Manually upgrading WordPress gives you direct control over which files are replaced and can restore access when automatic updates fail. However, mistakes can cause downtime or data loss. The safe approach is to back up the entire site, verify compatibility, replace only the correct core files, run any required database update, and test everything before considering the job complete.
Introduction to Manual WordPress Upgrades#
A manual WordPress upgrade replaces the site’s core software without using the one-click updater in the WordPress dashboard. You download a clean WordPress package, access the server through cPanel File Manager or FTP, replace the existing core directories and files, and then complete the upgrade in the administration area.
This process does not normally replace your content, database, plugins, uploaded media, or custom themes. Those resources reside primarily in the database and the wp-content directory. Nevertheless, deleting the wrong directory or uploading an incomplete package can break the site, so preparation is essential.
The instructions below assume WordPress is installed in public_html. Your installation may instead be in a subdirectory, so confirm that you are working in the folder containing wp-admin, wp-includes, and wp-config.php.
Why You Might Need to Upgrade Manually#
The dashboard updater is usually the easiest option, but it is not always available. A manual upgrade may be appropriate when:
- An automatic update stops midway.
- The dashboard is inaccessible or displays an update-related error.
- File permissions prevent WordPress from replacing its own files.
- A previous upgrade left the installation with missing or inconsistent core files.
- You need greater control over deployment and testing.
- You are restoring a site after malware removal and want clean core files.
Staying current matters because WordPress releases can contain security patches, bug fixes, compatibility changes, and performance improvements. An outdated installation may also become incompatible with supported PHP versions, browsers, themes, or plugins.
Updating core alone does not eliminate every risk. Vulnerable or abandoned plugins and themes can expose an otherwise current installation. Treat a core upgrade as one part of broader WordPress maintenance rather than a complete security solution.
Preparing Your Site: Backup and Compatibility Checks#
Never begin by deleting files. First create independent backups of both the database and the website files. A file backup cannot replace a missing database, while a database export does not preserve media, themes, plugins, or configuration files.
In Ruachost cPanel, open File Manager, locate the WordPress directory, select its contents, and use Compress to create a ZIP archive. Download that archive to your computer rather than leaving your only copy on the same server.
Next, open phpMyAdmin, select the WordPress database, choose Export, and perform a Quick SQL export. If you are unsure which database WordPress uses, inspect the DB_NAME value in wp-config.php without modifying or sharing its credentials.
A complete pre-upgrade backup should cover the following assets:
Asset | Why it matters | Suggested backup |
|---|---|---|
Database | Stores posts, settings and users | SQL export |
| Contains media, plugins and themes | ZIP or FTP copy |
| Contains site configuration | Secure file copy |
Root files | May include verification files and rules | Full directory archive |
| Controls routing and server rules | Separate secure copy |
Store at least one copy away from the live hosting account. Ideally, verify that the archive opens and that the SQL export is not empty; a backup is useful only if it can be restored.
Before upgrading, also:
- Review the target WordPress release notes.
- Check active plugin and theme compatibility.
- Confirm that the server’s PHP and database versions meet current requirements.
- Identify abandoned extensions that have not received recent maintenance.
- Record important functions that must be tested, such as forms, checkout, membership access, search, and media uploads.
- Perform the upgrade on a staging copy first when the website is business-critical.
Choose a low-traffic maintenance window. Notify relevant administrators and avoid publishing or processing orders while the database and files are being changed.
Downloading the Latest WordPress Version#
Download the release directly from WordPress.org. Avoid packages from file-sharing websites, email attachments, or unofficial download pages because you cannot safely assume that their contents are unchanged.
The download will usually be a .zip or .tar.gz archive. Extract it on your computer and confirm that the resulting wordpress folder contains the expected core directories and root files.
If you intend to use cPanel File Manager, you can upload the archive and extract it on the server. However, do not extract it blindly over the live installation. Doing so may create a nested directory such as public_html/wordpress instead of replacing files in public_html.
Keep the original archive until testing is complete. It provides a clean source if an upload fails and individual core files need to be transferred again.
Deactivating Plugins and Themes#
Before replacing core files, log in to WordPress and deactivate all plugins. This reduces the chance that plugin code will run against a mixture of old and new core files while the transfer is underway.
Make a note or screenshot of the active plugins first. If the site uses caching, clear its cache before deactivating the caching plugin.
You do not ordinarily need to delete plugins or themes. Nor must you automatically deactivate the active theme for every core update. If the theme is old, heavily customized, or not confirmed as compatible, switch temporarily to a current default WordPress theme. Test that default theme before beginning so that you know it works.
Component | Recommended action | Reason |
|---|---|---|
Plugins | Deactivate temporarily | Reduces upgrade conflicts |
Active compatible theme | Leave installed | Preserves presentation |
Questionable theme | Switch to a default theme | Helps isolate compatibility issues |
Caching layer | Purge and pause | Prevents stale output |
Security plugin | Record settings, then deactivate | May block file replacement |
After the core and database upgrades are finished, reactivate extensions gradually rather than all at once. This makes any conflict easier to identify.
If the dashboard is already inaccessible, plugin deactivation can be forced by temporarily renaming the wp-content/plugins directory in File Manager. Restore its original name after the upgrade; WordPress may still require you to reactivate plugins from the dashboard.
