Are GPL WordPress Plugin Sites Legal, Safe and Ethical?

You find a site selling thousands of premium WordPress plugins for less than what you would pay for just one of them.

Elementor Pro is in there. Gravity Forms. WP Rocket. The same stack you spent four hundred dollars on last year, sitting in one library for the price of a single subscription.

And your gut says: that can’t be legal.

Everybody has that reaction. Almost nobody checks it out. You close the tab, you go back to paying full price, and the question stays in the back of your head where it started.

So let’s answer it.

By the end of this you will know what you actually bought the last time you bought a plugin. You will know what the GPL lets you do and what it does not, because those are two different lists and both of them matter. You will know where the real limits are, and there are a few that most sites like mine will never mention. And you will know how to tell a safe site from one that will quietly put a backdoor on your client’s website.

Two things before we start.

I run one of these sites. I have been building WordPress sites since 2012, and I started 99Plugs in 2020. At the time I was a local web designer building sites for small businesses in my area, and I could not afford the plugins I needed. Not the renewals. The first purchase. Four hundred dollars of plugins for a project that paid maybe fifteen hundred. So read this the way you should read anything written by a person who makes money from the answer. Check me. I have linked every source, including the ones that make my business look worse.

And I am going to argue the other side, too. There are plugin developers who think I’m a parasite. They are not stupid, and their argument deserves the strong version of itself rather than a weak one, so it gets a section of its own. If you get to the end and still think this is wrong, at least you will be disagreeing with the real argument instead of an easy one.

Let’s start with the thing almost everyone has backwards.

What you actually buy when you buy a plugin

Think about the last premium plugin you paid for.

You went to the developer’s website. You paid. You got two things back: a zip file and a license key.

The zip file is the plugin. The key is a code you paste into a box in the plugin settings.

Here is the part that surprises people.

That key was never permission to run the code. Not for that plugin. Not for any WordPress plugin you have ever installed.

You do not have to take my word for it. The developers say so in their own help documents. Let a license run out and watch what happens.

The plugin keeps working.

WP Rocket’s help site says it plainly: after the license expires, the plugin keeps working normally. Their only catch is that features requiring access to their own servers stop working, which is a real limit and one I will come back to. Smash Balloon says the same thing. So does WPDeveloper. This is not a secret, and it is not a loophole somebody found. It is how this whole industry works, written down on the help pages of the companies selling you the licenses.

So what did they actually sell you?

Three things, and none of them is the software

Updates. A connection to the developer’s update server. When they release a new version, your site can pull it down.

Support. Access to their team. A real person who reads your ticket and answers it.

Cloud services. Anything that runs on the developer’s computers instead of yours. AI features. Template libraries they host. Work that happens on their servers and gets sent back to your site. Remember this one. It comes back later and it matters more than most people expect.

That is the list. Three services, sold together, renewed once a year.

Now look at what is not on the list. The right to run the plugin. The right to install it. The right to keep using it after the twelve months are up. None of those were ever gated, because none of those were ever the developer’s to gate.

A subscription, not a product key

Here is the confusion in one sentence.

A product key is what Microsoft Windows gives you. Type it in and the software unlocks. Skip it and you get a warning message and a crippled copy. Anyone who has bought software in the last thirty years has that idea in their head, and it shows up the second they read the words “license key.”

A WordPress plugin license works more like buying a new car.

The car is yours. You paid for it, you own it, and nobody can come and take it back. The service plan is a separate thing. It pays for the free servicing, the dealer’s help line when something goes wrong, and the features that only work while the car is talking to the manufacturer, like live traffic data or unlocking the doors from your phone.

Let that plan run out and the car does not stop working. It sits in your driveway and starts every morning, same as it did before. What you lose is the servicing, the help line, and the features that needed their servers.

That is your plugin. The zip file is the car. The license key is the service plan.

The software was yours the moment you downloaded it. What ran out was the service.

So why does everybody get this wrong?

Nobody is tricking you. It is the words.

The settings box says activate. The dashboard message says activate your license to continue. Those words came straight out of paid software like Windows, where they mean something completely different, and then they got copied all over an industry where they do not mean that at all.

And nobody has a reason to correct it.

Think about it from the developer’s side. A customer who believes the key is what makes the plugin work renews every year without thinking twice. A customer who understands they are paying for updates and support might stop and ask whether they need another year of it.

Which of those two customers would you rather have?

I am not accusing anyone of fraud. Most plugin developers are honest people making good software, and the three things they sell are worth real money. But this one misunderstanding quietly holds up a lot of renewal revenue, and nobody who could clear it up has ever had a reason to.

So it never got cleared up.

Which brings us to the next question. If the key was never permission, then where did the permission come from?

