Release v0.7.1 - Bug Fixes & Client Compatibility

## Fixed
- CRITICAL: Fixed API Verification Secret not displayed in PHP fallback template
- Response signing now includes /update-check endpoint

## Changed
- Updated magdev/wc-licensed-product-client to v0.2.2
- Updated symfony/http-client to v7.4.5

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -7,6 +7,530 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.7.1] - 2026-01-28
+
+### Fixed
+
+- **CRITICAL:** Fixed API Verification Secret not displayed in PHP fallback template on customer account licenses page
+- Response signing now includes `/update-check` endpoint (was missing from signed routes)
+
+### Changed
+
+- Updated `magdev/wc-licensed-product-client` dependency to v0.2.2
+- Updated `symfony/http-client` dependency to v7.4.5
+
+### Technical Details
+
+- Added customer secret display to `displayLicensesFallback()` method in `AccountController`
+- Added `/update-check` route to `ResponseSigner::shouldSign()` method for consistent signature headers
+- Verified server implementation aligns with updated client library documentation
+
+## [0.7.0] - 2026-01-28
+
+### Security
+
+- Fixed XSS vulnerability in checkout blocks DOM fallback injection
+- Unified IP detection for rate limiting across all REST API endpoints
+- Added rate limiting to license transfers (5 per hour) and downloads (30 per hour)
+- Added file size (2MB), row count (1000), and rate limiting to CSV import
+- Added JSON decode error handling in Store API extension
+- Added jQuery selector sanitization for license ID validation
+
+### Added
+
+- New `IpDetectionTrait` for shared IP detection logic with proxy support
+- New `RateLimitTrait` for reusable frontend rate limiting
+- New `src/Common/` directory for shared traits
+
+### Changed
+
+- RestApiController now uses IpDetectionTrait instead of inline methods
+- UpdateController now uses IpDetectionTrait for consistent rate limiting behind proxies
+- AccountController now uses RateLimitTrait for transfer rate limiting
+- DownloadController now uses RateLimitTrait for download rate limiting
+- Checkout blocks fallback uses safe DOM construction instead of innerHTML
+
+## [0.6.1] - 2026-01-27
+
+### Added
+
+- Filter functionality on customer account licenses page (filter by product or domain)
+- Split auto-update settings into two options: "Enable Update Notifications" and "Automatically Install Updates"
+- New `isUpdateNotificationEnabled()`, `isAutoInstallEnabled()` static methods in SettingsController
+- WordPress auto-update filter integration (`auto_update_plugin`) for automatic installation
+
+### Fixed
+
+- Fixed admin license test popup showing empty product field
+- `handleAjaxTestLicense()` now enriches response with product name
+- Removed version field from test popup (version_id is only set for version-bound licenses)
+
+### Changed
+
+- Updated `magdev/wc-licensed-product-client` dependency to v0.2.1
+- "Automatically Install Updates" is only selectable when "Enable Update Notifications" is enabled
+
+## [0.6.0] - 2026-01-27
+
+### Added
+
+- WordPress-style automatic update system for licensed plugins
+- Server-side `/update-check` REST API endpoint for WordPress-compatible update information
+- Client-side `PluginUpdateChecker` singleton for WordPress update integration
+- New "Auto-Updates" settings subtab with enable/disable and check frequency options
+- Secure download authentication via `X-License-Key` header
+- Response signing support for tamper-proof update responses
+- Configurable cache TTL for update checks (1-168 hours)
+
+### Changed
+
+- Updated OpenAPI specification to version 0.6.0 with `/update-check` endpoint documentation
+
+## [0.5.15] - 2026-01-27
+
+### Fixed
+
+- Fixed tab rendering bug in WooCommerce product edit page when switching to licensed or licensed-variable product types
+- Simplified JavaScript to avoid conflicts with WooCommerce's native show/hide logic
+- Removed conflicting CSS rule for `.hide_if_licensed` that was causing layout issues
+- License Settings tab now uses CSS class toggle (`.wclp-active`) instead of jQuery `.show()/.hide()` for proper display
+- Variations tab now properly shows for licensed-variable products via `woocommerce_product_data_tabs` filter
+
+## [0.5.14] - 2026-01-27
+
+### Fixed
+
