Every clockwork:* command, alphabetical, with a one-line summary and an example invocation. Commands provided by modules (modules/*/src/Commands, modules/*/src/Console and modules/*/src/Console/Commands) are registered automatically when their respective module is enabled. Most are also wired into the scheduler — see Scheduled jobs for cadence.
[!NOTE] Environment & PATH: On Linux,
phpandcomposerare installed in standard system paths (/usr/bin/php), so commands can be executed directly. On macOS using Laravel Herd, remember to export Herd’s binary directory (export PATH="$HOME/Library/Application Support/Herd/bin:$PATH").
Inventory + bootstrap
| Command | Purpose | Example |
|---|---|---|
clockwork:add-user |
Add or restore a user on the auth allowlist with optional display name, local password, and `–role=admin | operator` (default admin). Idempotent. |
clockwork:set-password |
Set or reset an operator’s local password via masked CLI prompt or option. | php artisan clockwork:set-password alice@example.com |
clockwork:sync-allowed-bots |
Pull arcjet/well-known-bots → allowed_bots. |
php artisan clockwork:sync-allowed-bots |
clockwork:digitalocean-test |
Verify the DO token + list droplets. | php artisan clockwork:digitalocean-test |
clockwork:hetzner-test |
Verify the Hetzner Cloud token + list servers in the project. | php artisan clockwork:hetzner-test |
clockwork:spinupwp-test |
Verify the SpinupWP token + list servers/sites. Supports clockwork:test-spinupwp alias. |
php artisan clockwork:spinupwp-test |
clockwork:pressable-test |
Verify the Pressable OAuth2 credentials + list sites. Supports clockwork:test-pressable alias. |
php artisan clockwork:pressable-test |
clockwork:wpengine-test |
Verify the WP Engine API credentials + list installs. Supports clockwork:test-wpengine alias. |
php artisan clockwork:wpengine-test |
clockwork:kinsta-test |
Verify the Kinsta API key + test authentication. Supports clockwork:test-kinsta alias. |
php artisan clockwork:kinsta-test |
clockwork:cloudways-test |
Verify the Cloudways API credentials + list servers and apps. Supports clockwork:test-cloudways alias. |
php artisan clockwork:cloudways-test |
clockwork:test-gridpane |
Verify the GridPane API key + list servers and sites. | php artisan clockwork:test-gridpane |
clockwork:test-turnkeywp |
Verify the TurnkeyWP API token and list the servers and sites it can see. Read-only. | php artisan clockwork:test-turnkeywp |
clockwork:turnkeywp-authorize-ssh |
Add Clockwork Control’s SSH public key to the turnkey user on TurnkeyWP servers through the TurnkeyWP API. Accepts --server=, --public-key-file=, --force. |
php artisan clockwork:turnkeywp-authorize-ssh |
clockwork:do-spaces-test |
Verify the DO Spaces HMAC creds. | php artisan clockwork:do-spaces-test |
clockwork:bill-com-test |
Verify Bill.com auth + count customers. | php artisan clockwork:bill-com-test |
clockwork:mattermost-test |
Post a test message to the configured channel. | php artisan clockwork:mattermost-test |
clockwork:azure-test |
Verify Azure creds by listing VMs + public IPs in the subscription. | php artisan clockwork:azure-test |
clockwork:import-spinupwp |
Idempotent server + site import + cert refresh. Skips domains / SpinupWP site ids listed in site_ingest_exclusions (skipped_excluded). Accepts --dry-run to simulate without writing to database. |
php artisan clockwork:import-spinupwp --dry-run |
clockwork:import-pressable |
Idempotent Pressable site import (no Server rows — Pressable has no server concept). Skips domains still actively hosted on SpinupWP if the same domain appears in both platforms, and skips site_ingest_exclusions matches. Accepts --dry-run. Not scheduled — run manually. |
php artisan clockwork:import-pressable --dry-run |
clockwork:import-gridpane |
Idempotent GridPane server + site import, linking WordPress sites to their parent servers. Accepts --dry-run to simulate without writing to database. |
php artisan clockwork:import-gridpane --dry-run |
clockwork:import-turnkeywp |
Idempotent TurnkeyWP server + site import. Never takes over a site another host still tracks. Accepts --dry-run, --include-staging, and --adopt=<domain> (move a SpinupWP-tracked site now). |
