Template sold as a custom website: how to spot it

I am writing this article because of something I ran into a few days ago. A short catch-up with a friend turned into a fight lasting several hours to save the search positions of his domains and to undo the damage caused by greed, or ignorance, or perhaps just plain arrogance on the supplier's side.

It started as a joke over coffee: what kind of companies do this and that. My friend went slightly pale and it was immediately clear to me that some of it had happened to him too.

The first domain was hacked and had malicious code inserted. The second had licensed images and, along with them, tracking code belonging to the company those images come from, a textbook example of how the owner of the photos finds out that someone is using them without a licence. The third domain was luckily untouched, at least visually.

So no, this is not about competition as such. Competition is healthy, it creates room to grow, to move forward and to outpace each other. It is about one particular way of doing business: buy a ready-made template for 20 dollars, install a free system such as WordPress and invoice thousands of euros as “a custom website”. I will show you how to spot it before you sign a contract.

What such a project is really made of

Imagine a quote for a modern custom website with a content management system, for three thousand euros. When you take it apart, this is often what is left:

We do not mind that someone makes money. We mind the claim that this is custom design and development, when it is an installation and a few clicks through settings. The difference is the same as between a tailor and a second hand shop assistant telling you the jacket was cut to your measurements.

You recognize it by one thing: six months later you ask for a feature the template does not have and suddenly it “cannot be done”, it “is not good for SEO” or it costs another few thousand. A developer who built the website would be able to say how much work it is. Someone who only installed it does not know, because they do not know the code they sold.

Which systems get sold this way

It is not only about WordPress. Any ready-made system can be sold the same way. They fall into two groups and each has a different catch.

Free systems with open code

You download them for free, install them on your own hosting and add a template. By far the most widespread is WordPress, then you will come across Joomla and Drupal, and in German speaking countries TYPO3. For online stores it is WooCommerce (a plugin for WordPress), PrestaShop or OpenCart.

These are capable systems and millions of websites run on them. But the licence costs nothing and the installation is a matter of minutes. When someone invoices you for that installation as “a content management system built for you”, you are paying for work that never happened. And you take on everything we write below about the public list of holes.

Rented platforms and website builders

The second group are services where you rent the website along with the hosting: Wix, Squarespace, Webnode, Webflow, and for online stores Shopify, Shoptet or Upgates. Website builders that hosting providers bundle with their plans belong here too.

To be fair: these are legitimate paid services and for a small company with standard needs they are often a sensible choice. The provider handles updates and security, so the worry about versions goes away.

The catch is elsewhere and there are two of them. The first is the same as with templates: putting a website together in such a builder takes hours, and when it is sold as “a custom website” for thousands of euros, you are paying for something other than what you get. The second is that you cannot take the website with you. You pay the monthly fee forever, the code is not yours, and when you decide to leave one day, you do not move the website, you build a new one. With an online store holding years of order history that tends to be an unpleasant surprise.

If you do not know what your website actually runs on, the free audit will tell you. We recognize the system from the page code and name it in the result.

Monthly maintenance that maintains nothing

After handover comes the second part. Either a monthly fee for “website maintenance”, or the exact opposite: silence.

A fee with nothing behind it. The invoice arrives every month, but when you ask what was done for it, the answer is vague. Try asking for a simple list: what was updated, when the backup ran, whether the website broke at any point that month and how long it was down. Where maintenance really happens, the answer comes within minutes.

Or silence. The second version goes: “you have a content management system, look after it yourself”. A client who has never administered a server is suddenly responsible for system updates, updates of ten plugins, backups and security. Usually nothing happens, until everything happens at once.

Honest website maintenance has measurable content. With us it is a separate service called Website Guardian: an uptime check every hour, the SSL certificate daily, a full audit once a week and an e-mail with what changed. For 29 € per month, and you can stop whenever you want. The point is not that we do it and others do not. The point is that you should know what you are paying for.

A public system means a public list of holes

Free content management systems have open code. That is a good thing in itself, many people look for flaws in it and fixes arrive quickly. But it has another side: when a flaw is found, it is published together with the version number it affects. That creates public lists that state exactly which version of a system or a plugin can be exploited, and how.

And here is the thing owners of smaller websites do not realize: nobody picks you. The attack is rarely targeted. Automated bots move across the internet non stop, read from a website what it runs on and in which version, compare it against the list and try what they can. They do not care whether you are a carpenter in Petržalka or a bank. Every day without an update is therefore a little more risk, and that risk grows on its own, even when nothing is happening on the website.

The good news is that you can read the same thing yourself, without a developer. Our free audit now reads from the page what system the site runs on, in what version, what theme it uses and which plugins it has, with their versions. It installs nothing and does not get into the site, it only reads what the page itself tells every visitor. So you see exactly what that automated robot sees.

If the version number does not appear in the report, that is good news: it means the site does not give it away. When it does appear, it is not a fault to fix immediately, but it is information the attacker has as well. That is when it is worth checking whether a fix exists for that version.

How many of those vulnerabilities appear in a year, what share of them sit in paid plugins and how many sites run a PHP version with no security support at all, we counted up in our article Why we do not build on templates. Here let us stay with how it works.

Why updating is often impossible

The logical answer is: so update it. In practice it often does not work. The website stands on a plugin that does not support the new version of the system yet. When you update the system, the booking form, the online store or the whole layout breaks. The client ends up between two bad options: a broken website, or a website with a known hole.

