WordPress Plugin Licensing
A commercial WordPress plugin can use PermitCore through the PHP SDK or documented HTTP API to check the customer entitlement. This is an integration pattern, not a ready-made PermitCore WordPress licensing plugin. Decide whether the purchase covers a site, deployment or another unit before wiring the checks.
Define site identity and transfers
Domains change, staging copies are created and multisite installations have their own account model. Decide what identifies a licensed installation and which changes require a transfer. Do not silently equate every request or temporary URL with a new device activation. Document staging and multisite policy for the offer you actually sell.
Protect your management boundary
PHP code delivered to the site administrator is inspectable. Do not place your platform administrator API key inside the plugin. Use the customer license and documented client flow for checks, and reserve privileged issuance or management operations for your own controlled backend.
Treat updates as a separate service
A license check does not automatically create a secure plugin-update endpoint or protect downloadable ZIPs. Authenticate and authorize update downloads on the service that delivers them. Keep package integrity, distribution, legal license terms and entitlement checks separate, and never claim that a disabled feature makes distributed source impossible to modify.
Test WordPress behavior deliberately
Check the supported PHP/WordPress versions, HTTP transport, scheduled tasks, caching, site cloning and admin error handling. Avoid turning every page request into a blocking remote call. Follow documented proof deadlines and response handling without converting a rejected entitlement into unlimited cached access. Exercise recovery after restoring a backup or moving the site. The paid entitlement should not disappear just because a temporary staging hostname was removed.
Common questions
Is there a dedicated integration for this platform?
Use the documented SDK or HTTP boundary described here. Platform packaging, plugin/update distribution and framework security remain part of your application.
Can I include a management API key in the shipped code?
No. Keep management credentials on a controlled backend; distributed client code is inspectable.
Which checkout provider can my Store use?
Each vendor chooses Stripe or Paddle for the whole Store. Existing purchases keep their original connection; checkout does not automatically switch providers.