WordPress Plugin Licence Compliance for Agencies

Agency plugin licence compliance maps every paid installation to documented code rights and eligible entitlements.

Reconcile sites, accounts, people, updates, support, services, and exceptions. Preserve evidence and remediate gaps safely.

How should agencies manage WordPress plugin licence compliance?

Maintain one entitlement register linked to every client site and installed commercial plugin.

Verify software licences and vendor terms separately. Audit actual use, then resolve every mismatch.

Compliance has more than one layer

• Software licence.
• Commercial purchase agreement.
• Update entitlement.
• Support entitlement.
• Hosted service access.
• Account permissions.
• Client contract.
• Organisational policy.

One layer cannot answer every question. Record which rule governs each action.

Start with the software licence

WordPress.org states that WordPress uses GPLv2 or later. The Plugin Handbook discusses GPL-compatible plugin licensing.

Read the distributed plugin’s actual licence notice. Do not infer every detail from platform custom. We cover the method in how agencies should inventory licences.

Software rights differ from commercial services

Code-use rights do not automatically grant vendor downloads, updates, support, cloud services, or account access.

Map code and service rights separately. This distinction prevents both overrestriction and overreach.

A licence key is not the software licence

A key can authenticate commercial access or site entitlement. The code licence states software permissions.

Protect keys as credentials even when plugin code has open-source rights.

An invoice is not enough alone

An invoice proves a transaction. It may not show site allowance, services, transfer, or support rules.

Keep the order, named plan, applicable terms, account record, and current entitlement state.

Define the compliance objective

The agency should demonstrate which entitlement supports each commercial use. It should also expose unresolved exceptions.

Compliance is not collecting keys. It is maintaining traceable, eligible relationships.

Choose one authoritative entitlement register

Use an approved database, asset system, or controlled spreadsheet. Name the register owner.

Site scans and vendor portals feed the register. They do not replace it independently.

Create a stable entitlement identifier

Vendor names, product names, and plans can change. A stable internal identifier preserves evidence history.

Use it across invoices, sites, tasks, support tickets, and remediation.

Record entitlement identity

• Vendor and seller.
• Product and plan.
• Order reference.
• Purchasing legal entity.
• Account owner.
• Purchase date.
• Term and renewal state.
• Secure key reference.

Keep full secrets outside the register when possible. Limit access to authorised staff.

Record entitlement scope

• Eligible production sites.
• Site limit.
• Staging and development treatment.
• Multisite treatment.
• Feature tier.
• Update access.
• Support access.
• Hosted services and quotas.
• Transfer or sharing options.

Record sources and verification dates. Public plan descriptions can change after purchase.

Build a separate site inventory

• Stable site identifier.
• Production domain.
• Environment type.
• Client owner.
• Maintenance owner.
• Lifecycle state.
• Installed paid plugins.
• Connected services.

Link sites to entitlements through stable identifiers. Avoid storing the same facts inconsistently.

Discover installations from multiple sources

• WordPress administration.
• Approved management platform.
• Command-line inventory.
• Vendor activation portal.
• Deployment manifests.
• Invoices and account records.
• Client handoff documents.

Each source can miss something. Reconcile differences instead of choosing the easiest list.

Include inactive installed plugins

Inactive code can remain present without consuming commercial activation. It still creates governance questions.

Record why it remains and whether removal is safe. Do not assume activation state proves entitlement.

Include archived and staging sites

Old domains and clones can remain connected in vendor portals. Their commercial treatment varies.

Classify environment and current need. Deactivate stale assignments through supported controls.

Verify production site limits

Compare active eligible production sites with purchased capacity. Investigate every excess or unknown mapping.

Do not count only successful activations. A technical bypass does not prove commercial eligibility.

Verify staging rules

Some systems exempt recognised development domains. Freemius documents configurable treatment for development and staging.

Your vendor’s plan and configuration remain authoritative. Document ambiguous custom domains.

Verify multisite rules

One WordPress network can consume multiple activations under some systems. Network activation alone does not settle counting.

Record network, subsites, plan, and vendor confirmation. Review changes as subsites grow.

