Last Update July 22, 2026

Is your WordPress website acting weird? Maybe you are seeing a blank white screen, or worse, your website got hacked. Website downtime can cost small businesses hundreds of dollars a minute, so getting back online quickly is critical.

Don’t panic. You can fix this by replacing your WordPress core files. Replacing core files sounds scary, but it is actually very simple. In this guide, we will show you exactly how to give your website a fresh start without losing a single blog post, image, or design setting.

Quick Answer: How to Replace WordPress Core Files? To replace core files safely: keep your wp-content folder (holds your design) and your wp-config.php file (connects to your database). Delete all other old files on your server. Download a fresh copy of WordPress.org, delete its wp-content folder, and upload the rest of the new files to your server. Finally, go to [yoursite.com/wp-admin/upgrade.php](https://yoursite.com/wp-admin/upgrade.php) and run a malware scan.

What Are WordPress Core Files?

Think of your website like a car.

  • The Core Files: This is the engine. It makes the car run (files like wp-includes and wp-admin).
  • The wp-content Folder: This is your custom paint and seats. It holds your themes, plugins, and images.
  • The wp-config.php File: This is your car key. It connects your website to your database.

You can easily swap out a broken engine (core files) with a brand new one. As long as you keep your custom parts (wp-content) and your key (wp-config.php), your website will work exactly the way it did before!

Why Would You Need to Replace Core Files?

Most people replace their core files for two main reasons:

  1. A Failed Update: Sometimes, an automatic update breaks, leaving your site stuck on a white screen.
  2. A Malware Attack: According to 2025 data from Patchstack, over 91% of WordPress vulnerabilities come from plugins and themes, but hackers use them to inject bad code directly into your core files.

Security experts at Wordfence warn that you should never have custom code in your core files. Any unexpected changes there mean your site is likely compromised.

Pro Tip: If your website has suffered a massive malware attack, replacing the core files is a must. We recently published a complete step-by-step tutorial on this. Check out our WordPress Malware Removal: How to Clean a Hacked Site to learn how to identify deep infections before you start replacing files.

Step-by-Step: How to Replace Core Files Safely

Follow these easy steps to clean your site. You do not need to be a coding expert to do this.

Step 1: Download a Fresh Copy of WordPress

First, you need clean files straight from the source.

  1. Go to the official WordPress.org website.
  2. Download the latest WordPress .zip file to your computer.
  3. Unzip the folder.

Step 2: Prepare the New Files

Open the fresh WordPress folder you just unzipped. Before you upload anything, you must delete two items from this new folder:

  • Delete the wp-content folder. (If you upload this, it could overwrite your beautiful website design!)
  • Delete the wp-config-sample.php file.

Step 3: Delete the Old Files on Your Server

Log in to your website hosting account. Open your File Manager (or use FTP) and go to your website’s main folder (usually called public_html).

What to KEEP:

  • Keep the wp-content folder.
  • Keep the wp-config.php file.
  • Note: Keep any hidden files like .htaccess.

What to DELETE:

  • Delete the wp-admin folder.
  • Delete the wp-includes folder.
  • Delete all the loose .php files (like index.php, wp-login.php, etc.) EXCEPT your wp-config.php.

Step 4: Upload the Fresh Files

Take the fresh files from your computer (from Step 2) and upload them to your server. Your wp-config.php file will instantly connect the new “engine” to your existing data.

Step 5: Update Your Database

This is a step many people miss! Open a new tab in your web browser and go to this link: [yoursite.com/wp-admin/upgrade.php](https://yoursite.com/wp-admin/upgrade.php) (replace “yoursite.com” with your actual domain name). If WordPress needs to update your database to match the new files, click the button to update.

Advanced Pro-Tip: The WP-CLI Method

If you are a developer or comfortable with the command line, you don’t need to use FTP or File Manager. You can replace the core files in 5 seconds using WP-CLI. Just run this command: wp core download --skip-content --force This automatically downloads fresh files and forces an overwrite while keeping your wp-content safe.

The Most Important Final Step: Run a Malware Scan

If you replaced your core files because of a hack, your job is not done yet.

Security experts at Sucuri highly recommend replacing core files instead of just restoring a backup, because your older backup might contain the hacked files too! However, malware might still be hiding inside your wp-content folder.

Immediately after your site is back online:

  1. Go to your WordPress dashboard.
  2. Install a top-rated malware scanner plugin.
  3. Run a full, deep scan of your website to secure it fully.

Frequently Asked Questions (FAQs)

Will replacing core files delete my website content?

No! All your text and settings live in your MySQL database. Your images and themes live in the wp-content folder. As long as you don’t delete those, your data is 100% safe.

Do I need to know how to code to do this?

Not at all. If you know how to copy, paste, delete, and upload files, you can do this easily.

Why can’t I just restore a backup?

If your site was hacked, restoring a backup might just bring the hacked files back if the infection happened before the backup was taken. Downloading fresh files directly from WordPress.org is the only way to guarantee the core engine is 100% clean.

What happens to my installed plugins and active theme?

They stay exactly as they are! All your plugins, themes, and uploaded images are safely stored inside the wp-content folder. Since you are not deleting this folder, your website will look and function perfectly once the fresh core files are uploaded.

Do I need to delete the wp-config.php file?

No, never delete your wp-config.php file. This is the most important file on your server because it contains your database passwords and connection settings. If you delete it, your website will lose connection to all your data.

Will replacing core files fix the “White Screen of Death”?

Yes, very often it does. The White Screen of Death (WSoD) is frequently caused by a corrupted core file resulting from a failed auto-update. Uploading fresh core files is one of the fastest ways to fix this error.

Will doing this hurt my website’s SEO rankings?

No. Because your written content, page URLs, and database remain completely untouched, your SEO will not be affected. In fact, if your site is currently down or hacked, replacing the core files quickly will actually protect your SEO rankings from dropping.

How long does it take to replace WordPress core files?

If you have your hosting File Manager or FTP open, the entire process usually takes less than 10 to 15 minutes. Downloading the .zip file and uploading it is very quick.

What if I accidentally delete the wp-content folder?

If you accidentally delete wp-content, your website will lose its design, images, and plugins (though your written text will still be safe in the database). Always be very careful, and if possible, download a quick backup of the wp-content folder to your computer before you start deleting anything!