Free Premium Themes From Download Sites

The theme that cost nothing

A premium WordPress theme usually costs less than an hour of a developer's time, and comes with updates and support from the people who made it.

Download sites offer the same themes for nothing, along with the paid plugins bundled with them. Search for a theme's name with the word free and they fill the first page.

The site gets built, it looks exactly like the demo, and for a while nothing seems wrong.

Then spam links show up in search results, an administrator account nobody created appears, or visitors on phones start landing on a different website.

What the hidden code does

• Adds spam links hidden from visitors but visible to search engines.
• Creates administrator accounts for someone outside the business.
• Redirects some visitors, often phones arriving from search.
• Inserts ads or pop-ups the business never chose.
• Leaves a back door for uploading more code later.

The third is the one owners notice last. The redirect usually skips anyone logged in to WordPress and anyone who types the address, which describes the owner on most days.

Why the download sites can offer them

Much of the code in a WordPress theme is released under an open licence that allows sharing, and some download sites present themselves as legitimate on that basis.

What the original developer actually sells is the rest: updates, support, and a copy that has not passed through anyone else's hands.

A copy from a download site has been altered at least once, to remove the licence check. Whoever made that change could add anything else at the same time, and nothing on the finished site shows it.

The real price of the free copy is not knowing what is in it.

Why the saving disappears

Cleaning a compromised site usually costs many times what the licence would have.

Spam links and redirects can get a site labelled in search results as possibly hacked, which turns visitors away before they ever see a page.

The downloaded copy also never updates. Premium themes often bundle plugins such as sliders and page builders, and when a flaw is found in one, licensed copies receive the fix while the downloaded copy keeps the flaw.

And a back door means the first cleanup may not be the last.

A worked example

A boat builder with a small yard on a river, building aluminum workboats and a few wooden launches a year, had its site built on a premium portfolio theme.

Whoever built it had found the theme on a download site. The galleries looked superb, and the site ran quietly for a year.

Then a customer mentioned that a link from a boating forum had taken him to a pharmacy site. Searches for the builder's name showed page titles in another language.

The theme carried code that created a hidden administrator account and sent visitors arriving from other websites to a spam site. The owner, who always typed the address, had never seen it.

The cleanup replaced the theme with a licensed copy from its developer, removed the unknown account, changed every password, checked the database for injected content and asked Google to review the site.

The licence cost a fraction of the cleanup. The receipt now sits with the site's other records.

Ask whoever built the site

If someone else built the site, ask them where the theme and each paid plugin came from, and for the receipts.

A developer who bought them will have the purchases on record, and can arrange licences in the business's name.

A vague answer is itself an answer. It does not prove anything either way, but it moves the theme to the top of the list to check.

Make receipts part of any future handover, along with the passwords and the hosting details.

How to check what is installed

In the WordPress dashboard, list every theme and plugin, active or not. Inactive ones still sit on the server, and their files can still be reached.

For each paid item, find the receipt and the licence key. A premium theme with no receipt, and nobody who remembers buying it, needs a closer look.

A theme that is years old and has never offered an update is another warning sign.

Look under Users for administrators nobody recognises, and search Google for your own domain together with words such as pharmacy or loans to see what it has found.

Signs in the files themselves

Someone comfortable with code can compare the installed theme with a fresh copy from the developer. Any file that differs needs an explanation.

Long runs of scrambled characters in a theme's functions file or footer, or code that decodes text before running it, are typical of hidden additions.

Search Console's Security Issues section will also report anything Google has found.

This is careful work, and a professional cleanup costs far less than a second infection through a back door that was missed.

Buying from the original developer

Buy themes and plugins from the developer's own site, or from the marketplace where the developer sells them, and buy them in the business's name.

Keep the receipt and licence key with the hosting and domain records, so whoever maintains the site next can renew and update.

Note when support and updates expire. Many licences need renewing to keep receiving updates, and that renewal belongs on the same list as the domain.

WordPress 4.7.3, a security release, came out on Monday, and most sites installed it on their own. A downloaded theme will never receive anything like it.

The counter-case

Free themes are not the problem. Those in the official WordPress.org directory are free by design, reviewed before they are listed, and updated through the dashboard.

A theme built for the business by its developer raises no licence question at all.

And a site running one properly bought premium theme, with a few well-known plugins, is in good shape whatever it cost.

The rule is about where a copy came from: its developer or the official directory, never a site offering paid work for nothing.

Receipts and replacements

1. List every theme and plugin installed.
2. Find the receipt for each paid one.
3. Check Users for unknown administrators.
4. Replace unlicensed copies with the developer's version.
5. Delete themes and plugins nobody uses.
6. Change passwords after any replacement.
7. Store licences with the hosting records.

Step four matters most. Patching a downloaded copy leaves whatever you did not find, while a clean copy from the developer starts from code you can trust.

Why every theme, plugin and core release needs someone watching for updates is covered in defaced WordPress sites and the update that was already out.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.