How WordPress Works: The Architecture of a WordPress Site

Most people meet WordPress through its admin screens: a place to write posts, upload images and change settings. Underneath those screens is a piece of architecture that has stayed remarkably stable for twenty years, and that runs a large share of the web. W3Techs counts WordPress on 40.1% of all websites and 58.6% of the sites whose content management system it can identify.

This guide explains that architecture. Not how to use WordPress, but how it is built: what each layer does, how the layers hand work to each other, and why the boundaries between them are the key to a site that lasts. Each section links to an article that goes into more depth.

The layers of a WordPress site

Seen from the outside, a WordPress site is just pages. Seen from the inside, it is six layers, each depending on the one below it:

Layer	What it does	Where it lives
Hosting stack	Receives requests, runs PHP, stores data	Web server, PHP, MySQL or MariaDB
WordPress core	Handles requests, queries content, manages users and settings	The WordPress files
Content	Pages, posts, media, settings	The database
Blocks	The structure of each page’s content	Inside the content, as HTML
Theme	Templates and styles: how everything looks	wp-content/themes
Plugins	Extra features, attached through hooks	wp-content/plugins

The browser then receives the result as HTML, CSS and JavaScript, the three languages of the front end. We explain those in The Front End of a Website: HTML, CSS and JavaScript.

The hosting stack

WordPress is a PHP application that stores its data in a database. To run, it needs a web server, PHP and either MySQL or MariaDB. WordPress.org currently recommends PHP 8.3 or greater, MySQL 8.0 or MariaDB 10.11 or greater, HTTPS support, and Apache or Nginx as the web server. It still runs on older versions of PHP and MySQL, but those have reached their end of life and no longer receive security fixes.

This layer is usually your host’s job, but it shapes everything above it: speed, security and which features your site can use. We describe it in The WordPress Hosting Stack: PHP, MySQL and the Web Server.

How a request becomes a page

Every time someone opens a page, WordPress runs the same sequence. Learn WordPress’s tutorial on the request lifecycle sets it out:

1. The web server receives the request and, with pretty permalinks on, rewrites it to WordPress’s index.php file.
2. WordPress loads itself: its configuration, its core files, every active plugin and the active theme’s functions.
3. WordPress parses the request: it matches the address against its rewrite rules to work out what was asked for.
4. It queries the database for the matching content, or marks the request as a 404 if there is none.
5. The template loader picks a template from the theme, following the template hierarchy.
6. The template renders the HTML, which is sent to the browser.

Plugins can step in at many points along the way. We follow the whole journey in How WordPress Builds a Page.

The content layer

Everything you write lives in the database, not in files. A standard single-site installation creates twelve core tables. Posts, pages and navigation menu items all live in one table, wp_posts, with their extra details in wp_postmeta. Site settings live in wp_options; categories and tags in the term tables; users in wp_users and wp_usermeta.

That single table for content is a deliberate design. A page and a post are the same kind of object with a different type, which is why WordPress can add new types without new tables. Developers call them custom post types, and they are how a site gets products, events or case studies alongside its posts and pages. We cover the database in The WordPress Database: Where Your Content Lives and the content model in Custom Post Types and Taxonomies.

Blocks: the structure inside the content

Since WordPress 5.0, released in December 2018, the content of a page is made of blocks: paragraphs, headings, images, columns. In the database, blocks are not a special format. They are ordinary HTML with an HTML comment before and after each block naming it and holding its settings. Strip the comments and you have a normal web page.

That choice matters for longevity: content written in blocks stays readable by any theme, and by anything else that understands HTML. We explain the format in How WordPress Stores Blocks.

The presentation layer: themes

The theme decides how content is presented. In a block theme, that means three things: templates for each kind of page, template parts such as the header and footer, and a theme.json file that sets the design system, from colors and fonts to spacing and layout widths.

WordPress chooses which template to use for each request through the template hierarchy, a fixed order of fallbacks that always ends at the theme’s index template. We explain the order in The WordPress Template Hierarchy, the design file in theme.json Explained, and the building pieces in Templates, Template Parts and Block Patterns. The difference between the newer block themes and older classic themes is in Block Themes vs Classic Themes, and the safe way to customize a theme’s files is a WordPress child theme.

The extension layer: plugins and hooks

Plugins change what WordPress does without editing its files. They do it through hooks: points in WordPress’s code where it pauses and lets other code join in. The developer handbook describes hooks as a way for one piece of code to interact with or modify another at specific, predefined spots. Actions let a plugin do something at a given moment; filters let it change a value before WordPress uses it.

This is the reason WordPress can be updated without breaking every site that uses it: plugins attach to hooks, and the hooks stay put. We explain how in WordPress Hooks: How Plugins Change WordPress.

Where each feature belongs

With two extension layers, every feature has to live somewhere. The rule that keeps sites healthy is simple: the theme decides how things look, plugins decide what the site can do, and content belongs in blocks that any theme can display. The WordPress.org theme review rules enforce this for directory themes, listing features such as custom post types, shortcodes and SEO options as plugin territory.

Break the rule and a redesign becomes a migration: change the theme and the features it was holding go with it. We set out the boundary in Themes vs Plugins: Where Each Feature Belongs.

How the architecture is kept current

WordPress, themes and plugins all change over time. Since WordPress 3.7, minor releases of core install automatically in the background by default, while major releases wait for the site owner. Major releases follow a published cycle that the project adjusts from time to time: in April 2025 it moved to a single major release for that year, and 2026 has brought WordPress 7.0 in May and 7.1 in August. We explain the cycle and what each kind of update touches in How WordPress Releases and Updates Work.

The architecture also explains where risk sits. Patchstack’s report on WordPress security in 2026 counted 11,334 new vulnerabilities found in the WordPress ecosystem during 2025: 91% in plugins, 9% in themes and only six in core. The further a layer is from the core, the less reviewed its code tends to be, and the more it matters which extensions you choose.

Why the boundaries matter

Every principle of a well-built WordPress site comes back to keeping the layers in their place:

• Content in the database, in standard blocks, so it survives any change of theme.
• Design in the theme, set through theme.json and templates, so it can be changed in one place.
• Features in plugins, attached through hooks, so they survive any redesign.
• Core untouched, so it can be updated safely.

A site built this way can change its look, its host or its features one layer at a time. A site that mixes the layers ends up being rebuilt whenever any of them changes.

Where our products fit

Architecture is what our company is named after, and our themes and plugins are built around these boundaries: themes that only present, plugins that only add, and content that stays yours in standard blocks. Powering WP is the home of our WordPress work, with our themes at Powerful WP Themes and our plugins at Powerful WP Plugins. You can read more at Powering WP, or see the lists on our themes and plugins pages.