Using nulled themes or plugins might seem like a good way to save money, but they often come with hidden dangers — most notably, malicious code. If your website is behaving strangely, redirecting users, or has been flagged by Google, there’s a high chance your site is infected. Here’s a step-by-step guide to fix your site and protect it going forward.
Step 1: Identify the Infection
The first step is to confirm whether your website is actually infected. Common signs include:
-
Unexpected redirects to suspicious sites
-
Strange pop-ups or ads
-
Admin panel access issues
-
Slow site speed or increased server usage
-
Blacklisting by Google or antivirus tools
Use security scanners like:
-
Wordfence (for WordPress)
-
Sucuri SiteCheck
-
VirusTotal for uploaded files
Step 2: Back Up Your Website
Before doing anything major, back up your entire website — both files and database. Even if the site is infected, having a copy allows you to analyze and recover critical data if needed.
Step 3: Remove the Nulled Theme/Plugin
Delete any nulled or pirated themes/plugins immediately. They are the most likely source of infection.
-
Go to your website’s file manager or use an FTP client (like FileZilla)
-
Navigate to
/wp-content/themes/or/wp-content/plugins/ -
Delete suspicious or nulled folders
If you’re unsure, compare them with the official versions from the developer or WordPress.org.
Step 4: Clean the Infected Files
Malicious code is often hidden in:
-
functions.php -
wp-config.php -
.htaccess -
Random files in
/wp-includes/or/wp-content/uploads/
Look for:
-
Base64 encoded strings
-
Obfuscated code (e.g. a long string of random letters/numbers)
-
Unauthorized
eval(),exec(), orsystem()functions
Tips to clean:
-
Use a security plugin like Wordfence or MalCare to scan and remove infected files
-
Use SFTP to manually inspect and replace corrupted files with clean versions from a fresh WordPress install
Step 5: Change All Passwords
After cleaning the site, change all credentials:
-
Admin passwords
-
Database passwords
-
FTP/SFTP credentials
-
Hosting account password
This ensures the hacker can’t get back in.
Step 6: Reinstall WordPress Core, Themes, and Plugins
To be sure everything is clean:
-
Download a fresh copy of WordPress from wordpress.org
-
Reinstall themes and plugins ONLY from official sources
-
Avoid using any pirated or nulled software again
Step 7: Check and Clean the Database
Sometimes, malware injects malicious scripts into the database, especially in posts, options, or user tables.
Use tools like:
-
phpMyAdmin to inspect suspicious content
-
Plugins like WP-DBManager or WP-Sweep to clean the database
-
Look for weird iframes, scripts, or strange content in post meta or options table
Step 8: Submit to Google for Review (if Blacklisted)
If your site was flagged by Google:
-
Go to Google Search Console
-
Under Security Issues, request a review after cleaning
-
It may take 1–3 days to remove the warning
Step 9: Install a Firewall and Monitor Security
To prevent future infections:
-
Install a security plugin like Wordfence, Sucuri, or iThemes Security
-
Enable real-time firewall and malware scanning
-
Regularly monitor login attempts and file changes
-
Set up automated backups (e.g. with UpdraftPlus or BackupBuddy)
Final Advice: Never Use Nulled Software Again
Nulled themes and plugins are not just illegal — they’re a ticking time bomb for your website. Always:
-
Buy from trusted developers
-
Use free alternatives from official sources
-
Consider investing in quality tools — it’s cheaper than recovering a hacked site
Would you like this article formatted for WordPress or as a downloadable PDF?