diff --git a/.htaccess b/.htaccess
index 7db5d3e..732b3e4 100644
--- a/.htaccess
+++ b/.htaccess
@@ -112,12 +112,6 @@ DirectoryIndex index.php index.html index.htm
   # uncomment the following line:
   # RewriteBase /
 
-  # Redirect common PHP files to their new locations.
-  RewriteCond %{REQUEST_URI} ^(.*)?/(install.php) [OR]
-  RewriteCond %{REQUEST_URI} ^(.*)?/(rebuild.php)
-  RewriteCond %{REQUEST_URI} !core
-  RewriteRule ^ %1/core/%2 [L,QSA,R=301]
-
   # Pass all requests not referring directly to files in the filesystem to
   # index.php.
   RewriteCond %{REQUEST_FILENAME} !-f
@@ -129,8 +123,6 @@ DirectoryIndex index.php index.html index.htm
   # Note: The following URI conditions are not anchored at the start (^),
   # because Drupal may be located in a subdirectory. To further improve
   # security, you can replace '!/' with '!^/'.
-  # Allow access to PHP files in /core (like authorize.php or install.php):
-  RewriteCond %{REQUEST_URI} !/core/[^/]*\.php$
   # Allow access to test-specific PHP files:
   RewriteCond %{REQUEST_URI} !/core/modules/system/tests/https?.php$
   # Allow access to Statistics module's custom front controller.
diff --git a/authorize.php b/authorize.php
new file mode 100644
index 0000000..28da6f5
--- /dev/null
+++ b/authorize.php
@@ -0,0 +1,53 @@
+<?php
+
+/**
+ * @file
+ * Administrative script for running authorized file operations.
+ *
+ * Using this script, the site owner (the user actually owning the files on the
+ * webserver) can authorize certain file-related operations to proceed with
+ * elevated privileges, for example to deploy and upgrade modules or themes.
+ * Users should not visit this page directly, but instead use an administrative
+ * user interface which knows how to redirect the user to this script as part of
+ * a multistep process. This script actually performs the selected operations
+ * without loading all of Drupal, to be able to more gracefully recover from
+ * errors. Access to the script is controlled by a global killswitch in
+ * settings.php ('allow_authorize_operations') and via the 'administer software
+ * updates' permission.
+ *
+ * There are helper functions for setting up an operation to run via this
+ * system in core/modules/system/system.module. For more information, see:
+ * @link authorize Authorized operation helper functions @endlink
+ *
+ * @see authorize.inc
+ */
+
+use Drupal\Core\DrupalKernel;
+use Symfony\Component\HttpKernel\Exception\HttpExceptionInterface;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+$autoloader = require_once __DIR__ . '/core/vendor/autoload.php';
+
+/**
+ * Global flag to identify update.php and authorize.php runs.
+ *
+ * Identifies update.php and authorize.php runs, avoiding unwanted operations
+ * such as css/js preprocessing and translation, and solves some theming issues.
+ * The flag is checked in other places in Drupal code (not just authorize.php).
+ */
+const MAINTENANCE_MODE = 'update';
+
+try {
+  $request = Request::createFromGlobals();
+  $kernel = DrupalKernel::createFromRequest($request, $autoloader, 'prod');
+  $kernel->prepareLegacyRequest($request);
+}
+catch (HttpExceptionInterface $e) {
+  $response = new Response('', $e->getStatusCode());
+  $response->prepare($request)->send();
+  exit;
+}
+
+require_once __DIR__ . '/core/includes/authorize.inc';
+authorize_send_response($request);
diff --git a/core/authorize.php b/core/authorize.php
deleted file mode 100644
index d033b7e..0000000
--- a/core/authorize.php
+++ /dev/null
@@ -1,161 +0,0 @@
-<?php
-
-/**
- * @file
- * Administrative script for running authorized file operations.
- *
- * Using this script, the site owner (the user actually owning the files on the
- * webserver) can authorize certain file-related operations to proceed with
- * elevated privileges, for example to deploy and upgrade modules or themes.
