Only when you run WP-CLI as root (common on some VPS setups). Prefer a dedicated deploy user that owns the site files. This simulator accepts the commands without –allow-root.

Core first, then wp core update-db, then plugins. Plugins often require a minimum WordPress version; updating them against outdated core can cause fatals.

Yes on real servers. Use a dated directory outside the web root for tar archives of the site plus wp db export. This interactive challenge focuses on WP-CLI commands; file archives remain part of the full protocol.

It disables plugin and theme install/update (and related file editing) from the WordPress admin UI. Updates then happen via WP-CLI or controlled deploy pipelines — which is what you want on production business sites.

Many premium plugins authenticate downloads against the vendor API using a license tied to the site. WP-CLI bulk update may not complete that handshake. Installing a verified zip with wp plugin install … --force --activate is the reliable production pattern.

The beginner maintenance case covers the happy path: check, export, update core, update plugins, flush cache. This case adds production security habits: plugin inventory, premium zip installs, deactivating unsafe tooling, locking wp-admin file mods, and a post-change backup.