
Product
PHP and Composer Support Is Now in Beta
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.
WPConvert.ai CLI — convert a website/codebase folder into a WordPress theme without leaving your terminal.
Convert a website or codebase folder into a WordPress theme without leaving your terminal. The CLI wraps the same conversion engine and credit system as the WPConvert dashboard.
Requires Node.js >= 18.
npm install -g wpconvert
Create an API key in your WPConvert dashboard (Settings → API & CLI), then:
wpconvert login # paste the key (input hidden); stored at ~/.wpconvert/config.json (0600)
# or, for CI:
export WPCONVERT_API_KEY=wpc_live_xxx
API keys require a Pro/Agency plan or available PAYG credits for full downloadable conversions. Free verified accounts may also create preview-only keys (up to 3 lifetime Playground previews — no theme ZIP download) when the server has developer previews enabled.
cd your-project
wpconvert convert . --type theme
index.html in the folder → uses it as-is (plain HTML sites, most AI exports).index.html (dist/, build/, out/, public/, …) → uses that and tells you.npm run build first.--root <dir> (skips detection).node_modules, .git, build output, OS junk, and — for safety — secrets (.env, *.pem, *.key, id_rsa*, .npmrc, .ssh/, credentials*.json). Your .gitignore is honored. Symlinks are never followed..zip into the current directory (paid conversions only; preview-only jobs open Playground instead).| Your project | Command |
|---|---|
Plain HTML (has index.html) — most AI exports, Framer/Webflow | wpconvert convert . |
| React/Vite/Next/Astro (Lovable, Bolt, v0, Replit, Cursor…) | npm run build, then wpconvert convert . |
| Not sure | wpconvert convert . --dry-run (detects it or tells you to build) |
wpconvert convert ./my-site --dry-run # list what would be uploaded; no upload, no credit
wpconvert convert ./repo --root dist # force a subdirectory; skip auto-detection
wpconvert convert ./site --max-asset-size 25 # drop individual files > 25MB (they won't render)
wpconvert convert ./site --ignore "*.psd" --ignore "design/**"
wpconvert convert ./site --include-env # DANGER: uploads .env/secret files
wpconvert convert ./site --no-download # don't auto-download on success
Preview a finished conversion in a live, in-browser WordPress (no local install):
wpconvert preview <jobId> # print a preview URL
wpconvert preview <jobId> --open # also open it in your default browser
The URL boots WordPress Playground with your theme installed and activated — the same preview you get in the dashboard. Sessions expire after about ten minutes and are use-limited.
wpconvert status <jobId> # check a job's status
wpconvert download <jobId> # download a completed conversion (paid / full jobs only)
wpconvert preview <jobId> # preview the theme in WordPress Playground
wpconvert quota # show plan, usage, and next-conversion capabilities
wpconvert quota --json # print the complete backend quota JSON (for scripts/agents)
wpconvert quota shows what the next developer conversion will do, using the server’s authoritative capabilities object (when present):
full or preview_only)wpconvert quota --json prints the complete backend response as pretty-printed JSON on stdout (no banners or colors). On failure, the error goes to stderr and stdout stays empty.
Real wpconvert convert commands call quota once before building the ZIP (after --dry-run exits). Behavior:
| Quota / capability result | CLI behavior |
|---|---|
capabilities.conversion.can_start === true | Continues; prints a compact mode/uses/download summary |
can_start === false | Stops before ZIP/upload; exit code 3 |
No capabilities (older API) | Legacy path — continues; server enforces at submit |
| Network / timeout / 5xx on quota | Warns and continues; server remains authoritative |
| Auth failure on quota | Stops; exit code 1 |
--dry-run skips the quota check entirely (local-only).
Submit-time rate limits, in-flight caps, and worker errors are not modeled by preflight — they remain server errors (typically exit 1).
| Code | Meaning |
|---|---|
0 | Success |
1 | Generic failure (auth, validation, network, submit-time errors) |
3 | Authenticated capability response explicitly blocks conversion (can_start: false) |
--dry-run first if you're unsure what will be uploaded. The secret denylist is on by default; --include-env is the only way to include those files.wpconvert preview URL can view the theme until the session expires. Avoid printing them in shared CI logs, and prefer omitting --open in headless environments.When enabled on the server, free verified accounts can create API keys that run preview-only conversions — WordPress Playground preview, no theme ZIP download. Try the CLI/MCP workflow before upgrading.
On success, wpconvert convert automatically creates a Playground preview URL. Preview-only jobs auto-open your browser by default; paid users get the link only (pass --open to launch). Use --no-open in CI/headless, or --no-preview to skip Playground entirely.
Paid conversions use 1 credit each (Agency is unlimited up to its soft cap), exactly like the web app. Failed conversions are refunded.
| Variable | Purpose |
|---|---|
WPCONVERT_API_KEY | API key (overrides the stored config). |
WPCONVERT_API_BASE | Override the API base URL (advanced/testing). |
FAQs
WPConvert.ai CLI — convert a website/codebase folder into a WordPress theme without leaving your terminal.
The npm package wpconvert receives a total of 215 weekly downloads. As such, wpconvert popularity was classified as not popular.
We found that wpconvert demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.

Research
/Security News
Three compromised Rust crates pulled in a malicious dependency that downloaded and executed cross-platform malware during Cargo builds.