php artisan clockwork:import-turnkeywp --dry-run |
clockwork:reconcile-provider |
Match provider_id-less servers against DO/Hetzner/Azure/Vultr/Linode inventory and fill provider + size columns. Idempotent. |
php artisan clockwork:reconcile-provider |
clockwork:find-orphan-sites |
Detect sites whose SpinupWP linkage was lost. | php artisan clockwork:find-orphan-sites |
clockwork:installer:reopen |
Disaster recovery: remove the storage/installed sentinel so /install becomes reachable again on a live instance. |
php artisan clockwork:installer:reopen --force |
Health + metrics
| Command | Purpose | Example |
|---|---|---|
clockwork:poll-servers |
Pull cloud-provider metrics (DO, Hetzner, Azure, Vultr, Linode) → server_metrics. Branches per row on servers.provider. Transitions into RED status or high CPU trigger AiRemedy spike triage. |
php artisan clockwork:poll-servers |
clockwork:watch-server-spikes |
Automated watchdog inspecting CPU spikes, load average, and RAM pressure across all servers (including custom VPS via SSH probe); dispatches AiRemedy in Shadow Mode or Auto-Heal. Supports --force to bypass cooldown. |
php artisan clockwork:watch-server-spikes |
clockwork:prune-server-metrics |
Drop rows older than 90 days. | php artisan clockwork:prune-server-metrics |
clockwork:prune-threat-logs |
Chunked delete of threat_logs older than the saved retention window (default 30 days), or DROP PARTITION when the MySQL table is monthly-partitioned. --days= overrides. --dry-run counts only. |
php artisan clockwork:prune-threat-logs --dry-run |
clockwork:rebuild-threat-logs-partitions |
MySQL only. Copy the retention window into a new monthly-partitioned table, swap, drop the old .ibd so disk shrinks. |
php artisan clockwork:rebuild-threat-logs-partitions |
clockwork:check-ssl-certs |
Per-site SSL state + Mattermost transitions. | php artisan clockwork:check-ssl-certs |
clockwork:check-cloudflare |
Per-site CF detection. | php artisan clockwork:check-cloudflare |
clockwork:check-site-uptime |
HTTP probe each monitored site. Respects per-site toggle, mute-alerts mode, and fleet-wide wildcard ignore patterns configured on /monitoring/settings. |
php artisan clockwork:check-site-uptime |
clockwork:scheduler-heartbeat |
Cheap Settings write that proves crontab spawned schedule:run. First among every-minute jobs. Detection of a missing tick happens on page load (a scheduled command cannot watch itself): 5+ minutes stale → layout banner + Issues + scheduler_stale chat once; the next tick fires scheduler_recovered. Never-ticked is a yellow UI warning only. See Runbooks → Scheduler stuck. |
php artisan clockwork:scheduler-heartbeat |
clockwork:backfill-uptime-seed |
One-off: seed initial uptime state on first run. | php artisan clockwork:backfill-uptime-seed |
clockwork:pull-site-metrics |
Pull per-site CPU/memory hourly rollups from Companion (resource-sampler cap) into site_metrics. |
php artisan clockwork:pull-site-metrics |
clockwork:push-site-metrics-state |
Push the current monitoring.site_metrics_enabled flag to Companion sites advertising resource-sampler-toggle. On-demand only — the Capacity toggle launches it in the background. |
php artisan clockwork:push-site-metrics-state |
clockwork:check-domain-expirations |
Check domain registration expiration dates via ICANN RDAP and alert on impending expiration. | php artisan clockwork:check-domain-expirations |
clockwork:check-robots-txt |
Check /robots.txt directives across monitored sites for search-engine disallow rules. |
php artisan clockwork:check-robots-txt |
clockwork:capture-site-screenshots |
Capture/refresh each site’s homepage screenshot via Automattic’s mShots service, feeding the visual fleet grid view. --site= targets one site (domain or ID), --force re-captures even if recent, --limit= caps the batch (default 50), --sync runs synchronously instead of queueing. |
php artisan clockwork:capture-site-screenshots --site=example.com --force |
clockwork:collect-field-metrics |
Query Google Chrome UX Report (CrUX) API for 28-day rolling real-user Core Web Vitals (LCP, INP, CLS, FCP, TTFB) across care-plan sites. --site= targets one site, --force overrides the weekly interval. |
