AI Built WordPress Themes: Four Decisions You Own
AI writes theme code well and fast. Here are the build decisions it still cannot make for you, and how to keep a human in the loop.
By David Jubé · Sep 3, 2026 · 13 min read
Generated theme code is genuinely good now, and four build decisions still land on a person.
A model will write your WordPress theme, and the code can be good enough that a developer would be happy to inherit it.
“Can’t AI just build the theme now?”
That is how a build conversation opens in 2026, and the answer is yes. A practitioner with a model in the loop produces template files, stylesheets and block patterns faster than was possible two years ago, and the output holds up under review. What the model cannot do is decide what any of it should describe. A theme encodes claims about your business: which page types exist, who is allowed to change what, what each page tells a machine it is, and who is responsible when WordPress ships a release that breaks something. Those four questions get an answer on every build. When nobody answers them on purpose, the generated code answers them by default, and the default is whatever the training data found ordinary.
Key takeaways
- Theme code is the part the tools genuinely solved, so the live question is which decisions they hand back to you.
- Four decisions still need a person: the content model, the editor experience, what gets marked up, and who owns the next platform release.
- Supervision, not authorship, separates a good AI assisted build from a bad one.
- Generated code fails in repeatable patterns, which is what makes an hour of review the highest value hour in the build.
- Search policy targets scaled publishing with nobody checking, not the use of a model to write.
Yes, and the theme code is the part that got easy
The 2025 developer survey on AI tool use found that “84% of respondents are using or planning to use AI tools in their development process, an increase over last year (76%)”, with 51% of professional developers using them daily. I use them daily in my own build work and would not go back. Generation has stopped being the constraint on a theme build. Judgement became the constraint instead.
Judging the output means knowing what the output is supposed to say, and that requires knowing which layer of your site the design actually lives in. Step one of this journey, WordPress Site Design: Builder, Parent Theme or Code, sorts that out first. If you cannot say whether your design sits in a page builder, a vendor parent theme, or a theme written for you, you have no reference point for reading what the model built.
What the tools extend is a practitioner’s range, not a practitioner’s judgement
Think of the model as a suit a skilled person climbs into. It lets one practitioner cover ground that used to take a team, and it clears the drudgery between a good decision and a working implementation. It does not supply the decision, and it has no way of noticing when one is missing.
DORA’s research on AI-assisted software development finds the same shape at team level. The tools amplify whatever practices they land in, so a team with a review habit gets faster and a team without one gets faster at shipping problems. GitHub’s data on AI-assisted code volume shows how ordinary generated contributions have become, while survey data on business adoption of AI tools shows adoption across businesses is still uneven.
Amplification runs in both directions, which is why two builds using the same model land in very different states. What separates them is whether four specific questions got a deliberate answer.
Four decisions a model will make for you if nobody makes them deliberately
Each of the four is a decision about your business rather than about code, and each gets an answer whether or not a person supplies one.
Structured markup is where AI assisted builds go wrong quietly, because generating markup is trivial and deciding it is not. The reference documentation on structured markup in HTML tells you how to express a claim, and nothing in it tells you which claim is true of your page. Step sixteen of this journey, AI Overviews and the Six Schema Types a Build Emits, works through that page type by page type, and Structured Data for SEO: The Founder’s 80/20 covers the short list worth emitting at all.
The content model surfaces fastest of the four, because a content model you did not choose becomes a site structure you did not choose, and structure is what a crawler reads before it reads a word of your copy. Step three, Site Structure for a New Website: The Two Numbers, picks that up.
Ownership of the next release reaches back furthest of the four, because it is the same question that put you on WordPress in the first place. If nobody can be named for it, the platform choice itself is worth reopening before the theme is.
The content model and the editor experience are the two nobody delegates well
A content model is a claim about how your business is organised, and a model can only infer that from businesses it has already seen. So it produces a plausible average: pages, posts, a portfolio, a testimonial block. Plausible is the problem, because a structure that looks reasonable never gets questioned. Six months later you are publishing service pages as blog posts, since nothing else exists to put them in.
The editor experience fails on different ground, because it is a judgement about people rather than about code. Deciding what an editor can move requires knowing who that editor is, how confident they are with a layout, and what they need to change on a Friday afternoon without asking anyone. A model holds none of that and will not ask, so its output goes to one of two extremes. A locked build turns every trivial edit into a support ticket. An open build hands a non-technical editor enough freedom to break a page while fixing a typo.
Both extremes get settled in a short conversation before the build and unwound only by opening every template after it. That asymmetry is the argument for putting a person in front of the question, and the same asymmetry runs through the code itself.
Review is where generated code becomes shippable
Veracode’s research on findings in generated code reports that “45% of AI-generated code contains security flaws”. The useful property of that number is not its size but its consistency. Generated code fails in recognisable, repeatable ways, which is the kind of failure a reviewer can learn to spot on sight, and fixing one is usually faster than writing the file fresh. That is what makes an hour of review the highest value hour in the build.
A theme review has a short, specific list:
- Output escaping. Every value a theme prints should be escaped for the context it lands in, and generated template code often prints one raw because its training samples did.
- Capability checks. Any action that changes something should confirm the current user is allowed to do it, rather than treating the admin screen as protection.
- Data handling on forms. Submitted values need validating on the way in, not only on the way out, and a generated handler tends to trust what it receives.
