Selling
How to Sell WordPress Plugins From Your Own Site
Five pieces sell WordPress plugins from your own site: checkout, license keys, updates, customer area, gateway. All five can run inside WordPress itself.
To sell WordPress plugins from your own site, you need five pieces: a checkout, license keys, an update server, a customer area, and a payment gateway. That’s the whole machine. Since Core Forms 4.4, all five run inside the WordPress site you already own — no SaaS subscription, no marketplace cut.
I know because it’s the stack I use. Core Forms is sold with Core Forms: the checkout is a form, the license server is a setting I switched on, the customer dashboard is a shortcode on a page. What follows is how each piece works, what the other routes cost, and the parts of ownership nobody warns you about.
The whole pipeline — product, checkout, key, download — living on one WordPress install.
The five pieces every plugin business needs
Every plugin business runs on the same five pieces: a checkout that takes money, license keys that gate access, an update server that delivers new versions, a customer area where buyers manage everything, and a payment gateway underneath it all. Marketplaces bundle these and charge for the bundle. Owning your site means assembling them yourself.
A checkout. Somewhere a buyer picks a plan and pays.
License keys. A key per purchase, an activation limit per plan, and an API your plugin calls home to.
An update server. Your paid plugin needs a server that answers WordPress’s update checks with the latest version — for valid licenses only.
A customer area. Buyers lose keys, re-download ZIPs, and check activated sites. Without a self-serve page, all of that lands in your inbox.
A payment gateway. Stripe, PayPal, Razorpay, or similar. The gateway moves the money; everything above decides what the money unlocks.
Where most sellers start
Most plugin sellers start on a marketplace or a merchant-of-record service, because those bundle the five pieces on day one. The trade is permanent: a cut of every sale, forever — and on a marketplace, the customer relationship too. Here’s the honest map:
| Route | Cost model | Who owns the customer |
|---|---|---|
| Marketplace (CodeCanyon-style) | A significant cut of every sale, set by the marketplace | The marketplace |
| Merchant-of-record SaaS (Freemius, Lemon Squeezy) | Freemius takes around 7% revenue share; Lemon Squeezy 5% + 50¢ per sale — both handle global sales tax for you | Shared — you get the data, they sit in the middle |
| Your own site | Gateway fees only — Stripe’s US card rate is 2.9% + 30¢ | You, entirely |
The merchant-of-record column deserves its credit: Freemius and Lemon Squeezy calculate and remit EU VAT and sales tax on your behalf. That’s real work for their percentage. The own-site route makes tax your problem — more on that below.
But run the math at any real revenue. On $2,000 a month, a 7% share is $140 monthly, $1,680 a year, forever. The gateway fee exists on every route; the platform fee only exists because you haven’t assembled the five pieces yourself.
The own-site stack to sell WordPress plugins, step by step
The own-site stack takes five steps in Core Forms: enable the License Issuing Server, define your product and plans, upload versioned ZIPs, build a payment checkout form, and publish the customer dashboard. Each step is configuration, not code. The licensing feature page covers the full surface; here’s the shape of it.
1. Enable the License Issuing Server. One toggle in Settings. Core Forms creates a customer dashboard page with the [cf_license_dashboard] shortcode automatically.
2. Define products and plans. Under Products & Licensing, a product is your plugin; a plan carries price, currency, billing period, license duration, trial, and activation limit. A “5 sites, 1 year” plan and a “lifetime, unlimited” plan can hang off the same product.
3. Upload versioned ZIPs. Releases go into the Media Library, one ZIP per version. Every file is SHA-256-verified before each download, download links expire after 15 minutes, and every download is audited. Your update server is now live — the client API is EDD Software Licensing-compatible, so check_license, activate_license, and get_version endpoints work with the update code most WordPress plugins already ship. I went deeper on the key mechanics in the software license manager post.
