Does the WordPress Plugin API feature any anti-piracy API/functionality? Or is this something developers need to role on their own?

  • WordPress as such is secure. Security problems usually start with poorly written plugins and themes. There are plugins dedicated to your site security, such as Wordfence Security, iThemes Security (formerly Better WP Security), just to name a few. Jun 11, 2017 at 2:30
  • 1
    @FrankP.Walentynowicz the purpose of my asking, is, how do companies who sell plugins protect against illegal copy and distribution of their plugin? Because anyone can go in and copy the plugin folder/zip and send it to another server running WordPress - ie pirate plugins. Do most plugin developers just not code for this at all?
    – sazr
    Jun 11, 2017 at 3:32
  • 1
    if your plugin is GPL licensed, you cannot do anything about it. Don't even call its copying and using, a piracy. Make your plugin a premium plugin, with smart checking for a valid licence, stored on your server. Jun 11, 2017 at 3:45

2 Answers 2


Wordpress itself is licensed under GPL which makes it open source and as such also gives freedom to modify and redistribute. You can red this up on the About page and in the Codex

The Codex is also the place where you can see that people behind WordPress see Plugins as derivative works and as such they also have to be licensed under GPL or a compatible license:

There is some legal grey area regarding what is considered a derivative work, but we feel strongly that plugins and themes are derivative work and thus inherit the GPL license.

Implementig any kind of "anit-piracy" functionality would defy the concept of openness, as copying the source code of GPL'd software is not considered piracy but expected behaviour instead. And as the makers of WordPress stand behind the open source idea, I think there won't be any such mechanisms to be seen in WordPress core any soon.

So if you wan't to sell your software and have some kind of protection aganinst side channel distribution, you have to add or implement it yourself. An approach for that you can read in Mark Kaplun's answer here.


No and yes. It depends on the level of protection you want, and what is it that you are "selling".

The fact of life is that once any software is delivered to a buyer, it can be hacked, and the only thing that can be done about it is to try to delay the hack. With PHP it is even worse as the code is right there as part of the "deliverables".

The approach that is usually taken by plugin and theme developers is that you do not "sell" the code, but the support, both as actual support, and enabling automatic updates. Since automatic update need to communicate with your server, you can validate a license key before serving them and in this way have a kind of level of DRM. You can spice it up with checking the license against your server before activating some major feature, but this obviously can be hacked by anyone that will be willing to spend the time. The trick is to make hacking just annoying enough for honest people to not be tempted, while keeping your "protection" not that annoying that people will do it just to spite you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.