+- **CRITICAL:** Fixed Product Versions meta box not appearing for licensed-variable products
+- Product Versions meta box now always added to product pages, visibility controlled via CSS/JavaScript
+- Added `Installer::registerProductTypes()` to create product type terms in the `product_type` taxonomy
+- Product type terms are now ensured to exist on `woocommerce_init` hook for existing installations
+- Fixed License Settings tab and Product Versions visibility toggling when changing product types
+
+## [0.5.13] - 2026-01-27
+
+### Fixed
+
+- **CRITICAL:** Fixed licenses not showing in admin order form for licensed-variable products
+- `OrderLicenseController` now uses `LicenseManager::isLicensedProduct()` for consistent product type detection
+- Fixed expected licenses calculation for variable product orders
+- Fixed manual license generation from admin order page for variable products
+
+### Changed
+
+- Removed debug logging from all source files (PHP and JavaScript)
+- Cleaned up checkout blocks integration, Store API extension, and checkout controller
+
+## [0.5.12] - 2026-01-27
+
+### Fixed
+
+- **CRITICAL:** Fixed stock indicator ("1 in stock") appearing in cart for licensed variable product variations
+- Override `get_children()` with direct SQL query to bypass WooCommerce's `is_type('variable')` check
+- Override `get_variation_attributes()` to properly load taxonomy attribute terms
+- Override `get_variation_prices()` to prevent fatal error with null `$this->prices_array`
+- Override `get_available_variations()` with empty `availability_html` for variations
+- Added `is_type()` override to return true for both 'licensed-variable' and 'variable' type checks
+- Added multiple stock-related filters: `woocommerce_get_availability_text`, `woocommerce_product_get_stock_quantity`, `woocommerce_product_variation_get_stock_quantity`
+- Improved `isLicensedProductOrVariation()` check using `WC_Product_Factory::get_product_type()` for reliable parent type detection
+
+### Changed
+
+- `LicensedProductVariation` now includes `get_availability()`, `managing_stock()`, and `is_purchasable()` overrides
+- Simplified `isVirtual()` to use shared `isLicensedProductOrVariation()` helper
+
+## [0.5.11] - 2026-01-27
+
+### Fixed
+
+- **CRITICAL:** Fixed "sold out" message on licensed variable products by correcting `is_purchasable()` method
+- Variable products don't have a direct price - `is_purchasable()` now delegates to parent `WC_Product_Variable` class
+- Fixed variation class detection by using product ID parameter instead of unreliable global `$post`
+- Product class filter now properly accepts all 4 WooCommerce filter parameters for reliable variation detection
+
+## [0.5.10] - 2026-01-27
+
+### Fixed
+
+- Fixed licensed variable products not showing variations even when attributes are defined
+- Re-load product via `wc_get_product()` to ensure correct class instance is used
+- Removed overly strict type check that was preventing variations from displaying
+- Now mirrors WooCommerce's standard `woocommerce_variable_add_to_cart()` implementation
+
+## [0.5.9] - 2026-01-27
+
+### Fixed
+
+- Fixed frontend error on licensed variable products when no attributes are defined
+- Added null checks for `get_variation_attributes()`, `get_available_variations()`, and `get_default_attributes()`
+- Show informative message instead of error when product has no variations configured
+- Changed product type check from `instanceof` to `is_type()` for better compatibility
+
+## [0.5.8] - 2026-01-27
+
+### Fixed
+
+- **CRITICAL:** Fixed critical error on frontend product pages for licensed variable products
+- Variable product add-to-cart template now passes required variables (`available_variations`, `attributes`, `selected_attributes`)
+- Variants tab no longer disappears when saving attributes on licensed variable products
+- Added WooCommerce AJAX event listeners to maintain tab visibility during attribute operations
+
+### Changed
+
+- Improved JavaScript event handling for licensed-variable product type in admin
+- Added listeners for `woocommerce_variations_loaded`, `woocommerce_variations_added`, `woocommerce_variations_saved` events
+- Added AJAX complete handler for attribute save operations
+
+## [0.5.7] - 2026-01-27
+
+### Changed
+
+- Removed "Default" prefix from setting labels on Default Settings page for cleaner UI
