Almost Everything: WordPress Security Audit, PHP 8.5 Upgrade & Legacy Theme Repair

Project overview

A seven-year-old WordPress theme that could not run on modern PHP. That was the biggest obstacle during an urgent security upgrade for Almost Everything, a London-based creative production business working across scenic construction, set systems and specialist fabrication.

The website was still running on PHP 7.4, a version that stopped receiving security updates in November 2022. Moving to PHP 8.5 was the immediate priority, but the existing Themify theme was too old to support it. Switching PHP versions without addressing the theme would have caused the website to stop loading.

A wider technical audit uncovered additional problems: abandoned plugins, duplicated functionality, outdated dependencies and enquiry forms that were no longer working correctly. The site had also experienced a previous malware incident, making it important to confirm the installation was clean before making changes.

Rather than recommend a complete rebuild, I repaired the legacy theme, upgraded the PHP environment, removed 12 unnecessary or outdated plugins and restored several broken website features.

The entire process was tested on a private copy before deployment, allowing the live website to be updated without the risks of experimenting directly on production.

The project combined WordPress support and maintenance, security auditing, legacy PHP compatibility work and website troubleshooting.

The challenge

Almost Everything’s WordPress website had been running for years with limited technical maintenance. Although it continued to serve as the company’s online portfolio and digital business card, several parts of its underlying technology had fallen significantly behind.

The immediate security concern was the outdated PHP environment. However, upgrading PHP exposed a larger dependency problem: the existing Themify theme and its older page-building components were not compatible with the newer runtime.

A normal theme update was not necessarily the safest option either. The client had previously experienced layout and navigation problems after an update, so an uncontrolled upgrade risked creating substantial additional work.

The challenge was to bring the website onto a supported PHP version while preserving its existing design, content and portfolio functionality.

What was delivered

I began with a complete backup and created a private local copy of the website. This allowed me to investigate the installation, test PHP compatibility and identify problems without affecting the public site.

The audit covered WordPress core files, uploaded content, plugins, database records and administrator accounts. Once the technical issues were understood, I carried out the necessary updates and repairs on the private copy before applying the tested changes to production.

After testing the changes locally, I took another full backup of the production website and deployed the updates.

The repaired website was then checked to ensure the original theme and core functionality continued operating as expected.

What the audit revealed

The audit showed why maintaining an older WordPress website involves more than simply installing updates.

Several underlying issues had developed over time, even though the public-facing pages still appeared functional.

One important finding was that the earlier reported malware incident did not appear to have left an active infection inside the WordPress installation.

The audit did identify an unrelated historical uploaded file and evidence of an older map-plugin security incident. These were documented for follow-up rather than presented as proof of a current compromise.

Key technical decisions

The guiding principle was modernise the underlying technology without unnecessarily replacing the existing website.

Almost Everything did not need a new design to resolve its immediate security concerns. It needed its existing theme, PHP environment and plugin dependencies to work together reliably.

The biggest decision involved the Themify theme. A full upgrade across approximately seven years of releases could have changed existing layouts and page-builder behaviour, potentially introducing substantial visual regressions.

Instead, I isolated the compatibility issues and made a targeted repair that allowed the existing theme to run under PHP 8.5.

Why repairing the theme made more sense than upgrading it

The Themify theme contained older page-building code and a long history of custom layouts.

A major version upgrade could potentially have required extensive page-by-page adjustments, especially given the client’s previous experience with navigation elements reappearing unexpectedly after an update.

A targeted compatibility repair provided a more practical short-term solution: it allowed PHP 8.5 to run without forcing a complete theme migration.

However, the repair did not eliminate every limitation of the older theme. Its legacy page builder still required a future security and maintenance decision.

This distinction was important. Making legacy software compatible with a modern runtime is not the same as bringing every component fully up to date.

Results and outcomes

The completed work moved Almost Everything from PHP 7.4 to PHP 8.5, removed unnecessary dependencies and restored several pieces of functionality without rebuilding the website.

The existing design and portfolio structure were retained, and the changes were tested before being applied to the live installation.

The result was a cleaner WordPress installation running on a supported PHP environment, with fewer unnecessary plugins and several longstanding functional issues addressed.

The work also provided the client with a clearer understanding of which areas genuinely needed future investment and which could remain unchanged.

Technology used

Almost Everything runs on WordPress with a legacy Themify theme and page builder, hosted through SiteGround.

The project involved upgrading PHP from 7.4 to 8.5, inspecting WordPress core files and database content, repairing legacy theme compatibility, removing unused plugins and replacing abandoned functionality with custom code.

Ninja Forms was temporarily restored during the remediation to repair existing enquiry functionality. Other components reviewed included Kadence Security, Classic Editor, CookieYes, Redirection, Simple History, Site Kit by Google, Smush, UpdraftPlus, Yoast SEO and SiteGround Speed Optimizer.

Testing was carried out on a private local copy of the website before the changes were applied to production.

Next steps

The urgent security and compatibility work is complete, but the audit also highlighted opportunities to simplify the website further.

Following the initial repairs, the client clarified that the laser cutting and CNC enquiry forms were no longer required, as those services were being reorganised into a new services page.

A separate follow-up phase was proposed to remove the obsolete forms, redirect retired pages, review administrator access, improve broken links and navigation, address the Set System terms document and replace the large homepage video with a more efficient hosted version.

That additional work was deferred at the client’s request and is not included in the completed project.

The older Themify page builder also remains a longer-term maintenance consideration. Although the compatibility repair allows the site to run on PHP 8.5, a future redesign or theme migration would provide an opportunity to move away from the legacy architecture entirely.

The key takeaway is that an ageing WordPress website does not always need to be rebuilt to resolve urgent technical problems.

With a careful audit, isolated testing and targeted compatibility repairs, it is often possible to extend the useful life of an existing website while reducing immediate security and maintenance risks.

If your WordPress website depends on an outdated theme, unsupported PHP version or abandoned plugins, professional WordPress support can help identify the safest route forward without putting your existing content and functionality at unnecessary risk.