WP-Content Uploads: What It Is and How to Upload Files in WordPress
The WP-Content directory plays a significant role in all WordPress sites. It houses your website’s content, including file and media uploads as well as the assets of all the plugins and themes installed on your WordPress site. If you delete this directory, your website will crash.
Due to its importance, this folder is a popular target of hackers. To minimize security risks, website owners should know how to access, manage, and protect their WP-Content directory properly.
This article will cover the steps to access and upload the WP-Content directory. We will also teach you how to hide the WP-Content/Uploads folder from the public, preventing hackers from attempting backdoor attacks on your WordPress site.
What Is the WP-Content Folder?
It’s a core folder within your WordPress website that stores all your site files. Its content includes but isn’t limited to media uploads and files belonging to your installed plugins and themes.
How to Access the WP-Content Folder
You can access the WordPress WP-Content directory using your hosting provider’s File Manager. The following tutorial explains how to do it via Hostinger hPanel:
- Log in to your web hosting account and navigate to Hosting -> Manage.
- Upon entering the Hosting Account page, scroll down to the Files section and select File Manager.
- Double-click your root directory (public_html) and locate the WP-Content directory within.
How to Upload the WP-Content Folder
When uploading your site to a different web server, you need to upload the WP-Content folder to the new WordPress installation via File Manager or SFTP. This time, we’ll explain the steps how to do it using the latter method:
- Establish an FTP connection using an FTP client.
- The left panel will display your local computer files, while the right panel will showcase your remote WordPress website directories. Make sure the right panel has your root directory open (public_html).
- Drag-and-drop the WP-Content folder from the left panel to the right panel. A pop-up warning will appear asking for confirmation to overwrite or merge the existing WordPress files. If it’s a fresh WordPress installation, you can choose to overwrite them – click OK.
Pro Tip
This method also works for uploading media files to your WordPress Media Library. If you don’t have access to the admin dashboard, you can use an FTP client to access the WP-Content/Uploads directory and add files there for later use.
How to Hide the WP-Content Folder
Your WP-Content repository is an ideal entry point for hackers to access your website’s sensitive information or inject malicious code into it. To reduce the risk of cyberattacks, we recommend hiding its URL path.
There are two ways to hide the WP-Content folder ‒ using a WordPress plugin or manually.
Many WordPress security plugins have a feature that secures website directories. The following are the steps to secure your WP-Content folder using the WP Hardening plugin:
-
.
- Navigate to WP Hardening -> Security Fixers from your WordPress dashboard.
- Expand the Server Hardening section and toggle the option next to Hide directory listing of WP includes. Doing so will hide your directories’ URL path, preventing third parties from discovering your directory structure and browsing your site’s content.
The manual method requires adding code to the .htaccess file. Here’s how to block access to the WP-Content/Uploads folder and disable PHP execution in it:
- Navigate to your WP-Content/Uploads directory from the root directory using File Manager.
- Locate the .htaccess file (or create a new file in the .htaccess format if there’s none present) and add the following code:
- Save the changes.
Other Suggested Reading
Conclusion
A WordPress site cannot function without a WP-Content directory. By understanding its role on your website and how it works, you’ll be able to maintain its operations and secure the folder from hackers. We hope this article has shed some light on the operation and importance of the WP-Content directory. Good luck.
Jordana is a digital marketing and web development enthusiast. She loves spending her time in front of her laptop, working on new projects and learning new things. When she’s not busy with work, you can find her traveling the world in search of the best sushi!
Beginner’s Guide to WordPress File and Directory Structure
Last updated on July 24th, 2022 by Editorial Staff | Reader Disclosure Disclosure: Our content is reader-supported. This means if you click on some of our links, then we may earn a commission. See how WPBeginner is funded, why it matters, and how you can support us.
Do you want to learn about WordPress files and directory structure?
All core WordPress files, themes, plugins, and user uploads are stored on your website hosting server.
In this beginner’s guide, we’ll explain the WordPress file and directory structure.
