GPL WordPress Plugins: What You Own When You Buy a Plugin

When you buy a GPL-licensed WordPress plugin, you are mostly paying for support and updates, not for the code itself. The GNU General Public License (GPL) gives you permanent rights to run, study, change and share the code you received. If the price goes up, support gets worse or the developer disappears, you can keep using the version you have. The catch is that you then become responsible for keeping it secure and working.

This guide explains what the GPL means for plugins you buy, what you can and cannot do with them, and your options when a plugin vendor lets you down.

This article is general information, not legal advice. Talk to a lawyer about your own situation.

What the GPL is

The GPL is a free software license. “Free” here means freedom, not price. The Free Software Foundation wrote it to protect four freedoms for anyone who receives the software:

1. Run the program for any purpose.
2. Study how it works and change it. This requires access to the source code.
3. Share copies with others.
4. Share your changed versions, so others benefit from your improvements.

There is one main condition. If you distribute the software, or a changed version of it, you must pass on the same freedoms under the same license. You cannot take GPL code, close it up and stop others from sharing it.

Why WordPress plugins are GPL

WordPress is licensed under GPL version 2 or later. WordPress.org’s license page explains its view that plugins and themes that build on WordPress are derived from it, so they inherit the GPL. Every plugin in the WordPress.org directory must be GPL-compatible, and most commercial plugin developers license their PHP code under the GPL too.

Some developers use a split license. The PHP code is GPL, but images, CSS and sometimes JavaScript are under a separate, more restrictive license. Read the license file in the plugin folder and the developer’s terms to see exactly what is covered.

What you are really paying for

The GPL allows developers to charge money. It just does not let them restrict what you do with the code afterwards. So premium plugin businesses sell things around the code:

• Support from the developer’s team.
• Updates delivered automatically to your dashboard, usually unlocked by a license key.
• Access to services, such as a cloud API, a template library or a licensing server.
• The convenience of a single, trusted source.

That means your license key is a subscription to a service. When it expires, you lose the service. You do not lose the right to use the code you already received.

Your rights when you buy a GPL plugin

For the GPL-licensed parts of a plugin, you can:

• Keep using it forever, on as many sites as you like. The GPL has no expiry date and no site limit. Site limits in the vendor’s terms apply to support and updates, not to the code.
• Read and change the code to fix bugs, add features or remove things you do not need.
• Share it, changed or unchanged, as long as you pass on the GPL with it.
• Ask for the source code. GPL version 2 requires the source to be the “preferred form of the work for making modifications”, which is not minified or obfuscated code. If you received only compiled or minified files, you can ask the developer for the readable source.

The GPL does not give you:

• Support or updates. The developer has no duty to help you or keep improving the plugin.
• Access to the developer’s servers or cloud services. If a feature depends on the vendor’s API, the code alone may not be enough to keep that feature working.
• The plugin’s name and logo. Trademarks are separate from copyright. A public fork needs its own name.
• Rights over separately licensed files, such as images or JavaScript under a split license.

When features live on the vendor’s servers

A growing number of plugins keep their most valuable parts on the vendor’s servers instead of in the code you download. The plugin on your site is GPL, but it only sends requests to the vendor’s API and shows the results.

• Uncanny Automator gates some premium functionality behind its own API. The plugin in your dashboard calls Automator’s servers, and those features stop working when the account or license does.
• SureCart goes further. Products, orders and payments are handled by SureCart’s hosted platform, so the plugin does not work at all without its API.

The GPL only covers the code you received. Code that runs on someone else’s server was never given to you, so it cannot be recovered, forked or reverse engineered from the plugin files. If you want to keep those features without the vendor, they have to be written again from scratch, either as code that runs on your own site or as an integration with another service. Before you buy a plugin, check which features run locally and which depend on the vendor’s API, because only the first kind is truly yours.

Your options when things go wrong

The price goes up

Many plugin vendors have moved from lifetime deals to yearly subscriptions, or raised renewal prices sharply. You have several options:

• Stay on your current version. You keep the right to use it. This is fine for a short time, but the code will slowly fall behind WordPress, PHP and security fixes.
• Negotiate. Vendors often have agency, nonprofit or multi-year pricing that is not on the pricing page.
• Switch to an alternative. Plan it like a migration, especially if the plugin stores data in its own tables or shortcodes.
• Maintain your own fork. Take over the code you already have and keep it updated yourself.