php artisan clockwork:collect-field-metrics --site=example.com |
clockwork:refresh-runtime-eol |
Pull PHP and WordPress release lifecycle data from endoflife.date into app_settings for the Capacity dashboard and site widgets. |
php artisan clockwork:refresh-runtime-eol |
Logs + ingest
| Command | Purpose | Example |
|---|---|---|
clockwork:tail-nginx-logs |
Inode-tracked tail of every site’s nginx access log. | php artisan clockwork:tail-nginx-logs |
clockwork:rollup-traffic |
threat_logs → site_traffic_daily. |
php artisan clockwork:rollup-traffic --backfill=2 |
clockwork:pull-lockouts(alias: clockwork:pull-llar-lockouts) |
Ingest active lockouts from Gatekeeper (Companion HMAC REST) with a direct-DB fallback to the native clockwork_lockouts table on sites with MySQL creds. |
php artisan clockwork:pull-lockouts |
clockwork:pull-wordfence-blocks |
Direct-DB pull of Wordfence blocks. | php artisan clockwork:pull-wordfence-blocks |
clockwork:warm-weird-stats |
Pre-warm the /settings/weird-stats cache. |
php artisan clockwork:warm-weird-stats |
clockwork:ingest-rotated-logs |
One-time recovery: ingest date-stamped rotated nginx logs (access.log-YYYYMMDD.gz) to fill gaps in threat_logs left by a stalled cursor. Only inserts rows not already present for the requested window. |
php artisan clockwork:ingest-rotated-logs --dates=YYYY-MM-DD,YYYY-MM-DD |
WordPress probing + plugins
| Command | Purpose | Example |
|---|---|---|
clockwork:push-gatekeeper-settings |
Push Gatekeeper lockout policy defaults and site overrides to WordPress via Companion or Renegade. | php artisan clockwork:push-gatekeeper-settings [--site=42] |
clockwork:push-update-exceptions |
Push active update exceptions (paused auto-updates) to wp-admin via Companion or Renegade. --site= limits to one site. |
php artisan clockwork:push-update-exceptions --site=42 |
clockwork:gatekeeper-rollout |
Migrate sites off LLAR: install/upgrade Companion where needed, persist + push a per-site enabled=true override, deactivate and delete LLAR over Companion REST, flip llar_enabled. Never removes LLAR unless Gatekeeper is confirmed enforcing. --site=domain, --scope=all|no-companion|llar, --limit, --dry-run, --force, --skip=a,b. |
php artisan clockwork:gatekeeper-rollout --scope=llar --limit=20 --dry-run |
clockwork:detect-wp-plugins |
SSH wp plugin list per WP site, refresh the llar_enabled/wordfence_enabled detected-state flags. |
php artisan clockwork:detect-wp-plugins |
clockwork:migrate-wfls-2fa |
Migrate admin/editor 2FA from Wordfence Login Security to Companion 2FA through the Companion REST API. Pass a site id/domain, or --all for every Companion site with WFLS-only users. --dry-run lists them without migrating. |
php artisan clockwork:migrate-wfls-2fa --all --dry-run |
clockwork:remove-wfls-plugin |
Deactivate and delete Wordfence Login Security on sites where every user has moved to Companion 2FA. Pass a site id/domain, or --all for every site Companion reports as ready. --dry-run previews. |
php artisan clockwork:remove-wfls-plugin --all --dry-run |
clockwork:extract-wp-configs |
One-off: parse wp-config.php → DB creds for sites missing them. | php artisan clockwork:extract-wp-configs |
Companion mu-plugin
| Command | Purpose | Example |
|---|---|---|
clockwork:install-companion |
Push the mu-plugin via SSH + register secret. Honors the policy denylist (companion.excluded_domain_suffixes, e.g. stateschools.example) on every path including single --site; --force overrides deliberately. |
php artisan clockwork:install-companion --site=42 |
clockwork:install-companion-pressable |
Same end state, Pressable transport (chunked upload over the async command API instead of SSH). Same policy denylist + --force. Repeatable --site= (id or domain), no fleet-wide flag yet. |
php artisan clockwork:install-companion-pressable --site=a.com --site=b.com |
clockwork:companion-canary-set |
Set / list / clear the canary site set used by the two deploy commands. | php artisan clockwork:companion-canary-set example.com --list |
clockwork:companion-canary-deploy |