- * Users should not visit this page directly, but instead use an administrative
- * user interface which knows how to redirect the user to this script as part of
- * a multistep process. This script actually performs the selected operations
- * without loading all of Drupal, to be able to more gracefully recover from
- * errors. Access to the script is controlled by a global killswitch in
- * settings.php ('allow_authorize_operations') and via the 'administer software
- * updates' permission.
- *
- * There are helper functions for setting up an operation to run via this
- * system in modules/system/system.module. For more information, see:
- * @link authorize Authorized operation helper functions @endlink
- */
-
-use Drupal\Core\DrupalKernel;
-use Drupal\Core\Url;
-use Symfony\Component\HttpKernel\Exception\HttpExceptionInterface;
-use Symfony\Component\HttpFoundation\Request;
-use Symfony\Component\HttpFoundation\Response;
-use Drupal\Core\Site\Settings;
-
-// Change the directory to the Drupal root.
-chdir('..');
-
-$autoloader = require_once __DIR__ . '/vendor/autoload.php';
-
-/**
- * Global flag to identify update.php and authorize.php runs.
- *
- * Identifies update.php and authorize.php runs, avoiding unwanted operations
- * such as css/js preprocessing and translation, and solves some theming issues.
- * The flag is checked in other places in Drupal code (not just authorize.php).
- */
-const MAINTENANCE_MODE = 'update';
-
-/**
- * Determines if the current user is allowed to run authorize.php.
- *
- * The killswitch in settings.php overrides all else, otherwise, the user must
- * have access to the 'administer software updates' permission.
- *
- * @return bool
- *   TRUE if the current user can run authorize.php, and FALSE if not.
- */
-function authorize_access_allowed() {
-  \Drupal::service('session_manager')->start();
-  return Settings::get('allow_authorize_operations', TRUE) && \Drupal::currentUser()->hasPermission('administer software updates');
-}
-
-try {
-  $request = Request::createFromGlobals();
-  $kernel = DrupalKernel::createFromRequest($request, $autoloader, 'prod');
-  $kernel->prepareLegacyRequest($request);
-}
-catch (HttpExceptionInterface $e) {
-  $response = new Response('', $e->getStatusCode());
-  $response->prepare($request)->send();
-  exit;
-}
-
-// We have to enable the user and system modules, even to check access and
-// display errors via the maintenance theme.
-\Drupal::moduleHandler()->addModule('system', 'core/modules/system');
-\Drupal::moduleHandler()->addModule('user', 'core/modules/user');
-\Drupal::moduleHandler()->load('system');
-\Drupal::moduleHandler()->load('user');
-
-// Initialize the maintenance theme for this administrative script.
-drupal_maintenance_theme();
-
-$content = [];
-$show_messages = TRUE;
-
-$response = new Response();
-if (authorize_access_allowed()) {
-  // Load both the Form API and Batch API.
-  require_once __DIR__ . '/includes/form.inc';
-  require_once __DIR__ . '/includes/batch.inc';
-
-  if (isset($_SESSION['authorize_page_title'])) {
-    $page_title = $_SESSION['authorize_page_title'];
-  }
-  else {
-    $page_title = t('Authorize file system changes');
-  }
-
-  // See if we've run the operation and need to display a report.
-  if (isset($_SESSION['authorize_results']) && $results = $_SESSION['authorize_results']) {
-
-    // Clear the session out.
-    unset($_SESSION['authorize_results']);
-    unset($_SESSION['authorize_operation']);
-    unset($_SESSION['authorize_filetransfer_info']);
-
-    if (!empty($results['page_title'])) {
-      $page_title = $results['page_title'];
-    }
-    if (!empty($results['page_message'])) {
-      drupal_set_message($results['page_message']['message'], $results['page_message']['type']);
-    }
-
-    $content['authorize_report'] = array(
-      '#theme' => 'authorize_report',
-      '#messages' => $results['messages'],
-    );
-
-    $links = array();
-    if (is_array($results['tasks'])) {
-      $links += $results['tasks'];
-    }
-    else {
-      $links = array_merge($links, array(
-        \Drupal::l(t('Administration pages'), new Url('system.admin')),
-        \Drupal::l(t('Front page'), new Url('<front>')),
-      ));
-    }
-
-    $content['next_steps'] = array(
-      '#theme' => 'item_list',
-      '#items' => $links,
-      '#title' => t('Next steps'),
-    );
-  }
-  // If a batch is running, let it run.
