Directory Structure

Previous Next

A fresh WordPress installation drops a specific set of folders and files into your site's root directory. Knowing what each one does — and more importantly, which ones you're actually allowed to touch — will save you from a very common beginner mistake: losing custom work the moment WordPress auto-updates itself.

1. The Three Top-Level Folders

Folder	What it contains
`wp-admin/`	The entire admin dashboard — all the PHP, CSS, and JS that powers `/wp-admin/`. This is core WordPress code.
`wp-includes/`	The core WordPress engine: the functions, classes, and libraries (like the loop, the hooks system, formatting functions, etc.) that everything else is built on top of.
`wp-content/`	Your themes, your plugins, and your media uploads. This is the only folder you should ever be adding to or editing.

2. Inside wp-content/: What You Actually Touch

Almost all of a WordPress developer's day-to-day work happens inside three sub-folders of wp-content/:

wp-content/themes/ — one folder per installed theme. Each theme folder holds the template files (index.php, single.php, style.css, etc.) that control how your site looks.
wp-content/plugins/ — one folder per installed plugin. Plugins add functionality (contact forms, SEO tools, custom post types) without touching theme files, so features survive even if you switch themes.
wp-content/uploads/ — every image, PDF, or other file uploaded through the Media Library, automatically organized into uploads/YYYY/MM/ sub-folders by year and month.

Rule of thumb: if the file you're about to edit lives outside wp-content/, stop — you're almost certainly about to edit WordPress core.

3. wp-config.php: The Configuration Hub

wp-config.php lives in the site root (one level above wp-content/) and controls how WordPress connects to everything. It typically defines:

<?php
// Database credentials
define('DB_NAME', 'my_wordpress_db');
define('DB_USER', 'wp_user');
define('DB_PASSWORD', 'a_strong_password');

// Security keys and salts - keep these secret, unique per site
define('AUTH_KEY', 'unique random string');
define('LOGGED_IN_KEY', 'unique random string');

// Debug mode - turn on while developing, off in production
define('WP_DEBUG', true);

The security keys and salts are used to encrypt information stored in visitors' cookies (like login sessions), and WP_DEBUG is the master switch for whether PHP errors, warnings, and notices are shown or logged — invaluable while building a theme or plugin, but it should always be set back to false on a live production site.

4. .htaccess: Permalink Rewriting

On Apache servers, WordPress also relies on a .htaccess file in the site root. This file contains rewrite rules that translate friendly URLs like /2026/my-first-post/ into the actual query WordPress needs to look up that post in the database — this is what makes "pretty permalinks" (Settings → Permalinks in wp-admin) possible instead of URLs like ?p=123. A typical block looks like this:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

5. Why You Should Never Edit Core Files Directly

It's tempting, when you need a small tweak, to open a file inside wp-admin/ or wp-includes/ and just change it. Don't. Here's why:

Updates overwrite everything. Every time WordPress updates itself (automatically, in many cases), the entire wp-admin/ and wp-includes/ folders are replaced with fresh copies — silently wiping out any direct edits you made.
You lose the update path entirely. Some site owners disable updates altogether to "protect" their core hacks, leaving the site running old, insecure code indefinitely.
There's always a proper alternative. Anything you'd want to change in core can be achieved safely from wp-content/ — a custom theme, a plugin, or a hook (covered in the Hooks lesson) that runs your own code at the right moment without modifying WordPress itself.

Note: These are real WordPress file paths and configuration values meant for your own installation — this tutorial site itself doesn't run WordPress, so nothing here executes on this page.

6. A Quick Reference Map

/ (site root)
├── wp-admin/          ← core, never edit
├── wp-includes/        ← core, never edit
├── wp-config.php        ← your database credentials & keys
├── .htaccess          ← permalink rewrite rules
└── wp-content/
    ├── themes/          ← your theme files
    ├── plugins/         ← your plugin files
    └── uploads/          ← media library files

Next up: Head into The Loop to see the PHP structure every theme template uses to actually display your content.

Previous Next