+- Labels now read "Max Activations", "License Validity (Days)", and "Bind to Major Version"
+
+## [0.5.6] - 2026-01-27
+
+### Fixed
+
+- License Settings tab now only shows for Licensed Product and Licensed Variable Product types
+- Previously the tab was visible on all product types due to CSS `!important` override
+
+### Changed
+
+- Improved JavaScript for License Settings tab visibility handling on product type change
+- Updated README.md with complete feature documentation for v0.5.x features:
+  - Variable Licensed Products
+  - Multi-Domain Licensing
+  - Per-License Customer Secrets
+  - Download Statistics
+  - Configurable Rate Limiting
+
+## [0.5.5] - 2026-01-26
+
+### Fixed
+
+- **CRITICAL:** Response signing key derivation now uses native `hash_hkdf()` for RFC 5869 compliance
+- Key derivation now matches client library (`SecureLicenseClient`) exactly
+- Added missing domain validation to `/activate` endpoint (1-255 characters)
+
+### Changed
+
+- `ResponseSigner::deriveCustomerSecret()` now uses `hash_hkdf('sha256', $serverSecret, 32, $licenseKey)`
+- Previous custom HKDF-like implementation was incompatible with client library
+
+### Security
+
+- Signatures generated by server now verify correctly with `magdev/wc-licensed-product-client`
+- All three API endpoints now have consistent parameter validation
+
+## [0.5.4] - 2026-01-26
+
+### Fixed
+
+- REST API `/validate` endpoint now returns HTTP 404 for `license_not_found` error (was 403)
+- License key validation now enforces minimum 8 characters per API documentation
+
+### Added
+
+- Configurable rate limiting via `WC_LICENSE_RATE_LIMIT` and `WC_LICENSE_RATE_WINDOW` constants
+- Rate limit now defaults to 30 requests per 60 second window (configurable)
+
+### Changed
+
+- Improved HTTP status code mapping: 404 for not found, 500 for server errors, 403 for all other errors
+- Rate limiting implementation now uses configurable constants instead of hardcoded values
+
+## [0.5.3] - 2026-01-26
+
+### Added
+
+- Variable licensed product type (`licensed-variable`) for selling licenses with different durations
+- Support for monthly, yearly, quarterly, or lifetime license variations
+- `LicensedVariableProduct` class extending `WC_Product_Variable`
+- `LicensedProductVariation` class for individual variation license settings
+- Variation-specific license duration settings in product edit page
+- Duration labels displayed in checkout domain fields (e.g., "Yearly License")
+- Variation ID tracking in order domain meta for proper license generation
+
+### Changed
+
+- Updated `LicenseManager::generateLicense()` to accept optional variation ID
+- Checkout now handles variations with separate domain fields per product/variation
+- WooCommerce Blocks checkout updated to display variation duration labels
+- Store API extension updated to include variation_id in domain data schema
+
+## [0.5.2] - 2026-01-26
+
+### Added
+
+- Per-license customer secrets for API response verification
+- "API Verification Secret" section in customer account licenses page (collapsible)
+- Copy button for customer secrets with clipboard support
+- Documentation for per-license secret derivation and usage
+
+### Security
+
+- Customers no longer need the master server secret for signature verification
+- Each license key has a unique derived secret using HKDF-like key derivation
+- If one customer's secret is compromised, other customers remain unaffected
+
+### Changed
+
+- Updated `ResponseSigner` with static methods for secret derivation
+- Updated `server-implementation.md` with per-license secret documentation
+- Added new translation strings for secret-related UI
+
+## [0.5.1] - 2026-01-26
+
+### Fixed
+
+- Product versions now sort correctly by version DESC when added via AJAX in admin
+- License actions in admin overview are now always visible instead of only on hover
+
+### Changed
+
+- Added `compareVersions()` JavaScript function for proper semantic version comparison
+- Updated CSS with `!important` to override WordPress default hover-only behavior for row actions
+
+## [0.5.0] - 2026-01-25
+
+### Added
+
+- Multi-domain licensing support: Customers can now purchase multiple licenses for different domains in a single order
+- Each cart item quantity requires a unique domain at checkout
