A nulled plugin is a paid plugin distributed without a license from its developer.
Definition source: Wordfence: The Price of Free. Read on October 24, 2026. The practical questions on this page help you define the issue with your administrator.
What does nulled mean for your installation?
You do not receive the developer’s updates through that license route, and the package may contain code the developer did not write. Replace it with the official version or an alternative.
Free software is not automatically nulled. An official free WordPress pluginA WordPress plugin is an add-on you install in WordPress to give your site extra features, such as contact forms, SEO tools or a webshop. can be a supported choice. The price you paid does not establish who produced or modified the package either.
Separate the purchase record from the question of which files were actually installed.
Wordfence describes research into tampered premium plugins containing added malicious code. That supports checking origin, not concluding that every unfamiliar package contains the same infection. Do not turn a name in an inventory into an accusation against a developer or a previous administrator without evidence.
What suggests an origin problem?
Which PHP version does your site report?
We read only what your site already sends in public: the headers and the top of the homepage. No scan, no login.
Ask where the installation package came from and which update arrangement applies. A missing receipt may be an administrative problem; it does not prove malware. An unexplained download source does make it harder to establish what code you are running.
Check origin and maintenance as separate questions.
The same question can apply to a WordPress themeA WordPress theme is a ready-made package that decides how your WordPress site looks and how its pages are laid out. Change the theme and the design changes.. Record which features your site needs before replacing anything. This helps avoid losing a form or payment feature unexpectedly during the change.
Record the existing settings as well, so the person testing the replacement knows what behavior to compare.
How should you choose a replacement?
Have your administrator assess the official version or a suitable alternative and check it on a test copy. Discuss features, license terms and access to updates. Do not look for another unverifiable download simply to keep the same package working.
Ask who will own future maintenance after the replacement.
A concrete warning about added code calls for investigation alongside replacement. A backdoorA backdoor is a hidden or undocumented way into a system outside its normal administration route. may provide access separately from the plugin feature visible on screen. Ask which environment will be examined and what can be established about earlier changes.
Installing another package does not answer that question by itself.
When should you ask for help?
Get help when nobody can establish the source, updates are unclear or suspicious changes have been found. Provide an inventory of the affected components and their purpose. Do not share license keys or account credentials through an ordinary contact form.
This explanation does not claim that distributing such software is always a criminal offense. License terms and code origin require separate assessment. For maintenance, establish whether you can verify the installation, update route and responsible supplier.
Product and company names on this page belong to their respective owners. We use them to describe the subject. We are not affiliated with those parties.
Prepare your request for help
Write a short note for your administrator naming the page, the time of the observation and what your team changed beforehand. Include the original warning if one is available. Keep facts separate from suspicions.
Describing what you saw on a particular page is more useful than stating a conclusion that has not been investigated.
For routine maintenance of a PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. site, review the existing PHP services. First discuss which question fits the service. This glossary page explains a term; it does not examine your installation or promise recovery.
For a possible incident, establish the expertise needed and which components someone can actually assess before agreeing the work.
Agree who receives the findings and who follows up an open question. Request a report identifying the areas checked, the date and the limitations. That helps you decide on a next step without treating general reassurance as evidence.
Your own first step is to record the observation and pass it to the administrator responsible for the site.
Frequently asked questions
Are free plugins also nulled?
No. Free and nulled mean different things. Check whether you use an official release and what support its developer offers.
Price alone proves nothing about the contents of the package.
What should I tell my administrator?
Provide the page, time and original warning. Describe what you observed and what remains a suspicion. Do not submit passwords, keys or customer personal information through an ordinary contact form.
Can the PHP Exposure Check establish this?
No. It reports public information such as the PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. exposed by your server. It does not investigate malware, access permissions or interception of form input.
Have your specific warning assessed separately.