WordPress-compatible headers, full template hierarchy.
Bring your existing theme knowledge — no framework lock-in.
Theme metadata lives in the CSS header.
The first 24 lines of style.css declare your theme. Format is 100% compatible with WordPress theme headers — drop themes in, they just work.
/*
Theme Name: Wah Default
Theme URI: https://wahpress.com/themes/wah-default
Author: WahPress Team
Author URI: https://wahpress.com
Description: Default lightweight theme for WahPress v1. Clean, fast,
fully widgetized. Works with any content structure.
Version: 1.0.0
Requires PHP: 8.2
Requires WP: 6.0
Tags: blog, news, portfolio, two-columns, right-sidebar,
custom-background, custom-logo, featured-images
Text Domain: wah-default
Domain Path: /languages
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html
*/
/* Reset, base styles, components ... */Which file renders which request.
Minimum theme is style.css + screenshot.png. WahPress falls back through the hierarchy just like WordPress — home → index, single → index, page → index.
style.cssTheme metadata header (required)
screenshot.png1200×900 theme preview (required)
home.phpBlog posts index / front page
single.phpSingle post view
page.phpStatic page view
404.phpNot found error template
searchform.phpSearch form partial
sidebar.phpSidebar partial
header.phpDocument <head> + top markup
footer.phpClosing markup + wp_footer()
functions.phpTheme hooks, enqueues, filters
Three ways to ship a theme to production.
All three produce the same result: theme extracted to /wp-content/themes/<slug>, row in the options table, activation nonce logged.
Admin ZIP Upload
- Appearance → Add New → Upload Theme
- Select your
.zip - Click Install Now, then Activate
Admin Direct URL Fetch
- Appearance → Add New → Install from URL
- Paste a publicly-accessible .zip URL
- TLS-validated fetch + unzip + Activate
FTP to wp-content/themes
- Extract theme folder locally
- Upload via SFTP to /wp-content/themes/
- Visit Appearance and click Activate
Removal is protected by per-action nonces.
Never delete the active theme. Deactivation must happen first. A HMAC-SHA256 nonce is required for every delete call — browser or API.
Admin UI flow
- Appearance → verify target theme is not active
- Click Delete → confirm modal reads the theme folder name
- Nonce is verified server-side, folder is rmdir'd recursively
- Admin notice: Theme deleted successfully
Nonce reminder
Every mutating request in the admin — including theme delete — carries a per-action, per-user HMAC-SHA256 nonce valid for 12 hours. Direct POST /wah-admin/themes.php?action=delete without a valid nonce fails 403.
- ›Nonce salt: site-wide from install time
- ›Action key: wah_theme_delete_<slug>
- ›Validation is constant-time hash_equals
Need a starter theme or a design pass?
We maintain a blank starter theme (wah-blank) and can review or white-label your theme work. Drop us a line.