Verify site reassignment

Agencies often replace client sites over time. Confirm whether eligible slots can move after deactivation.

Use vendor controls and preserve assignment history. Do not share one key beyond its scope.

Verify client-site use

Some plans permit agency use across clients. Others require client-specific purchases or commercial tiers.

Record the permitting term and client relationship. Avoid assumptions based on unlimited branding.

Verify account ownership

The purchasing account should belong to the appropriate agency or client entity. Personal accounts create continuity gaps.

Use organisation-controlled email, recovery, authentication, and named administrators.

Verify collaborator permissions

Use vendor collaboration features instead of sharing owner passwords. Grant only required account functions.

WooCommerce documents collaborator permissions with specific limitations. Other platforms differ.

Verify contractor access

• Named contractor.
• Approved client or agency.
• Required sites.
• Required account functions.
• Access start.
• Access expiry.
• Confidentiality obligations.
• Activity review.

Remove access after work ends. Do not provide complete portfolio credentials for one task.

Verify staff access after role changes

Departures and transfers can leave vendor, secret, and support access active. Connect reviews to offboarding.

Transfer operational ownership before removing access. Test recovery through remaining administrators.

Protect licence keys

Keys can expose account identity, activations, updates, or services. Treat them as controlled credentials.

Store keys in approved secret systems. Avoid tickets, source repositories, chat, and screenshots.

Use vendor key-security features

Freemius documents white-label and site-whitelisting controls for agency client use. Vendor availability varies.

Security features supplement inventory and contracts. They do not redefine purchased site capacity.

Control plugin package provenance

Use legitimate vendor, directory, or approved internal sources. Record package version and hash where useful.

Do not use unknown download sites to avoid commercial access. They create security and provenance risk.

Separate redistribution questions carefully

Software redistribution rights depend on the actual licence and facts. Bundled services and branding may differ.

Seek qualified legal advice for material uncertainty. Do not convert general GPL statements into custom conclusions.

Do not use GPL as an account-access shortcut

Software rights do not grant another customer’s account, private downloads, updates, support, or hosted services.

Obtain access through eligible commercial and technical routes.

Do not overrestrict code rights either

Agencies should not claim unsupported restrictions merely because a key controls services. Read the code licence.

Separate internal policy from legal permission. Explain both accurately to staff and clients.

Verify update eligibility

Map installed sites to current update access. Expired commercial access can affect authenticated delivery.

Do not update from another client’s entitlement. Use the eligible account or approved package process.

Verify support eligibility

Support can depend on purchaser, site, plan, version, and request type. Record permitted requesters.

Do not submit one client’s data through an unrelated entitlement. Protect privacy and account context.

Verify hosted service eligibility

• Named account.
• Covered sites.
• Usage quota.
• Permitted client use.
• Data processing scope.
• Service term.
• Overage route.
• Exit and export.

Hosted access can have conditions beyond plugin code. Monitor actual usage and account ownership.

Record client contract responsibilities

• Who purchases.
• Who owns the account.
• Who pays renewals.
• Who receives support.
• Who deploys updates.
• What happens at termination.
• What the client must repurchase.
• Which records transfer.

Client contracts should match vendor terms and operating practice. Resolve contradictions before deployment.

Avoid promising rights the agency lacks

An agency cannot promise transferable ownership when a portfolio plan cannot split. Verify before contracting.

Describe shared access, updates, support, and post-termination effects precisely.

Control white-label representations

Hiding account details can protect agency credentials. It should not misrepresent product authorship or client rights.

Follow vendor terms, trademarks, software notices, and client agreements.

Include acquired client sites

Inherited sites can contain unknown paid plugins, shared keys, expired plans, or personal accounts.

Audit before promising maintenance. Isolate urgent security work from commercial remediation.

Include sites leaving the agency

Offboarding must address ownership, transfers, sharing, deactivation, replacement, updates, support, and records.

Do not disconnect essential access before an approved transition. Follow the client agreement.