Install the current plugin to canary sites (provider-aware: SSH installer or PressableCompanionInstaller, purging Pressable’s edge cache before verification) and verify the expected capability appears in /detect. Stamps companion.canary_verified_at. |
php artisan clockwork:companion-canary-deploy --expect-capability=malware-scan |
clockwork:companion-fleet-deploy |
Roll the current plugin to every installed site after canary verification. Gated by companion.canary_verified_at; policy-excluded domains are always skipped (no --force here — use install-companion --site=X --force for a one-off). |
php artisan clockwork:companion-fleet-deploy |
clockwork:verify-canary-health |
After a deploy, check that the homepage and wp-login.php respond on every canary site. --all-installed checks every Companion site instead. --timeout= sets the request timeout (default 10s) and --skip=a,b skips domains. |
php artisan clockwork:verify-canary-health --all-installed |
clockwork:diagnose-companion-install |
Read-only triage for Companion install/health failures on one site. | php artisan clockwork:diagnose-companion-install --site=42 |
clockwork:backfill-companion-action-log |
Re-push action_log rows missing from a site’s Companion mirror (post-reinstall recovery). |
php artisan clockwork:backfill-companion-action-log |
clockwork:ensure-companion-trust-proxy |
Idempotently define CLOCKWORK_COMPANION_TRUST_PROXY in wp-config.php on care-plan auto-update sites. |
php artisan clockwork:ensure-companion-trust-proxy |
clockwork:sync-companion-form-subscriptions |
Reconcile client-chosen form-test subscriptions from Companion into contact_form_tests (created_by=client). |
php artisan clockwork:sync-companion-form-subscriptions |
clockwork:cleanup-spam-comments |
Bulk-purge spam and trash comments older than N days (default 30) from every Companion-equipped site advertising the comments-moderation capability. Runs weekly. |
php artisan clockwork:cleanup-spam-comments --days=30 |
clockwork:send-client-reports |
Generate and email scheduled white-labeled client reports for care-plan sites. --site= limits to one; --force bypasses the due-date check. Runs daily at 06:00 UTC; each report covers the previous calendar month. Care-plan sites only: a due schedule on a site without one is skipped and moved to its next run. An auto schedule’s report is held as a draft instead of emailed when something needs a look first. That means a malware, core-file or blocklist scan flagged something, a vulnerable plugin has an update waiting, backups are missing, stale or unchecked, or an outage was still ongoing at month end. A re-run for the same period reuses the unsent report and emails only recipients not yet in sent_to. Compiling a fresh report marks any unsent earlier copy superseded. The email contains the entire report inline (no “view online” link — Control isn’t publicly reachable): brand-colour header with the logo embedded as an inline image, at-a-glance tiles, updates, uptime, security, performance, traffic, forms (only when tests ran), backups and work log. Header colour = White Labeling → Client Reports → Primary Brand Color (default #2D2062). After a send, a monthly schedule’s next_run_at snaps to 00:00 on the 1st of next month (weekly: midnight seven days out) so a long batch never pushes the next run past the following 06:00 tick. |
php artisan clockwork:send-client-reports --site=example.com |
clockwork:import-report-recipients |
Load client report recipients from a CSV (e.g. the ManageWP export). Needs a site column (domain, website, site, site url, url or managewp) and at least one column with “email” or “recipient” in its name. Sites are matched by domain (scheme, www. and path are ignored). A matched site with no schedule gets a monthly auto schedule; one that already has a schedule gets the emails added to its recipients (--replace replaces them instead). Unmatched sites and rows without a valid email are listed, not imported. Dry run unless --apply; with --apply each changed schedule is pushed to the site’s Companion/Renegade plugin unless --no-push. The CSV holds client emails, so it stays on the server and is never committed. |
php artisan clockwork:import-report-recipients ~/report-recipients.csv --apply |
