Do you use null theme and plugin on client sites?

How do you handle this situation?

I'd never even consider doing it.

You should never do that.

I've actually done it once - downloaded and installed a nulled Wordpress plugin for my very first customer who ordered simple Wordpress site back in 2012 or 13. One day I wake up, go to www.clientswebsite.com and all I see is flying-rotating skulls and flashing text in the middle of the screen

Never again lol.

Years ago I have done it on my own website. Fortunately nothing has happened. On the other hand one of my client's website was hacked because he had installed some popular plugins, so be careful and simply reject all the IPs you can't recognize.

I’m using nulled theme and before installing it, i checked with Virustotal and the theme is fine. But i have no idea what will happen with theme in the future.

Is it eIf i checked the package with Virustotal? will my site be possible to be havked in the future?

You definitely shouldn't use nulled software on a client's website.
Very unprofessional and opens them up to risk/liability.

Yes , I have never used it on client site. Here's the thing I got lot clients run away as soon as I tell them the cost of theme and plugin. For example dokan starts from 500$ and cartflows is 300$.
I don't know what this clients think, we would code the plugin and theme?

I always provide my clients with retail licenses to the products and this is coming from somebody who has a BST that nulls themes and plugins. Whatever the developer charges for a single site license I pass that cost onto the client. I also purchase lifetime/agency plans whenever I can because they are more cost effective, and still pass the single site license cost as part of the build. If the plugin requires yearly subscription then that cost is added to a monthly or yearly maintenance plan should the client want me to manage their website.

should you -- no
can you -- yes

worst thing happens you get hacked -- just blame it on WP being insecure, and fix it. just look at normal sites wordfence -- thousands of attack attempts daily.

i've never had anything bad happen.
friend of mine had his server hacked and blamed it on a nulled theme
i've used nulled themes more than him too

can virustotal detect it? maybe. how do you know malicious code will go undetected? you have the option to audit it yourself (time-consuming and you need a brain).

uncutu said:

should you -- no
can you -- yes

worst thing happens you get hacked -- just blame it on WP being insecure, and fix it. just look at normal sites wordfence -- thousands of attack attempts daily.

i've never had anything bad happen.
friend of mine had his server hacked and blamed it on a nulled theme
i've used nulled themes more than him too

Click to expand...

Malicious code can be hidden everywhere. From utility files, to compilers, frameworks to PHP code and even images.
Also be aware plugins are very insecure. A lot of the problems for the people I know were caused by plugin called "file manager", "htaccess editor" and similar to those. Basically it's not a good idea to allow WordPress to access anything that isn't WordPress.
Bear in mind all this stuff becomes nugatory if you let go of bad habits and act a little bit more professional.

Install wordfence, lock access to wp-admin, ssh, ftp for any IP address except your own.

Code your own theme and then edit it accordingly. You'll be then able to prepare custom designs and work with tools like adobe experience design or figma. You don't need to code from the scratch. Hooks, filters and verified code snippets are enough. CSS is easy once you realize there are common schemes. You can get practically all of them on the internet. Don't make your work mental puzzle and you'll be much better.

Today one client asked to code subscriptions plugin, he bought a Shopify, woocommerce clone from jvzoo build with PHP. Ask me can you add subscriptions feature to it. I am like wtf dude. It's a hundreds of thousand dollar worth software in wp. You want me to code it for few hundred buck. Unbelievable People buys from jvzoo over wp and Shopify. There are some old timer late night tv advertisers there. They really know how to sell crap. They target old timers like them who have little computer skills.

Never do this. If a theme is 59$, just charge your client 79$. They are perfectly fine by something like this and you're still making a small extra profit on this.