Transferring New WordPress Files#
You can transfer files through cPanel File Manager or FTP. File Manager is convenient for uploading and extracting one archive, while FTP makes it easier to monitor many individual transfers.
Method | Best for | Main concern |
|---|---|---|
cPanel File Manager | Fast archive uploads | Extracting into the wrong folder |
FTP | Controlled file-by-file transfer | Interrupted or incomplete uploads |
SSH | Experienced administrators | Destructive command mistakes |
Whichever method you choose, verify the destination before replacing anything.
First, delete the old wp-admin and wp-includes directories from the live installation. Then upload the corresponding new directories from the downloaded package. Deleting these two directories before uploading prevents obsolete core files from remaining behind.
Next, upload the new root-level WordPress files and overwrite their old versions. These include files such as index.php, wp-login.php, and wp-settings.php.
Handle the main areas as follows:
Location | Action | Important warning |
|---|---|---|
| Delete and replace | Use the complete new directory |
| Delete and replace | Do not merge with an incomplete upload |
Root core files | Upload and overwrite | Preserve site-specific files |
| Keep the existing directory | Never delete it during a core update |
| Keep the existing file | Do not overwrite configuration |
The fresh package may include a wp-content directory containing default themes or language resources. Do not replace your live directory wholesale. If you need a new default theme or language file, copy only the required items into the existing directory.
Also preserve .htaccess, verification files, custom server configuration, and any site-specific root files. Direct modifications to WordPress core files will be overwritten; custom functionality should instead live in a child theme or custom plugin.
After the upload, compare file counts where possible and review the transfer log for failed or skipped files. An incomplete upload commonly produces blank pages, missing-function errors, or server errors.
Finalizing the Upgrade Process#
Once file replacement is complete, visit your administration area at https://example.com/wp-admin/. WordPress will inspect the installed core and database versions. If a database update is required, follow the Update WordPress Database prompt, which may appear at https://example.com/wp-admin/upgrade.php.
Do not refresh repeatedly or close the page while the database operation is running. Larger sites may need more time to complete.
Afterward:
- Sign in to the dashboard and confirm the displayed WordPress version.
- Visit Settings → Permalinks and save only if routes return errors.
- Reactivate essential plugins one at a time.
- Restore the normal theme if you switched to a default theme.
- Purge plugin, server, CDN, and browser caches.
- Remove uploaded installation archives and temporary extracted folders.
- Create a new backup after the site has passed testing.
If you paused a maintenance page, remove it only when both public and administrative functions are stable.
Testing and Troubleshooting Post-upgrade#
Test the website as both a signed-out visitor and an administrator. Do not rely solely on the homepage, because failures often affect only forms, account pages, scheduled tasks, or protected areas.
Check the homepage, several posts or pages, navigation, search, login, media uploads, contact forms, comments, and mobile layouts. For an online store, also test product pages, the cart, checkout, transactional email, and the customer account area without placing an unintended live order.
Common problems can often be isolated systematically:
Symptom | Likely cause | First response |
|---|---|---|
Blank page or | PHP or plugin conflict | Disable plugins and inspect logs |
Missing functions or files | Incomplete transfer | Re-upload clean core files |
Broken layout | Cache or theme conflict | Purge caches and test a default theme |
Repeated database prompt | Mismatched files or permissions | Re-upload and verify access rights |
Stuck maintenance message | Remaining | Remove it from the WordPress root |
Dashboard works, pages fail | Rewrite-rule problem | Resave permalinks and inspect |
If disabling all plugins resolves the problem, reactivate them one at a time and test after each activation. If the problem persists with plugins disabled, switch to a default theme. This sequence distinguishes an extension conflict from a core, PHP, or server issue.
Enable debugging only temporarily and avoid displaying technical errors to public visitors. Review the hosting error log for the exact failing plugin, theme, function, or file. If the site cannot be recovered promptly, restore both the file and database backups so that they represent the same point in time.
Tips for Maintaining a Secure WordPress Site#
A successful upgrade is not the end of maintenance. Use a repeatable routine that reduces the chance of another emergency update:
- Apply supported WordPress security releases promptly.
- Update plugins and themes after checking compatibility.
- Remove inactive extensions and themes that are no longer required.
- Replace abandoned software rather than keeping it indefinitely.
- Use unique passwords and enable multi-factor authentication where available.
- Give administrator access only to users who need it.
- Maintain automated off-server backups and test restoration periodically.
- Use HTTPS and renew TLS certificates before expiration.
- Monitor uptime, unexpected file changes, administrator accounts, and security alerts.
- Keep PHP on a supported version compatible with the site.
- Avoid editing core WordPress files.
- Test substantial changes on staging before deploying them to production.
Updates can also support performance and search visibility by maintaining compatibility with modern PHP versions, browsers, and optimized assets. More importantly, keeping the site uncompromised helps prevent malware warnings, injected pages, redirects, and spam content from damaging visitor trust and organic visibility.
Conclusion and Resources#
A safe manual WordPress upgrade follows a deliberate order: create restorable file and database backups, check compatibility, deactivate plugins, replace wp-admin, wp-includes, and root core files, preserve wp-content and wp-config.php, run the database upgrade, and test critical functions. If anything fails, stop changing files, inspect the error, and restore the synchronized backups when necessary.
For the official process and release-specific guidance, consult the WordPress updating documentation. If you need a reliable environment for your WordPress website, explore hosting and support options at Ruachost.
