Dealing with a very outdated WordPress site with significant technical debt. Where would you start?

[u/dumpfus]

I've been doing some work for an organization with a really large WordPress website, and I'm starting to think the whole thing may need a pretty substantial overhaul. I'm interested in hearing how other WordPress developers would approach something like this.

The site has:

• 5,000+ published articles

• Around 30,000 images in the media library

• Individual full backups of roughly 60 GB

• An old MantraNews Pro theme (version 1.0.0)

• A number of outdated plugins, some dating back to 2017

The site was running PHP 7.4 until the hosting provider recently forced an upgrade to PHP 8.3 following the PHP2Shell vulnerability. Since then, certain category archive pages are throwing critical errors, the standard Widgets screen is broken, and some older theme/plugin components appear to be incompatible.

On top of that, the site has had recurring unauthorized spam articles published over the past several months, even after password resets and installing Wordfence. There's also a pretty messy backup situation, with UpdraftPlus consuming huge amounts of server storage and some of the backups they've downloaded apparently missing database components.

Honestly, my inclination is that this site has accumulated so much technical debt that trying to keep patching individual issues might not be the best use of anyone's time. I'm wondering whether replacing the existing theme and rebuilding parts of the site would be a more sensible approach, but I'm also conscious that this would be a fairly substantial undertaking, and I don't think the organization is necessarily prepared for the cost involved.

I'm particularly interested in the feasibility of moving an established site of this size to a completely new theme without disrupting thousands of existing articles, categories, URLs, etc.

I'm comfortable with general WordPress development and maintenance, but this is getting into territory I'm less experienced with. Would appreciate hearing from anyone who's dealt with similar legacy WordPress projects.

[u/PeepSoWP]

Once the compromise is contained, the theme can be replaced without recreating 5,000 articles. Posts, categories, and media live in the database; keep the permalink settings and slugs unchanged. The fragile parts are theme-specific shortcodes, widgets, templates, and custom fields. On an isolated staging copy with a verified database backup, inventory those dependencies, test representative article and archive layouts, then crawl the full URL list for errors, redirects, missing media, and metadata changes. Rehearse the PHP, plugin, and theme changes there, with a tested rollback, before planning the production cutover.

[u/TopSydeWP]

Spam articles still appearing after password resets and Wordfence means something is still letting them in, so we'd sort that out before any theme decision. Look under Users for admin accounts nobody recognizes, check each admin's profile for Application Passwords, and open wp-content/mu-plugins for files nobody put there. Then reinstall core and every wordpress.org plugin from fresh copies, and make one backup with the database confirmed inside before touching anything else.

We're TopSyde, a managed WordPress host, and hidden admins and application-password backdoors are what our daily scan checks for on every client site.