We set out to prove that free WordPress themes are abandoned and dangerous. The data said otherwise. Out of the 8,430 themes in the official WordPress repository we sampled 900, and not one of them had gone two years without an update.
So "free" is not the risk factor. Where you download the file from is.
The measurement
The official theme repository exposes a public API that reports the last update date for every theme. On 16 August 2026 the repository held 8,430 themes, listed across 85 pages. We sampled every tenth page, 100 themes per page, for 900 themes in total, close to eleven percent of the whole repository.
| Last updated | Count of 900 | Share |
|---|---|---|
| Within 12 months | 768 | 85.3% |
| One to two years | 132 | 14.7% |
| More than two years | 0 | 0% |
The median gap since the last update was 79 days. Under three months.
A note on method, because the number should not be believed without it. Our sample follows the repository's popularity ordering, and popularity naturally leans towards themes that are still alive. Page 81 of 85 was in the sample and showed the same pattern, but the claim we are making is that maintenance is active across a large part of the repository, not that no abandoned theme exists anywhere.
The figure that did worry us
Something else in the same dataset was unexpected. Every theme declares the minimum PHP version it needs, and those declarations have fallen behind badly.
| Declared minimum PHP | Count of 900 |
|---|---|
| 5.6 | 308 |
| 7.4 | 167 |
| 7.2 | 157 |
| 7.0 | 130 |
| 8.0 or newer | 21 |
That is 610 themes out of 900, roughly 68 percent, declaring a floor of PHP 7.0 or older. Twenty one out of nine hundred declare 8.0 or above.
This needs saying precisely, because it is the number people misread most often. It is a support floor, not the version the theme runs on. A theme that says it works on PHP 5.6 is not thereby vulnerable, and it will run perfectly well on your PHP 8.3. What the figure tells you is that the code was written for an older world and nobody has bothered to raise the baseline since. Treat it as a signal, not a verdict.
Where the actual danger sits
It sits in the file you download from an intermediary site. The official repository reviews every theme before it is published and the list of requirements for that review is public. A site handing out a commercial theme worth several million toman for nothing has been through none of that, and its motive is not mysterious: there is something inside the file that makes free distribution worthwhile.
In the sites we have taken on for cleanup, the pattern repeats itself. A theme downloaded from a Persian mirror, hidden links in the footer, and one file that reappears after every update because it lives in the theme folder rather than in a plugin. The owner usually has no idea, and the first symptom is a ranking drop rather than a warning message.
The rule we give clients
A free theme from the official repository is fine. A paid theme bought from its actual author is fine. A paid theme that someone has posted for free is never acceptable, under any circumstances, not even on a staging site.
And a habit that gets mentioned less. Before installing anything, look at the last update date and the active install count on that theme's page in the official directory. It takes thirty seconds and it catches most bad decisions right there.
When this advice does not apply
If your site is a shop with real revenue, a free theme is the wrong call, though not for security reasons. A general purpose theme was not written for your scenario, you end up compensating with ten plugins, and those ten plugins are what makes the page output heavy. The money you saved on the theme comes back out of your conversion rate.
If you suspect your current theme is carrying something, read through the signs that a site has been compromised, and if any of it matches, inspecting the theme and plugin files is work we do. If you are at the start of a build, putting the site on a custom theme removes this whole question from the agenda.
Do free themes hurt SEO?
Being free does not. Code quality does, and it varies enormously even inside the official repository. The practical test is speed and output structure, not the price tag.
How do I tell whether my theme is nulled?
If it is a commercial theme and you did not pay for it, it is nulled. The technical route is diffing the files against the original release and looking for encoded blocks, but if the answer to the first question was yes, you do not need the technical route.
The repository API we used is open, so any of these figures can be reproduced. The counts above are ours, taken on one day, from one sample.
Comments & Questions
Have a question about this article? Ask, we'll answer.
No comments yet; be the first.