clockwork:build-companion-tarball |
Produce signed .tgz + .sha256 for dist_url mode. |
php artisan clockwork:build-companion-tarball --out=~/Downloads |
clockwork:refresh-companion-snapshot |
Pull /snapshot per site → companion_snapshot JSON column. Purges Pressable’s edge cache first (best-effort) — otherwise a stale cached response can mask a real update. |
php artisan clockwork:refresh-companion-snapshot |
clockwork:refresh-companion-capabilities |
Refresh companion_capabilities per site. Same Pressable edge-cache purge as the snapshot refresh above. |
php artisan clockwork:refresh-companion-capabilities |
clockwork:push-companion-branding |
Push white-label branding (logo, company name, colours, support email) to Companion/Renegade sites. --site= limits to one; --verify reads live branding first and re-pushes only drifted sites (scheduled weekly, Mon 06:50). |
php artisan clockwork:push-companion-branding --verify |
clockwork:push-companion-backups |
Push SpinupWP config + DO Spaces history per site. | php artisan clockwork:push-companion-backups |
clockwork:pressable-backups-report |
Pressable counterpart — pushes real backup run history from Pressable’s own /backups endpoint. No 30/90-day retention filter applied (Pressable’s API has no pagination to request more than it hands back). |
php artisan clockwork:pressable-backups-report |
clockwork:pressable-traffic-report |
Pushes Pressable’s period-total traffic stats (today/yesterday/current+last month/last 12 months) to Companion’s Traffic page. No daily breakdown — structurally different from the nginx-log rollup the SpinupWP command sources from. | php artisan clockwork:pressable-traffic-report |
clockwork:pressable-security-summary-report |
Pushes Pressable’s own plugin/theme CVE feed + Defensive Mode status to Companion’s Security page. Pressable-only capability, no SpinupWP equivalent. | php artisan clockwork:pressable-security-summary-report |
clockwork:record-site-backups |
Record each active site’s backups from its real source into site_backups: Pressable’s backup API, SpinupWP’s DigitalOcean Spaces bucket, or our S3 archives for unhosted relay sites. Also writes a site_backup_checks row for each site that has a backup source, saying whether the read worked. Sites with no source are skipped. Rows are kept after the source prunes them. Exits as failed if any site couldn’t be read. --site= limits to one site (id or domain). Runs daily at 05:30. |
php artisan clockwork:record-site-backups --site=42 |
clockwork:push-backup-relay-targets |
Writes the backup-relay-enabled site list to S3. Direct-to-S3 (Companion) sites are left out because the droplet can’t reach them; Control backs those up with clockwork:backup-relay-run --direct-only. The file goes to ({S3_BUCKET}/{prefix}/targets.json) for the standalone backup-relay droplet to read — no direct connection to that droplet. See Features → Backup relay. |
php artisan clockwork:push-backup-relay-targets |
clockwork:pull-backup-relay-report |
Reads the backup-relay droplet’s last run summary back from S3 and records it to backup_relay_runs + Settings, deduped by finished_at. Also checks staleness every run (6+ days since the last recorded run → backup_relay_stale alert once; a fresh run after → backup_relay_recovered once). |
php artisan clockwork:pull-backup-relay-report |
clockwork:backup-relay-run |
In-repo backup relay mode’s own runner — archives enabled sites’ backups to S3 Glacier natively via ArchiveSiteBackupJob, no external droplet involved. --site= limits to one site; --force ignores cadence (Backup Now); --queue dispatches the jobs instead of running them inline. --direct-only limits the run to direct-to-S3 (Companion) sites. It’s scheduled at 04:30 in external-agent mode, since the external agent can’t back those sites up, and writes no backup_relay_runs row. An inline sweep (no --site) skips a site that’s mid-restore or already running Backup Now. See Features → Backup relay. |
php artisan clockwork:backup-relay-run --site=42 --force |
clockwork:backup-restore |
