No. A nulled WordPress theme or plugin is a paid product copied and altered by someone outside the vendor to remove licence checks. You cannot see what else they changed, you lose official updates, and you take on all the risk for a saving that rarely survives one incident.
What nulled means
Nulled code is paid software redistributed for free after its licence verification has been removed. The person who did that is anonymous and has no obligation to you. Any change they made to the code runs with the full privileges of your site.
Two points from the WordPress.org material matter here. The hardening guide tells site owners to restrict themselves to the WordPress.org repository or well known companies. And the plugin guidelines explicitly prohibit obfuscated code, because hidden code is where malicious behaviour hides. Nulled copies often depend on exactly that.
Why the risk is higher than it looks
Reasoning from how plugins work, not from a single incident:
- Plugin and theme code runs on your server with the same rights as WordPress itself.
- The person who modified the copy chose what to add. Nobody audits it.
- You cannot compare the files with a vendor checksum, because the original was changed on purpose.
- Updates come from the same anonymous source, or not at all, so security fixes stop reaching you.
- The licence you are not paying for may also expose your client to legal trouble.
Signs a copy is nulled
- It came from a forum, a torrent, a coupon site or a bundle of hundreds of products.
- The vendor's licence key field is missing or bypassed.
- The package contains extra files the official download does not.
- Code is obfuscated or encoded in places that make no sense for the feature.
- The price is far below the vendor's own.
What to do if you already use one
- Do not just delete the plugin and assume the site is clean. Treat the site as potentially compromised.
- Compare core files with the core checksum command and review recently changed files and new admin users.
- Rotate every password and key a site administrator could reach, including hosting and database credentials.
- Replace the product with a legitimately licensed copy or a maintained directory alternative.
- Restore from a backup taken before the nulled code was installed, if you have one.
Cheaper routes that are safe
Look in the official directory for a free plugin that does the job. Ask the vendor for a student, nonprofit or agency licence. Pay for one licence and update from the vendor. The cost of a licence is small compared with a clean up.
If you inherit a client site and cannot tell where its code came from, start with an inventory. Safeguard can scan a repository for dependency manifests and produce an SBOM, and there is a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen. See how scanning source code surfaces risky patterns, the kind of review a nulled package never gets.
Quick check
Is a nulled plugin illegal?
Redistributing paid code without permission usually breaches the licence. Ask a lawyer about your own situation. The security risk stands regardless.
Is a free theme from a random blog the same risk?
It can be. Prefer the official directory or a known vendor, and review the code if you can.
Sources
Last reviewed: 19 October 2026.
