A WordPress theme runs code and controls templates throughout the site, so it must be selected and maintained with the same care as a plugin. Visual appearance is not evidence of safe code, reliable updates or a clean handover.
Use a trusted distribution
Obtain free themes from the official WordPress directory or paid themes from a known vendor account controlled by the business. Do not use “nulled” commercial packages or copies supplied without a verifiable update route. Keep invoices, licence access and the original package information.
Check maintenance signals
- Recent releases and clear compatibility information
- Support route and documentation
- Current WordPress/PHP expectations
- Public security-response process or responsible vendor contact
- Number and purpose of required companion plugins
- Ability to update without overwriting approved custom work
Separate custom code with a child theme or plugin
Direct edits to a third-party parent theme can be overwritten by updates. Use a child theme for appropriate presentation customisation and a separate site-specific plugin for functionality that should survive a theme change. Document every custom file, hook and build step.
Remove inactive and abandoned themes
Keep one supported fallback theme if the maintenance process uses it for diagnosis, but remove unnecessary inactive themes after a verified backup. Inactive code still exists on the server and can create attack surface if it contains a vulnerability.
Test updates safely
| Area | Check |
|---|---|
| Templates | Homepage, articles, archives, search, 404 and custom post types |
| Responsive layout | Navigation, long headings, tables and forms on small screens |
| Accessibility | Keyboard, focus, headings, contrast and error messages |
| Commerce | Product, basket, checkout, account and email templates |
| Custom work | Child theme, hooks, CSS/JS and template overrides |
| Performance | Unexpected scripts, fonts, layout shift and cache behaviour |
Protect the editing routes
Limit who can install or edit themes. Consider disabling dashboard file editing when it fits the deployment process. Use secure file transfer and correct ownership/permissions; do not make directories broadly writable merely to force an update through.
Plan for vendor failure
Keep a current export or source copy of custom work and record the replacement route. If a theme becomes abandoned, do not wait for a crisis: plan a controlled migration while the existing site still works and can be compared.
Theme security warning signs
- The package cannot be linked to an official directory or vendor account.
- Updates require replacing files manually with no change record.
- The theme bundles abandoned or duplicated plugins.
- Support recommends broad writable permissions as a permanent fix.
- Custom business functionality is embedded directly in the parent theme.
Any one warning does not prove compromise, but it justifies a controlled technical review before the next update or public launch.
Practical next step
Identify the active parent theme, child theme and companion plugins, then confirm who owns each update/licence route and whether custom work would survive the next update.
Sources and date checked
This guide was checked on 21 July 2026. WordPress, plugins, hosting platforms and commercial terms change, so confirm the current documentation and licence details before making a material change.
Keep the decision under your control
Retain the relevant accounts, source material, supplier terms and recovery information. Recheck changing prices, interfaces and rules before acting.