Orchestrate staging or applying an off-site backup restore via Companion. Polling lifecycle verifies download, extraction, DB import, and file swap. | php artisan clockwork:backup-restore --site=42 --key="backups/site.tar.gz" --phase=stage |
clockwork:rotate-companion-secret |
Rotate per-site HMAC secret. | php artisan clockwork:rotate-companion-secret --all |
clockwork:detect-contact-forms |
Companion-aware contact-form detection. | php artisan clockwork:detect-contact-forms |
clockwork:test-contact-forms |
Run the due contact-form tests across the fleet (care-plan only). --site=X bypasses the care-plan filter; --form=ID targets a single contact_form_tests row; --force bypasses the frequency-due check. |
php artisan clockwork:test-contact-forms --force --site=example.com |
clockwork:run-nightly-plugin-updates |
Nightly care-plan auto-update path — runs wp plugin update per opted-in site. Has no fixed time: it’s chained via ->then() and starts as soon as the 01:30 ET clockwork:refresh-companion-snapshot run exits. Per-site opt-out toggle on the site Updates tab. |
php artisan clockwork:run-nightly-plugin-updates |
clockwork:nightly-update-summary |
Email summary of the previous night’s auto-update run. Runs 06:15 ET. | php artisan clockwork:nightly-update-summary |
clockwork:push-companion-traffic |
Push the previous day’s traffic rollup to each Companion-equipped site for display in the WP admin. | php artisan clockwork:push-companion-traffic |
clockwork:ensure-queue-worker |
Watchdog for the com.clockwork.queue launchd service — checks launchctl list for a live PID and kickstarts the worker if it has crashed or been throttled into a backoff loop. Scheduled every 5 min so recovery gap ≤ 5 min. A successful revival is log-only; if the kickstart itself fails, fires a queue_worker_restart_failed Mattermost/Slack alert (every queued job in the app is stuck at that point). Crontab itself is watched by clockwork:scheduler-heartbeat (Health + metrics). |
php artisan clockwork:ensure-queue-worker |
Security + bans
| Command | Purpose | Example |
|---|---|---|
clockwork:check-blacklists |
URLhaus + Spamhaus DBL + optional Google Web Risk (legacy Safe Browsing v4 fallback). Every host-monitored site, serverless hosts (Pressable, custom, …) included. | php artisan clockwork:check-blacklists |
clockwork:scan-sitecheck |
Sucuri SiteCheck remote scan per site. | php artisan clockwork:scan-sitecheck |
clockwork:verify-wp-core-checksums |
wp core verify-checksums per site — SSH for SpinupWP, Pressable’s async command API for Pressable. |
php artisan clockwork:verify-wp-core-checksums |
clockwork:run-companion-malware-scans |
In-WP malware probe — Companion plugin endpoint preferred, SSH wp-cli fallback. Bypasses Cloudflare so CF-fronted sites get real signal instead of the 403 wall Sucuri’s external scanner hits. | php artisan clockwork:run-companion-malware-scans |
clockwork:suppress-malware-path |
Add or remove a path from the per-site malware scan suppression list (php_in_uploads findings). Requires --site= and --path=; --unsuppress removes instead of adds. Use for known-safe upload-resident PHP files (e.g. MC4WP debug logs that start with <?php exit;). |
php artisan clockwork:suppress-malware-path --site=example.com --path=wp-content/uploads/mailchimp-for-wp/debug-log.php |
clockwork:cf-rules |
Dump CF redirect/transform/WAF rules for a zone. | php artisan clockwork:cf-rules example.com |
clockwork:block-ua |
Push nginx User-Agent blocking rules to a server. Writes a map directive + per-site if-return-403 snippets. Safe: nginx -t runs before any reload. --remove cleans up. |
php artisan clockwork:block-ua --server=web29 --ua="Chrome/126.0.0.0" |
clockwork:sweep-cf-bans |
One-shot: unban any CF-edge IPs misattributed in the past. | php artisan clockwork:sweep-cf-bans |
clockwork:refresh-fail2ban-ignoreip |
Refresh CF + fleet IPs in every server’s jail. | php artisan clockwork:refresh-fail2ban-ignoreip |
clockwork:refresh-cloudflare-real-ip |
Push the nginx CF-Connecting-IP snippet to every server and bridge it into sites-enabled/ (conf.d alone is inert on SpinupWP boxes). Skips the bridge when nginx -T shows real-IP already active another way. |
php artisan clockwork:refresh-cloudflare-real-ip |
clockwork:cf-rate-limit |
