The Hidden Dangers of Free WordPress Themes

I have this terrible (or awesome, I suppose) tendency to create new blogs. In fact, just today I bought a new domain (another terribly awesome tendency) and will soon begin the process of setting up “just another WordPress blog.”

That means searching for a new WordPress theme. And those who’ve done this before know how difficult it can be to find a good theme in what is arguably the underbelly of the SEO beast: the search string “WordPress themes.”

As if finding a good WordPress theme isn’t challenging enough, Siobhan Ambrose points out the dangers and security issues when you’re searching for – or rather, installing, “free WordPress themes.”

Sponsor

Ambrose makes the argument in a blog post aptly titled “Why You Should Never Search for Free WordPress Themes in Google or Anywhere Else.” And it isn’t simply because the search is frustrating or spammy.

She takes themes from the top ten websites that are returned for such a search and finds that many of the themes there are out-of-date and won’t work with the latest version of WordPress. Many generated errors upon installation.

But more troubling, many of these sites contain themes with security exploits. Most common in Ambrose’s findings was Base64, which can be used to hide malicious code. In one example, Base64 stripped out the footer she wanted – her name and copyright information at the base of the blog – and replaced it with a link to a free Antivirus site.

In fact, of the top 10 sites that she looked at based on a Google search for “free WordPress themes,” only one was safe – WordPress.org. One she deemed “iffy.” But the other 8 all contained themes with some sort of potential exploit or malicious code.

Ambrose lists several “trusted sites,” including Smashing Magazine and Theme Shaper, where you can find free themes. She also points to sites like Woo Themes that offer premium themes, as well as some free options. But her suggestion is to avoid the search phrase “free WordPress themes” altogether, and to use exploit decoders to help double-check the safety of any suspcious themes.

Discuss