WordPress File Structure Explained

A standard WordPress installation combines replaceable core files, site-specific content, configuration and server-level files.

Understanding ownership is more important than memorizing every filename.

WordPress Root

The root commonly contains:

• index.php.
• wp-blog-header.php.
• wp-load.php.
• wp-settings.php.
• wp-login.php.
• wp-cron.php.
• xmlrpc.php.
• wp-config.php.
• server files such as .htaccess or web.config.

Most root PHP files belong to WordPress core and should not be edited for site customizations.

wp-admin

wp-admin contains administration application files.

Some public-facing infrastructure also lives there, including selected AJAX and upgrade handlers. Blocking the entire directory at the server level can break legitimate functionality.

wp-includes

wp-includes contains most WordPress application logic, libraries and public PHP APIs.

Treat it as replaceable core. Changes are overwritten during updates and are difficult to maintain securely.

wp-content

wp-content holds site-specific extensions and media.

Common directories include:

• plugins.
• mu-plugins.
• themes.
• uploads.
• languages.
• upgrade or cache directories.
• directories created by individual plugins.

The directory and selected subdirectories can be relocated through configuration, but compatibility and URL handling must be tested.

Must-Use Plugins and Drop-Ins

Must-use plugins load automatically from wp-content/mu-plugins.

Special drop-in files can replace or extend selected subsystems, such as object caching or database handling. Examples include object-cache.php, advanced-cache.php and db.php.

These files may not appear in the normal plugin workflow and must be included in inventories and handovers.

Themes and Plugins

A plugin has a main PHP file with a plugin header and can include PHP, JavaScript, CSS, templates and build assets.

A theme includes required metadata and templates. Modern block themes commonly use theme.json, HTML templates and template parts.

Generated and Environment Files

Do not commit or deploy blindly:

• Cache files.
• logs.
• local uploads.
• backup archives.
• environment secrets.
• build dependencies.
• temporary upgrade files.

Define which files are source, generated artifacts, persistent content and secrets.

Frequently Asked Questions

Can WordPress core files be customized?

They can be changed technically, but updates overwrite them. Use hooks, plugins, themes and public APIs instead.

Is everything inside wp-content safe to deploy between environments?

No. Uploads, caches, secrets, logs and environment-specific files require different handling.

Continue Learning

Previous: Advanced WordPress and Integrations

Next: WordPress Database Structure Explained