Add / list / remove a Cloudflare rate-limiting rule for a zone. | php artisan clockwork:cf-rate-limit example.com --list |
clockwork:refresh-plugin-vulnerabilities |
Refresh the wpvulnerability.net CVE mirror for every installed plugin slug. | php artisan clockwork:refresh-plugin-vulnerabilities |
clockwork:refresh-cisa-kev |
Sync the CISA Known Exploited Vulnerabilities catalog into cisa_kev_entries for the “Actively exploited” badge. |
php artisan clockwork:refresh-cisa-kev |
clockwork:refresh-closed-plugins |
Check WordPress.org directory status for closed plugins across the fleet’s unique slugs (surfaced on /issues). --slug= checks one. |
php artisan clockwork:refresh-closed-plugins --slug=example-plugin |
clockwork:auto-approve-repeats |
Promote 2+-occurrence IPs to the ban queue. | php artisan clockwork:auto-approve-repeats |
clockwork:process-pending-bans |
Drain queued_for_ban → fail2ban over SSH. |
php artisan clockwork:process-pending-bans |
clockwork:prune-expired-bans |
Mark active bans older than the ban retention window as unbanned. Default 12 months; 0 = keep indefinitely. --months= overrides the window, and --months=0 prunes all active bans. --dry-run counts only. Runs daily at 04:33. |
php artisan clockwork:prune-expired-bans --dry-run |
clockwork:composer-audit |
Composer dependency CVE scan. | php artisan clockwork:composer-audit |
clockwork:security-check |
System-wide audit (--ssh runs SSH-side checks). |
php artisan clockwork:security-check --ssh --quiet-ok |
clockwork:run-performance-scans |
Lighthouse run per care-plan site — GTmetrix primary, PSI fallback. --engine= forces one engine; --weekly-rotation (what the scheduler passes) scans only tonight’s 1/7th fleet slice to fit the GTmetrix credit budget, leaving out Pressable sites; --host-reports reads Pressable’s own report for every Pressable care-plan site (scheduled nightly, mobile and desktop). |
php artisan clockwork:run-performance-scans --site=42 --engine=gtmetrix |
clockwork:check-email-auth |
Inspect SPF (10-lookup limits, loop detection, void lookups), DMARC policies, and DKIM selector probing via DNS-over-HTTPS across unique client apex domains. --domain= checks a single domain. |
php artisan clockwork:check-email-auth --domain=example.com |
AiRemedy operations
| Command | Purpose | Example |
|---|---|---|
clockwork:ai-remedy-evaluate-outcomes |
Classify 60-minute resolution outcomes (self_resolved, human_resolved, persisted, escalated, unknown) for past AiRemedy diagnoses by analyzing server_metrics, site_uptime_events, and human action_logs. |
php artisan clockwork:ai-remedy-evaluate-outcomes |
clockwork:ai-remedy-expire-unreviewed |
Mark unreviewed Interactive Copilot incident runs older than 24 hours as expired to keep pending review queues fresh. |
php artisan clockwork:ai-remedy-expire-unreviewed |
Server ops
| Command | Purpose | Example |
|---|---|---|
clockwork:process-server-updates |
Drain queued apt-update jobs. A failed run logs server_update_failed (action_logs) and fires the matching Mattermost/Slack alert; success is not logged. |
php artisan clockwork:process-server-updates |
clockwork:reap-stale-update-jobs |
Flip plugin_update_jobs orphaned in running (>10 min) or pending (>60 min) to failed. Also pings Mattermost/Slack (plugin_update_failed, same nightly-batch-only gate as a live failure) for any reaped row — reaped jobs never go through the normal failure path, so they used to reap silently. |
php artisan clockwork:reap-stale-update-jobs |
clockwork:detect-stuck-companion-state |
Daily sweep for two states nothing else catches: an install that failed >24h ago with no successful retry, or a companion_installed=true site that’s gone silent (no snapshot/health touch) for 3+ days. Fires companion_unreachable once on newly-stuck, companion_reachable once on recovery; state tracked on sites.companion_stuck_since/companion_stuck_reason. --dry-run reports without writing or alerting. |
php artisan clockwork:detect-stuck-companion-state --dry-run |
clockwork:reap-stale-server-updates |
Flip servers stuck in update_status=running >2h back to failed for re-queueing. Fires a server_update_failed Mattermost/Slack alert for every reaped row. |
