Picking a secure WordPress theme can create panic in most people. The worry that their website could be hacked can make people freeze in place and question their decisions when picking a theme.
What are the most secure WordPress Themes? The easiest way to check this is to look at a theme‘s changelog. This is a log of all the changes the theme has gone through and what improvements they have made to theme. If a theme does not have a public changelog or is not from a of the reputable vendor, I would avoid it at all cost.
In this article we will tackle one of the toughest decisions, picking a theme. I will help you narrow down your choices and even give you a few themes I have personally used.
What makes a secure WordPress theme
Before we can jump into what themes are better than other themes, you need to understand what makes them secure. A theme like a plugin requires updates because WordPress never stop evolving.
These changes to WordPress core code can often create exploits or work-arounds that allow hackers to access your site unlawfully.
It is this reason that if you use a theme that is run by a company that offers little or no updates, then you can be targeted. Hackers just like plugins, look for themes that are out of date and that a majority of people use so they can abuse users.
The safest way to bypass these hackers and attackers is to use a theme that has a reputation of timely updates and security fixes. It’s the easiest way for a hacker to enter your site is through a theme that is not properly supported.
You should avoid any company that rarely update their theme. Ask to see a changelog before you buy a theme.
how to find reputable secure themes
Once you look at themes, you will often want to know, how do I know if a company is reputable or not. For someone looking to build a business, you don‘t want to start off on the wrong foot.
Below you will find a list of vendors I recommend and why I would recommend them over other sources.
1. WordPress Theme Directory
This should be your first choice for choosing any theme. WordPress has a high level of standards and rarely allows something that allowed to exploit the user base. If a theme doesn’t pass their standards, then you aren’t allowed to download it or worse yet it will be pulled. This has happen several times in the past when a theme did not meet the WordPress’s guidelines. Still the theme directory isn’t without fault and sometimes bad themes get listed before they are caught, use caution and read reviews.
2. Elegant Themes
While I may not agree with all of Elegant Themes updates, they do a great job of keeping their themes up to date. I would highly recommend you check them out as they have a lifetime license which means each of their themes would be free after you pay for a lifetime license. Still the company has proven in the past that when a security flaw has come out they patch it for free for all their users. That is a good company standard that even I can get behind.
3. StudioPress
StudioPress is the company behind the Genesis framework. For many people that might not mean much but the history of the Genesis theme is long and has great feedback from the community. If you want a theme and company with a proven track record of making excellent themes, it’s StudioPress. They are high regarded in the community as one of the top theme creators.
4. ThemeForest
This one is on the list because many people use ThemeForest for their themes. They have many popular themes such as Avada, Enfold, and X theme. The reason I can not recommend them is because that marketplace is often dangerous. ThemeForest standards are nowhere near as good as WordPress and it shows. Many fly-by-night companies show on ThemeForest and disappear the very next month. If you will buy a theme, I would only recommend sticking with “popular” or “best sellers”. I would not use themes that do not have a proven track record.
5. Ithemes
This is another developer that really has a solid reputation among the WordPress community. They also have several key plugins such as their Itheme‘s Security plugin and backup Buddy which are highly rated. This makes them a very good pick for finding themes you know will be supported well into the future.
6. GeneratePress
This is a smaller company that is run by a handful of people. Normally I would not recommend smaller companies but GeneratePress has been timely in updates and features making them a simple choice when picking a theme. While their theme doesn’t have some flashy bells and whistles, it is meant to be used a solid starting point for building your site.
7. Astra
Astra is another small company that has just one theme but it’s a theme they do very well. According to the speed test we have run it, it is the fastest theme out of the box. There isn’t another theme that can touch the speed and simplicity of Astra. PRO is required to do any major manipulating of the theme. Still a great theme and a team of people.
8. OceanWP
OceanWP is another small company but I would be silly not to include them. The team behind OceanWP keep the theme updated and secure which is important. Also, it’s one of the cheaper themes to run since they run sales often. I have used OceanWP, and it really is a solid theme if you want something simple.
How to find out if your theme is secure
One of the best ways besides changelogs to find out if a theme is secure is to use a website that checks themes reputation. These websites will often look at a theme’s core files and check to make sure it meets the demands of WordPress and also doesn’t have any bad code.
Theme Check is one such place that you can upload your zip file and find out if your theme is corrupted or has any bad code in it.
Below we will discuss what to do if your theme is corrupted or dangerous.
What to do if your theme isn’t safe
If you theme is not safe, I would recommend copying the website over to staging. At this point you will have a carbon copy in case anything goes wrong. This will give you a little peace of mind while you find a replacement theme.
After a good replacement theme has been found I would transition the website over to the new theme. Often this will mean that most of your styling goes away and you are starting from scratch.
It may seem like a pain but you are likely saving yourself tons of time by doing it now rather than waiting for your website to be hacked. It’s a great practice to stick with software and applications that have a proven track record of success.
Related Questions
What other ways can I check my website or themes for hacks? One simple way is to use a popular security service called Sucuri. They have one of the best services in the business for security-related concerns and questions.
Why is it bad to use a theme that has not been updated? Using a theme that hasn’t been updated for a long period puts a target on your back. Often hackers look for plugins or themes that haven’t been updated so they can exploit their users. It is usually only a matter of time before you find yourself on the end of hacked website.
I hope you found this article helpful. We covered a lot about what makes a theme good and bad. I would recommend any of the solutions above, beyond you will take chances in your own hands.
