No one likes spending more money than necessary – it’s a human thing. Even one of the richest people in the world, Warren Buffet, still searches out discounts on the cars he buys (ok, maybe that’s an extreme example – you get the idea).
Because people are always on the lookout for ways to cut costs, some WordPress users are tempted to turn to nulled WordPress plugins and themes instead of paying for the official premium version.
In this post, we’re going to tell you why using nulled WordPress plugins and themes is a bad idea…even if it’s not necessarily breaking any laws.
There are various definitions around the web when it comes to the term nulled. As we define nulled it refers to premium WordPress plugins or themes that have been hacked or contain modified code designed to cause harm or collect information. These are obtained from a third-party website (not the original author or creator) and sometimes are made to work without a license key.
It’s unlikely that the FBI kicks down your door if you use nulled WordPress plugins or themes. That’s because, in contrast to the other content that people usually “pirate” (e.g. music, movies), nulled WordPress plugins and themes are often not breaking the law.
The reason here has to do with the GPL (General Public License). Without making this a lesson on copyright, you just need to know that part of what the GPL license allows for is that anyone can freely distribute GPL-licensed software (yes – even premium GPL-licensed software).
So if a nulled plugin site puts a piece of GPL-licensed software up for download, they’re not technically breaking the law because they have the right to freely distribute that GPL code.
The GPL is a big part of WordPress, and most (but not necessarily all) WordPress plugins and themes use GPL. This is, in part, because themes and plugins must be GPL-compliant in order to be listed in the WordPress.org directory.
While premium plugins aren’t required to have a GPL license, many also have a freemium version on the WordPress repository, which then does a require GPL license. Or they choose to have a GPL license. Many premium plugins such as WP Rocket and Gravity Forms are GPL-licensed.
There are other reasons, as well – like being able to use existing GPL-licensed code in plugins and themes. Typically, if you use existing GPL-licensed code in a product, you must release subsequent products under the GPL (this is the reason for the dustup between WordPress and Wix back in 2017).
The GPL is complicated and we’ve overly simplified some of the principles to condense the core ideas into a few paragraphs. But basically – most of the nulled WordPress plugins and themes that you see are probably not doing anything illegal. In fact, GPL is one reason why WordPress is great.
But that doesn’t mean you should go out and pack your site full of nulled extensions…
Just because nulled extensions are legal, that doesn’t mean it’s a good idea to use them at your WordPress site.
Here are four reasons why you still shouldn’t use nulled plugins or themes on your site.
When you download an extension from a source other than the developer (or a trusted repository like WordPress.org), you don’t know what else is lurking in the code.
Malicious actors like to use nulled plugins or themes to insert their own nasty payloads, like injected links for SEO, or even more sinister actions.
When you use a nulled extension, you’re opening yourself up to this type of exploit because, unless you have the knowledge and time to dig through all the code, you have no idea what else is lurking for you in the nulled extension.
Beyond that, you might void any potential help from your host. For example, we offer a free hack-fix guarantee here at Kinsta, but this guarantee doesn’t apply if your site is hacked due to a backdoor in a nulled plugin or theme.
This isn’t a universal issue, as you can find legitimate GPL clubs that offer clean products (usually for a monthly fee). But even if you pay for a GPL club that offers downloads free from malicious code, there are still other important reasons why these extensions aren’t a good idea. And how are you to know which GPL club can be trusted?
An example of a paid GPL club
That’s why we typically refer to plugins obtained from third-party websites as nulled. It’s much safer to assume that if you didn’t obtain it from the original author that it may have modified, unsafe code, or even a virus. You can use an online tool like VirusTotal to scan a plugin or theme’s files to see if it detects any type of malware.
VirusTotal
While most developers do indeed enjoy creating WordPress products, most of them also enjoy being able to eat and afford a roof over their head.
That is, WordPress developers need revenue in order to be able to justify the time that they spend maintaining and improving their products.
When you use a nulled extension, you’re depriving them of the revenue that they could use to further enhance their plugin.
Basically, you’re shooting yourself in the foot by being a freeloader!