Classify compliance states

• Verified compliant.
• Evidence incomplete.
• Scope unclear.
• Capacity exceeded.
• Wrong account.
• Expired entitlement.
• Unauthorised access.
• Remediation in progress.
• Accepted documented exception.

Do not label every uncertainty a violation. Investigate facts and apply the correct standard.

Prioritise remediation by exposure

Critical sites, security gaps, unauthorised access, and service interruption can need urgent action.

Low-risk missing paperwork still needs ownership and a deadline.

Use proportionate remediation routes

• Locate missing evidence.
• Correct site assignment.
• Purchase required capacity.
• Move to the correct account.
• Request vendor clarification.
• Transfer or share legitimately.
• Replace the plugin.
• Remove unused code.
• Seek legal advice.

Preserve backups and service continuity while remediating. Do not create an outage to fix paperwork.

Document exceptions

An exception needs facts, risk, owner, approver, controls, deadline, and intended resolution.

Exceptions should expire or undergo review. They cannot become a hidden permanent category.

Audit on a defined cadence

Use portfolio size, client turnover, risk, and vendor change to set frequency.

Also audit after acquisitions, offboarding, account migration, staffing change, or major plan updates.

Run the audit in both directions

Start from sites and find entitlements. Then start from entitlements and find assigned sites.

Two-way reconciliation finds unlicensed installations and paid unused capacity.

Sample evidence quality

• Current account access.
• Readable order.
• Named plan.
• Applicable terms.
• Correct purchasing entity.
• Mapped production sites.
• Verified renewal state.
• Current support access.

A copied key without provenance is weak evidence. Improve the source before relying on it.

Measure the control system

• Installed paid plugins mapped.
• Entitlements with current evidence.
• Sites within verified capacity.
• Accounts with current owners.
• Contractors removed on time.
• Exceptions resolved by deadline.
• Offboarded sites completed.
• Unknown packages eliminated.

Do not measure key count as compliance. Measure traceable eligible use and resolved exceptions.

Train staff on the distinctions

Teach software licence, commercial entitlement, site activation, account access, and client ownership separately.

Use practical scenarios for staging, contractors, client departure, and failed renewal.

Review vendor-term changes

Plans, site rules, collaboration, transfers, and services can change. Existing terms may differ.

Preserve purchase evidence and review migration offers. Do not overwrite historical terms silently.

Verify reseller and marketplace purchases

Confirm the authorised seller, account route, updates, support, refunds, and renewal responsibility.

A valid invoice from a marketplace can still map services through another account.

Separate expiry from installed-code presence

A plugin may remain installed after commercial access expires. That state still needs risk review.

Record update, support, download, service, and continued-use evidence separately.

Protect client data in vendor support

Logs and site copies can contain personal data, secrets, domains, or commercial details.

Use approved secure channels, least data, authorisation, and retention controls.

Record remediation completion evidence

A purchase alone may not fix site assignment, updates, support, or account ownership.

Verify the corrected relationship from vendor account through production site.

Know the honest weak case

Contract and licence interpretation can require qualified legal advice. Operational teams should not invent conclusions.

A good control system exposes the question, evidence, impact, and decision owner.

Use the agency compliance checklist

1. Separate software licences from commercial entitlements.
2. Choose one entitlement register.
3. Create stable entitlement and site identifiers.
4. Record seller, buyer, account, and order.
5. Record site, feature, update, and support scope.
6. Record service and transfer terms.
7. Discover installations from several sources.
8. Include inactive, staging, and archived sites.
9. Verify production, staging, and multisite counting.
10. Verify client-use and reassignment rights.
11. Use organisation-owned accounts.
12. Control collaborator and contractor access.
13. Protect keys and package provenance.
14. Verify update, support, and service eligibility.
15. Align client contracts with vendor terms.
16. Audit acquired and departing sites.
17. Classify evidence gaps and exceptions.
18. Remediate proportionately without unsafe outages.
19. Reconcile sites and entitlements both ways.
20. Train staff and review changing terms.

Frequently asked questions

The verdict

Compliance becomes manageable when every relationship is explicit. Unknown keys and assumptions are not a control system. Review WP Block Suite’s $299 lifetime licence.