The WordPress market has changed a lot in ten years. Back then useful free tools showed up regularly, released out of curiosity or kept alive by volunteers. A lot more of it now sits behind a paywall, sometimes even a small utility that turns off comments or drops one more button into your footer. This is about the three options actually in front of you, free, nulled and premium, and how to choose between them.
One disclosure before anything else: we build and sell premium themes. When this reaches the premium section, read it knowing where our money comes from, and hold us to it. We have tried to be as hard on our own corner of the market as on the free one.
The old rough balance between free and paid is gone, and more of the space is commercial than it used to be. So is the frustration behind a question a lot of people ask quietly: am I being pushed toward pirated software just to keep a site running without spending hundreds of dollars? Usually there is a better path, and the reasons are worth walking through.
- Free
- often enough
- Nulled
- never
- Premium
- while maintained
The short version
Free covers far more than it gets credit for. The core block editor, block themes and a large set of well-maintained free plugins handle serious work, and for a lot of sites that is enough. Premium earns its price in specific situations: a cohesive design system, complex features built and supported as one package, someone to answer when it breaks. Free is capable. Premium solves a different set of problems.
The choice is also wider than free or premium. A free tier can already be sufficient. You can hire a developer. You can learn enough to adjust a few things yourself. Most real setups end up as some combination of those.
Nulled, a cracked copy with the license check stripped out, is the one option to rule out for almost everyone, and the reason is security rather than morality. The section below sets out what is actually in those files.
The fear of having to go nulled usually means the other options got a rushed look. The choice is almost always there.
Free themes and plugins, and when free is fine
How do you tell a free plugin from a paywalled one?
Most free products are only free on the cover. Many have a paywall behind them that unlocks the part you actually wanted. In WordPress this is easy to miss, because you install themes and plugins straight from your admin panel. You search, you see a good name and a description that seems to solve everything, and you install a stripped-down copy.
So read the description first. Look for marketing links and mentions of a premium version. Authors love to plant a row of backlinks to their pricing page right there in the listing. When the description reads as half sales pitch, the product is free for show.
Can you trust the reviews in the WordPress directory?
Partly. If you install from the official directory there are usually reviews and support threads already, and reading them beats trusting the star average. Weight the reviews that describe a specific experience, good or bad, over the ones that only vent. A single angry one-star is weak evidence either way, and a rating score means something once enough reviews sit behind it.
When free is the right call, on a personal blog, a hobby project, or a small site with a modest requirement and a plugin you have checked this way, paying for premium means spending money on a problem you do not have.
Nulled themes, and what you are actually downloading
Someone broke the license check on a paid theme or plugin and re-uploaded it to a forum or a third-party site. What you download is a stranger’s repackaged copy of what the author shipped, opened up and changed before it reached you.
That is the part people skip past. Whoever repackaged it did so for a payoff. Usually that payoff is traffic to an ad-heavy site, or code slipped into the file itself: a backdoor, a spam injection, or a script that skims whatever people type into your forms, logins and payment details included.
The GPL argument, and why it misses the point
The GPL on the code governs your right to use and modify it. It stays silent on the thing that matters here, which is whether the specific ZIP you pulled off a forum was tampered with. A file can be perfectly legal to run and still carry a backdoor. Those are two separate questions, and only one of them is about licensing.
What actually goes wrong with a nulled theme?
Two things, one slow and one sudden.
The slow one is the missing updates, and those are about security patches as much as features. WordPress core and PHP keep moving, and a theme frozen a year ago drifts out of compatibility and becomes an opening on your site, even if it shipped completely clean. You also lose support, so the first thing that breaks leaves you on your own.
The sudden one is whatever the file was modified to do, and security firms have tracked this for years. Wordfence documented a nulled-plugin campaign in September 2025 that read like a worst case: the tampered plugin went after the site’s own security plugin, created a hidden administrator account, and left the security plugin looking fully functional while it had been quietly silenced (Wordfence, September 2025). That is the goal of most nulled malware: long-term, invisible control. From there it does whatever pays, from skimming card numbers on a store to injecting spam or selling the access on.
The scale is not small either. In its 2020 threat report Wordfence attributed malware on roughly 206,000 sites to a nulled plugin or theme, more than 17% of every infected site it cleaned that year (Wordfence 2020 WordPress Threat Report).
The reason people take the risk barely survives contact with the details. In its earlier reporting on nulled plugins, Wordfence noted that these builds often ship with less functionality than the legitimate version, sometimes even less than the free build in the official directory (Wordfence, July 2021). Degraded software, on a stranger’s terms, with a possible backdoor attached.
