# Restoring WordPress core files

> Replace damaged, missing or infected WordPress system files with clean copies, without losing your content, plugins or themes.

Source: https://helpcenter.ruachost.com/wordpress/guides/restoring-wordpress-core-files/

WordPress's **core files** are the system files that make WordPress run: the `wp-admin` and `wp-includes` folders and the files in your website's main folder, such as `wp-login.php`. They can be damaged by a failed update, or changed by malware. Replacing them with clean copies is safe: your posts, pages, settings, plugins, themes and uploads aren't touched.

> **Caution:**
Take a backup first, or check you have one in **JetBackup**. See [Restoring files, email and databases using JetBackup](https://helpcenter.ruachost.com/cpanel/files/restoring-files-email-and-databases-using-jetbackup/).

## Option 1: From the WordPress dashboard

If you can log in:

1. Go to **Dashboard → Updates**.
2. Click **Re-install version x.x.x**.

WordPress downloads and replaces its core files.

## Option 2: With WP Toolkit in cPanel

1. Log in to cPanel and open **WordPress Management** (WP Toolkit).
2. Find your site and open **Check WordPress Integrity** (in the site's menu).
3. WP Toolkit compares your core files with the official ones. Choose **Reinstall WordPress core** to replace any changed or missing files.

## Option 3: By hand

Use this if you can't log in and the options above don't work.

1. Download the **same version** of WordPress from [wordpress.org/download/releases](https://wordpress.org/download/releases/), or the latest version if you're updating. Your current version is in `wp-includes/version.php`.
2. Unzip it on your computer. **Delete the `wp-content` folder** from the download, so you don't overwrite your themes, plugins and uploads.
3. In cPanel's **File Manager**, open your website's folder. Delete the `wp-admin` and `wp-includes` folders (they're replaced in the next step).
4. Upload the downloaded files: the `wp-admin` and `wp-includes` folders and the files from the main folder. Overwrite existing files when asked. Upload a `.zip` and use **Extract** in File Manager to save time.
5. Don't replace `wp-config.php` or `.htaccess`. They contain your own settings.
6. Visit `https://yourdomain.com/wp-admin`. If WordPress asks to update the database, click **Update WordPress Database**.

## After a malware infection

Replacing core files removes malware from WordPress itself, but not from your plugins, themes, uploads or database. Also:

- reinstall plugins and themes from their original source
- look for `.php` files in `wp-content/uploads/` and delete them
- change all passwords

See [Scanning for malware with Imunify360 and Monarx](https://helpcenter.ruachost.com/ssl-security/website-security/scanning-for-malware-with-imunify360-and-monarx/).