What WordPress is
WordPress is a content management system: software that stores your content in a database and builds pages when visitors request them. It runs on a web server using a server-side language and a database, and gives you a web-based dashboard for writing posts, creating pages, uploading images and managing settings. Because you can publish without touching code, it is a common choice for personal sites and blogs.
You can run it in two broad ways. A hosted service manages the software for you, usually with some limits on what you may customise. Or you install the open-source software on hosting you control, which gives more freedom but leaves you responsible for updates, backups and security. Which options are available, and what each costs, changes over time, so check current offers.
Where themes fit
WordPress separates content from presentation. Your posts and pages live in the database; the theme decides how they look. Switching themes changes the design while your content stays in place, although some content, such as custom layouts or theme-specific features, may not carry over neatly.
What a theme contains
Traditionally, a theme is a folder of template files, a stylesheet and some code. Template files describe how different kinds of page are shown: the home page, a single post, an archive, a search result, a 404 page. WordPress picks the most specific template available for the request, falling back to more general ones. Newer themes can be built around a block-based editing approach in which the site’s layout is composed in the editor rather than in code. The terminology and file structure have evolved, so rely on the official documentation for your version.
What a theme should not contain
A good rule is that a theme is for appearance, and a plugin is for features. If you put important functionality such as contact forms, custom content types or tracking in the theme, then switching themes later removes it. Keep that kind of logic in a plugin so the design can change independently.
Choosing: ready-made, child theme or fully custom
There are three levels of customisation, and the right one depends on your goals and skills.
Use a ready-made theme as it is. The fastest and lowest-maintenance option. Look for a theme from a reputable source, with recent updates, clear documentation, good accessibility and reasonable performance. A theme packed with features you do not need adds weight and more code that could contain faults.
Adjust it with built-in tools. Many themes allow changes to colours, fonts, menus and layouts from the dashboard, and the block editor can handle much of a personal site’s layout. This avoids code and survives updates.
Create a child theme. A child theme inherits everything from a parent theme and overrides only the parts you change. When the parent is updated, your modifications remain separate and are not overwritten. If you need small tweaks beyond the settings, this is generally safer than editing the parent theme directly, which loses your work on update.
Build a theme from scratch. This gives complete control and teaches how WordPress works, but it takes real effort and requires you to handle accessibility, security conventions and compatibility yourself. It makes sense if you have a specific design, want to learn, or need a very lean site. For most personal sites it is more than necessary. A foundation in how a hand-coded website works makes the template concepts much easier.
Customising without regret
- Decide what you want first. Sketch pages and navigation before looking at themes, so you pick on structure rather than screenshots.
- Test on a copy. Use a local or staging copy of your site for experiments, not the live one.
- Keep changes organised. Put custom code in a child theme or a small plugin, and keep it under version control so you can track and undo changes.
- Write tidy code with comments. Future you will not remember why a snippet exists, so readable code pays off.
- Follow official coding guidance, especially about escaping output and validating input. Careless theme code is a common source of security problems.
Maintenance: the real cost
Unlike a static site generator, which produces simple files, WordPress is software that runs on a server and needs ongoing care. This is the main trade-off to weigh before choosing it. Maintenance generally includes:
- Core updates. The WordPress software itself receives updates, including security fixes.
- Theme and plugin updates. Each plugin and theme is extra code written by various authors, and each needs updating. Fewer plugins means a smaller maintenance burden.
- Server software. If you manage your own hosting, the server and its language runtime also need updates. Managed hosting often handles this.
- Backups. You need regular backups of both files and the database, stored somewhere separate, and you should test that they restore. An organised backup strategy is essential.
- Compatibility. Updates can occasionally break a theme or plugin, which is another reason to test changes on a copy first.
Abandoned themes and plugins are a particular risk. If the author stops updating, security issues may remain unfixed. Prefer actively maintained ones and remove anything you do not use.
Security basics
Because WordPress is widely used, it is a common target for automated attacks, and most successful ones exploit outdated software or weak accounts rather than clever tricks. Sensible precautions, none of which guarantee safety, include:
- Keep everything updated, and remove unused themes and plugins.
- Use unique, long passphrases kept in a password manager, and turn on two-factor authentication.
- Change any default credentials, and avoid obvious usernames.
- Give each user only the permissions they need.
- Use HTTPS so logins and content travel encrypted; the background is in data encryption.
- Be wary of phishing attacks that imitate login pages or update notices.
- Download themes and plugins only from sources you trust, and be suspicious of “free” copies of paid ones, which are a known way to spread malware.
- Keep secrets such as API keys out of theme files and public repositories; see API key secrecy.
- Consider a security plugin or hosting-level protection, but treat these as one layer rather than a complete answer.
Follow your host’s guidance as well, since the responsibilities split differently depending on the hosting type.
WordPress or a static site?
Both can make a good personal site. WordPress offers a visual editor, built-in comments and search, an enormous range of plugins and easy collaboration with non-technical people. A static site is faster by default, easier to secure and cheaper to maintain, but expects you to be comfortable with text files and a build step. The thinking in static site generator approaches is worth reading if you mostly want to publish a few pages and posts without ongoing server care.
If you choose WordPress, keep it simple: a well-maintained theme, a handful of plugins, regular backups and a habit of applying updates. That combination takes much of the pain out of a CMS-based site.