WP-CLI commands

Everything an administrator needs on a server without a browser: the IP lists, a lookup, the status for monitoring, the support bundle and the 2FA administration come with the free plugin. The Pro add-on adds account blocking and the hardening mode. List commands accept --format=<table|json|csv|yaml>.

IP lists and lookup

wp reportedip whitelist add <ip> [--reason=<text>] [--expires=<datetime>]
wp reportedip whitelist remove <ip>
wp reportedip whitelist list [--format=<format>]
wp reportedip block <ip> [--reason=<text>] [--hours=<n>]
wp reportedip unblock <ip> [--reset-attempts]
wp reportedip blocked list [--format=<format>]
wp reportedip attempts reset <ip> [--type=<type>]
wp reportedip lookup <ip> [--format=<format>]

• <ip> takes a single IPv4 or IPv6 address or a CIDR range everywhere.
• Whitelisting lifts an active block and wins over every layer, the pre-WordPress guard included.
• To release a locked-out visitor use unblock with --reset-attempts; without it a threshold that is still exceeded blocks the address again on the next request.
• --expires is the site's local time; every other time is UTC.
• block warns when report-only mode is on, because the block would not be enforced.
• lookup asks the community and spends one check of your daily quota.

# Release a locked-out customer and clear the counters
wp reportedip unblock 203.0.113.9 --reset-attempts

# Whitelist a rotating IPv6 prefix instead of one address
wp reportedip whitelist add 2001:db8::/56 --reason="customer office"

# Block a range for a week, then list all blocks as JSON
wp reportedip block 203.0.113.0/24 --reason="scanner" --hours=168
wp reportedip blocked list --format=json

Status and support

wp reportedip status [--format=<format>]
wp reportedip support-bundle [--days=<1-30>] [--events=<n>] [--full-ips] [--output=<file>]

status reports the mode, the plan and, in the field issues, the open readiness issues as key (severity), which makes it a monitoring probe. support-bundle writes the same JSON file as System Status: 7 days and 300 events by default, addresses cut to their network unless --full-ips is given.

Two-factor administration

wp reportedip 2fa status [<user_id>]
wp reportedip 2fa enable <user_id> --method=<totp|email|webauthn> [--secret=<base32>] [--force]
wp reportedip 2fa disable <user_id> [--method=<method>]
wp reportedip 2fa reset <user_id>
wp reportedip 2fa enforce --role=<role> [--remove]
wp reportedip 2fa audit [<user_id>] [--since=<date>]
wp reportedip 2fa cleanup

enable without --secret creates a TOTP secret and prints it with the otpauth:// address for the app. It refuses webauthn for a user without a registered key unless --force is given, because that would lock the user out. An additional method keeps the user's default method. With the Pro add-on sms is accepted as a method as well. reset removes every method of a user, the last resort when recovery codes are lost.

Accounts

wp reportedip user unblock <user>
wp reportedip user list [--format=<format>]
wp reportedip user block <user> [--message=<text>] [--note=<text>]

<user> is an ID, a login or an e-mail address. unblock and list are part of the free plugin, so a block can always be found and lifted. block comes with the Pro add-on on the Business plan. Sessions themselves are handled by core: wp user session list and wp user session destroy.

Hardening mode

wp reportedip hardening status
wp reportedip hardening activate [--minutes=<5-360>]
wp reportedip hardening deactivate

Part of the Pro add-on from the Professional plan. activate starts the mode by hand, for the configured duration or the given minutes.

Last updated: 16. October 2026 · Maintained by the ReportedIP team