To choose a WordPress theme, first decide on the type (block theme, classic theme or a minimal theme for a page builder), then score each candidate on seven criteria: performance, code quality, compatibility, mobile display, customisation, updates and support, and security. This guide shows you how to check each criterion, gives you a scoring grid out of 100 and lists the warning signs that should make you walk away, however good the demo looks.
A theme is hard to replace: it carries your layout, sometimes content (shortcodes, custom blocks) and often a companion plugin. An hour of checks saves you months of workarounds.
Block, classic or hybrid theme: the first decision
Since the Site Editor arrived, there are two families of themes, plus a separate category for people who work with a page builder:
| Type | How you customise it | Who it suits | Limitation |
|---|---|---|---|
| Block theme | Site Editor: templates, global styles, patterns | New sites, editors who want autonomy | Fewer “ready-made” settings plugins |
| Classic theme | Customizer, widgets, PHP files | Existing sites, experienced developers | A development model WordPress no longer evolves |
| Hybrid theme | Classic Customizer plus a few Site Editor features | A gentle transition | Two approaches to master |
| Minimal theme for a builder | Almost everything in the builder (Elementor, Bricks…) | Sites designed in a builder | Dependence on the builder |
For a new site, a block theme is the most future-proof choice: it is the direction WordPress has taken, the layout lives in the editor and switching themes breaks fewer things. If you plan to work with a page builder, the theme matters less than the builder: read our comparison of WordPress page builders before you choose.
The seven criteria and how to check them
Performance
Don’t test the vendor’s demo, which is often hosted on a fast server and full of optimised images. Install the theme on a copy of your site with realistic content, then measure a post page and the home page in PageSpeed Insights, on mobile. Look at the Core Web Vitals (LCP under 2.5 s, INP under 200 ms, CLS under 0.1), the page weight and the number of CSS and JavaScript files loaded. A good theme loads little JavaScript and only loads a block’s styles when the page uses that block.
Code quality
Themes in the official directory go through a review that requires the GPL licence, escaping of displayed data and no obfuscated code or forced links. It is not a security audit, but it is a baseline that many themes sold elsewhere don’t guarantee. For a premium theme, install the Theme Check plugin on a staging site: an avalanche of warnings is a bad sign. Also check that a child theme is possible and documented, and that a block theme relies on theme.json rather than dozens of home-made options.
Compatibility
On the theme’s page, read the “Tested up to” WordPress version and the minimum PHP version. Then list the plugins you can’t do without (shop, forms, multilingual, SEO) and look for explicit support in the theme’s documentation. A WooCommerce shop needs well-designed cart and checkout templates; a multilingual site needs translatable strings and, if required, right-to-left support.
Mobile display
Most visits come from phones. Open your typical pages at 390 pixels wide: a menu you can use with your thumb, text readable without zooming, no horizontal scrolling, tables and forms that remain usable. A “mobile-first” theme starts from the narrow screen and adds the wide layout afterwards, which usually produces lighter pages.
Customisation without lock-in
Colours, fonts, widths and headers should be adjustable without code. The trap lies elsewhere: a theme that provides its own shortcodes or blocks for content locks you in, because that content becomes unreadable the day you switch. Prefer core blocks and patterns, and keep the theme’s own features to the layout.
Updates and support
Check the date of the last update and the changelog: a theme that has not been updated for more than a year has probably not kept up with recent WordPress releases. In the official directory, the support page shows the number of resolved topics. For a premium theme, check that updates arrive in the dashboard with a licence, and what happens when it expires.
Security
Themes themselves have few vulnerabilities; it is mostly their companion plugins (demos, blocks, shop features) that pile them up, as our review of vulnerabilities in popular themes shows. Search for the name of the theme and its plugin in a vulnerability database (Wordfence, Patchstack, WPScan): a few flaws fixed quickly are normal, repeated critical flaws or slow fixes are not. And never install a “nulled” copy of a paid theme: it is the most common backdoor (see the dangers of nulled themes).