4. Build the checkout form. Any payment-enabled Core Form works — Stripe, PayPal, Razorpay, Polar, or FluentCart — with the “Fulfill License Purchase” action attached. Fulfillment runs only after the gateway’s verified paid webhook, and it runs idempotently: a replayed webhook can’t issue duplicate keys. A hidden field mapping product_id:plan_id:quantity handles multi-product and bundle checkouts. The commerce setup docs walk through the wiring.
5. Publish the customer dashboard. Buyers see orders, masked keys they can reveal, downloads, expiry dates, and activated sites. Guests who checked out without an account get a signed link that works for 30 days.
That’s the machine. Mine has been selling Core Forms licenses with it since 4.4 shipped.
Free version on WordPress.org, paid on your site
The classic motion to sell WordPress plugins is freemium: a genuinely useful free version in the WordPress.org directory, a paid version with more on your own site. The directory brings the traffic; your site converts the fraction who need the paid tier.
Two rules keep the free half legitimate. The WordPress.org detailed plugin guidelines require the free version to actually work — no trialware, no features that exist only to advertise their locked state. And the directory only distributes the free version — which is exactly why you need your own update server for the paid one.
The freemium math is brutal but honest: conversion from free install to paid customer is low single digits for most plugins. The free version isn’t charity — it’s your top of funnel and your search presence in one listing.
Renewals and refunds without a SaaS
Renewals run through a form too: a “Renew License Subscription” form extends the license from the later of today or the current period end, so early renewers don’t lose paid time and late renewers don’t get free months. Refunds flow the other way — a verified refund webhook disables the license and cancels the subscription, automatically.
A daily maintenance task expires overdue licenses on schedule, and there’s a WP-CLI command (wp core-forms license maintenance) if you’d rather drive it from a server cron.
One boundary to be clear about: the payment provider still owns automatic recurring charging and stored payment methods. Core Forms tracks the terms — what was bought, when it lapses, what a renewal extends — while Stripe or PayPal actually charges the card. That’s the right split; you don’t want to store cards.
The honest costs of owning it
Owning the stack means owning two jobs the platforms were doing for their fee: tax and maintenance. Core Forms is not a merchant of record. It doesn’t calculate or remit EU VAT or US sales tax for you. You handle that yourself, through your accountant, or through your gateway’s tax tooling — Stripe Tax exists for exactly this.
There’s a middle path worth knowing: route payments through Polar, which acts as a merchant of record on the payment side, while your licenses, updates, and customer dashboard still live on your own site. You give up a platform fee on payments but keep everything else.
The second cost is quieter. Your store is now a WordPress site you maintain — backups, updates, uptime. If the site is down, checkout is down. For me that’s a non-issue; the site was already there and already maintained. If you don’t want to run a WordPress site at all, the merchant-of-record services are the honest answer, and their percentage is the fair price of not thinking about any of this.
FAQ
Do I need EDD Software Licensing to sell WordPress plugins from my site?
No. Core Forms’ client API is EDD Software Licensing-compatible — the same check_license, activate_license, deactivate_license, and get_version calls, plus legacy ?edd_action= requests. If your plugin already ships EDD-style update code, it works against a Core Forms license server without changes.
Can I sell a plugin that’s also free on WordPress.org?
Yes — that’s the standard freemium model. The directory hosts and updates the free version; your site sells the paid version and serves its updates from your own license server. The free version must be genuinely functional under WordPress.org’s guidelines, not a locked trial.
How do activation limits work?
Each plan carries an activation limit — say, 1, 5, or unlimited sites. When a customer’s site calls activate_license, Core Forms records the URL and counts it against the limit. Customers see and manage their activated sites from the dashboard, and deactivating frees a slot.
What happens when a customer refunds?
The gateway sends a refund webhook, Core Forms verifies it, then disables the license and cancels the subscription automatically. No manual key-hunting. Updates and downloads stop working for that key, and the daily maintenance task keeps expiry states accurate from then on.