-  elseif ($request->query->has('batch')) {
-    $content = ['#markup' => _batch_page($request)];
-  }
-  else {
-    if (empty($_SESSION['authorize_operation']) || empty($_SESSION['authorize_filetransfer_info'])) {
-      $content = ['#markup' => t('It appears you have reached this page in error.')];
-    }
-    elseif (!$batch = batch_get()) {
-      // We have a batch to process, show the filetransfer form.
-      $content = \Drupal::formBuilder()->getForm('Drupal\Core\FileTransfer\Form\FileTransferAuthorizeForm');
-    }
-  }
-  // We defer the display of messages until all operations are done.
-  $show_messages = !(($batch = batch_get()) && isset($batch['running']));
-}
-else {
-  $response->setStatusCode(403);
-  \Drupal::logger('access denied')->warning('authorize.php');
-  $page_title = t('Access denied');
-  $content = ['#markup' => t('You are not allowed to access this page.')];
-}
-
-if (!empty($content)) {
-  $response->headers->set('Content-Type', 'text/html; charset=utf-8');
-  $response->setContent(\Drupal::service('bare_html_page_renderer')->renderBarePage($content, $page_title, 'maintenance_page', array(
-    '#show_messages' => $show_messages,
-  )));
-  $response->send();
-}
diff --git a/core/includes/authorize.inc b/core/includes/authorize.inc
new file mode 100644
index 0000000..bf0f58b
--- /dev/null
+++ b/core/includes/authorize.inc
@@ -0,0 +1,130 @@
+<?php
+
+/**
+ * @file
+ * API functions for the script for running authorized file operations.
+ *
+ * @see authorize.php
+ */
+
+use Drupal\Core\Url;
+use Symfony\Component\HttpKernel\Exception\HttpExceptionInterface;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Drupal\Core\Site\Settings;
+
+/**
+ * Determines if the current user is allowed to run authorize.php.
+ *
+ * The killswitch in settings.php overrides all else, otherwise, the user must
+ * have access to the 'administer software updates' permission.
+ *
+ * @return bool
+ *   TRUE if the current user can run authorize.php, and FALSE if not.
+ */
+function authorize_access_allowed() {
+  \Drupal::service('session_manager')->start();
+  return Settings::get('allow_authorize_operations', TRUE) && \Drupal::currentUser()->hasPermission('administer software updates');
+}
+
+/**
+ * Sends a response containing the page for authorized file operations.
+ *
+ * @param \Symfony\Component\HttpFoundation\Request $request
+ *   The request object.
+ */
+function authorize_send_response(Request $request) {
+  // We have to enable the user and system modules, even to check access and
+  // display errors via the maintenance theme.
+  \Drupal::moduleHandler()->addModule('system', 'core/modules/system');
+  \Drupal::moduleHandler()->addModule('user', 'core/modules/user');
+  \Drupal::moduleHandler()->load('system');
+  \Drupal::moduleHandler()->load('user');
+
+  // Initialize the maintenance theme for this administrative script.
+  drupal_maintenance_theme();
+
+  $content = [];
+  $show_messages = TRUE;
+
+  $response = new Response();
+  if (authorize_access_allowed()) {
+    // Load both the Form API and Batch API.
+    require_once __DIR__ . '/form.inc';
+    require_once __DIR__ . '/batch.inc';
+
+    if (isset($_SESSION['authorize_page_title'])) {
+      $page_title = $_SESSION['authorize_page_title'];
+    }
+    else {
+      $page_title = t('Authorize file system changes');
+    }
+
+    // See if we've run the operation and need to display a report.
