Member Avatar for unikorndesigns

Hi,
I am developing a CMS in PHP, MySQL for a company in partnership. As you all know PHP is an open source language and it is really easy for a user to resell my software to another client or even publish it online for free. I have an agreement with the company stating that the company is not allowed to modify/extend/reproduce the copy of the application by any form digital or printed.
Since its just a non-technical solution which doesn't really secure the future of my application, am thinking of tracking my CMS and retrieve the domains in which the CMS is being installed and thereby i could create an call function which shuts down the user from using my application without my knowledge and yes ofcourse i can secure that function being accessed by any hackers out there so my loyal customers are safe from any hack attack on my CMS.

I also considered the idea of generating a license key and i could put a facility where if the license key entered is wrong while installation, then the application self destructs itself and thereby securing my application. I know it might seem a little rude but we have to protect our web applications/our own hard work from being used by the companies for free. Cuz honestly i had already 3 months of dedication on this and i almost finished preparing the BETA version of my application.

Really do appreciate your response and any suggestions in advance....Thanks.

  • 3 Contributors
  • 3 Replies
  • 128 Views
  • 2 Hours Discussion Span
  • Latest Post Latest Post by chrishea

Dani AI

Generated

This is doable, but do it with care. A "kill switch" that silently destroys installs will hurt paying customers, create support nightmares, and could have legal/privacy implications. Combine legal controls (clear EULA/contract and license terms) with technical controls that are robust, auditable, and fail-safe.

Recommended high-level approach:

  • Issue per-install licenses that are cryptographically signed and bind to an installation identifier or domain. Verify the signature locally so the app can tell whether the license came from you and which domains/features it covers (see JSON Web Tokens as one practical format: [https://jwt.io]).
  • Implement periodic server checks that fetch revocation/validation info. Cache results and use a reasonable grace period so temporary network issues never render a paying customer unusable. Prefer degrading features (read-only mode or disabled premium features) instead of total shutdown.
  • For discovery of unauthorized installs, use an opt-in/contracted "phone-home" mechanism: a tiny remote asset or update-check endpoint that logs the calling hostname/IP. That will only detect installs that haven’t been stripped; it’s useful but not foolproof. Google Analytics or Piwik won’t reveal sites running your code unless your tracking snippet is present in those installs.

Operational and legal cautions:

  • Disclose the phone-home behavior in your license/EULA and get agreement from partners/customers.
  • Avoid automatic mass deactivation. Send warnings, keep manual-review paths, and log everything you disable so you can reverse mistakes quickly.
  • If piracy is a major threat, consider alternatives: a hosted/SaaS model for core pieces, paid plugins/support, or offering a free core with paid advanced modules (this addresses adoption concerns raised earlier by @Lastmitch).

Credit: ’s suggestion to use remote verification is on point—just make the behavior conservative and auditable so legitimate customers are never collateral damage.

Recommended Answers

All 3 Replies

Member Avatar for Member #949455

I am developing a CMS in PHP, MySQL for a company in partnership. As you all know PHP is an open source language and it is really easy for a user to resell my software to another client or even publish it online for free. I have an agreement with the company stating that the company is not allowed to modify/extend/reproduce the copy of the application by any form digital or printed.

If you create a code to lock certain features then in order to unlock it you need a licenses. There's alot of CMS out there that are open source, no matter what kind of CMS. If you create a license for your CMS then it might turn people away. Most likely people will choose something is free CMS than paying for a CMS.

Member Avatar for unikorndesigns

I've got that covered Lastmitch. Right now if i start debating that paid CMS is better than free CMS....then this post will loose its focus. :P
In my application i haven't developed a trial version. While installation, the user will be prompted to enter the license key and the software will be installed. If an end user is supposed to get my application, then the legitable way for him/her to get is from me or else via my business partners. If at all the user manages to install the application without being issued a license key from my end then, i want to be able to track those domain which has my application hosted. Is it possible? Even via Google Analytics or Piwik?

Member Avatar for chrishea

I wrote a similar type of licensing module to use in a PC application. It (remotely) executed a php module on my server every time it started up. It passed various info about the PC on which the program was running as well as the license info. The PHP program recorded the info in a database. I made it possible to mark a particular copy of a the program as not authorized, in which case it would return an appropriate code to the program and the program would then terminate with a message. I did some testing but it has not yet been implemented in any programs that are being distrinuted / sold.

You could do something similar to do license checking for a php system. You can get various info using $_SERVER(...). The program that is to be licensed needs to be converted to byte-code (ie using Ioncube or Zend). Otherwise, anyone with even limited knowledge of php could disable it. The license code needs to have a timer so if it doesn't get a response from the licensing program on your server, it can carry on anyway. I suggest that the code be very conservative and avoid cutting anyone off arbitrarily. That would be a sure way to make your customers unhappy if something went wrong and it disabled a licensed copy.

My code isn't available at this time but it isn't difficult to develop. Best of luck.

Edited by chrishea
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.