Why the code was free before you paid for it

Short version: WordPress made a choice in 2003, and every plugin built since then has inherited it.

WordPress is not just “open source.” It uses one specific license.

WordPress uses the GNU General Public License, version 2 or later. Everyone calls it the GPL. This is not “open source” in the loose way people use the phrase at conferences. It is one specific license, with specific wording, that has been through real courtrooms.

The GPL gives four freedoms to anyone who has a copy:

1. Run it. Any purpose. Business use included.
2. Study it. You can read the code.
3. Change it. Edit whatever you want.
4. Pass it on. Give it or sell it to other people, changed or not.

Number four is what this article is about. Remember number three as well, because it comes back later and almost everyone forgets it is on the list.

Those four freedoms are not my summary of the license. They are the Free Software Foundation’s own words, and the Free Software Foundation wrote the GPL. WordPress did not add them or soften them. It picked the license they come with.

And WordPress says so about itself, in public, on its own license page. This is not a detail hidden in the small print. It is one of the first things WordPress tells you about what it is.

Why your plugins got the same license

Here is the part that does the work.

A WordPress plugin is not a separate program sitting next to WordPress. WordPress pulls it in, mixes it with its own code in memory, and runs all of it as one program.

In copyright law, that makes a plugin a derivative work. That means it is built on top of something else. And anything built on top of GPL software has to be GPL as well.

This did not get settled by people arguing in blog comments. In 2009 WordPress paid the Software Freedom Law Center to answer the question, and then published what they said. The Software Freedom Law Center are about as expert on this license as anyone gets. Their answer, in one sentence:

“The PHP files are subject to the requirements of the GPL while the images and CSS are not.”

Their reasoning was about how the code actually runs. The PHP in a theme “consists largely of calls to WordPress functions,” gets pulled in using PHP’s include() function, and is processed by WordPress itself. The CSS and images, they said, “could easily be used with a range of HTML documents” that have nothing to do with WordPress. The same reasoning lands on plugins, for the same technical reason.

The year somebody tested it in public

If you have been around WordPress a while, you might remember this one.

In 2010 Chris Pearson, who built the Thesis theme, said his code was not built on top of WordPress and did not have to be GPL. WordPress leadership disagreed. It turned into a live, recorded, genuinely awkward argument on a podcast that people still link to sixteen years later.

It ended with Pearson splitting his license. The PHP went under the GPL, the CSS and images stayed private. Which is exactly what the Software Freedom Law Center had said a year earlier. (LWN’s write-up is the clearest account of the legal argument if you want it.)

No lawsuit. No court ruling. But it was the most public test this question has ever had, and it ended with yes, this is GPL. The whole commercial plugin industry has been built on that answer ever since.

“Free” was never about the price

This is where most people’s understanding quietly breaks.

The Free Software Foundation, who wrote this license, repeat one point until they are tired of it: free means freedom, not price. Free as in free speech, not free as in free beer.

And what follows from that catches nearly everyone off guard.

The GPL says in writing that you may sell the software. Not that it puts up with it. It is named in the license text. GPLv2 Section 1 says you “may charge a fee for the physical act of transferring a copy.”

The Free Software Foundation goes further. They keep a page on their own site called Selling Free Software, and it says this:

“Actually, we encourage people who redistribute free software to charge as much as they wish or can.”

Read that twice if you have spent years filing this under gray area. The people who wrote the license actively want you to know you can charge money for passing the software on.

Selling GPL software is not a crack in the license. It is something the license was written to allow.

One more part, then we can answer the question

GPLv2 Section 6. It is short, and it carries more weight than any other sentence in this article:

“Each time you redistribute the Program… the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program… You may not impose any further restrictions on the recipients’ exercise of the rights granted herein.”

Two things happen in there.

The rights travel with the code. Not with your receipt. Not with your account. Not with a key. Whoever ends up holding the software holds the freedoms, automatically, without asking anyone.

And nobody further down the line can add extra conditions on top.

Remember that second one. It answers a question you are probably about to ask.

Is it legal? Yes, and here’s the proof

Let’s do the direct answer first and the evidence second.

Buying a WordPress plugin from a company that bought it from the developer is legal. Not a gray area. Not a technicality somebody is getting away with. The license was written to allow it, and the people who wrote the license say so out loud.

Here is the chain, in four steps:

1. A reseller gets a legitimate copy. We pay for ours. The license does not require that.
2. That copy carries all four freedoms above.
3. Sections 1 and 2 let them pass on copies, changed or not, and charge money for them.
4. Section 6 gives you those same rights the moment you receive the file.

Every step is written into the license itself, in a document you can read in fifteen minutes. This is not a loophole in the GPL. This is the GPL.