Why You Should Learn About WordPress File and Directory Structure?
Most users can run their WordPress website without ever learning about WordPress files or directories. However, understanding how WordPress stores files and directories can help you solve many common WordPress problems on your own.
This guide will help you:
- Learn which WordPress files and folders are core files.
- Understand how WordPress stores your images and media uploads.
- Where WordPress stores your themes and plugins.
- Where configuration files are stored on your WordPress install.
Having said that, let’s take a look at the WordPress file and directory structure.
Accessing WordPress Files and Directories
Your WordPress files and directories are stored on your web hosting server. You can access these files by using an FTP client. See our guide on how to use FTP to upload WordPress files for detailed instructions.
An easier alternative to FTP is the File Manager app that comes built into most WordPress hosting control panel.
Once you have connected to your WordPress site either using FTP or File Manager, you will see a file and directory structure that looks like this:
Inside the root folder, you’ll see the core WordPress files and folders. These are the files and folders that run your WordPress site.
Apart from .htaccess and wp-config.php files, you are not supposed to edit other files on your own.
Here is a list of core WordPress files and folders that you would see in your WordPress site’s root directory.
- wp-admin [dir]
- wp-content [dir]
- wp-includes [dir]
- index.php
- license.txt
- readme.html
- wp-activate.php
- wp-blog-header.php
- wp-comments-post.php
- wp-config-sample.php
- wp-cron.php
- wp-links-opml.php
- wp-load.php
- wp-login.php
- wp-mail.php
- wp-settings.php
- wp-signup.php
- wp-trackback.php
- xmlrpc.php
The above list is missing .htaccess and wp-config.php files. That’s because those two files are created after WordPress installation.
WordPress Configuration Files
Your WordPress root directory contains some special configuration files. These files contain important settings specific to your WordPress site.
-
– A server configuration file, WordPress uses it to manage permalinks and redirects. – This file tells WordPress how to connect to your database. It also sets some global settings for your WordPress site.
- index.php – The index file basically loads and initializes all your WordPress files when a page is requested by a user.
You may need to edit wp-config.php or .htaccess file sometimes. Be extra careful when editing these two files. A slight mistake can make your site inaccessible. When editing these two files, always create backup copies on your computer before making any changes.
If you don’t see .htaccess file in your root directory, then checkout our guide on why you can’t find .htaccess file in your WordPress root directory.
Depending on how your WordPress site is setup, you may or may not have the following files in your root directory.
- robots.txt – contains instructions for search engines crawlers
- Favicon.ico – A favicon file is sometimes generated by WordPress hosts.
Inside The wp-content Folder
WordPress stores all uploads, plugins, and themes in the wp-content folder.
It is generally assumed that you can edit files and folders inside wp-content folder. However, this is not entirely true.
Let’s take a look inside the wp-content folder to understand how it works and what you can do here.
Contents of the wp-content folder may differ from one WordPress site to another. But all WordPress sites usually have these:
- [dir] themes
- [dir] plugins
- [dir] uploads
- index.php
WordPress stores your theme files in /wp-content/themes/ folder. You can edit a theme file, but it is generally not recommended. As soon as you update your theme to a newer version, your changes will be overwritten during the update.
This is why it is recommended to create a child theme for WordPress theme customization.
All WordPress plugins you download and install on your site are stored in /wp-content/plugins/ folder. You are not supposed to edit plugin files directly, unless you wrote site-specific WordPress plugin for your own use.
In many WordPress tutorials, you will see code snippets that you can add to your WordPress site.
The best way to add custom code to your WordPress site is by adding it to functions.php file of your child theme or by creating a site-specific plugin. Alternately, you can also use custom code snippets plugin to add custom code.
WordPress stores all your image and media uploads in the /wp-content/uploads/ folder. By default, uploads are organized in /year/month/ folders. Whenever you are creating a WordPress backup, you should include the uploads folder.
