Skip to main content

Network User and Plugin Management

Overview

Network-level user and extension management is where multisite governance happens. WP-CLI gives you precise control over super admins, network-activated plugins, and network-enabled themes.

Understanding Network Governance​

In multisite, changes at network scope affect many sites at once. Core governance tasks include:

  • Access control with wp super-admin
  • Standardized functionality via network plugin activation
  • Theme policy control with network enable/disable
  • Audits and rollback workflows for safe platform operations

Managing Super Admins​

List Super Admin Accounts​

wp super-admin list

Use this for regular privilege audits.

Add a Super Admin​

wp super-admin add alice

Use case: Onboarding platform engineers who need full network control.

Remove a Super Admin​

wp super-admin remove alice

Use case: Offboarding or reducing high-privilege exposure.

Network Plugin Management​

Activate Plugin Across Entire Network​

wp plugin activate wordfence --network

Deactivate Network Plugin​

wp plugin deactivate wordfence --network

Inspect Network-Active Plugins​

wp plugin list --status=active-network --fields=name,status,version,update

This helps validate enforcement of required security/performance plugins.

Roll Out Plugin Updates with Safety Check​

# Preview first
wp plugin update --all --dry-run

# Apply updates
wp plugin update --all

Network Theme Management​

Enable Theme for Network Use​

wp theme enable astra --network

This makes a theme available to subsites (it does not force activation on each site).

Disable Theme Network-Wide​

wp theme disable twentytwentyone --network

Use this to retire unapproved or vulnerable themes.

Audit Enabled Themes​

wp theme list --status=enabled --fields=name,status,version,update

Cross-Site Operational Patterns​

Check Plugin Status on Every Site​

for url in $(wp site list --field=url); do
  echo "--- $url ---"
  wp plugin list --url="$url" --fields=name,status,update
done

Activate Plugin on Selected Sites Only​

for url in store.example.com blog.example.com support.example.com; do
  wp plugin activate woocommerce --url="$url"
done

Use this when a plugin should not be network-activated globally.

Real-World Scenarios​

Scenario 1: Security Baseline Rollout​

wp plugin install wordfence --activate-network
wp plugin install two-factor --activate-network
wp plugin list --status=active-network --fields=name,version

Scenario 2: Privileged Access Audit​

wp super-admin list > super-admins-$(date +%Y%m%d).txt

Pair this with ticket-based approval workflows.

Scenario 3: Theme Policy Enforcement​

# Enable approved themes
wp theme enable astra blocksy --network

# Disable deprecated themes
wp theme disable twentynineteen twentytwenty --network

Scenario 4: Emergency Plugin Rollback​

# Network-wide plugin issue detected
wp plugin deactivate problematic-plugin --network

# Optional downgrade and re-enable
wp plugin install problematic-plugin --version=1.2.3 --force
wp plugin activate problematic-plugin --network

Best Practices​

1. Apply Least Privilege for Super Admins​

Keep the super-admin list short and reviewed regularly.

2. Use Network Activation Only for True Global Requirements​

Prefer per-site activation when functionality is not universal.

3. Test Plugin/Theme Changes in Staging First​

Network-wide changes can impact every subsite simultaneously.

4. Keep a Rollback Command Ready​

wp plugin deactivate <plugin> --network

5. Automate Audit Snapshots​

wp super-admin list --format=csv > audits/super-admins.csv
wp plugin list --status=active-network --format=csv > audits/network-plugins.csv
wp theme list --status=enabled --format=csv > audits/network-themes.csv

Troubleshooting​

wp super-admin Command Fails​

# Ensure multisite context
wp eval 'echo is_multisite() ? "true" : "false";'

wp super-admin is available only on multisite installs.

Plugin Activates but Feature Missing on Some Sites​

Check plugin compatibility with multisite and per-site settings pages.

wp plugin status <plugin>

Theme Not Visible to Site Admins​

# Confirm theme is network-enabled
wp theme list --status=enabled

If it is enabled but still missing, verify site-specific restrictions and capability policies.

Quick Reference​

Essential Commands​

# Super admin management
wp super-admin list
wp super-admin add <user>
wp super-admin remove <user>

# Network plugin management
wp plugin activate <plugin> --network
wp plugin deactivate <plugin> --network
wp plugin list --status=active-network

# Network theme management
wp theme enable <theme> --network
wp theme disable <theme> --network
wp theme list --status=enabled

Comparison: Network vs Per-Site Control​

ScopeCommand PatternBest Use Case
Network-Wide--networkSecurity baseline, required platform plugins
Per-Site--url=SITETenant-specific features and exceptions
Super Admin Rolewp super-admin ...Platform governance and emergency control
Theme Enablementwp theme enable ... --networkApproved design system across subsites
Key Takeaway

Use network scope for policy-level controls, and per-site scope for tenant-specific flexibility.

Next Steps​