How to Manually Reinstall WordPress Core

This guide shows you how to replace the core program files that run WordPress with a clean, official copy, without touching your posts, images, themes, plugins or settings. Reinstalling core, sometimes called replacing the core files or dropping in a fresh copy of WordPress, is one of the most effective and least understood repairs available to a site owner. It fixes a site whose engine has been damaged, whether by a half-finished update, a corrupted file, or malware that has written itself into a core file, and it does so without the risk people fear, because done correctly it leaves everything that makes your site yours completely alone. This article explains exactly which parts of WordPress you are replacing and which parts you must never overwrite, then walks through three safe ways to do it on Noiz hosting: the one-click reinstall in the dashboard, the precise WP-CLI method over SSH, and the manual file replacement over SFTP or your control panel's File Manager.

Last reviewed: 27 July 2026, against WordPress 7.0.2 (latest stable). This guide is written for Noiz hosting and is kept current against WordPress. It complements, and does not replace, the official WordPress documentation linked below.

Official Documentation Reference

• Updating WordPress (WordPress Documentation): the official Manual Update procedure, whose file-replacement steps are the same ones used to reinstall core, including the explicit warnings about wp-content and wp-config.php.
• Upgrading WordPress, Extended Instructions (WordPress Developer Resources): the long-form version, with the full list of files and folders never to delete and detailed troubleshooting.
• wp core download (WP-CLI Command Reference): the exact syntax and options for downloading core files from the command line, including --version, --skip-content and --force.
• wp core verify-checksums (WP-CLI Command Reference): the command that tells you precisely which core files differ from WordPress.org's official copies, so you know whether a reinstall is even needed.
• WordPress Release Archive (WordPress.org): where to download the exact zip of any WordPress version, which you need if you want to repair an older install without also updating it.

Prerequisites

• A recent, restorable backup of your site, both files and database. This is non-negotiable and is covered in its own section below.
• A way to reach your site's files. On Noiz hosting that means either SFTP with your hosting credentials, or the File Manager built into your control panel (Plesk on the South African platform, DirectAdmin on the Irish platform). The WP-CLI method additionally needs SSH access.
• To use the dashboard method, you need to be able to log in to your WordPress admin dashboard. If the damage has locked you out, use the WP-CLI or manual method instead, neither of which needs a working dashboard.

What "Reinstalling Core" Actually Means

The confusion that stops people reinstalling core, and the fear that they will wipe their site, both come from not knowing what WordPress is made of. It is worth two minutes to get this straight, because once you can see the parts clearly the whole operation becomes obvious and safe. Every WordPress install is really three separate things living in the same folder:

• The core program, which is what you reinstall. This is WordPress itself, the engine. It lives in two folders, wp-admin and wp-includes, plus a set of loose .php files in the root such as index.php, wp-login.php, wp-settings.php and wp-load.php. These files are identical on every WordPress site in the world running the same version. They contain none of your content and none of your settings, which is exactly why they are safe to throw away and replace: a fresh copy from WordPress.org is a perfect substitute.
• Your content and customisation, which you never touch. This is the single folder wp-content, and it holds everything that is unique to your site: your themes, your plugins, and the uploads folder with every image and media file you have added. Nothing in here is part of core and nothing here is replaced by a reinstall.
• Your configuration and your data, which you also never touch. The file wp-config.php in the root holds your database name, username, password and secret keys. The .htaccess file holds your permalink and redirect rules. And your actual posts, pages, users, comments and settings live not in any file at all but in your MySQL database. A core reinstall changes none of these.

So reinstalling core swaps out the first group and leaves the second and third groups exactly as they are. You are replacing the engine while keeping the bodywork, the fuel and the number plate. This is why it is such a clean repair: a damaged engine is a solved problem, because a brand-new, guaranteed-genuine engine is a free download away, and dropping it in cannot disturb anything you care about.

When to Reinstall Core, and When It Will Not Help

Reinstalling core is the right tool for a specific class of problem: the core files themselves are wrong. That happens more often than you might think.