+    if (isset($_SESSION['authorize_results']) && $results = $_SESSION['authorize_results']) {
+
+      // Clear the session out.
+      unset($_SESSION['authorize_results']);
+      unset($_SESSION['authorize_operation']);
+      unset($_SESSION['authorize_filetransfer_info']);
+
+      if (!empty($results['page_title'])) {
+        $page_title = $results['page_title'];
+      }
+      if (!empty($results['page_message'])) {
+        drupal_set_message($results['page_message']['message'], $results['page_message']['type']);
+      }
+
+      $content['authorize_report'] = array(
+        '#theme' => 'authorize_report',
+        '#messages' => $results['messages'],
+      );
+
+      $links = array();
+      if (is_array($results['tasks'])) {
+        $links += $results['tasks'];
+      }
+      else {
+        $links = array_merge($links, array(
+          \Drupal::l(t('Administration pages'), new Url('system.admin')),
+          \Drupal::l(t('Front page'), new Url('<front>')),
+        ));
+      }
+
+      $content['next_steps'] = array(
+        '#theme' => 'item_list',
+        '#items' => $links,
+        '#title' => t('Next steps'),
+      );
+    }
+    // If a batch is running, let it run.
+    elseif ($request->query->has('batch')) {
+      $content = ['#markup' => _batch_page($request)];
+    }
+    else {
+      if (empty($_SESSION['authorize_operation']) || empty($_SESSION['authorize_filetransfer_info'])) {
+        $content = ['#markup' => t('It appears you have reached this page in error.')];
+      }
+      elseif (!$batch = batch_get()) {
+        // We have a batch to process, show the filetransfer form.
+        $content = \Drupal::formBuilder()->getForm('Drupal\Core\FileTransfer\Form\FileTransferAuthorizeForm');
+      }
+    }
+    // We defer the display of messages until all operations are done.
+    $show_messages = !(($batch = batch_get()) && isset($batch['running']));
+  }
+  else {
+    $response->setStatusCode(403);
+    \Drupal::logger('access denied')->warning('authorize.php');
+    $page_title = t('Access denied');
+    $content = ['#markup' => t('You are not allowed to access this page.')];
+  }
+
+  if (!empty($content)) {
+    $response->headers->set('Content-Type', 'text/html; charset=utf-8');
+    $response->setContent(\Drupal::service('bare_html_page_renderer')->renderBarePage($content, $page_title, 'maintenance_page', array(
+      '#show_messages' => $show_messages,
+    )));
+    $response->send();
+  }
+}
diff --git a/core/includes/common.inc b/core/includes/common.inc
index 5d88545..ac4fd01 100644
--- a/core/includes/common.inc
+++ b/core/includes/common.inc
@@ -500,12 +500,12 @@ function _format_date_callback(array $matches = NULL, $new_langcode = NULL) {
  * @deprecated in Drupal 8.x-dev, will be removed before Drupal 8.0.0.
  *   Use \Drupal\Core\Url::fromRoute() for internal paths served by Drupal
  *   controllers or \Drupal\Core\Url::fromUri() for external paths or
- *   non-controller or sub-domain URIs such as core/install.php. Note that
+ *   non-controller or sub-domain URIs such as install.php. Note that
  *   \Drupal\Core\Url::fromUri() expects a valid URI including the scheme. URIs
  *   from the same sub-domain that are not handled by Drupal controllers should
  *   use the base: scheme. For example:
  * @code
- * $installer_url = \Drupal\Core\Url::fromUri('base:core/install.php')->toString();
+ * $installer_url = \Drupal\Core\Url::fromUri('base:install.php')->toString();
  * $external_url = \Drupal\Core\Url::fromUri('http://example.com', ['query' => ['foo' => 'bar']])->toString();
  * $internal_url = \Drupal\Core\Url::fromRoute('system.admin')->toString();
  * @endcode
@@ -601,16 +601,16 @@ function drupal_http_header_attributes(array $attributes = array()) {
  * @see _url()
  * @see system_page_attachments()
  * @deprecated in Drupal 8.x-dev, will be removed before Drupal 8.0.0.