+- New "Enable Multi-Domain Licensing" setting in WooCommerce > Settings > Licensed Products
+- Multi-domain checkout UI for WooCommerce Blocks checkout
+- DOM injection fallback for checkout domain fields when React component fails to render
+- Grouped license display in customer account page by product/order
+- "Older versions" collapsible section in customer download area
+- Updated email templates to show licenses grouped by product
+
+### Changed
+
+- Customer account licenses page now shows licenses grouped by product package
+- Order meta now stores `_licensed_product_domains` array for multi-domain orders
+- Updated translations with 19 new strings for multi-domain functionality (de_CH)
+- Refactored checkout blocks JavaScript to use ExperimentalOrderMeta slot pattern
+
+### Technical Details
+
+- `CheckoutBlocksIntegration` now uses `registerPlugin` with `woocommerce-checkout` scope
+- `StoreApiExtension` handles both single-domain and multi-domain data formats
+- `CheckoutController` validates unique domains per product in multi-domain mode
+- `AccountController` groups licenses by product for package-style display
+- Backward compatible: existing single-domain orders continue to work
+
+## [0.4.0] - 2026-01-24
+
+### Added
+
+- Self-licensing prevention: Plugin automatically bypasses license validation when the configured license server URL points to the same WordPress installation
+- New `isSelfLicensing()` method in `PluginLicenseChecker` to detect circular licensing scenarios
+- New `normalizeDomain()` helper method for domain comparison (strips www prefix, lowercases)
+
+### Changed
+
+- `isLicenseValid()` and `validateLicense()` now check for self-licensing before attempting validation
+- Cache clearing now also clears the self-licensing check cache
+
+### Technical Details
+
+- Self-licensing detection compares normalized domains of license server URL and current site URL
+- Prevents circular dependency where plugin would try to validate against itself
+- Plugins can only be validated against the original store from which they were obtained
+
+## [0.3.9] - 2026-01-24
+
+### Added
+
+- "Generate Licenses" button in order meta box for admin-created orders
+- "Generate Missing Licenses" button when some products in an order are missing licenses
+- AJAX handler `ajaxGenerateOrderLicenses()` for manual license generation from admin
+- Warning message when order domain is not set before generating licenses
+
+### Fixed
+
+- **Critical:** Licenses are now generated for orders created manually in admin area
+- Previously, licenses were only generated via checkout hooks, leaving admin-created orders without licenses
+
+### Technical Details
+
+- Added `wclp_generate_order_licenses` AJAX action to `OrderLicenseController`
+- Updated `order-licenses.js` with generate button handler and page reload on success
+- Added CSS styles for generate status messages
+- Updated translations (365 strings)
+
+## [0.3.8] - 2026-01-24
+
+### Fixed
+
+- Fixed duplicate German translation string causing `ArgumentCountError` in settings page
+- The notification settings description had duplicated text with two `%s` placeholders
+
+### Changed
+
+- Updated `magdev/wc-licensed-product-client` to latest version (64d215c)
+
+## [0.3.7] - 2026-01-24
+
+### Added
+
+- Download counter for licensed product versions (tracked per version)
+- Download Statistics admin dashboard widget showing total downloads, top products, and top versions
+- New `DownloadWidgetController` class for download statistics widget
+- New `incrementDownloadCount()`, `getTotalDownloadCount()`, and `getDownloadStatistics()` methods in `VersionManager`
+- New `download_count` column in product versions database table
+
+### Fixed
+
+- Dashboard widget "View All Licenses" link now uses correct page slug (`wc-licenses`)
+- Download links in customer account page no longer result in 404 errors (added query var registration)
+- Added `license-download` endpoint registration during plugin activation
+
+### Changed
+
+- Removed redundant "Status Breakdown" section from dashboard widget (info already shown in stat cards)
+- License Types section in dashboard widget now uses card style matching the stats row above
+- Improved dashboard widget visual consistency
+
+### Technical Details
+
+- Added `addDownloadQueryVar()` method to `DownloadController` for proper endpoint registration