Now the proof.

The people who wrote the license

Covered in the last section, but worth saying once more in a single line, because everything else sits on it: the Free Software Foundation allows people to charge money to pass the software on, in the license text, and encourages it on their own website.

WordPress.org’s own rules are stricter than the GPL, not looser

Every plugin in the WordPress.org directory has to be GPL compatible. All of it. Code, images, CSS, JavaScript.

And the directory rules go further than the license does. Guideline 5 is one sentence long:

“Plugins may not contain functionality that is restricted or locked, only to be made available by payment or upgrade.”

The same rule adds that “functionality may not be disabled after a trial period or quota is met.” No license gates. No paywalls on features that are already in the download. No trial limits.

Think about that for a second. The official home of WordPress plugins looked at the practice of shipping code and then locking it behind a key, and banned it on their own platform.

That is not the GPL talking. That is a directory rule, and the difference matters (more on that in the next section). But it tells you how the organization at the center of WordPress feels about the thing everyone assumes is normal.

The developers, in their own words

This is the evidence that should end the argument, and it is strange to me that almost nobody uses it.

Justin Tadlock, one of the most respected theme developers in WordPress history, said this out loud:

“The act of copying my themes, making no changes, and selling them is perfectly fine. I gave you permission to do so by placing it under the GPL license. Just in case that wasn’t enough, I’m giving you or anyone who wants to do so permission right now.”

Beaver Builder publish a page on their own site called GPL or Bust, arguing for 100% GPL licensing including on their paid product. Their answer to “is the pro version really GPL” is “Yes, it is. Both the theme and plugin (free and paid versions) are released with a GPL license.” They are open about why they stopped fighting it:

“A proprietary license isn’t going to stop your software from being redistributed.”

They are just as clear about where their line sits, and they put it in one sentence: “We don’t support or allow using your Beaver Builder license to access support or updates when forking or redistributing the code.” That is the correct line, and it was drawn by the people whose product it is. Copy the code, keep the code, lose the service.

Chip Bennett, a long-time WordPress theme reviewer, in the same 2013 discussion:

“The only thing unethical is explicitly granting end users certain rights, and then trying to guilt-trip them out of exercising those rights, because you didn’t really want to grant them those rights in the first place.”

He goes on: “If you don’t want end users to have the rights expressed in GPL, then don’t license your copyrighted work under GPL. It’s really that simple.”

And then there is the one I did not expect to find

Carl Hancock built Gravity Forms. He is one of the sharpest critics of sites like mine, and you will meet his objections later in this article, at length, because they are good ones.

In that same 2013 thread, replying to somebody who had the license wrong, he wrote this:

“The GPL does not prevent you from selling GPL products. In fact they encourage it.”

Then he linked the Free Software Foundation’s Selling Free Software page and quoted the passage from it about charging as much as you wish. The same page. The same passage I quoted a few minutes ago.

Sit with that for a second. The person in this argument with the most money on the line, the one whose company is most affected by everything I do, is not disputing that it is allowed. He is disputing whether it is decent.

Those are two completely different arguments. It is worth knowing which one you are actually having.

None of these people are defending sites like mine. They build and sell WordPress products for a living, and this arrangement costs them money. They are simply describing the license they picked.

What the courts have said

Careful here, because this is where people go too far.

No court has ruled on whether reselling GPL WordPress plugins is legal. There is no case. Anyone who tells you otherwise is making it up, in either direction.

What the courts have settled is smaller, and still useful: the GPL is a real legal document that means what it says.

• Jacobsen v. Katzer (2008) found that breaking the conditions of an open source license can be copyright infringement. That gave these licenses real teeth.
• Artifex v. Hancom (2017) found that the GPL works as a contract you can enforce.
• Software Freedom Conservancy v. Vizio is still going, and I will give you the messy version rather than the flattering one. The Conservancy sued as a buyer of a Vizio television, arguing that a person who receives GPL software can enforce its terms even though they own no copyright in it. In 2024 that argument survived summary judgment. In December 2025 Vizio won a separate point, the buyer-can-enforce question is still undecided, and trial is now expected in late 2026. It is an open case, not a win. Anyone citing it as settled law, in either direction, is ahead of the facts.

Courts treat this license as binding. That works in both directions. One of those directions is that the right to pass the software on is binding too. A developer cannot publish under the GPL, take everything that comes with being in the WordPress world, and then act like freedom number four is decoration.

The uncomfortable one

In October 2024, WordPress.org took Advanced Custom Fields, a paid plugin owned by another company, copied it, renamed it Secure Custom Fields, and pushed it out to millions of installs. The reason they gave was the rights the GPL grants.