You can download fresh copies of WordPress core, your theme, and installed plugins from their sources. But if you lose your uploads folder, then it would be very hard to restore it without a backup.
Some other default folders you may see in your wp-content directory.
- languages – WordPress stores language files for non-english WordPress sites in this folder.
- upgrade – This is a temporary folder created by WordPress during upgrade to a newer version.
Many WordPress plugins may also create their own folders inside your wp-content folder to store files.
Some WordPress plugins may create folders inside the /wp-content/uploads/ folder to save user uploads. For instance, this demo website has folders created by Smash Balloon, WooCommerce, SeedProd, and WPForms plugins.
Some of these folders may contain important files. This is why we recommend backing up all such folders as a precaution.
Other folders may contain files that you can safely delete. For example your caching plugins like WP Rocket may create folders to save caching data.
That’s all, we hope this article helped you understand the WordPress file and directory structure. You may also want to see our beginner’s guide to WordPress database management with phpMyAdmin, and our tutorial on how to create a custom WordPress theme without any coding knowledge.
If you liked this article, then please subscribe to our YouTube Channel for WordPress video tutorials. You can also find us on Twitter and Facebook.
Determining Plugin and Content Directories
When coding WordPress plugins you often need to reference various files and folders throughout the WordPress installation and within your plugin or theme.
WordPress provides several functions for easily determining where a given file or directory lives. Always use these functions in your plugins instead of hard-coding references to the wp-content directory or using the WordPress internal constants.
PHP’s __FILE__ magic-constant resolves symlinks automatically, so if the wp-content or wp-content/plugins or even the individual plugin directory is symlinked, hardcoded paths will not work correctly.
Common Usage
This will return the full URL to myscript.js, such as example.com/wp-content/plugins/myplugin/myscript.js .
To load your plugins’ JavaScript or CSS into the page you should use wp_enqueue_script() or wp_enqueue_style() respectively, passing the result of plugins_url() as the file URL.
Available Functions
WordPress includes many other functions for determining paths and URLs to files or directories within plugins, themes, and WordPress itself. See the individual DevHub pages for each function for complete information on their use.
wp-content Directory
WordPress consists of 3 folders wp-includes , wp-admin , wp-content and several files next to these folders.
All files and folders except wp-content — this is WordPress, the engine. That is, the directories: wp-includes and wp-admin are the core of WordPress, and wp-content is everything else — all user data.
The wp-content directory is where almost all user files are stored, except for the wp-config.php configuration file (which is an integral part of the core). This is where plugins, themes, plugin files, themes and site content are stored. This is also the place to store all the files associated with the expansion of WordPress.
Initially in WordPress, wp-content contains one file index.php and 3 folders: plugins, themes, languages.
File wp-content/index.php
Should always exist and should have this content:
This file prevents you from seeing a list of files in the folder. If index.php doesn’t exist and your web server allows you to see files in directories, then clicking on the link http://example.com/wp-content you can see all the files and folders in that directory. This can be used by hackers to gain access to key files, allowing the site to be compromised. For example, if you have a vulnerable plugin installed, the site could easily be checked for that vulnerable plugin, and then the attacker could easily break the site.
When updating WordPress manually, never touch the wp-content folder or anything in it. It has nothing to do with updating WordPress.
A list of what what the wp-content directory may contain:
- /mu-plugins — must-use plugins
- /plugins
- /themes
- /uploads — media and other files
- /upgrade — auto updates
- /languages — translations
- The arbitrary directories
- Special files
- advanced-cache.php
- object-cache.php
- maintenance.php
- db-error.php
- sunrise.php
- db.php
- Renaming or moving the wp-content folder
/mu-plugins — must-use plugins
In WordPress, there are so-called «plugins that must be used», they are located in the wp-content/mu-plugins directory. About them I wrote in mu-plugins post, be sure to check it out!
Briefly about Must-use plugins: Must-use plugins, also known as mu-plugins are plugins that are installed in a special mu-plugins folder in the content wp-content directory and activated automatically (always active) for the site and network sites. These plugins are not visible among the regular plugins. In the admin panel, they appear in the top info line and there is no way to disable them except to delete the plugin file from the wp-content/mu-plugins directory.