- *   Use \Drupal::l($text, $url) where $url is an instance of
- *   \Drupal\Core\Url. To build a \Drupal\Core\Url object for internal paths
- *   served by Drupal controllers use \Drupal\Core\Url::fromRoute(). For
- *   external paths or non-controller or sub-domain URIs such as
- *   core/install.php use \Drupal\Core\Url::fromUri(). Note that
- *   \Drupal\Core\Url::fromUri() expects a valid URI including the scheme. URIs
- *   from the same sub-domain that are not handled by Drupal controllers should
- *   be prepended with base:. For example:
+ *   Use \Drupal::l($text, $url) where $url is an instance of \Drupal\Core\Url.
+ *   To build a \Drupal\Core\Url object for internal paths served by Drupal
+ *   controllers use \Drupal\Core\Url::fromRoute(). For external paths or
+ *   non-controller or sub-domain URIs such as install.php use
+ *   \Drupal\Core\Url::fromUri(). Note that \Drupal\Core\Url::fromUri() expects
+ *   a valid URI including the scheme. URIs from the same sub-domain that are
+ *   not handled by Drupal controllers should be prepended with base:.
+ *   For example:
  * @code
- * $installer_url = \Drupal\Core\Url::fromUri('base:core/install.php')->toString();
+ * $installer_url = \Drupal\Core\Url::fromUri('base:install.php')->toString();
  * $installer_link = \Drupal::l($text, $installer_url);
  * $external_url = \Drupal\Core\Url::fromUri('http://example.com', ['query' => ['foo' => 'bar']])->toString();
  * $external_link = \Drupal::l($text, $external_url);
diff --git a/core/includes/install.core.inc b/core/includes/install.core.inc
index f98c64d..3418cc4 100644
--- a/core/includes/install.core.inc
+++ b/core/includes/install.core.inc
@@ -894,7 +894,7 @@ function install_get_form($form_id, array &$install_state) {
  * @see install_full_redirect_url()
  */
 function install_redirect_url($install_state) {
-  return 'core/install.php?' . UrlHelper::buildQuery($install_state['parameters']);
+  return 'install.php?' . UrlHelper::buildQuery($install_state['parameters']);
 }
 
 /**
diff --git a/core/lib/Drupal/Core/DrupalKernel.php b/core/lib/Drupal/Core/DrupalKernel.php
index bc36c15..d110f8a 100644
--- a/core/lib/Drupal/Core/DrupalKernel.php
+++ b/core/lib/Drupal/Core/DrupalKernel.php
@@ -240,7 +240,7 @@ public static function createFromRequest(Request $request, $class_loader, $envir
     // installed yet (i.e., if no $databases array has been defined in the
     // settings.php file) and we are not already installing.
     if (!Database::getConnectionInfo() && !drupal_installation_attempted() && PHP_SAPI !== 'cli') {
-      $response = new RedirectResponse($request->getBasePath() . '/core/install.php');
+      $response = new RedirectResponse($request->getBasePath() . '/install.php');
       $response->prepare($request)->send();
     }
 
@@ -825,15 +825,7 @@ protected function initializeRequestGlobals(Request $request) {
       // For a request URI of '/index.php/foo', $_SERVER['SCRIPT_NAME'] is
       // '/index.php', whereas $_SERVER['PHP_SELF'] is '/index.php/foo'.
       if ($dir = rtrim(dirname($request->server->get('SCRIPT_NAME')), '\/')) {
-        // Remove "core" directory if present, allowing install.php,
-        // authorize.php, and others to auto-detect a base path.
