Skip to content
Ruachost Help Center

Restoring WordPress core files

WordPress’s core files are the system files that make WordPress run: the wp-admin and wp-includes folders and the files in your website’s main folder, such as wp-login.php. They can be damaged by a failed update, or changed by malware. Replacing them with clean copies is safe: your posts, pages, settings, plugins, themes and uploads aren’t touched.

Option 1: From the WordPress dashboard

Section titled “Option 1: From the WordPress dashboard”

If you can log in:

  1. Go to Dashboard → Updates.
  2. Click Re-install version x.x.x.

WordPress downloads and replaces its core files.

Option 2: With WP Toolkit in cPanel

Section titled “Option 2: With WP Toolkit in cPanel”
  1. Log in to cPanel and open WordPress Management (WP Toolkit).
  2. Find your site and open Check WordPress Integrity (in the site’s menu).
  3. WP Toolkit compares your core files with the official ones. Choose Reinstall WordPress core to replace any changed or missing files.

Option 3: By hand

Section titled “Option 3: By hand”

Use this if you can’t log in and the options above don’t work.

  1. Download the same version of WordPress from wordpress.org/download/releases, or the latest version if you’re updating. Your current version is in wp-includes/version.php.
  2. Unzip it on your computer. Delete the wp-content folder from the download, so you don’t overwrite your themes, plugins and uploads.
  3. In cPanel’s File Manager, open your website’s folder. Delete the wp-admin and wp-includes folders (they’re replaced in the next step).
  4. Upload the downloaded files: the wp-admin and wp-includes folders and the files from the main folder. Overwrite existing files when asked. Upload a .zip and use Extract in File Manager to save time.
  5. Don’t replace wp-config.php or .htaccess. They contain your own settings.
  6. Visit https://yourdomain.com/wp-admin. If WordPress asks to update the database, click Update WordPress Database.

After a malware infection

Section titled “After a malware infection”

Replacing core files removes malware from WordPress itself, but not from your plugins, themes, uploads or database. Also:

  • reinstall plugins and themes from their original source
  • look for .php files in wp-content/uploads/ and delete them
  • change all passwords

See Scanning for malware with Imunify360 and Monarx.

Was this page helpful?