To clean up after a nulled plugin, take a backup for evidence, delete the nulled plugin, scan the site with a security scanner, remove unknown admin users, look for stray PHP files in uploads and mu-plugins, reinstall WordPress core files, change every password and security key, then install the genuine plugin. If the site was redirecting visitors or sending spam, ask your host for a server-level scan too.
Step by step
- Back up the current site, infected or not, so you can compare later.
- Delete the nulled plugin's folder entirely, not just deactivate it.
- Install a scanner such as Wordfence and run a full scan.
- Under Users, delete administrators you do not recognise.
- Check wp-content/uploads and wp-content/mu-plugins for PHP files that should not be there.
- Reinstall WordPress core from Dashboard › Updates.
- Change passwords for WordPress, hosting, database and FTP, and generate new security keys in wp-config.php.
- Install the genuine Elementor Pro and connect it.
After the clean-up
- Check Google Search Console for security issues and request a review if your site was flagged.
- Watch the site for a few weeks: new users, changed files, odd traffic.
- Keep everything updated. See security basics.
Getting genuine Pro
AI Web Tools activates the genuine plugin for ₨799 a year and will not activate on top of a nulled copy; it has to be removed first. If your site was badly infected, have it cleaned before activation, because a genuine plugin does not remove a backdoor elsewhere.
Sources
- WordPress hardening guide
- Wordfence Security on WordPress.org
- WordPress Advanced Administration Handbook
Prices and features change. Check the source before you buy; we update this guide when they do.