/plugins
WordPress plugins are located in the wp-content/plugins directory. A plugin can be a single file or multiple files within a folder. Any files in the /plugins directory are scanned by WordPress to determine if the file is a plugin file. If the file is determined to be a plugin, it appears in the admin panel under «Plugins» and is ready to be activated.
To deactivate a plugin, you can delete the plugin from the /plugins folder. You can also rename the name of the folder, in which case, WordPress simply can not find the plugin file and will deactivate it while trying to connect. But keep in mind that it is better to delete plugins from the admin panel, through the Delete button, because the deletion triggers some functions that clean up the plugin data in the database or in the files.
/themes
WP Themes are stored in the wp-content/themes directory. Each theme must be in its own folder and contain a properly formatted style.css file so that WordPress will recognize it as a usable theme. There should be at least 2 files in the theme directory: index.php and style.css .
WordPress can store as many themes as you want in this directory. You can easily view any available theme or activate it in the Appearance ► Themes tab in the admin panel.
/uploads — media and other files
WordPress stores uploaded files in the wp-content/uploads directory. This directory does not exist in the WordPress distribution by default. It is created when the file is first uploaded to WordPress. A separate creation is necessary because this folder can be moved to another location (see below)
By default, WordPress stores uploads in folders by year and month:
Before any images or files can be uploaded to WordPress, the server must be allowed to create folders in the /wp-content directory. When the first image is uploaded, WordPress automatically creates the /uploads directory and the necessary sub-directories in it. After the first file is uploaded, you need set the permissions for /wp-content back, usually 755. Some servers allow the php script to create folders and files right away.
The uploads directory should have all permissions to allow PHP freely create and delete files in it, usually it’s 777 permissions.
WordPress does NOT know how to recognize and import images to admin uploaded to uploads directly (not through the admin). And such files don’t show up in the WordPress file library — WordPress doesn’t know anything about them.
uploads to Multisite
In Multisite installation for the main site files are uploaded as usual. And for all additional sites, creates a folder /wp-content/uploads/sites/2 , where 2 is the network site ID.
So for each site is created a folder with its ID in the /wp-content/uploads/sites directory. Then the files are also arranged in folders by year and month.
This approach allows to separate uploads for each site and simplifies their maintenance.
Before WP 3.5, the files of additional sites were not located in /wp-content/uploads/sites , but in /wp-content/blogs.dir .
So, for example, the directory for a site with ID 3 looks like this:
- WP 3.5 and above: /wp-content/uploads/sites/3 .
- WP 3.4 and below: /wp-content/blogs.dir/3
Moving the uploads folder
To move the uploads folder, you need to define the UPLOADS constant in wp-config.php as follows:
Or you can change the options: upload_path and upload_url_path in the options table, see update_option().
Moving the uploads folder is not recommended, I wrote about it in the article: Bug with moving the uploads folder.
/upgrade — auto updates
The wp-content/upgrade directory is created automatically by WordPress when you update WordPress. This folder is used to store the new version of WordPress downloaded from WordPress.org. Before updating, WordPress downloads the archive and extracts its contents into this folder. For the automatic update process to be successful, it is recommended not to touch this folder. If this directory is deleted, WordPress will create it the next update.
/languages — translations
wp-content/languages directory is present only if you install a non-English version of WordPress. This contains all the localization (translation) files of WordPress. Such files have extensions:
- .mo — a compressed version of a similar .po file, which is used by PHP for translation.
- .po — the original translation file. This file can be used to edit the translation. After editing it must be compiled into a compressed version with the .mo extension.
There may also be special sub-directories in languages dir:
/pliugns — contains translations of plugins. Plugin translation file must have the format: plugin_name-local.mo , for example: akismet-ru_RU.mo . Before loading its translation file, the plugin checks if there is a translation file in this folder, and if it is there, then this translation file is used instead of the plugin’s native translation.
