Code Snippets in functions.php vs a Custom Plugin: Which Is Safer?

The functions.php vs plugin question comes up every time someone needs to add a snippet of custom code to WordPress. Adding it to the theme's functions.php file is quick, and countless tutorials suggest it. But code in functions.php disappears when the theme changes, can be wiped by theme updates and can take the whole site down with a single typo. A small site-specific plugin is almost always the safer home.

This guide explains why functions.php is fragile, how site-specific and must-use plugins work, the pros and cons of snippet manager plugins, how to move code safely and a starting point you can copy.

Functions.php vs plugin: why functions.php is fragile

The functions.php file belongs to the active theme. That creates several risks:

• Theme changes: switch to a new theme and every snippet in the old theme's functions.php stops running.
• Theme updates: if the code was added to a parent theme rather than a child theme, the next update overwrites it.
• Fatal errors: a missing semicolon or bracket can produce a blank white screen across the whole site, including the admin.
• Mixed responsibilities: design code and business logic end up tangled in one file nobody fully understands.

Theme-related code, such as registering menus or image sizes for the design, does belong in the theme, ideally a child theme. Our guide to WordPress child themes explains why. Everything else is better elsewhere.

Site-specific plugins

A site-specific plugin is a small plugin written just for your site to hold its custom functionality: custom post types, tweaks to WordPress behaviour, integrations and so on. Because it is a plugin, it works whatever theme is active. You can also deactivate it if something goes wrong.

The WordPress Plugin Handbook explains the basics. A site-specific plugin can be a single PHP file with a short header, which makes it easy to read, version and hand over.

Must-use plugins

Must-use plugins, often called mu-plugins, live in the wp-content/mu-plugins folder. WordPress loads them automatically on every request, before normal plugins, and they cannot be deactivated from the admin.

That makes them useful for code that must always run, such as security hardening, essential integrations or small fixes your site depends on. They have limits. They do not appear in the normal plugin update system. WordPress also only loads single files placed directly in that folder, so larger plugins need a small loader file.

Snippet manager plugins: pros and cons

Plugins such as Code Snippets and WPCode let you add PHP, CSS and JavaScript snippets from the admin without editing files.

Pros:

• No file access needed.
• Snippets can be switched on and off individually.
• Some include safe modes that catch errors.

Cons:

• Code is stored in the database, outside version control.
• Anyone with admin access can add code that runs on the server, which widens the damage a compromised admin account can do.
• The snippet plugin itself becomes a dependency and part of your security exposure.
• Snippets are harder to review, test and hand over than a plugin file.

They are reasonable for a handful of small snippets on a simple site. For anything a business depends on, a site-specific plugin is cleaner.

Moving code safely

To move snippets out of functions.php:

1. List every snippet and note what each one does.
2. Decide where each belongs: design-related code stays in the child theme, everything else moves to the plugin.
3. Create the site-specific plugin on a staging copy.
4. Move one snippet at a time, removing it from functions.php as you add it to the plugin, so it never runs twice.
5. Lint the PHP before activating, for example with php -l on the command line, to catch syntax errors.
6. Test the features each snippet controls.
7. Deploy to the live site with a backup in place, and keep the plugin in version control.

A starting point to copy

A minimal site-specific plugin needs only a header and a guard against direct access. Save this as a PHP file in its own folder in wp-content/plugins, then add your functions below it:

<?php
/**
 * Plugin Name: Example Site Functions
 * Description: Custom functionality for this site, kept separate from the theme.
 * Version: 1.0.0
 */

if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

Give each function a unique prefix based on your site name to avoid clashes with other plugins, and add a short comment above each block explaining what it does and why.

When custom code grows beyond a few snippets, it is worth treating it as a proper plugin project, with a specification, testing and maintenance. Our guides to custom WordPress plugin cost and WordPress plugin security explain what that involves, and our guide to custom WordPress plugin development covers the full process. For the wider platform picture, see WordPress for business. You can see our plugin work on our custom WordPress plugins and web development pages.

Frequently asked questions

Tidy up your custom code

If your site has years of snippets in functions.php, ask us to move them into a proper plugin and document what each one does.