GPL plugins:
a security question, not a legal one.
The "paid themes and plugins for free" sites are commonly called piracy, and that is not accurate. The licence genuinely does permit selling copies — the problem is somewhere else entirely.
Selling is permitted by the licence. But you are not buying the code — you are buying the updates.
The official GPL FAQ states plainly that the licence allows selling copies, and that "the right to sell copies is part of the definition of free software" — provided the corresponding source code goes with any copy distributed. So anyone telling you this is flatly "piracy" is wrong, and we will say so even though our recommendation is ultimately not to do it.
The reason is that the licence obliges nobody to provide support or updates. And that is precisely what you buy from the original developer: not the code, which is already free, but that what breaks gets fixed and that a hole gets closed when one is found. A copy that reaches you through a reseller carries no such commitment.
And the distinction everyone conflates: a copy redistributed under the GPL is the code as it is. A nulled copy has been modified to strip out a licence check — and that modification is where something you cannot see gets added. The danger is in the tampering, not in the licence.
Licence wording from the official GPLv2 FAQ on the GNU site; that WordPress itself is licensed under GPLv2 from the About page on WordPress.org. Reviewed 12 August 2026. This is general information, not legal advice.
What the licence permits, and what it does not address
| The licence | |
|---|---|
| Redistributing the code | Permitted |
| Charging money for it | Permitted |
| Supplying the source code | Required of whoever distributes |
| Technical support | Not addressed by the licence |
| Security updates | Not addressed by the licence |
The last two rows are the whole story: what you actually need is what the licence does not guarantee.
Why is the modification the danger?
For a paid copy to run without a licence key, something in its code has to be changed — the part that checks the licence is removed or disabled. That is an ideal opportunity to add something else at the same time, because you will not notice:
- A backdoor — an account or a route that allows entry later.
- Link injection — links shown to search engines and not to you, so you take the penalty.
- Data collection — sending whatever passes through your site somewhere you do not know about.
And you will not know which of those is present, because the code you inspect is not the code the developer wrote. That is why we call it a security matter: the judgement does not rest on the distributor's intentions but on the fact that you cannot verify.
What about "club" sites that say they modify nothing?
Some genuinely do distribute the copy as it is, and as we said, the licence permits that. Two problems remain:
- No updates — you stay on the version you downloaded. Any vulnerability found after it stays open on your site, because the update comes from the developer rather than the reseller.
- No way to verify — you cannot tell whether a copy has been modified without comparing it against the original line by line. And if you are capable of that, you are not the audience for these sites.
So the practical outcome is the same either way: you build your site on code that will not be updated and that you cannot inspect.
The alternative we recommend
Start with the free plugins in the official directory. They pass review before publication, you get their updates automatically, and they genuinely cover most sites. This is the same thing we said in our themes guide.
And if you need one particular paid feature, buy a single licence from the original developer for a year. You get the updates and the support, which is what you are actually paying for. Pay when you hit a limit you need past — not because the demo looks nice.
The plain arithmetic: one annual licence is far cheaper than cleaning up a compromised site and losing your customers' trust. We itemised every line of a WordPress site's cost in our cost guide.
Some links on this page are affiliate links — they cost you nothing extra, and they do not affect how we rank recommendations. Full disclosure.
GPL questions.
What is the GPL?
The free licence WordPress itself is published under (GPLv2). It gives anyone who receives the code the right to use, modify and redistribute it. That right is where the abundance of themes and plugins comes from: someone can build on someone else's work and pass it on.
Is selling GPL plugins legal?
Yes, and that is the straight answer. The official GPL FAQ states that the licence allows selling copies, and that "the right to sell copies is part of the definition of free software" — provided the corresponding source code goes with any copy you distribute. So this is not a legal question, and anyone telling you it is flatly "piracy" is wrong.
Then why not recommend buying from those sites?
Because what you buy from the original developer is not the code — the code is already free — it is updates and support, and the licence obliges nobody to provide either. A copy bought from a reseller arrives without security updates, so you are building your site on something that will not be fixed when a vulnerability is found in it.
What is the difference between a GPL copy and a nulled one?
A crucial difference that gets conflated. A copy redistributed under the GPL is the code as it is. A nulled copy has been modified to strip out a licence check — and that modification is precisely where something you cannot see gets added: a backdoor, code that injects links, data collection. The danger is in the tampering, not in the licence.
So what should I actually do?
Start with the free plugins in the official directory, which genuinely cover most sites. If you need a paid feature, buy one licence a year from the original developer and you get the updates and the support. The price difference is far smaller than the cost of a compromised site: cleanup, lost trust, and the possibility of your domain landing on blocklists.
Themes: the same principle, and a faster check.
There is no such thing as an "Arabic theme" — only one with RTL support, and checking takes 30 seconds. A nulled theme is a security problem rather than a bargain.