Is Your WordPress Theme Abandoned?

An abandoned theme does not announce itself. There is no warning in the dashboard, no email, no broken page. The site looks exactly as it did last year, which is precisely the problem: the thing that has stopped happening is invisible, and it stays invisible until the day PHP is upgraded, or a vulnerability is published, or the block editor changes something your theme was relying on. By then you are not making a decision. You are handling an incident.

Checking takes about five minutes. Here is how, and what to do with the answer.

How to check, in five minutes

Where you look depends on where the theme came from, and there are only three cases.

Free themes from WordPress.org

The easiest to check, because the information is public. Find your theme in the WordPress theme directory and look at two fields in the sidebar:

• Last updated. The date the developer last shipped anything.
• Tested up to. The most recent WordPress version the developer has confirmed it works with.

If your theme is not in the directory at all, that is its own answer. Themes are removed for guideline breaches, unpatched security issues, or at the author's request, and a theme that has been pulled will never update again no matter how long you wait.

Commercial themes

No public directory, so you are looking at the vendor. Find the changelog, which is usually on the product page or in your account area, and check the date of the most recent entry. Then check the vendor themselves: is the company still trading, is the support forum answered, was the last blog post three years ago.

Marketplace themes need one extra look. On a marketplace, an item can remain on sale long after the author has stopped supporting it, so the listing being live tells you nothing. Look at the last update date on the item and the date of the most recent author reply in the comments.

Custom themes

If somebody built the theme for you, there is no update to wait for and no changelog to read. That is not automatically a problem, but it makes the question sharper: who would fix it if it broke? If the answer is the agency that closed, or the freelancer who no longer replies, you are in the same position as an abandoned theme with extra steps.

Reading the answer honestly

This is where most advice goes wrong, because the two dates mean different things and neither is a verdict on its own.

Two honest caveats.

A simple theme genuinely needs fewer updates. A small, well-written theme that does very little may go eighteen months without a release because there was nothing to fix. Complexity is the variable: a theme bundling a page builder, a slider and a demo importer has far more surface to rot than one that renders posts.

Tested up to matters more than last updated. A developer who keeps that field current is at least still looking. One who has not confirmed compatibility across several WordPress releases has stopped paying attention, even if they pushed a small commit last spring.

What actually breaks, and in what order

Abandonment is not an event. It is a slow decay, and knowing the sequence tells you how much time you have.

First, nothing at all

For roughly the first year, an abandoned theme behaves exactly like a maintained one. WordPress is unusually good at backwards compatibility, so old code keeps running. This is the dangerous period, because everything working is taken as evidence that everything is fine.

Then PHP moves

Usually the first real break, and it arrives from your host rather than from WordPress. Hosts upgrade PHP because old versions stop receiving security fixes, and PHP publishes exactly when each version reaches end of life. A maintained theme is updated ahead of that. An abandoned one meets the new version unprepared, and the symptom is a fatal error or a white screen rather than a gentle warning.

Our guide to checking your PHP version covers where to find yours. If your host has emailed about an upcoming PHP upgrade and your theme has not been touched in three years, those two facts are related.

Then WordPress itself moves

Core changes rarely break old themes outright, but the gap widens. Features that assume modern theme support stop appearing, the block editor renders things the theme never anticipated, and new template capabilities pass you by. Nothing is broken exactly, but the site starts behaving like an older site, because it is one.

Then, eventually, security

The one that matters, and the reason this is worth checking rather than assuming.

The security part, specifically

A maintained theme with a vulnerability gets a patch. An abandoned theme with a vulnerability gets a public disclosure and nothing else.

That asymmetry is the whole risk. Vulnerability databases such as WPScan catalogue known issues in themes and plugins, and those catalogues are read by attackers as readily as by defenders. A disclosed flaw in an abandoned theme is a permanent, published, unfixable opening, and automated scanning finds every site running it.

Worth being proportionate. Most abandoned themes never have a serious vulnerability disclosed, and the ones at real risk are the complex ones: themes bundling their own plugins, handling file uploads, or shipping an outdated copy of a library. A simple abandoned theme is a much smaller worry than a complicated maintained one.

What removes the proportion entirely is a nulled theme, meaning a pirated copy of a commercial theme distributed free. Those are abandoned by definition, they never receive patches, and a meaningful share carry deliberately inserted backdoors. It is among the most common ways we find a site has been compromised, and it is covered in our guide to auditing a WordPress site. If a theme came from anywhere other than WordPress.org or the vendor, treat that as the finding.

What to do about it

Four options, and the right one depends on how much the theme is doing.

1. Nothing, deliberately

A legitimate answer, and it should be a decision rather than a default. It is reasonable if the theme is simple, came from WordPress.org, has no known vulnerabilities, and the site is small and not earning. Note the date, check again in six months, and be honest that you have chosen to accept the risk rather than forgotten about it.