• A failed or interrupted update. If an update was cut short, by a timeout, a dropped connection, or a permissions error, you can be left with a mismatched set of core files, half old and half new. The classic sign is a site stuck on "Briefly unavailable for scheduled maintenance", which is caused by a leftover .maintenance file, often alongside a broken update. A reinstall of the matching version puts a consistent set of files back in place.
• A white screen or fatal error that survives disabling plugins and switching themes. If you have already ruled out plugins and the theme (the usual first suspects) and the site is still broken, damaged core files become a real possibility worth ruling out. It is worth diagnosing the exact error first; the Noiz guide to fixing common WordPress errors helps you narrow it down before you reach for this.
• A checksum mismatch. If a scan (or the WP-CLI command shown later) reports that a core file no longer matches WordPress.org's official copy, that file has been altered. A reinstall restores the genuine version.
• Malware cleanup. One of the commonest things malware does is inject itself into core files, because they are always present and rarely inspected. Overwriting every core file with a clean copy removes that injected code in a single stroke. It is important to understand that this is only part of a cleanup, not the whole of it, and there is a dedicated section on that below.

Equally, it is worth knowing when a reinstall is the wrong tool, so you do not waste effort on it. It will not fix a problem caused by a plugin or theme, because those live in wp-content, which a core reinstall deliberately leaves untouched. It will not fix an "Error establishing a database connection", because that is a configuration or database problem, not a core-files problem. And it will not, on its own, remove malware that has taken up residence in your plugins, uploads, database or .htaccess. Match the repair to the fault.

Before You Start: Back Up (Not Optional)

Even though a correct reinstall is safe, you are about to delete folders and overwrite files, and the golden rule of any such operation is that you never do it without a way back. Take a full backup first: both the files and the database. On Noiz hosting you can download your files over SFTP or through the File Manager, and export your database through phpMyAdmin in your control panel. If your site is on a managed Noiz plan, you can simply ask the Noiz support team to take a fresh backup for you before you begin, or to perform the reinstall on your behalf. Do not skip this step because the reinstall "should" be safe. A backup costs a few minutes and turns any mistake into a five-minute restore instead of a disaster.

The Golden Rule: What You Must Never Overwrite

This is the single most important part of the whole article, so it gets its own section. Whichever method you use, three things must survive completely untouched. Losing any of them is the one way to turn a routine repair into real data loss.

• Never delete or overwrite wp-content. This is your themes, your plugins and every image you have ever uploaded. If you are replacing files by hand, copy into this folder only if you have a specific reason to; for a pure core reinstall you should not be writing to it at all.
• Never delete or overwrite wp-config.php. This holds your database credentials and security keys. Without it, WordPress cannot find your content and behaves as if it has never been installed, sending you to the setup screen.
• Never delete your .htaccess file (and, if you have one, robots.txt or any other custom file you placed in the root). These hold your permalink rules and any redirects, and they are not part of WordPress core.

Here is the reassuring part, and the reason the manual method is safer than it sounds: the official WordPress download does not contain a wp-config.php or a .htaccess at all. It contains only a wp-config-sample.php. So when you unpack a fresh copy and upload its files, there is simply no file in the package that can overwrite your real configuration. Your wp-config.php will be safe. The only folder in the fresh download that overlaps with your content is wp-content (it ships with a default theme and one or two default plugins), and the methods below all show you how to avoid touching yours.

First, Find Out Which Version You Are Running

A clean repair replaces your core files with a fresh copy of the same version. Mixing a repair with an update at the same time makes it much harder to tell whether the reinstall fixed anything, and downloading the wrong version can leave your files and your database out of step. So before you download anything, note your current version. You can find it in any of these ways:

• In the dashboard, at the bottom-right of almost every admin screen, or on the Dashboard > Updates screen, which states the version plainly.
• Over SSH with WP-CLI, by running wp core version.
• In the file wp-includes/version.php, on the line beginning $wp_version.

If you are already on the latest release (7.0.2 at the time of writing) then a reinstall and an update amount to the same download, and you can use any method below. If you are deliberately on an older version, download that exact version from the release archive rather than the latest, so you repair without upgrading. The archive lets you fetch any version directly, for example https://wordpress.org/wordpress-7.0.2.zip.

Method 1: Reinstall From the Dashboard (Easiest)

If you can still log in to WordPress, this is by far the simplest route and needs no file access at all. WordPress can reinstall its own core files for you.