Whatever you think of that decision, and plenty of people in this community think it was indefensible, you cannot call that a fair use of the GPL and also call a company reselling a plugin it paid for piracy. Both are the same part of the license.

Full context, because I said I would give you the sources that complicate things: it happened in the middle of a live legal fight between Automattic and WP Engine, it was widely criticized at the time, and in December 2025 a federal judge ordered WP Engine’s control of ACF restored. That case is not over.

I am not holding it up as an endorsement. I am pointing out that when the most powerful organization in WordPress needed to hand out somebody else’s paid plugin, the GPL is what it reached for, and nobody involved argued that the license did not allow it.

What most GPL sites won’t tell you

If I gave you only the good half of this, I would be doing the same thing I am complaining about.

So here is the whole list. Eight things that are limiting, messy, or genuinely annoying. None of them makes reselling illegal. All of them are things you should know before you spend money, and most sites in this corner of the internet will happily let you not know them.

1The GPL covers code. It does not cover names.

The license covers software. It says nothing about brand names or logos.

“Gravity Forms” is a trademark. So is the logo and the brand. Anyone may use a product name to say truthfully what a file is, the same way every shop on earth tells you what it sells. What nobody may do is use another company’s logo as their own, suggest that company approves of them, or pretend to be an official channel.

That is why every honest site in this category runs a notice saying it is not connected to the developers whose products it carries. Ours sits in the footer of every page. If a site does not have one, notice that.

2“100% GPL” is a little too tidy, and I would rather say so

The Software Freedom Law Center’s opinion was specific: the PHP must be GPL, the images and CSS are not required to be.

In practice nearly every WordPress plugin is GPL from top to bottom, because WordPress.org requires it for the directory and most developers choose to license the whole thing that way. But some marketplaces, Envato most of all, allow a split license where the PHP and the HTML are GPL and the CSS, images and graphics are covered by Envato’s own license instead.

So “everything is 100% GPL, always” is a line you will see constantly in this corner of the internet, and it is a little cleaner than the truth. The important part, the code, is GPL. The edges vary.

3A developer’s terms of service may say do not resell

Some of them do. This is where two different areas of law rub against each other.

Copyright law says the GPL gives you the right to pass the software on, and Section 6 says nobody may add restrictions to that right. Contract law says a company can set its own conditions for doing business with you.

The real answer is less dramatic than either side would like. A developer can end their relationship with a reseller. A developer cannot make the code stop being free. Two separate things.

Beaver Builder put it more clearly than anyone: the code is GPL and you may copy it and pass it on, and if you do, you no longer get their support or their updates. That is fair, and it is exactly right.

4Cloud features do not come with the file

This one catches people, so read it twice.

Plenty of premium plugins now do part of their work on the developer’s servers. AI writing tools. Template libraries they host. Work that sends your data somewhere, does something expensive to it, and sends it back.

The GPL gives you code. It does not give you an account on somebody else’s computers, and no software license ever could.

If you need a feature that runs on the developer’s servers, you need the developer’s subscription. Anyone who tells you otherwise is confused or lying.

Carl Hancock of Gravity Forms said this back in 2013, before most of these features existed. A key does more than fetch updates, he wrote, and the parts of the product that run on their systems “will simply not work unless you have an API key to interact with our API.” He was right then and it is truer now.

5You do not get the developer’s support. You do get delivery support.

These are two different things wearing the same word, and it is worth being exact about the difference.

What you are not buying: a relationship with the people who wrote the plugin. If you want to ask the Beaver Builder team how to build a specific layout, or have a bug looked at by someone who knows that code from the inside, that comes with a license bought from them. It is worth real money and I am not going to pretend otherwise.

What you are buying from us: the product working. Installing correctly. Running the way it should. Updating the way it should. If any of that breaks, open a ticket and we fix it. We want it working as much as you do. This is our business. A shop that sells plugins that do not work does not stay in business very long.

We will not teach you the software. We will make sure the software works.

Know which one you need. For most of what most people install, it is the second one.

6Updates arrive later than the developer’s. Here is our actual number.

An update has to reach us before it can reach you. There is no version of this where that is not true.

We check for new versions every day and aim to have them ready for you within 24 to 48 hours of the developer releasing them.

I am publishing a number because everyone else in this category says “instant,” and if you have ever used one of these sites you already know that is not how any of it works. A real number that is not zero is worth more than a perfect claim nobody believes. Go ask any other provider what their number is and see what happens.

And the honest cost of that: when a security fix comes out, that gap is real. On a plugin doing something important for a client, those hours are one of the things buying direct genuinely buys you.

7Our files are not identical to the developer’s

Here is exactly what is different.

