Nulled WordPress Themes: What They Really Cost

Most people running a nulled theme did not choose one. It arrived with a cheap build, or a developer supplied it without saying where from, or somebody two owners ago downloaded it and nobody has looked since. So this is not a lecture about piracy. It is what is actually in the file, how to find out whether you have one, and what it costs when it goes wrong, which in our experience is the single most common route to a site being compromised.

What "nulled" actually means

A nulled theme is a commercial WordPress theme redistributed for free, with the licence check removed so it runs without a key. The same thing exists for plugins, and the term is used interchangeably with "cracked" or "GPL download".

That last label is where it gets interesting, because the licence argument is not as clear cut as most articles pretend.

The licence is not really the point

WordPress is released under the GPL, and the WordPress project's position is that themes and plugins built on WordPress functions inherit that licence. Under the GPL, redistributing code is permitted. That is what the licence is for. A number of commercial theme companies are entirely open about this and sell support and updates rather than the code itself.

So "it is illegal" is a weaker argument than it is usually made to sound, and if that is the only reason someone gives you for avoiding nulled themes, they have not thought about it much. Some vendors do use split licensing, keeping CSS, JavaScript or images under a separate proprietary licence, so the picture varies by product.

The problem is not the licence. It is that the file has been modified by somebody whose entire business is distributing modified files, and you have no way to see what else they changed.

Removing a licence check means editing the code. Once you accept a build from somebody willing to edit the code, the question is not whether they edited it. It is what else they edited, and you cannot answer that by looking at the site.

What is actually in them

Not every nulled theme is malicious. Plenty are exactly what they claim: the real theme with eight lines removed. The difficulty is that you cannot tell which kind you have without reading the code, and the ones that are not clean tend to carry one of a small number of things.

The loud ones are almost a mercy, because you find them the same week. The genuinely damaging category is the quiet one: injected links and dormant backdoors sit there for months while the site behaves normally and the search rankings slide for reasons nobody can identify.

The obfuscation tell

Malicious additions are rarely readable. They are usually encoded so that a glance at the file shows nothing meaningful: a long base64 string, or a chain of eval, gzinflate and str_rot13 that decodes itself at runtime.

Legitimate theme code has essentially no reason to look like that. If you open a theme file and find a single line running to several thousand characters of apparent nonsense, you have found something, and it is not a performance optimisation.

How to tell whether you have one

Four checks, quickest first.

1. Ask where it came from

The fastest check is not technical. If the theme is commercial and nobody can produce a purchase receipt or a vendor account, that is your answer. Ask whoever built the site. A straightforward answer is usually a straightforward answer.

2. Look for the licence field

Most commercial themes want a licence key, and it lives under Appearance or in the theme's own settings screen. A commercial theme with no licence field at all, or one that says "activated" while nobody has ever entered a key, has had that check removed.

3. Compare against the real thing

If you know which theme it claims to be, and you can get a legitimate copy, compare the file listings. Extra files are the giveaway, particularly anything sitting in an odd place: a PHP file in the uploads directory, or a file whose name looks like part of WordPress but is not, such as wp-cache.php or wp-config-sample.php.bak in the theme folder.

4. Search the theme folder for the patterns

Over SSH, this takes seconds:

grep -rE "eval\(|base64_decode|gzinflate|str_rot13" wp-content/themes/

Hits are not proof. A few legitimate themes use these functions for dull reasons. But a hit inside a long unreadable string is worth taking seriously, and no hits at all is genuinely reassuring.

Without SSH, a security plugin that compares core and repository files against known-good copies covers most of this, though it cannot check a commercial theme it has no reference for. Our guide to running a security audit covers the wider sweep.

What it costs when it goes wrong

This is the part worth being concrete about, because "it is risky" persuades nobody.

The clean-up is not the expensive part. Removing malware from a site is a defined job with a known cost. What it sits alongside is the expensive part.

• Every credential becomes suspect. Admin passwords, the database user, FTP, any API key stored in the site. A backdoor with file access has had sight of wp-config.php, which holds the database credentials in plain text.
• Your backups may already contain it. If the theme has been there four months and your host keeps seven days, every restore point is infected. This is the argument for retention that reaches past a slow-moving problem, covered in our guide to backups.
• Search visibility takes the longest to recover. Injected links and cloaked pages can get a site flagged, and the warning outlasts the infection. Recovering rankings takes weeks after the code is clean.
• If the site takes payments or holds accounts, it is a personal data question. Under UK GDPR a compromise involving personal data may be reportable, and "we did not know the theme was modified" is not a defence, because you chose the supplier.