-        $core_position = strrpos($dir, '/core');
-        if ($core_position !== FALSE && strlen($dir) - 5 == $core_position) {
-          $base_path = substr($dir, 0, $core_position);
-        }
-        else {
-          $base_path = $dir;
-        }
+        $base_path = $dir;
         $base_url .= $base_path;
         $base_path .= '/';
       }
diff --git a/core/lib/Drupal/Core/Session/SessionConfiguration.php b/core/lib/Drupal/Core/Session/SessionConfiguration.php
index 9de1603..a73c75a 100644
--- a/core/lib/Drupal/Core/Session/SessionConfiguration.php
+++ b/core/lib/Drupal/Core/Session/SessionConfiguration.php
@@ -99,9 +99,6 @@ protected function getUnprefixedName(Request $request) {
       // Otherwise use $base_url as session name, without the protocol
       // to use the same session identifiers across HTTP and HTTPS.
       $session_name = $request->getHost() . $request->getBasePath();
-      // Replace "core" out of session_name so core scripts redirect properly,
-      // specifically install.php.
-      $session_name = preg_replace('#/core$#', '', $session_name);
     }
 
     return substr(hash('sha256', $session_name), 0, 32);
diff --git a/core/modules/simpletest/src/InstallerTestBase.php b/core/modules/simpletest/src/InstallerTestBase.php
index 11e9076..6d5beb8 100644
--- a/core/modules/simpletest/src/InstallerTestBase.php
+++ b/core/modules/simpletest/src/InstallerTestBase.php
@@ -100,7 +100,7 @@ protected function setUp() {
 
     // Set up a minimal container (required by WebTestBase).
     // @see install_begin_request()
-    $request = Request::create($GLOBALS['base_url'] . '/core/install.php');
+    $request = Request::create($GLOBALS['base_url'] . '/install.php');
     $this->container = new ContainerBuilder();
     $request_stack = new RequestStack();
     $request_stack->push($request);
@@ -121,7 +121,7 @@ protected function setUp() {
       ->set('app.root', DRUPAL_ROOT);
     \Drupal::setContainer($this->container);
 
-    $this->drupalGet($GLOBALS['base_url'] . '/core/install.php');
+    $this->drupalGet($GLOBALS['base_url'] . '/install.php');
 
     // Select language.
     $this->setUpLanguage();
diff --git a/core/modules/simpletest/src/Tests/SimpleTestBrowserTest.php b/core/modules/simpletest/src/Tests/SimpleTestBrowserTest.php
index e384a3c..e394903 100644
--- a/core/modules/simpletest/src/Tests/SimpleTestBrowserTest.php
+++ b/core/modules/simpletest/src/Tests/SimpleTestBrowserTest.php
@@ -77,7 +77,7 @@ public function testInternalBrowser() {
     // @see drupal_valid_test_ua()
     // Not using File API; a potential error must trigger a PHP warning.
     unlink($this->siteDirectory . '/.htkey');
-    $this->drupalGet(Url::fromUri('base:core/install.php', array('external' => TRUE, 'absolute' => TRUE))->toString());
+    $this->drupalGet(Url::fromUri('base:install.php', array('external' => TRUE, 'absolute' => TRUE))->toString());
     $this->assertResponse(403, 'Cannot access install.php.');
   }
 
diff --git a/core/modules/system/src/Tests/Installer/InstallerExistingInstallationTest.php b/core/modules/system/src/Tests/Installer/InstallerExistingInstallationTest.php
index 08198db..d71fbdd 100644
--- a/core/modules/system/src/Tests/Installer/InstallerExistingInstallationTest.php
+++ b/core/modules/system/src/Tests/Installer/InstallerExistingInstallationTest.php
@@ -29,12 +29,12 @@ protected function setUp() {
    */
   public function testInstaller() {
     // Verify that Drupal can't be immediately reinstalled.