There is a small folder called 99plugs inside the plugin. In that folder is one short text file named product.json. It is about four lines long. It holds the product name and an ID number, and that is everything it does:

{
    "item_id": 320,
    "name": "WooCommerce Table Rate Shipping",
    "type": "plugin"
}

That file is not a program. It is text. Nothing in it runs.

The thing that actually delivers your updates is the 99Plugs Update Manager, and that is a separate plugin. You install it once, the same as any other plugin. It reads that little file to learn what each product is, then brings the updates into your WordPress dashboard. On almost every plugin we carry, that folder and that one text file are the only difference between our copy and the developer’s.

On fewer than fifty plugins out of more than three thousand, a license gate is removed so the plugin will run at all. A small number of developers ship code that switches itself off without a key. A plugin that refuses to run is not a plugin, so the gate comes out and nothing else changes. Freedom number three from earlier, the right to change the code, is the part of the license that covers this.

On a handful of products, that folder also holds a file called guard.php, and one line in the plugin’s main file loads it. This one needs a little background.

Some premium plugins are add-ons. They do not run on their own. They need the free WordPress.org version of the same plugin installed underneath them, and that is where the license gate lives. Our copy removes the gate, so our copy is the one you have to be running.

Here is what happens without the guard. WordPress.org releases an update for that free plugin. WordPress installs it straight over our version. The gate comes back, and your premium features stop working until you reinstall ours.

The guard prevents that, and that is all it does. It holds no keys, tracks nothing, and never contacts our servers. It keeps your premium features running.

That is the list. If you ever put our copy next to a developer’s download, that is what you will find.

8The GPL does not ban license keys

I have seen this claim on a lot of GPL sites. It is wrong, and being wrong about it is how everything else you said gets thrown out with it.

There is nothing in the GPL that says a developer may not require a license key, may not charge for renewals, or may not lock features. Nothing. Go and look.

What does exist is a WordPress.org directory rule that bans license gates and paywalls in plugins hosted on WordPress.org. That is the policy of one website. It is not the license, and it has nothing to do with a plugin sold from a developer’s own site.

The true version is more interesting anyway. The key does not lock the code, because the GPL already made the code free. The key locks the service. A developer selling that service is not breaking anything at all. They are simply not selling you permission, because permission was never theirs to sell.

Is it safe? What nulled really means

Everything so far has been about the law. This section is about safety. They are not the same question, and mixing them up is how people get hurt.

You can be completely within the law and still hand a client a backdoor, because of who put that file online in the first place.

Not a developer. Not a company. Somebody who uploaded it hoping you would install it, because getting into other people’s websites is how they make their money.

So let’s deal with the word.

What “nulled” actually means

To null something means to cancel it. To empty it. To set it to zero.

A contract can be nulled, which means cancelled. A field in a database can be nulled, which means emptied. In software, nulling something means removing a check.

That is the whole meaning. Now notice what is not in it.

Malware is not in it. Backdoors are not in it. Stealing your data is not in it. None of those are part of what the word describes. They are things that happened to be done by the same people, at the same time, to the same files.

The word picked up the reputation of the people using it.

For most of the last fifteen years, the people doing this at scale were pirate download sites. No company name, no support desk, nobody responsible, giving files away for free and making their money by hiding malicious code inside them. Removing the license check was a side note. The hidden code was the business.

So today, if you say “nulled” to a WordPress developer, they hear “malware.” Given who has been carrying that word around, the reaction makes sense.

I am not going to spend a page arguing about a word. It is easier to tell you what actually happens and let you pick your own words.

The data is worse than you probably think

In 2022 a team at Georgia Tech published a study at the USENIX Security Symposium called Mistrust Plugins You Must. They built a tool called YODA, pointed it at more than 400,000 live web servers, and traced plugin history back to 2012.

Across eight years they found 47,337 malicious plugins on 24,931 different websites. More than 94% were still active when they published.

Then the number that matters here. Of the plugins traced back to nulled download sites, over 97% carried malicious code. That is the paper’s own finding, not mine. Site by site in their sample: wplocker.com 98.3%, vestathemes.com 96.2%, theme123.net and themlot.net both 100%.

Not “some risk.” Not “be careful out there.” Ninety-seven percent.

If you have ever downloaded a premium plugin from a free pirate site and put it on a client’s server, go and check that site tonight.

The part of that study nobody quotes

Here is the finding that should change how you judge any provider, including mine.

The worst group in the whole study was not one of the named sites. It was the files the researchers could not trace to anybody at all. Those were 100% malicious, and they were almost a third of every bad plugin in the study.

Why were the anonymous ones the worst? Because, in the paper’s words, they “impersonate the plugin author entirely and hide that they were downloaded from a nulled source.”