Then there is the cost. A compromised site gets flagged. Google may show a “this site may be hacked” warning and drop the affected pages, or your host suspends the account. Cleaning that up costs far more than the theme you were trying not to pay for.
You did not save the price of a theme. You deferred a much larger bill.
Why is nulled a dealbreaker on client and store sites?
Because the risk stops being only yours. On a client project or a store, a breach exposes customer data, and a card skimmer lifting numbers at checkout is a documented outcome rather than a hypothetical. Now it is a question of trust, reputation and legal liability. A hacked hobby blog is a bad weekend. A store leaking customer cards is a different category of problem, and it lands on your name.
Premium themes, and where the trap really is
A high price and a good theme are two different things. On a marketplace like Envato the range inside the premium label is huge. Some of it is excellent and maintained for years. Some was assembled fast, sold hard, and left to rot. Same price tag on both. So the question worth asking is which premium theme you are actually buying.
- You paid for the theme, and half of what you need is extra. The core features you assumed were included turn out to be separate paid add-ons or companion plugins stacked on top.
- The author stops maintaining it. A few releases in, updates dry up, and a year later the theme is stuck on whatever WordPress version it last supported.
- Vendor lock-in: custom shortcodes, a proprietary page builder, a layout structure only that theme understands. The day you want to switch, the migration hurts.
- The support period gets confused with updates. You bought six months of support, it ran out, and you assume the theme has stopped updating. Often it still updates fine, and the checkout page rarely makes the difference clear.
How do you vet a premium theme before you buy?
Four checks tell you most of what you need, and none of them require reading the code:
- The date of the last update. Recent is good, two years untouched is a warning.
- How often the changelog moves. A changelog that stops abruptly means the author walked away.
- What it is built on. A supported framework outlives an author’s one-off homemade stack.
- Demo speed. A slow demo often means heavy, careless code. A rough proxy, but a fair one.
Price is a signal, not a guarantee. A higher price sometimes tracks a more serious product, and on its own it stays weak. Check the specifics before you trust it.
So which one should you actually pick?
The best option depends on what you are building.
| Free | Nulled | Premium | |
|---|---|---|---|
| Cost | Free, paid tier for extras | Free up front | One-time or subscription |
| Security | Vetted in the directory | Often tampered, malware | As safe as its code |
| Support | Volunteer-paced | None | Included while maintained |
| Functionality | Covers common needs | Cut down, sometimes broken | Full, if well built |
| Best for | Blogs, small sites | No one | Client work, stores |
- Personal blog or hobby project: free works well, as long as you vetted it. Pay only for weight you will actually use.
- Freelance work for a client, or a business with revenue: nulled is not worth the risk, full stop. The exposure to client data and to your own reputation dwarfs the license fee you would be dodging. When free falls short, the path here is a properly licensed premium theme you have vetted.
- Non-profit on a minimal budget: look for authors who offer a free tier or a non-profit discount before assuming premium is out of reach.
If you do go premium, the other question is where you buy it, because a marketplace download and a direct license are not the same product:
The same handful of questions comes up every time, so here they are:
Is nulled WordPress software legal?
Start with what the GPL actually covers. Most theme and plugin code is GPL-licensed, so redistributing the code is broadly permitted. What it leaves out is the tampered file, the stripped licensing, the trademarked brand name, and the bundled fonts, images or third-party assets that are often licensed separately. And all of it sidesteps the real problem, which is whatever got added to the copy you downloaded.
Can a nulled theme hurt your SEO?
Yes, and it often shows up there first. Nulled files commonly carry hidden spam links or malware that inject content into your pages, and search engines catch it. The usual result is a ranking drop, a hacked-site warning next to your listing, or Google deindexing the flagged pages. Winning that visibility back after a warning takes far longer than the theme ever cost.
Are free WordPress plugins safe?
The ones in the official WordPress.org directory are reasonably safe, because they are reviewed and openly maintained. The real risks with free plugins are abandonment and features locked behind a paywall you only find after installing. A nulled file off a forum is a different animal, since tampering is the whole reason it exists.
Is a premium theme always worth the money?
Only when it earns it. A high price tracks quality loosely at best. A premium theme is worth it when it is actively maintained, built on a supported framework, and right for the job. One that was sold hard and left to rot a year later is worse value than a maintained free theme, whatever the sticker says.
How do you tell if a theme is abandoned?
Look at the last-update date and the changelog together. Both quiet for a year or more, support threads left unanswered, and silence on recent WordPress versions add up to an abandoned theme. Before you buy, that check takes two minutes and saves a lot later.
Which brings it back to where this started. The fear of having to go nulled almost always means the three options got a rushed comparison at best. Compare them properly and a good one usually appears.
Last updated