-    $this->drupalGet($GLOBALS['base_url'] . '/core/install.php');
+    $this->drupalGet($GLOBALS['base_url'] . '/install.php');
     $this->assertRaw('Drupal already installed');
 
     // Delete settings.php and attempt to reinstall again.
     unlink($this->siteDirectory . '/settings.php');
-    $this->drupalGet($GLOBALS['base_url'] . '/core/install.php');
+    $this->drupalGet($GLOBALS['base_url'] . '/install.php');
     $this->setUpLanguage();
     $this->setUpProfile();
     $this->setUpSettings();
diff --git a/core/modules/system/src/Tests/Installer/InstallerLanguagePageTest.php b/core/modules/system/src/Tests/Installer/InstallerLanguagePageTest.php
index ce573ba..82b6bf3 100644
--- a/core/modules/system/src/Tests/Installer/InstallerLanguagePageTest.php
+++ b/core/modules/system/src/Tests/Installer/InstallerLanguagePageTest.php
@@ -25,7 +25,7 @@ protected function setUpLanguage() {
     touch(\Drupal::root() . '/' . $this->siteDirectory . '/files/translations/drupal-8.0.0.xoxo.po');
 
     // Check that all predefined languages show up with their native names.
-    $this->drupalGet($GLOBALS['base_url'] . '/core/install.php');
+    $this->drupalGet($GLOBALS['base_url'] . '/install.php');
     foreach (\Drupal::languageManager()->getStandardLanguageList() as $langcode => $names) {
       $this->assertOption('edit-langcode', $langcode);
       $this->assertRaw('>' . $names[1] . '<');
diff --git a/core/modules/system/system.module b/core/modules/system/system.module
index 007595e..8136c73 100644
--- a/core/modules/system/system.module
+++ b/core/modules/system/system.module
@@ -422,7 +422,7 @@ function system_authorized_init($callback, $file, $arguments = array(), $page_ti
 function system_authorized_get_url(array $options = array()) {
   global $base_url;
   // Prefix with $base_url so url() treats it as an external link.
-  $url = Url::fromUri('base:core/authorize.php');
+  $url = Url::fromUri('base:authorize.php');
   $url_options = $url->getOptions();
   $url->setOptions($options + $url_options);
   return $url;
diff --git a/core/modules/system/tests/modules/system_test/src/Controller/SystemTestController.php b/core/modules/system/tests/modules/system_test/src/Controller/SystemTestController.php
index 5b4bf73..f483c4b 100644
--- a/core/modules/system/tests/modules/system_test/src/Controller/SystemTestController.php
+++ b/core/modules/system/tests/modules/system_test/src/Controller/SystemTestController.php
@@ -162,7 +162,7 @@ public static function preRenderCacheTags($elements) {
    * @see system_authorized_init().
    */
   public function authorizeInit($page_title) {
-    $authorize_url = Url::fromUri('base:core/authorize.php', array('absolute' => TRUE))->toString();
+    $authorize_url = Url::fromUri('base:authorize.php', array('absolute' => TRUE))->toString();
     system_authorized_init('system_test_authorize_run', drupal_get_path('module', 'system_test') . '/system_test.module', array(), $page_title);
     return new RedirectResponse($authorize_url);
   }
diff --git a/core/modules/update/update.module b/core/modules/update/update.module
index e3eba3f..065e40c 100644
--- a/core/modules/update/update.module
+++ b/core/modules/update/update.module
@@ -616,7 +616,7 @@ function update_verify_update_archive($project, $archive_file, $directory) {
   // Make sure this isn't a tarball of Drupal core.