The scoring grid out of 100
Score each criterion from 0 to 5, multiply by its weight and add everything up. Below 60, move on; above 80, the theme is a good candidate. Adjust the weights to your project: a shop might raise compatibility, a blog performance.
| Criterion | Weight | Quick check | Red flag |
|---|---|---|---|
| Performance | ×4 (20 pts) | Mobile PageSpeed on your copy | LCP over 4 s on a simple page |
| Security | ×4 (20 pts) | Vulnerability databases, file origin | Repeated critical flaws, unofficial copy |
| Updates and support | ×3 (15 pts) | Latest version, changelog | Nothing for over a year |
| Code quality | ×3 (15 pts) | Official directory or Theme Check | Obfuscated code, forced links |
| Compatibility | ×2 (10 pts) | Tested versions, must-have plugins | Old PHP required, no WooCommerce support |
| Mobile display | ×2 (10 pts) | Typical pages at 390 px | Horizontal scrolling, unusable menu |
| Customisation | ×2 (10 pts) | Global styles, patterns | Content built on theme shortcodes |
The checklist before you install
- Download the theme from the official directory or the vendor’s website, never from a file-sharing site.
- Install it on a staging site with your real content and plugins.
- Measure three typical pages on mobile and compare them with your current theme.
- Check for known vulnerabilities in the theme and its companion plugin.
- Note what the theme adds to your content (shortcodes, custom blocks): that is what you will have to clean up if you switch.
- Create a child theme if you need to modify the theme’s files.
- Delete unused themes, except one default theme as a fallback.
What a theme gives away to bots
Your theme’s folder appears in the code of every page (/wp-content/themes/theme-name/). Bots hunting for vulnerabilities use it to find out which theme you run and which flaw to try (see how bots detect WordPress). Updating remains the first line of defence, but reducing these clues wastes the bots’ time.
WP Masquerade Pro replaces the URLs of theme and plugin files with aliases, which removes the theme’s name from your pages, and alerts you when a vulnerability is published for an installed theme or plugin, with the fix to apply (vulnerability alerts). The free version already hides WordPress’s generic traces. None of these features fixes a vulnerability: they buy you time to update.
Key takeaways
- Choose the type first: a block theme for a new site, a minimal theme if everything happens in a builder.
- Test performance on your own copy, on mobile, not on the vendor’s demo.
- Security depends mostly on the companion plugin and on where the file comes from.
- Avoid content locked into the theme’s own shortcodes.
- A grid scored out of 100 makes choosing between two themes objective.
Frequently asked questions
Free or premium theme: which should you choose?
Price says nothing about quality. A free theme from the official directory has been reviewed and gets its updates automatically; a premium theme often brings more templates and dedicated support, but its updates depend on a licence. Apply the same grid to both.
Is a block theme faster than a classic theme?
Often, because it only loads the styles of the blocks in use and little JavaScript, but it is not automatic. Always measure with your own content.
Do you lose content when you change themes?
Posts and pages stay, but shortcodes, widgets and blocks specific to the old theme stop displaying correctly. Make the switch on a staging site and list what breaks before going live.
Should you keep unused themes?
No. A deactivated theme is still reachable on the server and may contain a vulnerability. Keep only your active theme, its parent if it is a child theme, and a recent default theme as a fallback.
Know when your theme becomes vulnerable
WP Masquerade Pro alerts you as soon as a vulnerability affects an installed theme or plugin, explains the risk and the update to make, and removes your theme’s name from your pages. The free version already hides WordPress and protects the login.
Sources
- WordPress Theme Handbook (external link, opens in a new tab)
- WordPress.org: theme review requirements (external link, opens in a new tab)
- web.dev: Core Web Vitals (external link, opens in a new tab)
- Official WordPress theme directory (external link, opens in a new tab)
