GPL vs Nulled: The Difference That Can Cost You an Entire Website
GPL vs nulled explained: one is legal, the other is cracked code carrying malware. Learn the difference and how to spot a nulled file before installing.
Last updated: 17 September 2026
Quick Answer
GPL files are legally purchased originals, redistributed intact under the GNU General Public License. Nulled files are cracked — their licence verification has been stripped out, and the code has been modified. GPL redistribution is lawful and, from a reputable source, safe. Nulled distribution is copyright infringement and the single most common way WordPress sites get backdoored.
The two get used interchangeably in forums and Facebook groups. They are not the same thing, and confusing them is how people end up with an SEO spam injector in their footer.
The Core Difference in One Table
| GPL | Nulled | |
|---|---|---|
| How the file was obtained | Bought from the developer | Cracked, or copied from another cracked source |
| Is the code modified? | No — byte-identical to the developer’s release | Yes — always |
| Licence check | Left intact; you simply have no key | Removed, patched or faked |
| Legal status | Lawful under GPL §4 | Copyright infringement + often a DMCA violation |
| Malware risk | Low from a scanning vendor | High |
| Update path | Vendor re-uploads each official release | Whatever the cracker feels like |
| Can you audit it? | Yes — diff it against the official ZIP | Diff will show injected code |
Why GPL Redistribution Is Legal
WordPress is licensed under GPLv2. Because themes and plugins call WordPress functions, the overwhelming consensus — and the position of the WordPress Foundation — is that they inherit the GPL. The licence’s terms then apply.
GPLv2 §4 permits verbatim copying and distribution of the source. And the Free Software Foundation is unambiguous that money may change hands: “We encourage people who redistribute free software to charge as much as they wish or can,” and “The GNU General Public License has no requirements about how much you can charge.”
So a GPL site that buys one developer licence and redistributes the unmodified files to thousands of members is operating inside the licence. What it cannot do — and what the good ones don’t do — is modify those files.
Why Nulling Is Different
Nulling means editing the code. Specifically, finding the function that phones home to verify a licence key and neutering it. That single act breaks the model in three ways:
- It’s a modification made to defeat a technical protection measure, which moves it out of ordinary GPL redistribution and into infringement territory in most jurisdictions.
- It requires someone to touch the source. Once an anonymous party is already editing the file, adding four more lines costs them nothing.
- It destroys verifiability. With a GPL file you can checksum against the developer’s release. With a nulled file there is nothing to compare against.
What Actually Gets Injected
The payloads found in nulled WordPress files follow a small number of recurring patterns:
- Backdoor shells — an obfuscated
eval(base64_decode(...))block or a fakewp-cache-config.phpgiving persistent admin access - SEO spam injectors — hidden links served only to Googlebot, which poison your rankings before you ever notice them
- Credential harvesters — hooks on
wp_loginthat POST your admin password to an external endpoint - Ad and affiliate hijackers — silently rewriting affiliate IDs in your own content
- Crypto miners — enqueued JavaScript that runs on your visitors’ machines
The common thread: none of these announce themselves. A nulled plugin works perfectly. That’s the point — a plugin that visibly broke would get uninstalled.
How to Tell a Nulled File from a GPL File
Five checks, in order of speed:
1. Read the vendor’s own language. Sites that say “nulled”, “cracked”, “activated”, “pre-activated”, “licence bypass” or “no key needed” are telling you exactly what they sell. Believe them.
2. Compare file size. Download the official free version from WordPress.org where one exists, or check the developer’s stated ZIP size. Injected payloads add bulk. A 200 KB discrepancy is a red flag.
3. Grep for the usual suspects. Unzip and run:
grep -rn "eval(base64_decode" .
grep -rn "gzinflate(" .
grep -rn "str_rot13(" .
grep -rnE "file_get_contents\(['\"]https?://" .Legitimate plugins occasionally use these functions, so a hit isn’t proof — but a hit inside a long single-line obfuscated string is.
4. Scan it. Wordfence, Sucuri or a ClamAV pass before activation, not after.
5. Check whether the vendor states a policy. Reputable GPL sites say plainly that files are original and unmodified, and name a scanner. PureGPL states files are original and scanned before listing; GPL Times advertises ClamAV verification; GPLDL states its items are “true originals… no nulled scripts.” Vendors that say nothing about file integrity have told you something.
“But It Still Works” — The Real Cost
The argument for nulled software is that it’s free and it functions. The costs are just deferred:
- Google penalties. Injected spam links get sites demoted or deindexed. Recovery takes months.
- Host suspension. Managed WordPress hosts scan for known malware signatures and suspend accounts, sometimes without warning.
- Client liability. If you install a nulled plugin on a client’s site and it leaks customer data, that exposure is yours.
- Cleanup labour. Removing a persistent backdoor usually means rebuilding from a clean install, because the shell drops copies outside the plugin directory.
Against that, a legitimate GPL membership runs $79–$179. A single incident costs more than a decade of membership.
Where GPL Still Has Honest Limits
Being accurate cuts both ways. GPL files from a legitimate vendor are safe, but you do give things up:
- No developer support — your support relationship is with the GPL site
- No official licence key on most plans, so activation-gated cloud features may be limited
- Update lag of hours to days while the vendor buys, scans and re-uploads each release
- Some SaaS-dependent features won’t function without an active key
These are honest trade-offs, not hidden dangers. Nulled software has the same limits plus the malware.
FAQ
Is nulled the same as pirated? Effectively yes. Nulling modifies software to circumvent licence verification and redistributes it without authorisation. That is infringement in most jurisdictions.
Can a GPL site be nulling files without saying so? It can. This is why the vendor’s stated integrity policy matters, and why you should still scan downloads yourself. Vendors that publish a scanning policy and a changelog are easier to trust than ones that publish neither.
Is it illegal to use a nulled plugin on my own site? Distribution is the clearer violation, but use of infringing copies carries risk too — and separately breaches most hosts’ terms of service. The security exposure is the more immediate problem.
Are free plugins on WordPress.org nulled? No. WordPress.org hosts GPL software distributed with the author’s consent, reviewed by the plugin team. It is the safest source that exists.
How do I pick a vendor I can trust? Check for a stated no-modification policy, a named malware scanner, a real support channel, a changelog, and standard payment processors. Our full comparison of the best GPL site options scores ten vendors on exactly these criteria.
Bottom Line
GPL and nulled are not two words for the same grey-market product. One is a licence permission the WordPress ecosystem is built on; the other is modified code from an anonymous source. Buy GPL from a vendor that states its files are unmodified and scans them — and never install anything that advertises itself as nulled.