2. Adopt it yourself

If the theme is free and open source, nothing stops you maintaining your own copy. This makes sense when the theme is small, does exactly what you want, and switching would cost more than it is worth. You are taking on the job the developer stopped doing, which means somebody has to actually do it.

3. Switch to a maintained theme

The usual answer, and less painful than people expect, particularly if your content is in the block editor and your customisations are modest. More on this below.

4. Rebuild

Sometimes the honest answer, and the most expensive one. It applies when the theme is so entangled with the content that switching is not a swap. Themes with their own page builder, their own custom post types, or shortcodes scattered through every page are the usual culprits, because the content only makes sense inside that theme.

Which is worth knowing before you pick your next one. A theme you can leave is worth more than a theme that does slightly more.

What this looks like on real sites

Across the sites we look after, abandoned themes arrive in four recognisable shapes. Knowing which one you have tells you how urgent it is.

The agency theme

Built for you by a company that has since closed, been acquired, or simply moved on. It is often genuinely good work. It is also the case with no upgrade path at all, because there is no vendor, no changelog and no version number that means anything.

The tell is usually the footer credit or a folder in wp-content/themes/ named after a company you have not spoken to in years. These are lower risk than they look on the security side, since nobody else runs the same code and automated scanners have nothing to match, but they are higher risk on the PHP side, because nobody is watching for the next version bump.

The marketplace theme nobody supports

Bought once, five years ago, from a marketplace. The listing may still be live and still taking money, which reads as reassurance and is not. The author stopped replying in 2022 and the last update predates three major WordPress releases.

This is the most common shape and usually the most tangled, because marketplace themes tend to bundle a page builder, a slider plugin and a demo importer. You are not maintaining one abandoned thing, you are maintaining four.

The nulled theme

A commercial theme obtained free from somewhere it should not have been. Frequently the customer did not know, because it came with a cheap build. This is the one that turns into malware recovery work rather than a maintenance conversation, and unlike the others it is urgent rather than eventual.

The theme that outlived its purpose

Perfectly maintained, but you are using two per cent of it. A theme built for a magazine running a five page brochure site. Not abandoned at all, but worth mentioning in the same breath, because the cost of carrying it is the same: complexity you do not need, updating on somebody else's schedule.

Plugins have exactly the same problem

Worth saying, because the theme is the visible one and the plugins are where the real exposure usually sits. A typical site runs one theme and fifteen plugins, so the odds that at least one is abandoned are considerably higher, and a plugin has more opportunity to do damage because it can hook into anything.

The checks are identical: last updated, tested up to, active installs, whether support is answered. Our list of maintenance plugins worth running covers the tooling, and the same rule applies to all of it. Anything that has not been touched in two years is a decision you have not made yet.

Switching without losing everything

Not a full guide, but the order that prevents the worst outcomes.

1. Take a backup you hold yourself, and confirm it is not empty. Our guide to backups covers why the host's copy should not be your only one.
2. Write down what the old theme is doing. Widgets, menus, homepage layout, anything set in the customiser. Screenshot every page you care about, because the reference disappears the moment you activate the new theme.
3. Find the shortcodes. Search your content for square brackets. Theme shortcodes stop working the moment the theme does and leave literal text like [vc_row] across your pages. This is the most common nasty surprise.
4. Test on staging, never live. Activate the new theme on a copy and work through it there.
5. Check the pages that earn. Not the home page. The contact form, the checkout, the top few pages by traffic.
6. Keep the old theme installed but inactive for a month. It is your rollback and it costs nothing but disk space.

One thing that catches people: if your customisations were made by editing the theme's files directly rather than through a child theme, they are gone the moment you switch, and they were already at risk from any update. WordPress's documentation on child themes explains the mechanism.

Choosing the next one so this does not recur

Five checks, before you install anything. They take longer than picking on looks, and they are the difference between a five year theme and a five month one.

• Last updated within six months, and tested up to matching the current WordPress version.
• Active installs going up rather than down. The directory shows the trend, and a falling count usually means people know something you do not.
• Support requests being answered. Open the support tab and read the last month. Unanswered threads are the clearest sign of what is coming.
• Does it bundle plugins? Bundled plugins update on the theme's schedule rather than their own, which means a slow theme developer becomes a security problem in software they did not write.
• Could you leave it? If the theme's own shortcodes and post types are woven through your content, you are not choosing a theme, you are choosing a platform.

That last one is the one nobody weighs at the time and everybody weighs later. A theme is a ten year decision most people make in ten minutes.

If you would rather this were somebody's job, it is part of what a care plan covers: themes and plugins watched for exactly this, updates applied and checked, and a backup that has been restored on purpose rather than assumed. Our piece on whether maintenance is worth paying for goes through the arithmetic, and the signs a site needs attention covers what else tends to be true when a theme has been left this long.