Set against a theme licence, usually somewhere between fifty and a hundred pounds a year, the arithmetic is not close. The saving is real and small; the exposure is unbounded and lands on a day you did not pick.

Why these sites exist at all

Worth understanding, because it explains why some nulled themes are clean and others are not.

Running a nulled download site costs money. Hosting, bandwidth, and somebody keeping the library current. That cost is recovered in one of three ways, and which one a site uses decides what you get.

Advertising. The site is plastered with it and the downloads are largely untouched. These are the ones where the file usually is what it claims to be. The operator's product is your attention, not your website.

Selling access. A membership fee for a library, positioned as a GPL club. Some of these are entirely legitimate businesses redistributing GPL code lawfully and saying so. Others use the same language while distributing modified files. The presentation is identical, which is the difficulty.

The sites themselves. The download is the product only in the sense that a lure is a product. Injected code turns thousands of installations into an asset that can be sold on, rented out, or used to build links. This is the category worth worrying about, and it is invisible from the download page.

You cannot tell which of the three you are dealing with from the outside, and the third one has every incentive to look exactly like the first.

If the reason is budget, there are honest options

Most people reaching for a nulled theme are not trying to get away with anything. They want a site that looks decent and cannot justify a hundred pounds a year. That is a fair position, and it has real answers.

• The WordPress.org directory. Free, reviewed against coding standards before listing, and the quality at the top end is genuinely good now. It is also the only source where the checks in our piece on spotting an abandoned theme work, because the update history is public.
• The free tier of a commercial theme. Several of the most popular themes have a capable free version in the directory and sell a paid add-on. You get real updates and can upgrade later without changing theme.
• Block themes and the site editor. WordPress now does natively much of what people used to buy a theme for. A simple block theme plus the site editor covers a brochure site without a page builder, and it will still be supported in five years.
• Buy one year and stop. Most commercial licences are perpetual for the code you already have; the fee buys ongoing updates. Letting it lapse leaves you with an unsupported theme, which is a known and manageable position. Running a modified copy is not.

That last point is the one worth sitting with. An expired licence and a nulled theme both end with no updates. Only one of them also means installing code from a stranger who edits code for a living.

What to do if you find one

In this order, and the order matters.

1. Do not simply delete it and carry on. If it did something, the something is elsewhere by now. Deleting the theme removes the door, not whatever came through it.
2. Take a backup before you touch anything. Yes, of an infected site. You may need to know what was there, and an unhelpful clean-up is easier to undo than to reconstruct.
3. Buy the real theme, if you want to keep it. Install the clean copy from the vendor over the top, so the design survives and the modified files are replaced.
4. Scan properly. Not just the theme folder. Core files, plugins, uploads, and the database, because injected links are often stored as content rather than as code.
5. Check the user list. Look for administrator accounts you cannot account for, and for ordinary-looking accounts whose role has been quietly raised.
6. Change everything. Admin passwords, database password, FTP and SSH keys, and the WordPress salts in wp-config.php, which logs everybody out and invalidates stolen sessions.
7. Watch for a fortnight. Reinfection means something was missed, and a site that gets cleaned twice usually had a second door.

If that reads like more than you want to take on, it is what malware removal is for, and nulled themes are one of the most common things we find at the root of it.

If it came with your website build

The common and awkward case, so worth addressing directly.

A cheap build sometimes includes a premium theme at a price that could not possibly cover the licence. That is not always dishonesty. Some builders genuinely do not know, having bought a bundle themselves. Either way you are the one holding the site.

Two useful questions for whoever built it, asked neutrally:

• Which theme is this, and is the licence in my name or yours?
• What happens to updates when the licence lapses?

A builder using legitimate licences answers both easily. One who cannot, or who explains that updates are not necessary, has told you what you needed to know. The second question matters even with a legitimate licence, because a theme licensed to an agency you no longer work with stops updating the moment that relationship ends, which lands you back at an abandoned theme by a different route.

The honest summary

Nulled themes are not dangerous because somebody broke a rule. They are dangerous because you are installing code, on a server holding your customers' details, from a supplier whose only product is modified code, with no way to audit what you received.

If you have one and the site has been fine for two years, you are probably in the majority of cases where nothing was added. You still cannot prove it, and the cost of being wrong is not proportionate to the licence fee you saved.

If you would rather this were checked rather than assumed, it is part of what a care plan covers: themes and plugins tracked against their real sources, updates applied, and file changes noticed when they happen rather than when they surface.