Recently, I gave some thought to how WordPress themes can be licensed. Initially, I considered implementing licensing by determining the domain through JS. However, this idea was quickly rejected because JS licensing is easy to crack; the code can be viewed simply by inspecting the elements. Next, I considered PHP licensing, which is relatively more secure because PHP offers various encryption methods, and cracking it requires more time and effort, effectively preventing many people from attempting to crack the theme.

Below is the idea for PHP domain licensing.

Method 1: Cloud-Based Domain License Verification

Client-Side Code:

<?php
$shouname = trim($_SERVER['SERVER_NAME']);  // 获取域名
$shouurl = file_get_contents('https://www.ikxin.com/shouquan.php?domain='.$shouname);  // 获取服务端授权文件
if(!empty($shouurl)){
    echo "已授权！";    // 授权成功
}else{
    die("未授权！");    // 授权失败
}
?>

Server-Side Code:

<?php
$domain = $_GET['domain'];                                // 获取域名
$Array = array('127.0.0.1','localhost','www.ikxin.com');  // 授权域名列表
echo in_array($domain, $Array) ? 'yes' : '';              // 校验结果
?>

Note:

• The domain licensing code can be encapsulated in a function or encrypted.
• Common PHP encryption methods, such as Zend, mzphp2, ionCube, all have certain methods of being cracked. If there are many authorized domains, you can add a domain field to the project and write the domains to a database for retrieval and verification.

Method 2: Independent Domain License Verification

<?php
function allow_domain(){
    $is_allow = false;
    // 获取不带端口号的域名前缀
    $servername = trim($_SERVER['SERVER_NAME']);
    // 授权域名列表
    $Array = array("localhost", "127.0.0.1");
    // 遍历数组
    foreach($Array as $value){
        $value = trim($value);
        $domain = explode($value, $servername);
        if(count($domain) > 1){
            $is_allow = true;
            break;
        }
    }
    if(!$is_allow){
        die("域名未授权！");    // 授权失败
    }else{
        echo "域名已授权！";    // 授权成功
    }
}
allow_domain();
?>

How to Use

Of the methods above, the first method is recommended because it is easier to manage. You can write the client-side code into the global PHP function file of the WordPress theme, and then configure the domain authorization on your own server. The client's PHP file can also be encrypted. Of course, although encrypting PHP code presents certain difficulties, there is no code in the world that cannot be decrypted absolutely.