WordPress Theme Update Checklist (2026)

Key Takeaways

• Work through this WordPress theme update checklist in order before you click update: back up, test on staging, protect your customizations, check compatibility, then update one thing at a time.
• The biggest risk is not the update itself. It is updating a theme whose files you edited directly, which wipes those changes. A child theme prevents this so you “receive updates to the parent theme without losing those modifications”.
• Block themes change the rules. Customizations made in the Site Editor and Global Styles live in your database, not in theme files, so the classic child-theme advice only partly applies.
• Theme risk is rising. Themes accounted for 9% of the 11,334 WordPress vulnerabilities disclosed in 2025, up from 4% a year earlier (Patchstack, 2026). Skipping updates leaves those holes open.
• If an update does break your site, WordPress now rolls back failed manual updates (since 6.3) and failed auto-updates (since 6.6) on its own.

Updating a WordPress theme should take two minutes and change nothing you can see. Most of the time, that is exactly what happens. The trouble starts with the small share of updates that overwrite a customization, clash with a plugin, or need a newer PHP version than your server runs, and take a chunk of your site down with them.

The fix is not to avoid updates. An outdated theme is a security and compatibility liability, and putting off updates only makes the eventual jump riskier. The fix is a repeatable process: a short checklist you run every time so that even a bad update stays contained to a staging copy and never reaches your visitors. This guide is that checklist, in the order you should actually do it.

Why Updating Your Theme Matters (and Why Owners Put It Off)

Your theme controls how every page renders, so an outdated one is both a security risk and a compatibility risk. WordPress powers 41.2% of all websites and 59.1% of sites running a known content management system as of July 2026, which makes its themes and plugins a constant target. When a theme flaw is disclosed and patched, the update is what closes the door. Staying on the old version leaves it open.

Themes used to be a minor slice of that risk. They are getting larger. Of the 11,334 new WordPress vulnerabilities disclosed across the ecosystem in 2025, themes accounted for 9%, up from 4% the year before. Plugins still account for almost all of the rest at roughly 91%, with core down to just 6 issues, but the theme share more than doubling in a single year is the trend that matters for this checklist.

Theme Risk Is Rising, Themes’ Share of WordPress Vulnerabilities (Source: Patchstack)

The reason owners still delay is fear of breakage, and it is a fair fear. Sucuri’s most recent annual hacked-website report found that 39.1% of infected content management system sites were running outdated software at the point of infection. Delaying does not remove the risk of a broken site. It just trades a small, controlled risk today for a larger, uncontrolled one later.

[UNIQUE INSIGHT] The safe move and the scary move are the same move done differently. An owner who updates blindly on the live site and an owner who never updates are both gambling. The first bets that this release will not break anything. The second bets that no attacker will find the unpatched hole first. The checklist below removes the bet entirely by moving the risky part, the actual update, onto a copy of your site where a failure costs nothing.

Step 1: Back Up Your Entire Site First

Before anything else, take a full backup of your files and your database. This is your undo button. If a theme update goes wrong in a way that staging did not catch, a complete backup lets you return the whole site to its exact pre-update state in one action, with no guesswork.

A theme update touches files, but your content, menus, widgets, and any customizations stored in the database can be affected by the change too, so back up both. Follow the 3-2-1 rule: three copies of the backup, on two types of storage, with one kept offsite. Our WordPress backup guide walks through the methods and the plugins that automate this.

Do not skip this step because the update “looks minor.” Minor updates break sites too, and the two minutes a backup takes is the cheapest insurance in this entire process.

The first step in any WordPress theme update checklist update is a full backup of both files and database, following the 3-2-1 rule of three copies on two media types with one offsite. A complete backup restores the site to its pre-update state in a single action if the update causes a problem that testing did not surface.

Step 2: Test the Update on a Staging Site

A staging site is a private copy of your live site where you can run the update and check the result before anything reaches visitors. This is the single habit that turns a scary update into a routine one. If the theme update breaks the staging copy, you learn that in private, fix it or postpone it, and your live site never shows a single visitor a broken page.

Most managed WordPress hosts include one-click staging that clones your live site, including its theme, plugins, and content, so you are testing the real thing rather than an approximation. Run the theme update on staging, click through your key pages, then push the change to production only once it passes. Our guide to setting up a WordPress staging environment covers the options if your host does not offer it built in.

