Designing honest licensing

Plugin licensing is where a lot of otherwise good products quietly turn hostile. We wrote our rules down, put them on the pricing page, and built the software to match. Here is what we decided and why.

When a licence lapses, the core keeps working

This is the one that matters most, so it goes first. If your licence expires, nothing on your site breaks and nothing is deleted. The plugin stays installed and its core features keep running — for WooFraudGuard that means every order is still scored by the core rules, and your thresholds, blocklist and order history are all exactly where you left them.

What pauses is the premium half: for WooFraudGuard, behavioural biometrics, fast-checkout detection, MaxMind, chargeback history, order-graph linking, and the Stripe/PayPal dispute webhooks. Chada Cart Recovery works the same way. And across every product, updates and support stop. Renew and all of it switches back on where it was.

We draw the line there deliberately. Switching a store’s fraud screening off entirely at renewal time is the dangerous version — a store owner might not find out until the chargebacks arrive — so core scoring never stops. But we are not going to pretend an expired licence is the same as a paid one either. The premium features are what the subscription pays for, and we would rather say that on the pricing page than let you discover it later.

The trade-off is real and we will state it plainly: an expired licence still running old code will not receive security fixes. Renewing is how you stay current, and that is a good enough reason on its own.

Every activation counts, and you can move them

A licence tier is a number of sites: one, five, or unlimited. Every site you activate counts against that number — including staging and local development installs. We considered exempting development domains, and decided against it: any rule of the form “domains matching this pattern are free” is both easy to game and impossible to explain precisely.

What we did instead is make activations cheap to move. Deactivate a site from your account and the slot is immediately free for another. Building on staging and promoting to production is two clicks, not a support ticket.

Under the hood, a site is identified by its host name, normalised so that http versus https, a port number, or a www. prefix can never consume a second slot for what is obviously the same site.

No dark patterns at renewal

Subscriptions renew annually and we send a reminder before any charge. Cancelling is a link in your account — not an email to support, not a retention flow, not a phone call. If you cancel, you keep the plugin and the updates you already received.

These are the terms we actually publish — the activation and refund clauses say the same thing this post does. Refunds run for 30 days, no interrogation. If a plugin is not right for your site, say so and we will refund it.

Upgrades are prorated

Moving from one tier to a larger one charges the difference for the remainder of your billing period, rather than restarting the year. Growing should not be punished with a second full payment.

The licence is verified, not merely stored

There is an engineering side to honesty too. Licence responses from our server are cryptographically signed and bound both to the site that asked and to an expiry date. The plugin verifies that signature every time it reads its cached licence.

Two things follow. A customer cannot unlock premium features by editing a value in their own database, which keeps the pricing fair to everyone who did pay. And nobody sitting between your site and our server can forge or tamper with a licence response.

We will be straightforward about the limits of this: anyone determined enough to edit the plugin’s PHP on their own server can bypass any check we write. That is inherent to self-hosted software, and pretending otherwise would be its own kind of dishonesty. What signing prevents is casual tampering and interception, which is the realistic threat.

Sites keep working when our server does not

Licence checks are cached and revalidated on a daily background schedule rather than on every page load. If our licensing server is unreachable, your site does not fail closed, block a checkout, or slow down — it carries on with its cached, signed licence until it can check again.

A licensing system that can take a customer’s store down when our infrastructure has a bad day is a licensing system we have no business shipping.