Would the Elementor page builder team be able to keep pushing out new features, like theme building, if everyone were using a nulled version? Would the OceanWP theme have all those great add-ons if there were no money coming in?
No! Of course not.
If you’re going out of your way to find a nulled version of a plugin or theme, that probably means you think it’s a valuable addition to your website.
So even if you don’t think it’s worth paying the developer for all the hard work they’ve already put into building you that product, why are you depriving yourself of a chance to get an even better product in the future?
Basically, you should help developers put food on the table so that they can keep creating awesome stuff that makes your life easier.
Nulled extensions can get you all the features of a premium plugin or theme, but they’ll never be able to get you all the benefits that a paying customer gets.
That’s because a big part of what you’re paying for with GPL-licensed software is support from the developer.
When you pay for a product, you get the option to reach out directly to the developer if you encounter any issues with the product.
On the other hand, with a nulled extension, you get zero support. Hit a snag? Hopefully Google helps! Because that’s pretty much your only option. If the plugin your using has a free version in the WordPress repository, you might be able to get a response there. But let’s be honest, it’s pretty much like playing the lottery. And that’s simply because developers simply can’t afford to work for free.
If you waste three hours fixing an issue that the developer could’ve fixed for you in five minutes, did you really “save money” in the end? Probably not (if you value your time).
In order to enable automatic updates for a premium plugin or theme, you’re going to need a license key.
Without a valid license key, you’re going to have to manually update extensions every time there’s a new update.
There are two big problems with this:
First off, it’s just plain annoying and time-consuming. You go from having to simply click a button, to having to delete and re-upload a plugin every single time.
No updates without the license key
That’s not the biggest issue, though.
More importantly, you’ll no longer get that red update notification in your WordPress dashboard. That means you’ll have to find another way to keep track of when new updates come out.
What if the developer releases an urgent security fix, but you don’t get the memo until a few weeks later? Out-of-date extensions are a big attack vector for WordPress sites, so you’re leaving your site open to unnecessary risk if you’re not able to promptly apply new updates.
It’s true that some GPL clubs go and grab the latest versions and then they’ll release the update on their site. But who do you want to put your trust in? A GPL club with a thousand different plugins, or the developer of the plugin. Is that risk worth saving a few bucks?
We don’t see any good reasons to use nulled plugins or themes. However, if you’re really want to get nit-picky, here’s one scenario we’ve personally heard from users.
A lot of premium WordPress plugins don’t have free versions or trials, and their refund policies might only apply if the plugin didn’t work due to a technical reason. A lot of times plugin developers have to be strict with their refund policies to prevent abuse from those trying to get a free copy.
If you’re a WordPress developer, agency, or freelancer, there might be some instances where you simply need to see if a plugin will work for a client. It might not always make sense to buy the plugin if it ends up not being able to do what you need. Because then you’re out the money.
Testing a nulled plugin or theme locally or on a staging site (never on production) might be the route you decide to go down. We won’t be sharing where to get any of these on our site.
If you do this and discover that the plugin or theme does indeed deliver, then, by all means, chat with your client and purchase it to get a legitimate license key, support, and updates.
On the surface, it might seem like a great deal to get a premium plugin or theme for free. But in our opinion, it’s just not worth it. Even if you find a source for legal, clean GPL plugins and themes, you’re still going to waste extra time because you:
Time is money, and nulled plugins and themes will take you more time to use.
Beyond that, you’re just plain depriving developers of the rewards for the hard work they’ve already put in, as well as money to keep improving their products going forward. Even if you have no problem with the ethical implications there, you’d lose out if everyone used nulled extensions because developers would have no incentive to improve.
So – think twice before installing a nulled plugin or theme. Especially if your building or working on other people’s WordPress sites. Don’t put your client in a bind later down the road. We’ve seen this happy way too many times.
If you’re really on a budget, consider one of the 55,000+ free plugins and thousands of free themes that are available at WordPress.org.
Any thoughts? We would love to hear from more WordPress users on this topic in the comments below.
