Software / SaaS Licensing
License Enforcement Security Hardening & Renewal Automation
Audited a WordPress plugin licensing system, fixed a silent webhook authentication flaw that had broken remote license enforcement, and replaced manual renewal tracking with a rate-limited, automated system.
Project Overview
Industry
Software / SaaS Licensing
Solution
License Enforcement Security Hardening & Renewal Automation
Duration
~2 Months
Services
Technologies
The Challenge
Where This Started.
Before
- Webhook secret embedded directly in the request URL — logged in plain text by servers and proxies
- Remote deactivate/delete commands silently failing from a signature-secret mismatch
- No rate limiting on public license endpoints, no per-plan control over renewal pricing
After
- HMAC-SHA256 webhook signing with timing-safe verification and replay protection
- Remote license commands working reliably, verified through a staged rollout
- Rate-limited endpoints and a 5-stage automated renewal sequence with a configurable grace period
Business Impact
Why It Mattered
A licensing system that fails silently is worse than one that fails loudly — the vendor has no way to know a revoked or expired license is still active on a client site until someone notices by accident. And every unprotected license-check endpoint left open is a standing invitation for automated key-guessing.
Engineering Approach
How We Approached It
Rather than patching the reported symptom, the engagement started with a full audit of the licensing system end to end — tracing the webhook signing path from server to client to find the actual point of failure — before any fix was written. The audit findings were documented first, then implemented as a defined set of milestones.
Architecture
How It's Wired Together.
A dedicated webhook-signing layer replaced the original URL-embedded secret: the license server now signs each command payload with HMAC-SHA256, the client plugin recomputes and verifies that signature with a timing-safe comparison, and a timestamp inside the signed payload blocks replay of any captured request. A WP-Cron-driven renewal engine runs alongside it, tracking each license against its real expiry window rather than a static database flag.
Implementation
What We Built
Root-caused the broken remote commands to a secret-key mismatch and fixed it, then replaced the URL-embedded webhook secret with HMAC-SHA256 request signing (signature in a dedicated header, verified with a timing-safe hash comparison, timestamped against replay). Added transient-based rate limiting to the three public license REST endpoints. Consolidated previously hardcoded values — license-server URL, plugin version string, secret key — into single-source-of-truth constants. Built a 5-stage automated renewal reminder sequence on WP-Cron with deduplicated notification logging and a configurable grace period, added idempotency protection to the Stripe/PayPal renewal flow to prevent duplicate-charge risk, and rolled the whole change out in three phases — staging verification, a small pilot group of client sites, then full deployment — rather than a single global push.
Access & Role Settings
Technical Highlights
What Made This Work.
-
HMAC-SHA256 webhook signing with timing-safe verification and replay protection
-
Rate-limited license REST endpoints blocking automated key-guessing
-
5-stage automated renewal sequence with deduplication and a configurable grace period
Results
The Outcome.
Remote license commands work reliably again and can no longer be forged from a captured URL. The license API is protected against brute-force enumeration with no impact on legitimate plugin traffic, and renewal follow-up now runs on an automated schedule instead of manual tracking. Verified through a staged rollout — pilot sites first, then full deployment — and confirmed stable in production.
Lessons Learned
What This Taught Us
A security flaw doesn't have to throw an error to be serious. The webhook secret mismatch here failed completely silently — commands simply appeared to do nothing from the admin side, with nothing in the logs pointing at why. Diagnosing that kind of failure means tracing the signing logic on both ends of a request, not just checking for errors that were never going to appear.
Facing a Similar Challenge?
Let's talk about what your store or system actually needs — no template pitch, just an engineering conversation.