How to Null and Activate Premium WordPress Themes and Plugins [Valuable info]
ChikosPizza
Registered Member
- Jan 13, 2026
- 85
- 13
I tried it a while ago, and the truth is that nulled themes always come with risks: many come with malware or stop being updated. In the end, I found it better to use discounted official versions or look for free alternatives, because that way you avoid security problems.
- Jun 10, 2010
- 2,405
- 1,675
You install it first, then install the other ThemeRex items. You need to wipe out any ThemeRex installs ahead of time before proceeding.
It all depends on where you get them from. Go checkout wpscan.com and you'll see a number of security problems in WP themes and plugins. You want a plugin and theme that is actively maintained because exploits popup in PHP and WP every day.
I find it better to use nulled themes on my LocalWP instance to test out, try, and see if I like the theme before buying it. So many themes look nice in the dev's preview/demo mode but absolutely suck when you want to use it.
Thank you but how to install it ? there is just one 'php' file inside. As plugin or how ?
Did like these:
1. Installed wordpress.
2. Uploaded 'ThemeREX Activator' and activated in plugin section.
3. Uploaded Elementra (ThemeREX) and activated in themes.
4. Uploaded plugin& activated 'ThemeRex Addons', downloaded from mentioned league.
Then it says in theme panel that is activated but unfortunately in every section (skins, addons, demo etc) it says:
'Activate your theme in order to be able to install demo data.'
- Jun 10, 2010
- 2,405
- 1,675
Damn. It looks like ThemeRex dev recently made a change and is making API calls to obtain demo data now. Activator will only work on older versions.
zilog357
Senior Member
- Nov 27, 2008
- 892
- 1,930
Using the activator provided here might do the trick now, but it is not local, and it is hosted in GPLTimes*com, a nulled script seller, which makes it not as safe.
In the case that gpltimes is hacked, or goes out of business, or simply wants to add malicious code because they can, you are giving permission by installing this backdoor.
How it works: The activator waits for the theme to send a request for updates to themerex, and intercepts such a request, redirecting from the genuine themerex.net to a subdomain of gpltimes (themerex.gpltimes*com). In turn, gpltimes will return the needed code to your website's Themerex installation for mocking a valid license. The script is clean. The response sent, you will never know.
Also, gpltimes will have a log of all connections, knowing how many are using the code, and the exact domain. A nice tool to make a spam list.
Yeah, I am always a bit paranoid about these things.
- Jun 10, 2010
- 2,405
- 1,675
Absolutely, and great work. People should always be paranoid and skeptical. There used to be a website that provided polyfill JS code and many plugins and themes used to use it. That service became useless when all browser's started adopting the same JS and CSS standards and eventually the domain dropped and somebody else registered it and replaced the once valid code with malicious code, so anyone that was still calling the endpoint eventually got the malicious code. It doesn't matter if the intentions are good or not, calls out are always a concern.
This doesn't mean someone can't find value in all of this though. My use case is always running these sort of things in a local instance usinig LocalWP to see if I even like the theme and it can do what I want before purchasing. I recommend everyone to take this approach to using nulled themes or plugins and then purchasing directly from the developer because that's the only way you'll ever get support and real time updates.