php artisan clockwork:reap-stale-server-updates |
clockwork:clear-site-update-lock |
Force-release the site_update:{id} cache lock for one site. |
php artisan clockwork:clear-site-update-lock 42 |
clockwork:scan-wp7-truncation |
Detect (and --repair) sites with truncated WP 7.0 php-ai-client core files. |
php artisan clockwork:scan-wp7-truncation --repair |
clockwork:drop-orphan-prefix-tables |
Drop MySQL tables matching an orphan prefix on a site (refuses the live prefix). | php artisan clockwork:drop-orphan-prefix-tables |
clockwork:provision-droplet-agent |
Install/start DO droplet-agent so the DO Web Console works. --restart clears “Registering SSH Keys” hangs. |
php artisan clockwork:provision-droplet-agent --server=web35 |
clockwork:poll-system-updates |
SSH apt-check + reboot-required.pkgs + apt list –upgradable → server_update_snapshots. Default gate: SpinupWP-managed servers flagged upgrade_required=true, plus every non-SpinupWP-managed server unconditionally (nothing else sets that flag for GridPane/Hetzner/custom-VPS boxes). --all bypasses the gate entirely, for the weekly full-fleet safety-net sweep. |
php artisan clockwork:poll-system-updates --all |
clockwork:clean-failed-provision |
Recovery script for the v0 provisioner bug — paste into SpinupWP “Run a Custom Script”. | php artisan clockwork:clean-failed-provision myhost.example.com |
clockwork:provision-console-access |
Drop a Match Address 127.0.0.1,::1 sshd config so the DigitalOcean Web Console can log in as root via droplet-agent on SpinupWP-hardened boxes. Validates with sshd -t, reloads (not restarts), auto-rollback on failure. |
php artisan clockwork:provision-console-access --server=web-test3.example.com |
Bill.com sync
| Command | Purpose | Example |
|---|---|---|
clockwork:sync-bill-customers |
Pull customer list + invoice history → link sites. | php artisan clockwork:sync-bill-customers |
clockwork:sync-bill-care-plans |
Flip care_plan_enabled per site based on care-plan-Item invoicing. |
php artisan clockwork:sync-bill-care-plans |
Maintenance
| Command | Purpose | Example |
|---|---|---|
clockwork:rebuild-threat-logs-partitions |
Rebuild threat_logs as monthly partitions and copy only the retention window. Reclaims InnoDB disk space. MySQL only. | php artisan clockwork:rebuild-threat-logs-partitions --days=90 |
clockwork:prune-threat-logs |
Prune threat_logs older than configured retention, dropping obsolete monthly partitions or deleting rows. | php artisan clockwork:prune-threat-logs |
clockwork:prune-scheduled-job-runs |
Delete scheduled_job_runs rows older than the retention window (default 30 days, CLOCKWORK_SCHEDULED_JOBS_RETENTION_DAYS), keeping Settings → Scheduled Jobs history bounded. --days= overrides. |
php artisan clockwork:prune-scheduled-job-runs |
clockwork:reencrypt-secrets |
Re-encrypts every 'encrypted'-cast column (SSH keys, DB passwords, Companion secrets, integration credentials) under the current APP_KEY. Run once, immediately after rotating APP_KEY, while the old key is still in APP_PREVIOUS_KEYS — bypasses Eloquent’s dirty-tracking (which no-ops save() for unchanged plaintext) via a direct Crypt::encryptString() + raw DB::table()->update() per row. |
php artisan clockwork:reencrypt-secrets |
clockwork:check-updates |
Check the GitHub Releases API for a newer Clockwork Control Core version, and print the Companion fleet rollout breakdown. Same data /settings/updates shows. --force bypasses the 12h cache. See Features → System updates. |
php artisan clockwork:check-updates --force |
clockwork:self-update |
Operator-triggered self-update: git pull → composer install --no-dev → migrate --force → optimize:clear. Aborts before touching anything if the working copy has uncommitted changes. Prompts for confirmation unless --force. |
php artisan clockwork:self-update --force |
clockwork:send-telemetry |
Sends the anonymous usage report (exact site/server counts, per-module breakdown, enabled modules — nothing else) to the project maintainer. On by default (CLOCKWORK_TELEMETRY_ENABLED=true); disable anytime via Settings → Maintenance or the env var. Runs weekly. |
php artisan clockwork:send-telemetry |