   if (
     file_exists("$directory/$project/index.php")
-    && file_exists("$directory/$project/core/install.php")
+    && file_exists("$directory/$project/install.php")
     && file_exists("$directory/$project/core/includes/bootstrap.inc")
     && file_exists("$directory/$project/core/modules/node/node.module")
     && file_exists("$directory/$project/core/modules/system/system.module")
diff --git a/core/tests/Drupal/Tests/Core/Session/SessionConfigurationTest.php b/core/tests/Drupal/Tests/Core/Session/SessionConfigurationTest.php
index dbd9497..1644524 100644
--- a/core/tests/Drupal/Tests/Core/Session/SessionConfigurationTest.php
+++ b/core/tests/Drupal/Tests/Core/Session/SessionConfigurationTest.php
@@ -182,7 +182,7 @@ public function providerTestGeneratedSessionName() {
       ['http://subdomain.example.com/path/index.php', 'SESS', 'subdomain.example.com'],
       ['http://example.com:8080/path/index.php', 'SESS', 'example.com'],
       ['https://example.com/path/index.php', 'SSESS', 'example.com'],
-      ['http://example.com/path/core/install.php', 'SESS', 'example.com'],
+      ['http://example.com/path/install.php', 'SESS', 'example.com'],
       ['http://localhost/path/index.php', 'SESS', 'localhost'],
       ['http://127.0.0.1/path/index.php', 'SESS', '127.0.0.1'],
       ['http://127.0.0.1:8888/path/index.php', 'SESS', '127.0.0.1'],
@@ -230,7 +230,7 @@ public function providerTestEnforcedSessionName() {
       ['http://subdomain.example.com/path/index.php', 'SESS', '.example.com'],
       ['http://example.com:8080/path/index.php', 'SESS', '.example.com'],
       ['https://example.com/path/index.php', 'SSESS', '.example.com'],
-      ['http://example.com/path/core/install.php', 'SESS', '.example.com'],
+      ['http://example.com/path/install.php', 'SESS', '.example.com'],
       ['http://localhost/path/index.php', 'SESS', '.example.com'],
       ['http://127.0.0.1/path/index.php', 'SESS', '.example.com'],
       ['http://127.0.0.1:8888/path/index.php', 'SESS', '.example.com'],
diff --git a/core/install.php b/install.php
similarity index 84%
rename from core/install.php
rename to install.php
index 3493d4a..73b5b0e 100644
--- a/core/install.php
+++ b/install.php
@@ -5,9 +5,6 @@
  * Initiates a browser-based installation of Drupal.
  */
 
-// Change the directory to the Drupal root.
-chdir('..');
-
 /**
  * Global flag to indicate the site is in installation mode.
  *
@@ -27,6 +24,6 @@
 }
 
 // Start the installer.
-$class_loader = require_once __DIR__ . '/vendor/autoload.php';
-require_once __DIR__ . '/includes/install.core.inc';
+$class_loader = require_once __DIR__ . '/core/vendor/autoload.php';
+require_once __DIR__ . '/core/includes/install.core.inc';
 install_drupal($class_loader);
diff --git a/core/rebuild.php b/rebuild.php
similarity index 76%
rename from core/rebuild.php
rename to rebuild.php
index 7ca8af7..8985ad4 100644
--- a/core/rebuild.php
+++ b/rebuild.php
@@ -17,19 +17,16 @@
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 
-// Change the directory to the Drupal root.
-chdir('..');
-
-$autoloader = require_once __DIR__ . '/vendor/autoload.php';
-require_once __DIR__ . '/includes/utility.inc';
+$autoloader = require_once __DIR__ . '/core/vendor/autoload.php';
+require_once __DIR__ . '/core/includes/utility.inc';
 
 $request = Request::createFromGlobals();
 // Manually resemble early bootstrap of DrupalKernel::boot().
-require_once __DIR__ . '/includes/bootstrap.inc';
+require_once __DIR__ . '/core/includes/bootstrap.inc';
 DrupalKernel::bootEnvironment();
 
 try {
-  Settings::initialize(dirname(__DIR__), DrupalKernel::findSitePath($request), $autoloader);
+  Settings::initialize(__DIR__, DrupalKernel::findSitePath($request), $autoloader);
 }
 catch (HttpExceptionInterface $e) {
   $response = new Response('', $e->getStatusCode());
@@ -46,5 +43,6 @@
   drupal_rebuild($autoloader, $request);
   drupal_set_message('Cache rebuild complete.');
 }
-$base_path = dirname(dirname($request->getBaseUrl()));
+
+$base_path = dirname($request->getBaseUrl());
 header('Location: ' . $base_path);