Are you using a separate datadir? If so, you need to specify it in the bitcoin-cli command.
Additionally, try stopping Bitcoin Core and seeing a file in the datadir named
.cookie (or something like that) exists. If it does, then delete the file and restart Core and try again.
Lastly, rpcuser and rpcpassword have been deprecated and replaced with cookie authentication. For cookie auth, you read the user and pass from the aforementioned file. This user and pass will change every time your restart Bitcoin Core. If you do want to continue to use rpcuser and rpcpassword, I suggest you instead use rpcauth. You can take a look at
https://github.com/bitcoin/bitcoin/blob/44f2df613f23d0a095a6e47b3d9c498b9df3055b/share/rpcuser/rpcuser.py for help with creating the proper string for rpcauth.
That's interesting..
Ok, So I've killed the bitcoin process, deleted the cookie and rebooted.
Same result, in php it works but not in terminal/ssh with bitcoin-cli.
I previously tried specifying datadir... same results.