Why “saved on the licence” usually reads as “got hacked”
A nulled plugin is a paid extension with the licence check bypassed, downloaded from a piracy site. The problem is not only legal: the “free” version almost always ships with malware attached — nobody audits that code, and the site handing it out has an obvious interest in access to your server.
What is hiding inside
- •A backdoor — a hidden entrance that bypasses passwords entirely,
- •A dropper — code that pulls the real payload down later, after installation,
- •Spam and SEO injections — hidden links and redirects to somebody else’s pages,
- •Data theft — intercepting forms, passwords and payment details,
- •A swapped update channel — “updates” arriving from the attacker rather than the developer.
How to detect them
| Sign | How to check |
|---|---|
| Unofficial source | the plugin did not come from the catalogue; “Pro” with no licence |
| Swapped update URL | check where the plugin actually goes for updates |
| Obfuscated code | eval, base64_decode, long encoded strings |
| Extra files | anything the original version does not contain |
| Diff against the original | comparing files with the genuine release — the most reliable method |
For the broader infection check, see how to check a website for malware.
What to do about it
Replace nulled plugins with proper licences or free equivalents, then check the site for implants that were already left behind — the licence bypass may not have been the only gift. To diff plugins and core against the genuine versions automatically, ServerShield does it from Pulse.
Frequently asked questions
What makes a nulled plugin different from a normal one?
It is a paid plugin with the licence check bypassed, downloaded from a piracy site. Along with the “removed protection” there is usually malicious code baked in — nobody audits it, and updates no longer come from the official channel.
How do I tell whether a plugin is nulled?
Typical signs: it did not come from the official catalogue, it is a “Pro/Premium” build with no licence, the update URL has been swapped, there is obfuscated code inside, and there are files the original does not have. The most reliable test is a diff against the genuine version.
What do I replace it with?
An official licence for the plugin you need, or a free equivalent from the catalogue. The licence fee is almost always cheaper than the aftermath of a breach — downtime, cleanup and lost data.