Theme System

WordPress-compatible headers, full template hierarchy.

Bring your existing theme knowledge — no framework lock-in.

style.css

Theme metadata lives in the CSS header.

The first 24 lines of style.css declare your theme. Format is 100% compatible with WordPress theme headers — drop themes in, they just work.

style.css
/*
Theme Name:     Wah Default
Theme URI:      https://wahpress.com/themes/wah-default
Author:         WahPress Team
Author URI:     https://wahpress.com
Description:    Default lightweight theme for WahPress v1. Clean, fast,
                fully widgetized. Works with any content structure.
Version:        1.0.0
Requires PHP:   8.2
Requires WP:    6.0
Tags:           blog, news, portfolio, two-columns, right-sidebar,
                custom-background, custom-logo, featured-images
Text Domain:    wah-default
Domain Path:    /languages
License:        GPLv2 or later
License URI:    https://www.gnu.org/licenses/gpl-2.0.html
*/

/* Reset, base styles, components ... */
Theme Name
Human-readable title
required
Author
Your name or studio
required
Version
Semver, e.g. 1.3.2
required
Text Domain
Slug matching folder
required
Template Hierarchy

Which file renders which request.

Minimum theme is style.css + screenshot.png. WahPress falls back through the hierarchy just like WordPress — home → index, single → index, page → index.

style.css

Theme metadata header (required)

Required
screenshot.png

1200×900 theme preview (required)

Required
home.php

Blog posts index / front page

Optional
single.php

Single post view

Optional
page.php

Static page view

Optional
404.php

Not found error template

Optional
searchform.php

Search form partial

Optional
sidebar.php

Sidebar partial

Optional
header.php

Document <head> + top markup

Optional
footer.php

Closing markup + wp_footer()

Optional
functions.php

Theme hooks, enqueues, filters

Optional
Install / Activate

Three ways to ship a theme to production.

All three produce the same result: theme extracted to /wp-content/themes/<slug>, row in the options table, activation nonce logged.

Method 1

Admin ZIP Upload

  1. Appearance → Add New → Upload Theme
  2. Select your .zip
  3. Click Install Now, then Activate
Method 2

Admin Direct URL Fetch

  1. Appearance → Add New → Install from URL
  2. Paste a publicly-accessible .zip URL
  3. TLS-validated fetch + unzip + Activate
Method 3

FTP to wp-content/themes

  1. Extract theme folder locally
  2. Upload via SFTP to /wp-content/themes/
  3. Visit Appearance and click Activate
Delete a theme

Removal is protected by per-action nonces.

Never delete the active theme. Deactivation must happen first. A HMAC-SHA256 nonce is required for every delete call — browser or API.

Admin UI flow

  1. Appearance → verify target theme is not active
  2. Click Delete → confirm modal reads the theme folder name
  3. Nonce is verified server-side, folder is rmdir'd recursively
  4. Admin notice: Theme deleted successfully

Nonce reminder

Every mutating request in the admin — including theme delete — carries a per-action, per-user HMAC-SHA256 nonce valid for 12 hours. Direct POST /wah-admin/themes.php?action=delete without a valid nonce fails 403.

  • ›Nonce salt: site-wide from install time
  • ›Action key: wah_theme_delete_<slug>
  • ›Validation is constant-time hash_equals
Building a theme for WahPress?

Need a starter theme or a design pass?

We maintain a blank starter theme (wah-blank) and can review or white-label your theme work. Drop us a line.