What Is in the WordPress wp-content Folder? Themes, Plugins and Uploads

Applies to: WordPress 7.1.2

wp-content is the folder that holds everything that makes a WordPress site yours: themes, plugins and uploaded media. The core folders wp-admin and wp-includes are replaced on every WordPress update; wp-content is left alone, so this is where your customisations must live.

What a fresh WordPress contains

The official WordPress 7.1.2 download has only three things in wp-content:

• themes/: the default themes (Twenty Twenty-Five, Twenty Twenty-Four and Twenty Twenty-Three) and any theme you install.
• plugins/: Akismet and Hello Dolly (hello.php) plus every plugin you add.
• index.php: a file that only says // Silence is golden., so that visitors can’t list the folder’s contents.

Folders that appear later

• uploads/: your media, sorted by year and month (for example uploads/2026/09/). Usually the largest folder.
• upgrade/: temporary files during updates.
• languages/: translations, once you use a language other than English.
• mu-plugins/: “must-use” plugins that always load and can’t be switched off in the dashboard. You or a developer create this folder.
• cache/ and plugin folders such as backups: created by caching and backup plugins.
• Drop-ins such as advanced-cache.php, object-cache.php or db.php: files placed by plugins to replace parts of WordPress.
• debug.log: WordPress’s error log, when debugging is turned on (see WordPress critical error).

Find what uses the space

cd ~/public_html/wp-content
du -sh * | sort -h

In cPanel’s File Manager, the Size column shows the same for files; use Disk Usage in cPanel for folders.

Back it up

A full WordPress backup is the wp-content folder, the database and wp-config.php (which sits one level up, next to wp-content). The core files can always be downloaded again.

Permissions and security

• Folders 755, files 644, owned by your hosting user. Never use 777.
• No PHP file should run from uploads/. On Apache or LiteSpeed, add this .htaccess file inside wp-content/uploads:

  <Files *.php>
      Require all denied
  </Files>

  In our test, a PHP file in uploads returned 200 before and 403 after adding this file.
• Remove themes and plugins you don’t use; they still get attacked even when deactivated.

Moving a site: WordPress migration. Taking a site offline: maintenance mode.