1. Log in and go to Dashboard > Updates.
2. When you are already running the current version, WordPress shows a message that you have the latest version, followed by a button labelled Re-install version 7.0.2 (the number matches whatever is current). Click it.
3. WordPress downloads a fresh copy of that version and drops the core files into place, leaving your content, plugins, themes and database alone. When it finishes, you are done.

This method reinstalls the current version only, and it needs a working login, so it is the wrong choice if the damage has locked you out or if you are pinned to an older version you do not want to change. In those cases use Method 2 or Method 3. One caveat worth knowing: because it relies on WordPress writing to its own files, a permissions problem on the server can make it fall back to asking for connection credentials, or fail outright; if it does, the manual method sidesteps that entirely.

Method 2: Reinstall With WP-CLI (Precise and Fast)

If you have SSH access, WP-CLI is the cleanest way to do this. It is exact, it is quick, and it can tell you both what is wrong before you start and whether you fixed it afterwards. Managed-plan clients can ask the Noiz support team to run these steps.

Start by asking WordPress which core files, if any, do not match the official copies. This tells you whether a reinstall is warranted and exactly what it will fix:

wp core verify-checksums

If everything is genuine you will see a success message. If not, you will get a line for each altered file and an overall warning that the installation does not verify against checksums. Note that this command only checks WordPress core files against WordPress.org; it does not and cannot verify your plugins or themes in wp-content, because those are not part of core. A clean checksum result therefore does not prove your whole site is clean, only that the engine is genuine.

To reinstall, download a fresh copy of your current version straight over the top of the existing core files:

wp core download --version=$(wp core version) --skip-content --force

Two options in that command are doing important work:

• --skip-content tells WP-CLI to fetch WordPress without the default themes and plugins, so the download contains nothing that could be written into your wp-content folder. This is what keeps your themes, plugins and uploads guaranteed untouched. Do not leave it out.
• --force allows the download to overwrite the core files that are already there. Without it, WP-CLI refuses to run because it sees an existing installation.

Then confirm the repair worked by verifying again. This time it should come back clean:

wp core verify-checksums

One honest limitation: a reinstall overwrites genuine core files, but it does not delete files that were never part of core in the first place. If malware dropped an extra rogue .php file into wp-includes or your root, that stray file is not on WordPress.org's list and so is not removed by the download; verify-checksums with the --include-root option can help flag such unexpected root files, but removing them is a separate step covered in the malware section below.

Method 3: Manual File Replacement (SFTP or File Manager)

This is the method to reach for when you cannot log in, when the automated methods fail on permissions, or when you simply want to see and control every file yourself. It is the same procedure the official documentation uses for a manual update, applied to the same version rather than a newer one. It works entirely over SFTP or your control panel's File Manager, so it needs no dashboard access.

Step 1: Download and Unpack a Fresh Copy

Download the matching version zip from WordPress.org (the latest from https://wordpress.org/latest.zip, or a specific version such as https://wordpress.org/wordpress-7.0.2.zip from the release archive) onto your own computer, and unzip it. You will get a folder called wordpress containing the fresh wp-admin and wp-includes folders, a fresh wp-content, and the loose root files. Note again what it does not contain: no wp-config.php, no .htaccess.

Step 2: Deactivate Plugins If You Can

If you still have dashboard access, deactivate your plugins first; it reduces the chance of a conflict while the files are in flux, and you will reactivate them at the end. If you are locked out, skip this and carry on; you can deal with plugins afterwards.

Step 3: Delete the Old Core Folders

Connect over SFTP or open the File Manager, and navigate to your WordPress root (on Noiz hosting this is usually the document root of your domain, for yourdomain.com replace with your own). Delete the existing wp-admin and wp-includes folders entirely. This is deliberate: deleting them first, rather than merging over the top, guarantees that no stale or malicious file survives inside them. Do not delete anything else. Leave wp-content, wp-config.php and .htaccess exactly where they are.

Step 4: Upload the Fresh Core Folders

Upload the new wp-admin and wp-includes folders from your unpacked copy into the root, in place of the ones you just deleted.

Step 5: Overwrite the Loose Root Files

Upload all the loose files from the root of the unpacked wordpress folder (files like index.php, wp-login.php, wp-settings.php, wp-cron.php and so on) into your root, overwriting the existing ones when prompted. Because the package has no wp-config.php or .htaccess in it, this cannot touch your configuration. Your wp-config.php stays exactly as it was.