And then this:

“A comparison of the plugin header from a [nulled] marketplace plugin did not reveal any differences. Only after matching the code files were we able to tell a nulled malicious plugin apart from the legitimate plugin.”

Read that twice. Security researchers, doing this for a living, could not tell by looking. The file details looked clean. The plugin looked correct. They had to compare every code file against a known good copy to find the difference.

Which means the useful question was never is this file changed. Plenty of files are changed for plenty of reasons. The useful question is who tells you what they changed, and can you check it yourself. The dangerous ones in that study were, exactly and measurably, the ones hiding their tracks.

It is worth being blunt about what that does and does not settle. Where a file was originally bought is close to irrelevant to whether it is safe. A site could buy every product straight from the developer at full price and still put a backdoor in it before handing it to you. Provenance is not a safety control. What predicts safety is whether there is somebody accountable on the other end, and whether their business makes money helping you or compromising you. That is the whole test, and everything below is a way of checking it.

So your friend was right, and also a little bit off

Somewhere in a Reddit thread or a Slack channel, a developer told you never to download premium plugins from another site because they are all malware.

They were describing something real. Everything above is their evidence and it is overwhelming. Do not ignore them, and do not let anyone tell you they were being paranoid.

But look closely at what the study measured. It measured plugins traced to anonymous pirate sites. It did not measure every business that resells GPL software. Those are not the same group of sites.

Sites that give away pirated files and hide malware in them are dangerous is a finding.

Every site that resells GPL software is malware is a slogan built on top of that finding.

The first one is backed by eight years of data. The second one is a leap, and I will point out that the leap happens to be worth a lot of money to anyone selling yearly licenses. I am not going to tell you it is organized. I will point out who benefits from the belief and let you decide what to make of that.

How to check any provider, including this one

This is the useful part of the article, and it is written on purpose to work on everybody. Use it on us.

Is there a real company behind it? A name, a registered business, somebody who can be held responsible. The most dangerous group in the Georgia Tech data was the one nobody could trace.

What is their business model? This is the question that explains all the others. The sites in that study gave the files away for nothing. Free was not generosity. Malware was the product and compromising your site was what they were hoping to gain. A company charging a fair price has a business that only works if you come back for more, which is a completely different set of incentives pointed at you. So ask what they are actually selling. If the answer is “nothing, it is free,” you already have it.

Do they say what they change? Not are the files untouched, which is the question that gets you a comfortable answer. Ask what is different and why, and see whether the reply is specific or slippery.

Can you check it yourself? Download the same version from the developer and compare the two sets of files. There are free tools that do this and show you every line that is different. What you want to see is a clearly named folder, an update tool they told you about, and, where it applies, a removed license gate. What should worry you: scrambled code you cannot read, long blocks of random characters, the plugin calling out to a website nobody explained, and changes in files that had no reason to change.

Is there support and a refund policy? Somewhere to complain is part of the structure, not a nice extra. Anonymous sites do not have one because there is nobody home.

Do real people leave reviews under real names, on a site the company does not control?

Is the payment process normal? A software shop that only takes crypto has made a choice, and that choice is about being hard to trace.

Does anything ask you to switch off a security plugin? Nothing honest needs that. Ever. Close the tab.

Is it ethical? The case against me

Legal and right are two different words. You can hold both thoughts at once, and plenty of thoughtful people in this community do.

So here is the case against what I do for a living, made as well as I can make it. I am going to lay it out without arguing back inside it. Arguing back in the middle of somebody else’s point is what you do when you are afraid of it.

The case against

Somebody has to pay for the work. Carl Hancock built Gravity Forms. Here he is in 2013, and I am giving you his words rather than my summary of them:

“Gravity Forms wouldn’t exist as we know it if we didn’t have the business model that we have. In fact it probably wouldn’t exist at all.”

He is talking about a specific, countable thing:

“That’s 12 people with families who wouldn’t be making a living creating a WordPress plugin and over a million sites that wouldn’t be using our product.”

His argument is that the money does not just buy code. It buys an office, employees, benefits, and people who stay long enough to get good at supporting a product they wrote. He also thinks the “give the code away and sell support” model only works for one and two person shops, and that a user who hits a problem in a free plugin does not go and buy support, they uninstall it and say the plugin is bad. Having read a lot of support tickets, I think he is right about that.

The numbers are not small. Divi Engine published their own running costs to make the point. Their estimate for a small plugin business comes to $512,000 a year, and $360,000 of that is wages: three developers, two support staff, a marketer and a manager. That is what your renewal is holding up. There is not much left over, and cutting the price by 95% does not make the costs go away.

