Nulled plugins and GPL club sites: where your theme leaks (and how to stop it)

You sell a WordPress theme for $59 a year. Someone searches your product name and finds it on a site offering “every premium theme for $9.99 a month,” or on a forum handing it out free with the license check ripped out. Nulled WordPress themes and GPL club resellers sit on the first page of results for plenty of paid products, and most developers don’t learn about them until a support request arrives from someone who never bought anything.

This guide covers where your plugin or theme ends up, what the GPL does and doesn’t let those sites do, and the removal routes that work.

Nulled vs GPL club: two different problems

Developers lump these together, but they call for different arguments.

Nulled sites distribute your product with the licensing removed. Someone edits your code to skip the license key check, disable update calls, or fake an activation response. The uploader then posts the zip on a warez forum, a Telegram channel, or a download site stuffed with ads. Many nulled copies also carry injected code: hidden links, redirect scripts, or backdoors. Your name stays on the product, so when a site owner gets hacked through a nulled copy, your brand takes the blame.

GPL clubs resell your product more or less intact. The operator buys one license, downloads the package, and lists it for members to download at a flat monthly fee. GPLVault is a typical example. These sites present themselves as legal businesses and point to the GPL as their defense.

The difference matters because a GPL club will argue with you, and a nulled download site usually won’t answer at all. You file with the club itself, then go to its host or payment processor. You file on nulled sites through the host, the CDN, and Google.

What the GPL actually permits

WordPress core ships under the GPL, and WordPress.org’s license page explains that themes and plugins built on it inherit that license for their PHP code. So yes, anyone who receives your PHP code can legally share it. GPL clubs rest their whole business on that point.

They leave out what the GPL doesn’t cover:

• Your trademark. The GPL grants rights to copy code. It grants nothing to use your product name, logo, or brand to sell someone else’s membership.
• Separately licensed assets. Many developers license images, CSS, JavaScript, fonts, and design files under different terms. The GNU GPL FAQ confirms that non-code assets can carry their own license. If you licensed yours restrictively, redistributing them infringes your copyright.
• Your marketing copy and screenshots. GPL clubs often lift your product description and demo images word for word to rank for your product name. You own that text and those images outright.
• Your update and support service. You sell access to updates and support, not just a zip file. A GPL club can’t deliver either, and when it claims to, it misrepresents the product.

Nulled copies fail on another count: the uploader altered your code to defeat a license mechanism and often added malicious code under your brand. Hosts rarely defend that.

Check your own product before you file. If your theme is 100% GPL, including the CSS and images, your strongest claims shrink to trademark and copied marketing material. If you split-licensed your assets, you have a straightforward copyright claim on the whole package.

Where your plugin or theme ends up

Most leaks trace back to a short list of places:

1. GPL club membership sites. These form the biggest category by search visibility. They list hundreds of premium products and update them within days of your releases.
2. Nulled download sites. Ad-heavy sites that host “free premium themes,” usually with the license check stripped.
3. Warez forums and file lockers. Uploaders post links to Mega, MediaFire, or similar lockers, and the forum thread survives even when a locker removes the file.
4. Telegram and Discord channels. Groups that post new releases of popular plugins as soon as a member buys one.
5. Marketplace reupload accounts. Sellers on generic digital-goods marketplaces who list your theme under a slightly different name.

GPL clubs tend to rank for your product name. Forums and channels feed the clubs and nulled sites. Start where your buyers search.

How to get listings removed

File with the GPL club directly

Most GPL clubs publish a DMCA or contact page. Send a notice that names the specific infringing elements: your trademark in the listing title, the copied product description, your screenshots, and any separately licensed assets in the download. Link your own product page and your license file. Some clubs remove the listing quickly to avoid trouble with their payment processor. Others ignore you.

Go to the host and the CDN

If the club or nulled site doesn’t respond within a few business days, look up who hosts it. A WHOIS or IP lookup shows the hosting provider, and many sites sit behind a CDN that accepts abuse reports. Send them the same notice. Hosting providers act on documented infringement more readily than the site operator does.

Report the payment processor

GPL clubs need to take card payments. Payment processors maintain acceptable use policies that bar selling infringing goods and misusing trademarks. A report to the processor, with evidence of your trademark in the club’s listings, can cost the club its merchant account. The club has far more to lose there than from one removed listing.

Delist it from Google

A listing that ranks above your own sales page does the most damage. File a copyright removal request through Google’s legal removal form for each infringing URL. Google can delist the page even when the site itself refuses to act, which cuts off the traffic that makes the listing worth keeping up.

Use your trademark where it applies

If you registered your product name as a trademark, use that registration in every notice. A trademark complaint sidesteps the GPL argument entirely, because the GPL says nothing about brand use.

Make the next leak harder

You can’t stop a paying customer from uploading your zip, but you can make the leaked copy worth less:

• Split-license your assets. Keep PHP under the GPL and put CSS, JavaScript, images, and design files under a proprietary license. You gain a clean copyright claim on every full-package redistribution.
• Register your product name. A trademark gives you a removal route that doesn’t depend on any licensing debate.
• Gate updates and support behind a license key server-side. A GPL club copy then freezes at the version the uploader bought, and buyers notice when security fixes stop arriving.
• Track which customer license leaked. Tie download packages to an account so you can see which license a copy came from and revoke it.

How Clampdown helps

GPL clubs relist. You remove your theme from one club, and it shows up on two others within a month, often from the same uploader. Clampdown scans GPL clubs, nulled download sites, warez forums, and marketplaces for your plugin or theme. We match by product name, assets, and code fingerprints, and we confirm the listing goes beyond bare GPL code before we file anything. From there we send DMCA notices to hosts and CDNs, file trademark complaints where your brand appears, submit Google delisting requests, and keep watching so relists get caught and re-filed without you tracking them in a spreadsheet.

If you want to see how far your product has spread, start with a free piracy audit. For the general playbook on stolen work, read what to do when someone steals your content, and for a comparison of paid options, see the best DMCA takedown services.

FAQ

Are GPL clubs legal? Redistributing GPL-licensed PHP code is legal. Using your trademark, copying your marketing material, or redistributing assets you licensed separately is not, and most GPL clubs do at least one of those.

Can I send a DMCA notice for a 100% GPL theme? You can send one for the parts you still own outright: your product description, screenshots, and demo content. For the code itself, rely on a trademark complaint if the listing uses your product name.

Is it risky to use a nulled theme? Yes. Nulled copies often contain injected code such as spam links, redirects, or backdoors, and they never receive security updates. Security researchers regularly trace hacked WordPress sites back to nulled plugins.

How long does a GPL club take to remove a listing? Responsive clubs remove listings within a few days. Unresponsive ones may never act, which is why hosts, payment processors, and Google delisting matter more than the first email.