Test on staging even when you plan to update anyway. The point is not to decide whether to update. It is to know what will happen before it happens on the site your customers see.

A staging site is a private clone of the live site where theme updates are tested before production, so a broken update never reaches visitors. Most managed WordPress hosts provide one-click staging that copies the full site, letting owners verify an update on real content and then push it live only after it passes.

Step 3: Protect Your Customizations With a Child Theme

Edits made directly to a parent theme’s files are erased the moment you update it, so move them into a child theme first. When WordPress updates a theme, it downloads the new package, unzips it, and replaces the old files. Any change you made straight to the parent theme’s files is overwritten in that step and gone. This is the number one way owners “lose their design” to an update, and it is entirely preventable.

The prevention is a child theme. A child theme is a small, separate theme that inherits everything from the parent and holds your custom code on top of it. WordPress’ official documentation is direct about why this matters. A child theme lets you “make customizations to the parent theme without directly modifying the parent theme’s files. This means that you (or your child theme’s users) can still receive updates to the parent theme without losing those modifications” (WordPress Theme Handbook, 2026).

So the rule is simple. If your site uses a classic theme and you have any custom CSS, template edits, or functions, put them in a child theme first, then the parent theme can update freely underneath. If you are not sure whether your customizations are safe, treat that uncertainty as a reason to check before you update, not after.

[OUR EXPERIENCE] The most painful theme-update calls are never the ones where the update failed. They are the ones where the update succeeded perfectly and erased months of direct edits to a parent theme, with no error and no warning, because there was no child theme to hold them. Restoring from backup gets the work back, but the lesson is always the same: the child theme should have existed before the first customization, not after the first loss.

Updating a theme replaces its files, so edits made directly to a parent theme are overwritten and lost. A child theme holds customizations separately and inherits from the parent, letting the parent “still receive updates without losing those modifications”. Any classic theme with custom code should use one before updating.

Step 4: Know How Block Themes Change the Rules

If your site uses a block theme, the child-theme advice above only partly applies, and most update guides never mention this. Block themes power Full Site Editing, where you design your header, footer, and templates visually in the Site Editor instead of in PHP files. The default themes since Twenty Twenty-Two, including Twenty Twenty-Five, which remains the current default because WordPress shipped no new default theme in 2025 or 2026, are all block themes.

Here is the key difference. When you customize a block theme through the Site Editor or change colors, fonts, and spacing in Global Styles, those edits are saved to your database, not to the theme’s files. A theme update replaces the files, so your database-stored Site Editor changes are generally preserved through an update rather than wiped. That is good news, with one catch: any change you make in the Site Editor to a template also detaches that template from future theme updates, so you can stop receiving the theme’s own improvements to it without realizing.

What this means for your checklist:

• Classic theme with code edits: use a child theme (Step 3). This is the traditional case.
• Block theme customized only in the Site Editor and Global Styles: your changes live in the database and usually survive updates, but note which templates you have edited, because those no longer track the parent.
• Block theme with custom code or a `theme.json` you want to keep across major versions: consider a child block theme, or export your current design with the Create Block Theme plugin before a big update so you have a clean snapshot to fall back on.

The takeaway is to know which kind of theme you run before you update, because the risk to your customizations is different for each. If you are choosing a new theme rather than updating one, our guide to the best WordPress themes covers what to look for.

Block themes store Site Editor and Global Styles customizations in the database rather than in theme files, so those edits usually survive a theme update, unlike direct edits to a classic parent theme. Editing a block template in the Site Editor detaches it from future parent-theme updates. The default WordPress themes have been block themes since Twenty Twenty-Two.

Step 5: Check Compatibility Before You Update

With a backup taken and staging ready, spend two minutes on compatibility so the update on staging is not a surprise. Three things to check:

1. The theme changelog. Read what the update actually changes. A minor bug-fix release is low risk. A major version that rewrites templates or drops a feature you rely on deserves closer testing.
2. Your PHP version. New theme releases often need a newer version of PHP than older ones. WordPress recommends PHP 8.3 or greater. Check yours under Tools > Site Health > Info > Server. If you are on PHP 7.4 or lower, update PHP on staging first, because the jump can surface its own issues.
3. Plugin compatibility. Themes and plugins interact, especially page builders and WooCommerce. If the theme update is a major one, confirm your key plugins support the new version before pushing to production.

