A legal copy comes from one of two places: the WordPress.org directory for a free edition, or your jkdevstudio account or Envato for Pro. There is no third source.
This page is for two different readers. One arrived from the installation pages and wants to understand why a theme cannot simply be taken from somewhere. The other has already installed a cracked copy and is wondering what happens now.
#It does not deliver what people go to it for
The argument here is practical rather than legal.
No updates. The theme updates through our server or through the directory, and both channels need something a cracked copy does not have. The site is frozen on whatever version was uploaded, with all of its bugs and all of its security holes.
No support. No support channel works without a confirmed purchase.
No demo content and no Hub resources. Demos, the documentation in the panel, the changelog and the roadmap all come from our servers against a license.
No Pro layer as it was designed. Bypassing the licensing breaks the places the person who made the bypass did not get around to testing. You will not see it immediately. You see it a month later, on a live site.
You save once, and then pay in time on every problem afterwards, with nobody to solve it.
#What it puts on your server
Cracked builds are the primary distribution channel for malicious code in WordPress.
The usual payload: a hidden administrator account, a backdoor in an ordinary looking file, injected links in your content, redirects for mobile traffic, a miner, spam sent from your server.
The consequences land on you: the site blacklisted by search engines, suspended by your host, the domain's email reputation destroyed, and database access, including your customers' data, in somebody else's hands.
This code is not caught by a security scanner on day one.
It is usually found after the incident. If you are reading this because such a copy is already installed, the cheapest way out is a clean reinstall from a legal source and a change of every password, including the database and the hosting account.
The longer version of the argument, including how the sites distributing these files make their money, is on the main site:
#Where you stand legally
People skip this part, and it is the part with legal exposure in it. Read it whether the copy was installed by you, by a contractor, or by a client who never mentioned it.
The theme code is GPL. The rest of the package is not. GPL covers the PHP a WordPress theme is built from, and it is why a license key buys a service rather than permission to run code. It does not cover everything else in the package: the images, the CSS and JavaScript, the demo content, the fonts and the trademarks. Those are ordinary copyright, and redistributing them without permission infringes it. Almost every "GPL is GPL" argument on a pirate site gets this wrong.
A modified build is not the product we published. A cracked copy has had its licensing code rewritten by somebody unknown, so it is a derivative work distributed without authorization, and running it is not covered by any license you could have bought afterwards.
A refunded or blocked license carries the same rule. Once a purchase is undone, the right to use the item ends with it, and continuing to run the product is a breach in the same category, not a lesser one. Our terms and conditions and refund policy both state that plainly.
On a client site, the liability is usually yours rather than theirs.
An agency or a freelancer who installs a cracked copy is the party that made the distribution decision, and the client who paid for a working site is the party with a claim if it later has to be rebuilt. On any project with an invoice attached, that risk costs more than the license fee.
The documents themselves are the authoritative version of all of the above:
#What happens on our side
Use of a cracked copy on a public site is detected, and detected quickly.
What follows is a copyright complaint under the DMCA procedure, both against the site distributing the copy and, where necessary, to the hosting provider of the site using it. The usual outcome of such complaints is removal of the material or suspension of service by the provider.
If a cracked copy is used on a commercial site or in work for clients, we reserve the right to take further legal action.
#The way out
Most people arrive at cracked copies because of price, not bad intent, so this page ends with the alternatives.
The free edition of the theme is free and entirely legal, and you can work on it for as long as you like.
For several sites, buying the activations you need costs less than one security incident. Cleaning a compromised site costs more than the license does, and activations are sold individually, so you pay for the number of sites you actually run.
And if your licensing situation is unusual, write to us before looking for a workaround. It is a shorter conversation than you expect.
#Common questions
The theme is GPL, so is a nulled copy not legal?
No. GPL covers the code, not the package around it. The images, stylesheets, scripts, demo content, fonts and trademarks are ordinary copyright, and redistributing them is infringement whatever the PHP license says. A cracked build is also a modified derivative distributed without authorization, which is a separate problem.
I inherited a site and I think it runs a nulled copy. How do I check?
The theme's license screen is the quickest tell: a nulled build usually shows no license state at all, or one that never verifies. After that, a file integrity scan against a clean copy of the same version is what finds the injected code.
Can I just buy a license and keep the files that are already there?
No. The modified files are the problem, not the missing license. Replace the theme and the Pro plugin from a legal download, then activate, and treat the rest of the site as compromised until you have checked it.
My client installed one without telling me
That is the common case. Handle it as a security incident first and a licensing question second: reinstall clean, rotate the credentials, and buy the license for the site going forward.
#Still stuck
Open a support ticket and say what you tried and where it stopped. Your product, your domain, a screenshot and the exact message you saw are usually enough to settle it in one reply.
Last updated