The arbitrary directories
In /wp-content you can create any directories. Some plugins, create such folders for storing files. Usually an additional folder is created when you need to store a lot of files or when the stored files are somehow different from the default WP files.
For example plugin WP Super Cache creates directory /wp-content/cache to store cached pages. Cached page — this is a generated page of the site, stored as a static HTML file. When such page is accessed, it is not re-generated, but a static file is given. This is the page cache, which reduces the server load dozens of times, because pages are not generated on every crawl, and are created only when the cache is overwritten.
The WP Super Cache plugin also adds two files to the wp-content directory: advanced-cache.php (special) and wp-cache-config.php. They are needed for WP Super Cache to work.
Another example, a popular gallery plugin — NextGen Gallery — creates a directory /wp-content/gallery to store images uploaded to galleries. Each gallery created is a subdirectory of /gallery .
Another example, my plugin Kama Thumbnail, which also creates a folder /wp-content/cache/thumb and writes created thumbnail files into it.
Special files
advanced-cache.php
Called at the earliest stage of loading WordPress, in the wp-settings.php file, if the WP_CACHE constant is enabled. This is what the call looks like:
This file is used by page caching plugins. It usually checks for a suitable cache file, and if there is one, it is displayed and the script is terminated. This allows you not to load 90% of WordPress files and give static HTML files.
object-cache.php
Called from function wp_start_object_cache(), which in turn is called from the wp-settings.php file, a little later advanced-cache.php . Unlike advanced-cache.php , object-cache.php is always triggered if it exists. It is needed to override the operation of basic WordPress object caching.
The object caches based on this file are Memcache, Redis, Memcached, APC, XCache.
The call looks like this:
Since WP 5.8 the enable_loading_object_cache_dropin hook has appeared which allows you to disable object caching plugin. The hook is invoked before the plugins are loaded and is needed when the code is launched not from the web, for example during tests.
maintenance.php
wp-content/maintenance.php is responsible for displaying a stub page that is shown when WoordPress auto-updates. Such a page is defined by default and the wp_maintenance() function is responsible for it. But if you create a file maintenance.php in wp-content , then the contents of that file will be responsible for the page’s output.
In maintenance.php you need to describe the maintenance-page according to all HTML rules.
See function wp_maintenance() for details.
db-error.php
Allows you to display an arbitrary database error page template.
If the wp-content/db-error.php file exists in the wp-content , then this file will be loaded instead of the default WordPress database connection error message. In the file you need to create HTML code for the error page!
The connection error page should set the 500 response status, so that search engines do not process content.
File db-error.php is called by function dead_db(), and the function in turn is called when the database connection error occurs.
An example of such a page:
sunrise.php
Only loaded for multisite builds, i.e. when is_multisite() is triggered and SUNRISE constant is defined (it should be defined in wp-config.php ).
File wp-content/sunrise.php allows you to change the logic of the site at an early stage in the network multisite. For example, here you can set global variables $current_site , $current_blog defining the current network site. Or you can change the prefix of the database tables — the variable $table_prefix .
Also in the unrise.php file you can change the constants that are responsible for where the directories of MU plugins or ordinary plugins are located. See wp_plugin_directory_constants().
sunrise.php connects even before SHORTINIT constant.
sunrise.php is connected in the wp-includes/ms-settings.php file, which in turn is connected in the main loading wp-settings.php file.
db.php
Allows you to rewrite the database engine. If the file exists in the wp-content folder, it will be called before creating a connection to the database. Further, if in this file variable $wpdb is defined, then it will be used as a global variable for work with the database.
With this logic, you can, for example, extend the base class wpdb<> or replace it completely.
An example of an extension for the base wpdb<> class.
Renaming or moving the wp-content folder
In some cases, for example, to unique many URLs of your site, or to combine site structure with another script, or for some other reason, it is necessary that the directory wp-content have a different name or that it is located in a different directory.