- Dependencies. A model will add a library to solve a problem the platform already solves, a maintenance cost you agreed to without noticing.
- Markup semantics. Generated components carry the visual result without the structure beneath it, so headings, landmarks, and focus order need a human pass.
Every item there is a pattern rather than a judgement call, which is why the same list works every time and works in the hands of someone other than whoever wrote the prompt. The judgement calls sit one layer up, in what the finished site publishes.
Scale without supervision is what gets penalised, not authorship
Founders ask whether Google will punish a site for AI written pages. Google’s spam policy on scaled content abuse describes the problem as pages “generated for the primary purpose of manipulating search rankings and not helping users”, and says it applies “no matter how it’s created”. The trigger is volume with nobody checking whether any of it helps a reader.
Industry coverage draws the line in the same place. Reporting on how mass-produced pages read as a site-level signal treats the pattern across a site rather than any single page as the evidence, and reporting on unsupervised programmatic output puts it more bluntly.
Supervision leaves a trace on the page. A supervised page carries the number you measured, the constraint you ran into, and the reason you took this path over the obvious one, and a model cannot invent any of the three on your behalf. Step thirteen of this journey, AI Generated Content SEO: Four Kinds of Evidence, makes that gap specific. Research on how people actually read a page explains why writing for a scanning human reads differently from writing to cover a topic, and Comparison Tables and Formats LLMs Love to Cite and The On-Page AEO Playbook: Build Pages AI Quotes cover the formats that survive both audiences.
Founder insight: The four decisions above are what I ask about first when I inherit a site someone else built with AI in the loop. If the answer to any of them is “the tool did that”, you have found the gap before it costs you anything.
A workflow you can ask any builder to describe
The four decisions and the review list are checkable from outside the build. Ask whoever builds your site to walk through five steps and say who does each one.
- Decide before generating. The content model and the editor permissions are agreed in words before any code is requested, so the model implements a decision rather than inventing one.
- Generate in small pieces. One template or pattern at a time, because a person can read that much and cannot read a whole theme at once.
- Review against a named list. Escaping, capabilities, data handling, dependencies, and markup semantics, checked every time, not when something feels off.
- Test with the actual editor. Whoever maintains the site makes a real change while someone watches, before launch.
- Name the owner of the next release. One person retests when WordPress ships a major version, written down somewhere findable.
A builder who describes that workflow without hesitating is using the tools the way the tools reward being used. A builder who answers with a demonstration of how fast generation runs has told you which half of the job they measure.
The workflow should also show up in your numbers, since a supervised site earns attention a generated one does not. How to Measure AI Traffic With No Referrer covers the tracking gap these sites hit first, and SEO and AI Visibility Tracking Tools, Compared covers what to point at it.
Your site’s shape is the decision this leaves open
One of the four decisions is already made on your live site whether or not you made it. The content model shipped with the build, and in shipping it set your page types, your hierarchy, and what your navigation claims you do.
Step three of eighteen, Site Structure for a New Website: The Two Numbers, shows how to read the structure you were handed. Reading it needs no rebuild and no developer. It needs you to see what your structure tells search engines, and to confirm that a person agreed to it.
Frequently Asked Questions
Can ChatGPT build a WordPress website?
Yes. A model can produce theme templates, block patterns, stylesheets, and working page markup, and a practitioner who can read the output will get a usable site from it. What it will not do is choose your page types, your editor permissions, or your structured markup, which stay judgement calls.
Are AI-built websites good?
They are as good as the supervision behind them. Authorship of the code is not the variable that decides quality, because the same model produces excellent output for someone reviewing each piece and mediocre output for someone accepting everything. Ask who reviewed the build, not who or what wrote it.
Is AI-generated code secure?
It is secure once it has been reviewed against a specific list. Veracode’s research reports that 45% of AI-generated code contains security flaws, and those flaws cluster in a few predictable places rather than scattering randomly. Check output escaping, capability checks, form data handling, and added dependencies every time.
Should I review the AI code?
Yes, and the review looks for known patterns rather than reading every line equally. Escaping, permission checks, input validation, unnecessary dependencies, and accessible markup are where generated theme code repeatedly falls short. That review is faster than writing the file yourself, and it is where quality actually gets decided.
Does Google care about AI-generated content?
Google’s spam policy targets pages produced at scale to manipulate rankings rather than help people, and it says this applies no matter how the content is created. Using a model to write is not the trigger. Publishing volume without a person checking whether any of it is useful is the trigger.
Are web developers still needed in 2026?
Yes, with a wider range than before. The tools remove implementation drudgery, so one practitioner now covers work that used to need several, and that is a genuine change. The four decisions in this article did not move, and they are the part of the job that was always judgement.
Continue Reading:
Previously in this series
- WordPress Site Design: Builder, Parent Theme or Code, the three places a design can live, and the portable content layer that separates them.
Next in this series
- Site Structure for a New Website: The Two Numbers, the hierarchy your generated build already chose, and the two numbers that expose it.
From the library
- Use AI to Write Without Sounding Like AI, supervision matters just as much once a model starts drafting your copy.
- Writing for E-E-A-T: Prove Experience on the Page, what your content model still has to prove about who actually did the work.
- Schema Markup for AI: Answer-First Writing Guide, why the markup decision only pays off once the passage underneath is answer-first.
Explore TDM Insights Categories