I'm starting a very large project soon. It must include a licensing system.

The project will produced using PHP/Laravel/JavaScript and use many different libraries, a CMS, and a few databases.

The software will be licensed out to other companies, which is why the ability to enable/disable usage is very important.

For the most part, piracy shouldn't be an issue considering the vast majority of the companies that will use this software don't have the know-how to disable the protection or don't have a developer that could do this.

What's the best way to handle this? Is restricting the source-code via a per domain basis possible and would it work well?

How would this be done? How could I manage updates to the software too?

  • What happens if they change their domain name? Due to trademark disputes, business merge, whatever. Note that most system admins hate automated updates to production systems, because it can cause things to break unexpectedly. What do you mean by "source code" - if you distribute the source it makes removing protections much easier. If you're not really worried about piracy, why use DRM? Commented Jul 17, 2014 at 10:52

2 Answers 2


Perhaps it goes against your current projects intentions - however - you should try and avoid selling products to clients which are bundled in this way and where they have direct and absolute control over the source. (I assume they would be hosting your application on a local server? They would need some kind of technician and would they have to know your code in order to fix problems etc...)

The best solution is: Host the application on your own server and have individual clients subscribe to your server. Distributing a licence to them is essentially granting them authentication rights. You have technical control over their version/authentication/support and are able to amass logs of usage to improve performance etc...

Is there a reason you can't do it this way?


DRM is incredibly hard to do, if not impossible.

Perhaps you make the your JS or PHP send a POST to your servers with the domain it was accessed from every n requests. The person using your software could remove those lines.

Or perhaps you make part of the software dependent on your servers. The person using the software could, potentially, reverse engineer what your server does.

Perhaps you require an API key. If somebody is managing to get the PHP from a server, why wouldn't they be able to get the API key too and spoof the origin header (if you check that).

So while there are ways to limit software's use to only certain domains, it's nearly impossible to do so efficiently.

I'd recommend this:

  • use a good license
  • obsfucate your code
  • serve sensitive assets from your server if possible

Other things include sending POST requests to your servers, using API keys, checking the origin headers, etc.

See: How do you limit javascript api to a domain? and https://stackoverflow.com/questions/9962120/limit-php-script-to-one-domain-per-license and

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .