A “free” premium theme is a common WordPress infection path.

What this usually is

Nulled themes and pirated plugins ship with extra PHP: admin users, phone-home code, or a dropper that waits. A security plugin on top of that theme will not finish the job. The honest fix is a legitimate theme (or a rebuild of the design) plus the published IR cleanup.

What you are probably seeing

• Theme was not bought from the official vendor
• A “license” nag you clicked through years ago
• Encoded PHP in the theme that is not in the vendor’s copy
• The same gambling or redirect symptoms as any other hacked WordPress site

What not to do

• Do not keep the nulled theme after cleanup “because it looks fine.”
• Do not buy the real theme and overlay it on the infected files without a cleanup.
• Do not install three security plugins on the still-nulled copy.

What we actually do

We treat it as a WordPress incident: find what the theme loaded, remove it, and tell you honestly whether the design can be rebuilt on a licensed copy. Packages are the same published rates. Hosting can stay yours.

Published rates live on the WordPress incident-response packages page: Phase A from $2,500, Phase B from $2,000, combined from $4,200. Remote nationwide. Onsite in the Tri-Cities and Western North Carolina if you want someone in the room. If the WordPress site is the front door to a larger business compromise, start at emergency incident response instead.