Customers do not always understand what they are choosing. Kevin Muldoon said it without softening it: people reselling WordPress plugins and themes “are doing nothing for WordPress community. They are parasites.” Take the heat out of that and the sharpest version of the complaint is not about money at all. It is that a lot of buyers genuinely do not realize that none of their payment reaches the people who wrote the software they depend on.

And it is not the big companies who feel it. This is the strongest argument against what I do and it deserves its own paragraph, in his words rather than mine. Muldoon’s point was never that WooThemes would suffer. He said the opposite, that they make tens of millions a year and will be fine. The people who lose are “the independent developers who are working thousands of hours to develop unique extensions,” selling one product through somebody else’s marketplace. A large company absorbs this. A person who built one good plugin does not.

He made a second point that has aged well. A reseller cannot improve any of it. Nobody can develop forty premium plugins at a tenth of the price, so a site like mine depends completely on other people continuing to do the work. That is true, it is not flattering, and I am not going to pretend it is not the shape of the thing.

And there are real costs to you. No developer support. Updates that arrive later. Cloud features that do not come at all. I put all of that in the last section because it is true, and it belongs in this one too.

That is the case. It is not stupid, it is not dishonest, and if you find it convincing I understand why.

Here is the rest of the picture.

They chose this license, knowingly

Nobody forced the GPL on the WordPress plugin industry from outside. Every business in it signed up, with lawyers, understanding the terms.

Some of them will tell you so directly. Beaver Builder wrote a page arguing for full GPL licensing on their own paid product. Justin Tadlock said copying his themes and selling them was “perfectly fine” because he “gave you permission to do so by placing it under the GPL license.”

And the critics say it too, which is the part worth noticing. In the same article where he calls people like me parasites, Muldoon writes:

“Right or wrong, the General Public License allows any WordPress related product or theme to be forked, redistributed and resold. When any developer develops a plugin or theme, they knowingly (or in many cases unknowingly) adhere to those same rules. Therefore, there is not much they can do if someone takes their product and resells it.”

He is not happy about it. He is also not confused about it.

You do not get to build a company on a license, take everything that license gives you, which is the whole ecosystem, the users, the distribution, and the right to freely use everyone else’s GPL code inside your own product, and then call one part of it theft when it points the other way.

The prediction has had thirteen years to come true

GPL clubs are not new. They started in 2013.

Elementor, Yoast, WP Rocket, Gravity Forms, WooCommerce and dozens of others are all much bigger businesses today than they were then. The WordPress commercial industry grew through the entire period it was supposedly being destroyed.

“This will kill plugin development” is a claim you can test. It has been tested for thirteen years.

One caveat, because Muldoon saw this rebuttal coming and answered it before I made it. Every company I just named is a big one, and his argument was never about big ones. Whether the solo developer with a single extension has done as well over those thirteen years is a harder question, and I do not have data on it. What I can say is that the industry as a whole did not collapse, and the specific prediction that it would has not come true. That is less than a complete answer to him and I would rather say so than pretend otherwise.

Look at who actually uses these services

Not the agency with a fifty thousand dollar project budget. That agency buys direct and bills the client, because it can.

The people I sell to are the freelancers with twelve client sites, the consultant looking after WordPress installs for small businesses on fees that have not gone up since 2019, and the person in a country where three hundred dollars a year is a lot of money.

Take this option away and most of them do not go and buy twelve subscriptions. They use the free version, or they use nothing, or they use something from a pirate site where 97% of the files carry malware.

A large part of what gets counted as lost sales was never a sale. And was never going to be.

The history runs in both directions

Almost nobody knows this part, and it matters.

GPL clubs did not appear because a group of people woke up one day wanting to take money from developers. They appeared because companies changed the deal on customers who had already paid.

In August 2013 WooThemes cut lifetime licenses down to two years of updates, and dropped the unlimited site tier in favor of a twenty-five site one. People who had bought “lifetime” found out that lifetime had an end date. WP Avengers formed right after that, as a customer reaction. When Automattic bought WooCommerce in 2015 and prices moved, it made the whole thing worse.

That is where this started. Not theft. A group of paying customers who were told the terms had changed, and went to read the license to find out what their rights actually were.

I am not the only one who reads it that way. WP Builds, a WordPress podcast with no stake in my business, put it like this: we tend to think of GPL clubs as a bit shady, “but you could also argue that they serve as an essential consumer rights movement within WordPress.”

And then there are the takedown notices

I want to be careful here, because this is the part where I have money on the line and it would be easy to sound like I am whining. I will stick to what I can prove.

We get DMCA takedown notices. They are filed on behalf of plugin developers. They target the resale of GPL licensed code.

