed and free to use. Pinegrow is commercial software with a paid license. ThiefMD falls under the GPL license. Always check the license terms of the tools you include in your workflow — a wrong assumption about licenses can lead to legal problems.

Security recommendations for production

A WordPress site in production requires more than just a scan. Change the database prefix from `wp_` to something random:

wp config set table_prefix 'x9k2m_'

Remove the admin user and create a new user with a unique name:

wp user create redactie redactie@jouwdomein.nl --role=administrator --user_pass=sterkWachtwoord
wp user delete 1 --reassign=2

Limit the number of login attempts:

wp plugin install limit-login-attempts-reloaded --activate

This plugin blocks IP addresses after a configurable number of failed logins. Combine this with a firewall at the server level for a layered defense.

The question is not whether your WordPress site will be attacked, but when — and whether you have the tools installed to detect the attack before it is too late.