Join 20,000+ others who get our FREE weekly newsletter with WordPress tips on how to drive more traffic and revenue to your business!
Send this to a friend
Some developers use the “WordPress bubble” to become millionaires. Not all of them, of course. But some boast of having a “multimillion-dollar business” with two or three plugins. And many extension prices are totally abusive.
Now most plugins are aimed at agencies that don’t mind paying the amount they ask for to use them on unlimited sites. But for a small business or entrepreneur it’s insane. They have to pay a volume license in order to have access to all the pro options.
I understand that you have to pay for work, support and upgrades but many take advantage of the GPL in an unethical way.
Hey Jim,
You are definitely correct that GPL can and is sometimes taken advantage of by developers. But the great thing about WordPress is there is almost always an alternative out there.
But we completely agree, it’s a two-way street. However, we still need to support developers, especially those with high-quality plugins who don’t have that “multimillion-dollar business.”
Hmm this article is a bit misleading or simply incorrect.
Premium or paid WordPress plugins are not released with GPL licenses, most likely they include a detailed & proprietary license stating these details.
Only the plugins from WordPress directory are required to be released under GPL and there’s no need for nulled plugins that are already free in the directory.
This article only encourages people who already do this to continue without feeling bad about it..
Hey Alex,
That is why we said “but not necessarily all.” Many premium plugins are sold on their own website and also have a freemium version on the WordPress repository, which then requires GPL license.
This article encourages supporting developers to help grow the WordPress community. We frown upon nulled plugins and that’s why we don’t offer free hack fixes if it originated from a nulled plugin.
The author of this article really should define what they mean by Nulled Code.
I’d agree with Alex. This article is both misleading + incorrect, depending on various factors… including the author’s definition of Nulled Code.
I don’t mind paying for good plugins. But plugins that require $99 or more, or monthly subscriptions are a total deal breaker to be able to build a site for small business owners makes it really hard. Imagine that several plugins are needed and either have to pay monthly or yearly fees to keep the plugin working. I bought one plugin for a car rental website. A hefty plugin that runs the whole site and paid $55 for it and have the choice to pay for 12 months of extended support for $18.75. For me these are acceptable prices especially looking at the functionality of this plugin it’s even a bargain.
Anyway, for me a monthly subscription is a big no and plugins for $99 or more are to extreme.
I find it interesting when folks say that a $99 plugin (or more) makes it a deal breaker to build a small business site. I wonder how much it would cost you to hire a developer to build the same functionality, if that plugin didn’t exist? A lot more than $99 I’m sure.
One of the biggest mistakes I made as a starter plugin developer was to price myself too low, and it eventually killed my ability to actively support and improve my plugins and still feed my family.
The only time I used a nulled plugin (because there was no free/trial version of it) was to see how it worked and how good it was.
I ended up having such a horrible experience. The plugin was infecting all my sites in MAMP, with some kind of malware and I had a hard time cleaning everything up. So I’m not doing nulled plugins ever again.
Hey Dominique!
That is a great example of how dangerous it can be to use nulled plugins. Appreciate you sharing that.
Here’s idea, using dismissable “subscribe to newsletter” slide-in windows cause not everyone wants your newsletter and blocking about 40% of bottom screen area on mobile permanently is worse than nulled plugins.
Feel free to click the X button to close it. You will never see it again. We would never force something like that on a reader.
Great article.
On my case, I have been forced to use them on dev environment so I can confirm that they are what Im looking for and to compare contenders as well. There’s a few relatively new subscription-type websites which claims that their files are “nulled-free code”, “100% original”, etc. I have confirmed this by comparing their code with the original version bought once I move to production.
How many plugins would you recommend to have and use? Like what is the optimal number or the maximum number? I find myself constantly want to use more and more without actually knowing how many is too many.
Hey Hafiey,
The number of plugins isn’t as important as the quality of the plugins and how well they are coded. Running 20-25 active plugins is fine.
The reason an install might slow down when you have too many plugins is that typically each plugin will load separate scripts (JS + CSS). The more you install, the more scripts and HTTP requests your site generates.