The DMCA is a tool for copyright infringement. Reselling GPL software under the terms of the GPL is the opposite of infringement. And Section 512(f) of the DMCA makes you liable if you knowingly and materially misrepresent that something is infringing.

The pattern is worth thinking about. These notices are sent by developers who chose to publish under a license whose fourth freedom is the right to pass the software on. They took what the GPL gave them, sold on its terms, and now pay firms to attack the part they agreed to.

It has also worked. If you are wondering why you have never heard of a company that has been running since 2020 with thousands of customers, that is a big part of the answer. The takedowns do not come to us. They go to Google.

Where I actually land

Here is the part my marketing person would probably cut.

When your business depends on a plugin, buy it from the developer.

If Gravity Forms is how you deliver client work, if Elementor is what you build in every day, if there is a plugin whose failure would cost you a client, then go and pay those people. Fund the thing you depend on. You get support from people who know the code, fixes the hour they ship, and a say in where the product goes next. It is worth the money and it is the right thing to do.

Plenty of our members do exactly that. They buy the two or three that matter most straight from the developer, and use us for the other forty they need once in a while, or once, or for a project that could not carry the cost otherwise.

That is a sensible way to work and I have never had a problem saying so out loud.

What I will not accept is the idea that a person with twelve client sites and no budget for twelve subscriptions has no honest option. The GPL exists so that person has one. That was the whole point of writing it.

Try before you buy

One last thing, and it is the use that even the critics agree on.

Refund policies on premium plugins range from generous to nonexistent, and there is no reliable way to find out whether something fits your project before you own it.

Two of the writers hardest on sites like mine land in exactly the same place I do. The Blog Marketing Academy, in a piece that calls this corner of the industry “sketchy,” still says these sites “can be quite handy as a ‘try before you buy’ setup,” because you often cannot tell whether a plugin is worth the money until you have run it on a real project. And then a sentence I would have written myself:

“If it will suit your needs and be of use to you, I believe you owe it to the team to buy their license.”

The WP Builds hosts got there too, talking about their own habits rather than in theory. You test it because you do not have enough at stake yet to buy it, and you test it with a view to buying it.

That is three of us, with three different amounts of money riding on the answer, agreeing on the same use.

And if it turns out to be the right tool and your work starts to depend on it, see the section above.

What this means for you

You have the argument. Here is the decision.

Buy direct from the developer when

• Your business or your client’s income depends on the plugin working.
• You need support from people who know the code from the inside.
• You need the cloud features. AI tools, hosted libraries, anything processed on their servers.
• You need security fixes the hour they ship, not two days later.
• The plugin is cheap enough that the decision does not matter. Plenty are forty dollars. Just buy it.

A GPL library is the right tool when

• You are testing something and need to know whether it fits before you commit.
• You need a plugin for one project, once, and a yearly subscription makes no sense.
• You are looking after older client sites where a full stack of renewals cannot be justified, and the other option is leaving them unmaintained.
• You are building on a budget that will not carry ten subscriptions at once, and the honest alternative is going without.
• You need something once in a while across a lot of sites, and per-site pricing turns a small need into a big bill.

Never, under any circumstances

Files from an anonymous pirate site. This is not a budget decision, it is a safety decision, and the numbers in the last section are why. Ninety-seven percent.

The comparison, scored honestly

Four rows in that table go to buying direct, and I have put them in bold so you do not have to hunt for them. If those four matter for the plugin you are thinking about, the decision is made and you should go and buy it.

For most of what most people install, they do not matter. That is the honest shape of it.

How 99Plugs works

This is the part where I tell you about my company. It is short, it is the last thing in the article, and you have every right to skip it.

Instead of making claims, I am going to run the checklist from earlier against ourselves, in the same order. Then go and run it against everyone else, including whoever you are paying now.

And yes, that includes files that came from the developer themselves. Paying for a file takes the nulled sites out of the chain, which is the biggest risk by far, but a developer can put tracking in their own plugin, or collect data they have no business collecting, or worse. Writing the software does not make somebody trustworthy. So everything gets scanned, whoever it came from.

The rest is what sets us apart: 3,000+ premium WordPress plugins and themes, unlimited downloads with no daily limit, use on as many sites as you need, and automatic updates with a backup taken before every one and a rollback if something breaks.

We also offer a 30-day trial so you can give us a try. For free.

You have just read eleven thousand words of me telling you to trust nobody in this industry. I meant every word of it, and that includes me.

So do not believe this section. Test it.

Start the trial. Put the plugins on a real project and see whether they behave like the ones you already pay for. Scan every file. Open a support ticket and see who answers, and how fast. Run the checklist from earlier against us the same way you would run it against anybody else.

Every other site in this business is asking you to take their word for it.

I am asking you to check.

Questions people actually ask