When the WordPress core gets updated, it overwrites the core installation with any new updates included in the release. If the core has been chopped up and modified beforehand, it’ll wipe out those changes. That means big sections of the installation will just stop working.<\/p>\n\n\n\n
Worse, modifying the core can have all kinds of unintended consequences, like preventing updates from working correctly, further screwing up an installation. But wait! There’s more! Even worse than that is the potential to introduce unintended security vulnerabilities. Messing with core files could easily introduce a hole in WordPress\u2019 security, allowing hackers to take over a site.<\/p>\n\n\n\n Now that we\u2019ve hammered home why you shouldn’t edit core files, let\u2019s take a quick nerd moment to look through their structure. Here\u2019s what a base directory looks like:<\/p>\n\n\n\n That\u2019s the WordPress Core in its entirety. The folders So if we aren’t supposed to edit the core, who is? Let’s talk about the people who implement features and push out updates. Lead developers, core developers, and guest committers, many of whom work for WordPress\u2019 parent company Automattic, all work together to maintain the WordPress core. Some core developers and guest committers, however, contribute either on their own accord or because they\u2019re associated with another WordPress related company. Because WordPress is fully open source, anyone is free to contribute documentation and code to the codebase. However, commit access on the core is limited, and any new contributions go through a code review process.<\/p>\n\n\n\n WordPress developers utilize a formalized release cycle for major releases, and according to the core handbook, release cycles are broken down into five phases:<\/p>\n\n\n\n 1. Planning and securing team leads<\/strong> 2. Development work begins<\/strong> 3. Beta testing<\/strong> 4. Release candidate<\/strong> 5. Launch<\/strong> This phase is repeated for each release cycle, with major point releases being published two or three times a year. There are also usually several security releases, which come in the form of sub points, like 4.0.1. 4.0.1 is a fix for some security vulnerabilities discovered in version 4.0 that needed to be repaired. Security releases do not include any new features\u2014they just focus on hardening the security of WordPress.<\/p>\n\n\n\n It\u2019s always a good idea to update to the latest available version of WordPress. Also, make sure to use themes and plugins that aren’t version dependent or specific. WordPress is an incredibly popular platform, which makes it a prime target for hackers. Hackers give WordPress a lot of extra scrutiny because of how widely it\u2019s used.<\/p>\n\n\n\n WordPress plugin developers and core developers work hard to keep the platform as secure as possible and to immediately release patches for any discovered vulnerabilities. That\u2019s why keeping WordPress updated is so important\u2014you\u2019ll stay ahead of the hackers while getting to use all of the great new features introduced by developers. You can update the core via the WordPress admin panel manually, although hosts like WP Engine<\/a> will update it for you automatically, keeping your sites patched and secure.<\/p>\n\n\n\n Getting involved with an open-source project can be an immensely rewarding experience, and your contributions have an opportunity to impact hundreds or even thousands of people. For WordPress specifically, there\u2019s a great deal of work to do for developers and nondevelopers alike. It\u2019s always great to write code and contribute to the functionality of your favorite open-source projects, but WordPress also requires a great deal of technical documentation and copy editing as well.<\/p>\n\n\n\n WordPress.org maintains the Codex, which is a large repository of information surrounding WordPress, including information such as technical documentations, How Tos, and introductions to WordPress. The Codex has a section dedicated to contributors<\/a> and discusses in detail how you can get involved in valuable, important work that doesn\u2019t involve writing and committing code.<\/p>\n\n\n\n![\"never-edit-wordpress-core-1\"](\"https:\/\/getflywheel-images.s3.us-east-2.amazonaws.com\/uploads\/2014\/12\/DSC_0294_900.jpg\")
<\/figure>\n\n\n\nUnderstand the Core’s File Structure<\/h3>\n\n\n\n
license.txt\n readme.html\n wp-activate.php\n wp-admin\/\n wp-blog-header.php\n wp-comments-post.php\n wp-config-sample.php\n wp-content\/\n wp-cron.php\n wp-includes\/\n wp-links-opml.php\n wp-load.php\n wp-login.php\n wp-mail.php\n wp-settings.php\n wp-signup.php\n wp-trackback.php\n xmlrpc.php<\/code><\/pre>\n\n\n\nwp-admin<\/code>, wp-content<\/code>, and wp-includes<\/code> have the bulk of the code that powers WordPress, namely the back-end code that powers the WordPress dashboard, for example.<\/p>\n\n\n\nFamiliarize Yourself With the Core’s Release Cycle<\/h3>\n\n\n\n
Discussions and planning take place regarding the features and fixes that need to be made, and developers are assigned different tasks and\/or take the lead on specific feature implementations.<\/p>\n\n\n\n
Actual feature implementation and bugfixes begin. At this point, implementing actual code and performing automated tests is done by developers and team\/project leads coordinate the arrangement.<\/p>\n\n\n\n
After development work has made significant progress, the codebase is released to beta testers and anyone who is interested in living on the bleeding edge. Users discover and report bugs and other inconsistencies with the new code, and developers make fixes accordingly. At this point, no new features are added.<\/p>\n\n\n\n
Once everything is locked in, final tests are run on the codebase to ensure its stability, security, and implementation.<\/p>\n\n\n\n
The release is launched to the public and available on every WordPress admin console for downloading.<\/p>\n\n\n\nUpdate to Decrease Your Site’s Vulnerability<\/h3>\n\n\n\n
![\"never-edit-wordpress-core-2\"](\"https:\/\/getflywheel-images.s3.us-east-2.amazonaws.com\/uploads\/2014\/12\/never-edit-wordpress-core-2.jpg\")
<\/figure>\n\n\n\nGet Involved<\/h3>\n\n\n\n