None of this replaces the staging test. It tells you what to watch for during that test, so a failure points you straight at the cause instead of leaving you guessing.

Step 6: Run the Update, One Change at a Time

Update the theme by itself, not bundled with a pile of plugin updates in one click. When you change one thing, and something breaks, you know exactly what caused it. When you change ten things and something breaks, you are back to guessing, which wastes the isolation your staging site gave you.

On staging, update the theme, then reload and look at the result before moving on. Once the theme update passes on staging, repeat it on production during a quiet traffic window, or push your tested staging copy live if your host supports it. Then move to the next update, whether that is a plugin or core, as its own separate step.

This one-at-a-time discipline is slower by a few minutes and it is the difference between a five-minute fix and an afternoon of troubleshooting when something does go wrong.

Update the theme as a single isolated change rather than bundled with plugin or core updates, so any resulting problem traces directly to that one update. Apply it on staging first, verify, then push to production, and handle each additional update as its own separate step.

Step 7: Test Everything After the Update

An update that installs without an error is not the same as an update that worked. Once the theme is updated, walk through the site as a visitor would and confirm the things that actually matter to your business still function:

• Homepage and key landing pages render correctly, with no broken layout or missing sections.
• Navigation menus, header, and footer appear and link where they should.
• Forms, buttons, and calls to action submit and work. Test your contact form and, on an online store, a test checkout.
• Mobile view looks right, not just the desktop version.
• Custom fonts, colors, and spacing survived, which is where an overwritten customization shows up.

Do this on staging before you go live, and again with a quick pass on production right after. Catching a broken checkout in a two-minute test beats hearing about it from a customer a day later.

Step 8: Know Your Rollback Options If Something Breaks

Even with a clean process, a theme update can occasionally cause a problem in production that staging did not, so know your undo options before you need them. Modern WordPress does a lot of this automatically. You have three, from most to least automatic:

If your site is actually down rather than just visually off, our step-by-step guide to a WordPress site that crashed after an update covers recovery in detail, including Recovery Mode and the folder-rename fix.

WordPress Has Made Updates Easy to Undo (Source: Make WordPress Core)

To reverse a bad theme update, WordPress core automatically restores a pre-update backup when a manual update fails (since 6.3) or an auto-update fails (since 6.6). For an update that succeeded but broke the design, reactivate the previous theme or restore the backup taken before updating.

Should You Turn On Automatic Theme Updates?

Automatic theme updates are worth enabling for most sites that use a well-supported theme and a child theme, and worth holding back on for heavily customized ones. Since WordPress 5.5, you can switch auto-updates on per theme from the Themes screen, so security patches land without you watching the release calendar.

The trade-off is control. Auto-updates apply straight to production without a staging pass, so the safety net is the automatic rollback that reverses a failed update (Step 8). That net catches a failure that crashes the site. It does not catch a subtle visual break on a page that still loads. So the honest rule is this. On a simple site with a child theme, turn auto-updates on and let WordPress keep it patched. On a business-critical or heavily customized site, keep updates manual so everyone runs through staging first. An outdated theme also undermines the rest of your security setup, which our WordPress security best practices checklist covers alongside the other habits that keep a site safe.

If keeping up with safe, tested updates is not realistic for you to do yourself, our WordPress maintenance service runs theme, plugin, and core updates on staging with backups first, so a bad release never reaches your visitors.

Frequently Asked Questions

Conclusion

A theme update is only risky when it is done blind on a live site. Run it through a process instead and the risk nearly disappears. Back up, test on staging, protect your customizations with a child theme or by knowing how your block theme stores them, check compatibility, update one thing at a time, then test the result. If anything slips through, WordPress now rolls back failed updates on its own, and your backup covers the rest.

The whole checklist adds a few minutes to an update you were going to run anyway. What it buys you is certainty: you know what will happen before it reaches a visitor, and you know exactly how to undo it if it does not go to plan.

If your site keeps breaking on updates, or you would rather hand the whole cycle to someone who tests every release first, our WordPress audit finds the fragile themes, plugins, and configuration behind repeat failures and tells you what to fix first.