Step 6: Leave wp-content Alone

For a pure repair, do not copy the fresh wp-content over yours at all. The only reason you would ever copy anything from it is if a default theme or the bundled default plugin was itself damaged, and even then you copy only the individual affected file into your existing wp-content, never the whole folder. If in any doubt, leave wp-content completely untouched.

Step 7: Clear a Stuck Maintenance Message

If your site was showing "Briefly unavailable for scheduled maintenance", look in the root for a hidden file named .maintenance and delete it. That file is what puts WordPress into maintenance mode, and a failed update sometimes leaves it behind. (In the File Manager you may need to enable "show hidden files" to see it.)

Step 8: Finish in the Dashboard

Visit yourdomain.com/wp-admin. If WordPress needs to bring the database into step with the code, it will show a "database update required" prompt; click through it. Then reactivate any plugins you deactivated, and if you run a caching plugin or server cache, clear it so visitors see the repaired site immediately rather than a stale copy.

If You Are Reinstalling as Part of a Malware Cleanup

Reinstalling core is one of the strongest single moves in a malware cleanup, because it replaces every genuine core file with a known-clean version in one pass, wiping out any code injected into wp-admin, wp-includes or the root .php files. But it is a step, not the finish line, and treating it as the whole job is how reinfections happen. To understand why, remember what a core reinstall leaves alone: your wp-content, your database and your .htaccess. Attackers know this too, which is why they also hide:

• Backdoors and injected code inside plugins, themes and the uploads folder, none of which a core reinstall touches. These need to be found and cleaned or replaced separately, ideally by reinstalling each plugin and theme from a trusted source too.
• Rogue extra files dropped into core folders or the root that were never part of WordPress. Because they are not genuine core files, overwriting core does not remove them; they must be identified and deleted.
• Malicious rules in .htaccess, which a core reinstall preserves along with your legitimate rules.
• Injected content or admin users in the database.

After a cleanup, you should also change every password and rotate your security keys, and it is wise to assume the attacker knew your admin credentials. If you find you cannot get back in, the Noiz guide to resetting a WordPress admin password via phpMyAdmin covers regaining access. For the full picture of hardening a site so it stays clean, work through the Noiz WordPress Security Checklist. If your site is compromised and you are unsure how deep it goes, open a ticket with the Noiz support team; a reinstall of core is a good first move, but a proper cleanup is worth doing thoroughly.

Troubleshooting

• Symptom: after the reinstall the site sends you to the setup screen asking to configure a database. Your wp-config.php is missing or was overwritten. Restore it from your backup. This is exactly the file the golden-rule section warns never to touch, and it is why the fresh download deliberately excludes it.
• Symptom: the site is stuck on "Briefly unavailable for scheduled maintenance" even after replacing the files. Delete the hidden .maintenance file in your WordPress root, which the earlier steps describe.
• Symptom: you see a "failed update" notice after the reinstall. Same cause as above; remove the .maintenance file to clear it.
• Symptom: WordPress prompts that a database update is required. This is normal and safe if you reinstalled a newer version than before; click through the prompt at yourdomain.com/wp-admin/upgrade.php. If you only meant to repair the current version, it means the version you downloaded was newer than the one you were running; that is fine, but it is now an update as well as a repair.
• Symptom: verify-checksums still reports altered files after a WP-CLI reinstall. Make sure you verified against the same version you are running by including --version, and remember the command flags files that were added as well as changed; a stray non-core file needs deleting by hand, it is not something the download will remove.
• Symptom: the dashboard re-install button asks for FTP or connection details, or fails. This is a filesystem permissions situation on the server. Use the WP-CLI or manual method instead, which do not depend on WordPress writing to its own files, or ask Noiz support to check ownership and permissions.
• Symptom: your theme or plugin settings look reset after the reinstall. A pure core reinstall cannot cause this, because those settings live in wp-content and the database, neither of which core touches. It points to the fresh wp-content having been copied over yours by mistake; restore wp-content from your backup.

If you are not sure whether reinstalling core is the right fix for what you are seeing, or you would rather not delete and replace files by hand, open a support ticket with the Noiz support team. Tell them your domain, the symptom you are chasing, and whether you can still log in, and a technician can confirm the diagnosis, take a safety backup, and reinstall core cleanly on your behalf, on both the South African and Irish platforms.