Support is slow or unhelpful

Support is what you pay for, so poor support is a fair reason to stop paying. Because you have the code, you can also:

• Debug it yourself or hire a developer who can read the code, instead of waiting in a ticket queue.
• Fix bugs locally and send the fix to the developer, so it ends up in the next release.
• Keep the fix in a patch file or fork if the developer never merges it.

The plugin is unstable

Frequent updates that break your site are a sign of missing automated tests on the vendor’s side. You can:

• Stop auto-updating and test each update on staging first. Our guide to safe WordPress updates with staging and tests shows how.
• Pin a known-good version and only take security fixes.
• Add your own tests around the features you depend on, so a bad update is caught before it reaches customers.

The developer abandons the plugin

This is where the GPL matters most. The developer cannot take back your rights, even if the company closes or the product is retired. You can keep running the last version, fix it and update it for new WordPress and PHP versions yourself.

Abandoned plugins are also a security risk, because nobody is fixing new vulnerabilities. Our guide to measuring WordPress technical debt explains how to track this risk across your site.

Maintaining a GPL plugin yourself

Forking a plugin is legally simple. Keeping a fork healthy is the real work. You need to:

• Keep it compatible with new versions of WordPress, PHP and the other plugins it works with. See how to upgrade PHP safely.
• Watch for security issues, both in the code you inherited and in its libraries.
• Replace any calls to the vendor’s servers, such as license checks, update checks and cloud features. Features that ran on the vendor’s API have to be rebuilt, which is often the largest part of a fork.
• Rename it if you plan to share it publicly, so you do not use the original trademark.

AI coding agents have made this much more realistic for small teams. An agent can explain unfamiliar code, update deprecated functions and fix compatibility problems quickly. But an agent working on code with no tests is guessing. The safe way to maintain a fork, with or without AI, is to first cover the plugin’s important behavior with automated tests, then let every change, human or AI, prove it did not break anything. Our guide to automated testing with Playwright and PHPUnit explains the approach.

When the code is minified or obfuscated

Some premium plugins ship JavaScript that has been minified, or PHP that has been deliberately scrambled so it is hard to read. That makes forking harder, but not impossible.

• Ask for the source first. If the code is GPL, the developer is required to make the readable source available. Many publish it on GitHub or include source maps.
• Check the license of each part. If the JavaScript is under a separate proprietary license, the GPL rights described here may not apply to it.
• Reverse engineer what you are allowed to. For GPL code, minified files can be reformatted, variables renamed back to meaningful names and the logic reconstructed. Tests written against the original behavior confirm that the rebuilt code works the same way.

A warning about GPL club sites

Because GPL code can be shared, there are sites that sell or give away premium plugins for a fraction of the price. Redistributing GPL code is legal, but these copies are a common way malware reaches WordPress sites. They are also often out of date and come with no support. If you have used one, our guide to finding WordPress backdoors shows what to look for. A fork you control, built from code you bought from the original developer, is a much safer path.

Need to take over a plugin?

Our GPL plugin fork and reverse engineering service helps when a plugin you depend on gets too expensive, too unstable or is abandoned. We check the license, reverse engineer minified or obfuscated code where the license allows it, cover the plugin with unit and end-to-end tests, and maintain the fork for you, so your site keeps working without depending on the original vendor. Contact us with the plugin’s name and what is going wrong.

Frequently asked questions

What does GPL mean for WordPress plugins?

The GNU General Public License gives everyone who receives the software the right to run it, study it, change it and share it. WordPress is licensed under the GPL, and WordPress.org's position is that plugins built on it should be too. Most premium plugins say they are GPL-licensed.

If a plugin is GPL, what am I actually paying for?

Usually support, automatic updates, a license key that unlocks updates and access to the developer's services. The GPL lets the developer charge for distributing the code, but once you have it, you are free to keep using and changing it.

Can I keep using a GPL plugin after my license expires?

Yes. The GPL does not expire, and the developer cannot take back the rights it gave you. You lose updates and support, not the right to use the version you have. You become responsible for keeping it secure and compatible.

Can I fork a premium WordPress plugin?

If the code is GPL-licensed, you can change it and share your changed version under the same license. You cannot use the developer's trademark, so a public fork needs a new name. Check whether images, CSS or JavaScript are under a separate license first.

Is it safe to download GPL plugins from GPL club sites?

It is legal for someone to redistribute GPL code, but these sites are a common source of hidden malware and outdated versions. Only use code from the original developer or a source you can verify.

What if the plugin's code is minified or obfuscated?

The GPL requires the developer to provide the source code in the form people normally edit. You can ask the developer for it. If they will not provide it, the code can often be reconstructed by reverse engineering, as long as it was distributed under the GPL.