The theme you wanted costs money every year. Then a search turns up a site offering the exact same theme, “premium version, fully activated”, as a free download. Or perhaps you never made that choice at all: a developer built your site, and only later did someone notice that the expensive page builder was never paid for.
Either way, you now have what is usually called a nulled theme or plugin. It may work perfectly. That is part of the problem. This post explains what nulled software is, why it so often contains malware, how to tell whether your site has some, and what to do about it without making things worse.
What “nulled” actually means
Paid WordPress themes and plugins normally check a licence key. The key switches on automatic updates, support and sometimes certain features. A nulled copy is one where that check has been cut out or faked, so the software runs as if it were licensed when it is not.
These copies are passed around on download sites, forums, file-sharing links and some “bundle” sites that offer hundreds of premium products for a small fee or for nothing. Some of those bundle sites say they only redistribute untouched files. You have no practical way to check that the files you receive are the same as the ones the developer released.
Is it legal?
Please read this section as general information, not legal advice. WordPress is released under the GPL, an open-source licence, and many premium themes and plugins are released under the GPL as well, at least for their code. That licence allows people to copy and share the code. So redistributing GPL code is not automatically illegal in the way copying a film would be.
That does not make a nulled copy safe, and the licence question is mostly a distraction. Some products include images, fonts or other files under different terms, and trademarks are a separate matter. More importantly for you, legality says nothing about whether someone has tampered with the code before handing it over.
Why nulled copies so often carry malware
Ask a simple question: why would someone spend time cracking a premium plugin and hosting it for strangers at no charge? Sometimes it is advertising on the download page. Very often it is because every site that installs the copy becomes useful to them.
Code added to nulled software tends to do a handful of things:
- Create a hidden administrator. A user account is added that does not show in the normal Users list, giving the distributor a login to your site.
- Phone home for instructions. The plugin quietly contacts an outside server and runs whatever code comes back. Today it may do nothing. Next month it may do anything.
- Insert spam links. Links to gambling, pharmacy or loan sites are added to your pages, sometimes visible only to search engines. Cleaning that up is a job of its own; our SEO spam cleanup page describes what is involved.
- Redirect some visitors. People on phones, or people arriving from Google, are sent to scam pages while you see nothing wrong.
- Plant files elsewhere. A second piece of code is copied into another plugin, the theme or the uploads folder, so it survives if the nulled product is deleted.
- Collect data. Form submissions, login details or, on a store, customer information can be copied and sent out.
Not every nulled file is infected. The trouble is that you cannot tell the safe ones from the dangerous ones by using them, and the cost of guessing wrong is a compromised site.
Why it is hard to spot
Owners often run a security scan, see a clean result and assume the nulled plugin is fine. A few things work against that conclusion.
The added code lives inside a large, legitimate product with thousands of files. It may be a few lines in one of them, written to look like normal licence-handling code. It is frequently scrambled so that it cannot be read at a glance. Some versions wait days or weeks before doing anything, so the site behaves normally during the period when someone might be watching. Others stay silent for logged-in administrators. And because the product is not the official release, a scanner that compares files against the developer’s original cannot always do that comparison.
The other cost: no updates
Suppose you were lucky and your copy is genuinely untouched. It still cannot receive updates from the developer, because updates are tied to the licence that was removed.
That means when a security flaw is found and fixed in the real product, your copy stays on the old version with the hole still in it. Attackers know which versions are vulnerable and look for them. So even a clean nulled plugin turns into an open door over time. Our guide to the common ways websites get broken into explains why unpatched add-ons are such a common target.
You also lose support. If the plugin breaks after a WordPress update, there is nobody to ask, and searching for fixes often leads back to the same kind of download sites.
How to tell if your site has nulled software
You may not know how every plugin on your site was obtained, especially if someone else built it. These checks help:
- Find the receipt. For each premium theme or plugin, can you find an invoice or an account on the developer’s own website showing a licence in your name or your developer’s name?
- Look at the licence screen. Most paid products have a settings page with a licence key field. A blank field on a product that is clearly working, or a key that looks like filler text, is a hint.
- Watch the updates. If the Plugins screen shows an update is available but it will not install, or the product has never updated at all while the developer’s changelog shows many releases, that is worth asking about.
- Check readme and text files. Some nulled packages include a text file or comment crediting the site they came from.
- Ask whoever built the site. A straightforward question about where each paid component came from, and whose account holds the licence, usually settles it. If you have inherited the site, our guide to inheriting a site from a previous developer lists other things to ask for at the same time.
What to do if you find one
The instinct is to delete the plugin straight away. Pause first, because deleting it may break the site and will not remove anything it has already planted elsewhere.
- Take a full copy of the site, files and database, before changing anything.
- Get a genuine replacement. Buy a licence from the developer and install their official download over the top, or choose a different product that does the same job. If budget is the issue, the official WordPress.org directory has free themes and plugins for most common needs, and our post on installing WordPress plugins safely covers where to get them.
- Remove the nulled copy completely, including its folder, rather than just deactivating it.
- Look for what it may have left. Check for administrator accounts nobody recognises; our post on unexplained administrator accounts explains where they hide. Check for PHP files in places they do not belong, and for unexpected scheduled tasks.
- Change passwords for WordPress, hosting and the database, since the plugin may have had access to all of them.
- Scan, then keep watching. Run a scan with a reputable tool, but do not treat a clean result as proof. Watch for new admin users, changed files or odd behaviour over the following weeks.
If the site has already shown symptoms, such as redirects, spam pages or a Google warning, treat it as hacked rather than as “a site with a dodgy plugin”. The cleanup needs to cover the whole site.
If a developer installed it
Finding nulled software on a site someone else built is uncomfortable, but it is not always a sign of bad intent. Some developers use these copies to show a client a design before buying licences, then forget to swap them. Ask calmly, ask for the licence details, and give them the chance to replace the files with genuine ones. What matters is that the site ends up on official copies you control.
Saving money without the risk
Wanting to keep costs down is perfectly reasonable. There are safer ways to do it than nulled downloads.
- Use free plugins from the official directory where one does the job well. Many are maintained by the same companies that sell premium versions.
- Buy only the premium products you actually use, and drop the ones that duplicate each other.
- Ask that every licence is registered to your business, not to a developer’s personal account, so you keep updates if you change who maintains the site.
- When a developer quotes for a build, ask which paid components they plan to use and whether the licence cost is included.
A paid licence is a small, predictable expense. A hidden backdoor tends to be neither.
For a sense of what recovering a site involves once something has got in, see our page on repairing hacked websites.
If you have found nulled software on your site and want to be sure nothing was left behind, our WordPress backdoor removal service is built for exactly that: finding hidden access points, removing them and telling you plainly what we found.
Next in this series: How to Scan a Website for Malware (and What Scans Miss)
