If you want to download WordPress, there is exactly one place you should get it from: wordpress.org. The software is free and open source, so there is never a reason to pay for a copy or grab one from a mirror site. This guide walks through the safe way to get a WordPress download, what is inside the package, how to verify it has not been tampered with, where older versions and test builds live, and what to do once the file is on your computer.
Where to download WordPress safely
The official page is wordpress.org/download. It always offers the latest stable release as a .zip file, with a .tar.gz alternative for people working on Linux or macOS servers. Both contain identical files; pick whichever your tools handle more easily.
A few rules keep you out of trouble:
- Use wordpress.org, not wordpress.com. WordPress.com is a hosted service run by Automattic. It does not offer the software as a download. If the difference is new to you, see WordPress.org vs WordPress.com.
- Ignore third-party “download” sites. Repackaged copies can contain injected code. The same applies to “nulled” premium themes and plugins.
- Never pay for core WordPress. You may pay for hosting, themes or plugins, but the core software is licensed under the GPL and is free.
Localized versions
WordPress is translated into many languages. Localized packages are available from the language-specific wordpress.org sites, and you can also install the standard English package and switch the language later under Settings → General → Site Language, which downloads the translation files for you.
Do you even need to download WordPress?
Many people searching for a WordPress download do not actually need the file. Consider these routes first:
| Route | Download the zip yourself? | Best for |
|---|---|---|
| Host one-click installer | No, the host fetches it | Most new sites on shared or managed hosting |
| WP-CLI | No, wp core download fetches it | Developers and servers with shell access |
| Local app (Studio, LocalWP) | No, the app handles it | Testing and building on your own computer |
| Manual install | Yes | Hosts without an installer, custom setups, learning |
All of these pull from the same official source. Our step-by-step guide on how to install WordPress covers each route in detail.
What is inside the WordPress zip
Unzip the package and you get a single folder called wordpress. Its contents fall into three groups.
The three directories
wp-adminholds the dashboard: the screens and logic behind everything you do after logging in.wp-includesholds the core libraries: the block editor scripts, the database layer, the REST API, the hooks system and much more.wp-contentis yours. It containsthemes(the most recent default Twenty-something themes),plugins(Akismet and Hello Dolly), and later your uploads. Updates never overwrite your own themes, plugins or media here.
The root files
index.phpis the entry point for every front-end request.wp-config-sample.phpis the template for your configuration file. You copy it towp-config.phpand add database details, or the installer does it for you.wp-login.php,wp-cron.php,xmlrpc.php,wp-settings.php,wp-load.phpand a handful of others handle logins, scheduled tasks, remote publishing and bootstrapping.readme.htmlandlicense.txtdescribe the release and the GPL license.
Notice what is not included: there is no database. WordPress creates its tables during installation, which is why you need a MySQL or MariaDB database ready before you start. The database tables guide explains what gets created.
Verifying your download with checksums
A checksum is a short fingerprint of a file. If even one byte changes, the fingerprint changes. The releases page lists MD5 and SHA-1 checksums alongside each package, so you can confirm your copy matches the official one.
Generate the checksum of your downloaded file and compare it with the published value:
# Linux
sha1sum latest.zip
# macOS
shasum -a 1 latest.zip
# Windows PowerShell
Get-FileHash latest.zip -Algorithm SHA1If the strings match, the file is intact. If they do not, delete it and download again directly from wordpress.org.
Checking an existing install
Checksums are just as useful after installation. WP-CLI can compare every core file on a live site against the official checksums for its version, which is a quick way to spot modified or injected files after a suspected hack:
wp core verify-checksumsAny file it flags should be investigated. Pair this with the steps in our security hardening guide.
Older versions, betas and nightly builds
The release archive
Every past release is kept on the releases page. Legitimate reasons to download an older version include reproducing a bug, restoring a site to the exact version it ran before a failed update, or testing a plugin against an older branch. With WP-CLI you can request one directly:
wp core download --version=6.4.3Do not run an old version on a public site. The WordPress project states that only the latest release is actively supported, and while the security team has historically backported some fixes to older branches, you should not rely on that. If a plugin forces you to stay on an old version, the plugin is the problem.
Betas and release candidates
Before each major release, the project publishes beta and release candidate (RC) builds, announced on the official WordPress news blog. Testing them on a staging copy is the best way to catch problems with your theme or plugins before the stable release lands. The easiest route is the WordPress Beta Tester plugin, which switches a test site to beta or nightly updates. Nightly builds, which change every day, are also available from wordpress.org and via wp core download --version=nightly.
Keep betas, RCs and nightlies off production sites. They are for testing.
What to do after you download WordPress
Once you have a verified package, the path to a working site is short. Check the current server requirements on wordpress.org first: you need a supported PHP version, MySQL or MariaDB, and HTTPS is strongly recommended. Our guide to hosting WordPress covers what to look for in a host. Then:
- Create a database and a database user with full privileges on it, usually from your hosting control panel.
- Upload the contents of the
wordpressfolder to your web root by SFTP or the host’s file manager. Upload the files inside the folder, not the folder itself, unless you want WordPress in a subdirectory. - Visit your domain in a browser. The installer asks for the database name, user, password and host, and writes
wp-config.phpfor you. - Enter a site title, an admin username (not “admin”), a strong password and your email.
- Log in, set Settings → Permalinks to “Post name”, delete the sample content, and choose a theme.
Choosing a theme is the next big decision. Modern block themes let you edit every template visually in the Site Editor; if you run a news, magazine or sports site, the StepFox theme catalogue has block themes built for those. Whatever you choose, set up backups before you start adding content.
Frequently asked questions
Is it free to download WordPress?
Yes. WordPress is free, open-source software released under the GPL. You pay only for things around it, such as a domain, hosting and any premium themes or plugins.
Can I run WordPress on my own computer?
Yes. Local tools such as WordPress Studio or LocalWP set up a full environment without you configuring a server. That is ideal for learning and testing before you go live.
Do I need to download WordPress again to update it?
Usually not. Updates run from Dashboard → Updates, and minor security releases install automatically by default. A manual download is only needed if automatic updates fail or are disabled.
Key takeaways
- Only download WordPress from wordpress.org; it is free, and repackaged copies are a security risk.
- Most people never need the zip: host installers, WP-CLI and local apps fetch it for you.
- Verify the package against the published checksums, and use
wp core verify-checksumson live sites. - Older versions, betas and nightlies are for testing only; production sites should run the latest release.
- After downloading, prepare a database, upload the files, run the installer and set up backups.