That is when it is the supplier's turn, and it often turns out that the company that “built” the website cannot program. They have to hire a developer from outside, and the price for a fix that should have been part of the maintenance matches that. The client becomes permanently dependent on someone they never signed a contract with and whose name they may not even know.

The worst ending is when the author of the plugin stops supporting it. The plugin is never updated again, so the system stays on the old version for good and the website lives out its days with a hole the whole internet knows about. The only fix is to rewrite that part of the website, which is exactly the work the client wanted to avoid when buying a ready-made solution.

So ask in advance: which plugins the website stands on, who maintains them, what happens when their author quits, and who pays for the fix if the website breaks after an update. Just four questions, and the answers will tell you a lot.

You can answer the first one yourself. The free audit lists the plugins that can be recognised from the page, with their versions, so you no longer have to ask the supplier „what is in there“ but rather „why has this plugin not been updated for two years“. That is an entirely different conversation. The list is not complete, because not every plugin leaves a trace on the page, but whatever does appear in it can be verified.

A template downloaded “for free” is the most expensive one

The worse version of the story happens when the supplier does not even pay those few dozen dollars for the licence. Paid templates can be found freely available for download, modified and without a licence. For the client that means three kinds of problems.

1. Foreign code inside your website

The groups that publish paid templates for free do not do it out of kindness. Lines that were never there get added to the code. It tends to be a hidden way into the administration, links to other websites hidden from the visitor but not from Google, or part of your traffic redirected elsewhere. The website works on the outside, so nobody notices.

When it comes out, the company that owns the website pays for it. Google marks the website as hacked and search traffic drops from one day to the next. If spam starts going out from your domain, your ordinary e-mails to customers stop arriving for a while too. Fixing it then costs more than the original website did.

2. No updates

An illegally downloaded template cannot be updated, because it has no licence key. When a security hole is found in it later, everyone else gets the fix, only your website does not. Everything from the previous section applies here, just without any way to defend yourself.

3. Photos that are not yours

Templates are shown off with nice photos, but those are usually licensed for the demo only. When the supplier leaves them on your website, you are using someone else's photo without the rights. Payment demands from photo agency representatives go to the domain owner, not to the person who built the website.

It is fair to say that this is a risk, not a certainty. Not every downloaded template contains malicious code. But it is a risk you carry and cannot influence, because you cannot see into the code.

Three domains, three hostings, no passwords

That day left one more lesson. It has nothing to do with templates directly, but the two go hand in hand. My friend's three domains ran on three different hostings. There was no reason for it, it simply grew that way. So instead of roughly a hundred euros a year he paid three times that, plus small fees he did not understand and for which I could not see a reason either.

The real reason was years during which the hosting terms kept changing. Instead of someone keeping an eye on it and avoiding the fees, they were simply accepted. That is exactly how the whole thing works: invoice paid, service over. I will not name the providers here, nor go through their pros and cons, that deserves an article of its own.

Worse than the money, though, was access. When something happened, the hunt began: who is the domain registrar, where the hosting runs, who has the login to the administration. The passwords he had been given long ago no longer worked. And every hour spent looking for a login is an hour with malicious code on the website while Google takes notes.

So a simple rule applies: the domain, the hosting and the administration should be in your name, not the supplier's. Let the supplier have access that you can take away at any time. And when a company has several domains, they belong under one roof. Not because it tends to be cheaper, although it does, but because on the day something breaks, you want it all in one place.

How to check it in five minutes

You do not need a developer for this. You just need to know where to look.

• Run the free audit. You enter the address and within a minute the report tells you what system the site runs on, in what version, what theme it uses and which plugins. That is the first thing the supplier would otherwise have to admit on their own. No registration and nothing to install.
• Or look at the page source. If you want to check it by hand: in the browser, right click and choose „View page source“, then look for the word themes. If you find a path such as /wp-content/themes/name/, that name is the name of the template.
• Search for that name online. When a marketplace page with a price in dollars comes up, you know it is a bought template. That is not a fault in itself, it just is not custom design.
• Ask for proof of the licence. A paid template has a purchase code or an invoice. A supplier who bought the licence will find it in a minute.
• Ask about the photos. Where they come from and what licence they have. With your own photos, or ones bought from a stock library, you get an answer right away.
• Ask who owns the code. The question is simple: if we decide to move elsewhere one day, can we take the website with us? The answer “yes, it is yours” should be in writing, in the contract or in the quote.
• Check whose name the accesses are in. The domain, the hosting and the website administration should be in your company's name. The supplier should have access you can take away at any time, not the other way round.
• Look at the rest of the audit too. Besides the system and the plugins it shows speed, SEO, security headers and whether AI search engines can read the site. If something cannot be measured, the report says why, not just that it failed.

When WordPress is perfectly fine

To be fair: the problem is not WordPress. It is a widespread, capable system and plenty of honest studios do good work on it. The problem is the description and the price, that is, when an installation is sold as development and an edited template as an original.

What an honest WordPress quote looks like, everything it should state and what the numbers say about the security of core itself, we cover in our article Why we do not build on templates.

How we do it

We design and program websites, portals and apps ourselves. No bought template, no free system passed off as our own solution. The code is yours, you know the price in advance and you know exactly what you get for it. We write more about it on the page how we work.

You will find the prices in the price list, a presentation website starts at from 1,999 € and a website with a content management system at from 3,000 €. If you are weighing up whether you need a content management system at all, this article helps: When a website with a CMS pays off. And if you have a website and do not know what is in it, start with a a free audit.