You can’t. You can only mitigate at expense to yourself.
- People determined to do this will achieve their goal regardless of how many obstacles you place in their path
- The GPL means you can’t control how people use the code once you put it in their hands, and you can’t prevent them modifying it
- Nothing prevents one user from doing all the hard manual work then distributing your plugin themselves with their own automatic updater that bypasses you and your protections entirely.
- Even if you achieved this, most people would never need to spoof a domain in the first place.
- A lot of plugin vendors don’t do this “Domain Verification” so the answer of how they do it is simple, they don’t.
- Most HTTP requests don’t include the domain so unless you include it yourself you wouldn’t know which domain you needed to verify in the first place.
The only method people have figured out to reliably avoid these things is to implement their product as a subscription service and move some functionality into the cloud, and sue copycats for trademark and brand infringement.
Fundamentally, the value is not in the code you sell, but in the support services and continued updates that you as the seller/vendor provide.
This is a cat and mouse game, and there is always a path to escalation. You will never defeat a determined pirate, no matter what licensing scheme you implement, no matter what code license you choose.
Misc
I know many plugin providers limit the number of activations to a certain number of domains but I am wondering how it is achieved and why it cannot be bypassed.
No plugin providers have cast iron solutions. Most do not do these checks, all can be bypassed with a little effort.
In the standard licensing model, what stops a user from using the same license on unlimited domains?
Nothing, the user can edit the code and delete the licensing functions if they wish, they have the right to do so according to the GPL license.
If my server is expected to verify which domain the request is coming from, can’t a user spoof the domain by changing a few lines of code in WordPress?
In practice people don’t spoof domains because they don’t need to, and because that’s not how these systems work.
Your server can’t verify the domain based on just what was sent in the request, that’s not how HTTP requests work. Your server sees the IP it came from, but there is no guarantee the IP maps to the domain if you were to look it up, even if it’s a legitimate request.
You can try to verify the domain, but fundamentally this gives minimal protection that is easily circumvented. The concern you have does not fit with the reality of piracy. It’s much easier to change the code that checks with your server to always say “yes” without bothering to make the request, either by modifying your plugin/theme or via filters/proxies. Likewise it’s easier to buy 1 licence and copy the updated code to hundreds of sites, or let a pirate do that for you.