Pick what your repository holds and get a .gitignore that keeps WordPress core, uploads, caches and secrets out of Git, and keeps your own code in.

What does the repo hold?

Whole siteRepo root is the folder with wp-config.php

wp-contentRepo root is wp-content

One pluginRepo root is the plugin folder

One themeRepo root is the theme folder

Options

Ignore WordPress coreTrack only wp-content. WordPress updates core itself.

Ignore OS and editor files.DS_Store, Thumbs.db, .idea/, .vscode/

Only track these pluginsFolder names, comma separated. Leave empty to track every plugin.

Only track these themesFolder names, comma separated. Leave empty to track every theme.

Ignore Composer vendor/

Ignore build output (build/, dist/)

Only ignore these if something builds them on the server. WordPress runs whatever is in the folder, and most Git deploys (WP Pusher included) copy the repo as-is. If vendor/ or build/ is missing from the repo, it's missing from the site.

.gitignore

# .gitignore for a whole WordPress site (repo root = the folder with wp-config.php)
# Made with https://wppusher.com/tools/gitignore/

# WordPress core: WordPress installs and updates it, so keep it out of Git
/wp-admin/
/wp-includes/
/index.php
/license.txt
/readme.html
/xmlrpc.php
/wp-*.php

# Config and secrets that differ per server
/wp-config.php
/.htaccess
/.user.ini
/wordfence-waf.php
.env
.env.*
!.env.example
auth.json

# Uploads and files WordPress generates
/wp-content/uploads/
/wp-content/upgrade/
/wp-content/upgrade-temp-backup/
/wp-content/fonts/
/wp-content/languages/

# Caches and the drop-ins caching plugins write
/wp-content/cache/
/wp-content/et-cache/
/wp-content/litespeed/
/wp-content/w3tc-config/
/wp-content/wp-rocket-config/
/wp-content/advanced-cache.php
/wp-content/object-cache.php
/wp-content/wp-cache-config.php

# Backups, security logs and database dumps
/wp-content/ai1wm-backups/
/wp-content/updraft/
/wp-content/backups-dup-lite/
/wp-content/wflogs/
*.sql
*.sql.gz

# Dependencies
node_modules/

# Logs
*.log

# OS and editor files
.DS_Store
._*
Thumbs.db
Desktop.ini
.idea/
.vscode/
*.swp
*~

Before you commit

Three things the file won't do for you

It won't untrack files you already committed

A .gitignore only stops new files from being added. If wp-config.php or uploads/ is already in the repo, remove it from the index (the files stay on disk):

git rm -r --cached wp-config.php wp-content/uploads

If a secret was ever committed, change it. It's still in the history.

Check a path before you trust it

git check-ignore -v path/to/file prints the rule that matches, or nothing if the file is tracked. git status --ignored lists everything being ignored.

Some lines are judgment calls

The whole-site file ignores .htaccess because WordPress rewrites it. Delete that line if you hand-edit it. languages/ is ignored because WordPress downloads translations. Delete that line if you ship your own.

Then deploy it

Push to GitHub, and the site updates

WP Pusher installs a plugin or theme straight from GitHub, Bitbucket or GitLab and updates it when you push. It runs inside WordPress, so the server needs no Git and no SSH. It deploys plugins and themes, not WordPress core, which is the same line this file draws.

Download WP Pusher

WordPress .gitignore generator

Three things the file won't do for you

It won't untrack files you already committed

Check a path before you trust it

Some lines are judgment calls

Push to GitHub, and the site updates

Level up with WP Pusher