+- Updated `Installer::activate()` to register `license-download` endpoint before flushing rewrite rules
+- Updated translations (356 strings)
+
+## [0.3.6] - 2026-01-23
+
+### Security
+
+- Added CSRF protection (nonce verification) to CSV export functionality
+- Fixed IP header spoofing vulnerability in rate limiting - now requires explicit trusted proxy configuration
+- Enabled explicit Twig autoescape for XSS protection
+- Fixed unescaped status values in CSS classes in Twig templates
+
+### Fixed
+
+- Fixed response signing to use recursive key sorting for client compatibility
+- ResponseSigner now recursively sorts nested array keys alphabetically as required by client implementation
+
+### Changed
+
+- Rate limiting now only trusts proxy headers when `WC_LICENSE_TRUSTED_PROXIES` constant is defined
+- Added Cloudflare IP range support via `WC_LICENSE_TRUSTED_PROXIES = 'CLOUDFLARE'` configuration
+- Improved IP detection with CIDR notation support for trusted proxy ranges
+
+### Technical Details
+
+- Added `recursiveKeySort()` method to `ResponseSigner` for proper response signing
+- Added `isTrustedProxy()`, `isCloudflareIp()`, and `ipMatchesCidr()` methods to `RestApiController`
+- Twig environment now explicitly sets `autoescape => 'html'`
+- Export CSV link now includes nonce via `wp_nonce_url()`
+- Added `export_csv_url()` Twig function for generating export URL with nonce
+
+## [0.3.5] - 2026-01-23
+
+### Added
+
+- Admin dashboard widget showing license statistics on WordPress dashboard
+- Automatic license expiration via daily wp-cron job
+- License expired email notification sent when license auto-expires
+- New `LicenseExpiredEmail` WooCommerce email class (configurable via WooCommerce > Settings > Emails)
+
+### Changed
+
+- Improved download list layout in customer account licenses page
+- Downloads now displayed in two-row format: file link on first row, metadata on second row
+- Better visual separation between download link and version/date/checksum information
+
+### Technical Details
+
+- New `DashboardWidgetController` class in `src/Admin/` for WordPress dashboard widget
+- Widget displays: total licenses, active, expiring soon, expired counts, status breakdown, license types
+- New `LicenseExpiredEmail` class in `src/Email/` for expired license notifications
+- Added `getExpiredActiveLicenses()` and `autoExpireLicense()` methods to `LicenseManager`
+- Daily cron now auto-expires licenses with past expiration date and sends notification emails
+- Updated `templates/frontend/licenses.html.twig` with new two-row structure
+- Added `.download-item`, `.download-row-file`, `.download-row-meta` CSS classes
+- Improved responsive behavior for download metadata
+
+## [0.3.4] - 2026-01-23
+
+### Added
+
+- Current version display on single product pages for licensed products
+- Version number shown directly under the product title
+- Frontend CSS styling for version badge with monospace font
+
+### Technical Details
+
+- Added `displayCurrentVersion()` method to `LicensedProductType` class
+- Hooked to `woocommerce_single_product_summary` at priority 6 (after title)
+- Added `enqueueFrontendStyles()` to load CSS on product pages
+- Uses `LicensedProduct::get_current_version()` to fetch latest version
+
+## [0.3.3] - 2026-01-22
+
+### Fixed
+
+- Fixed version deactivation button not working in admin product versions table
+- Corrected parameter order in `updateVersion()` call - `isActive` was being passed to `attachmentId` parameter
+
+### Technical Details
+
+- Bug in `VersionAdminController::ajaxToggleVersion()` - parameters were in wrong order
+- Changed from `updateVersion($versionId, null, null, !$currentlyActive)` to `updateVersion($versionId, null, !$currentlyActive, null)`
+
+## [0.3.2] - 2026-01-22
+
+### Changed
+
+- Updated OpenAPI specification to version 0.3.2
+- Added documentation for response signing headers (X-License-Signature, X-License-Timestamp)
+- Enhanced API description with response signing security information
+
+### Technical Details
+
+- OpenAPI spec now documents optional response signature headers
+- Added header component definitions for X-License-Signature and X-License-Timestamp
+- All endpoint 200 responses now reference signature headers
+- Improved API documentation describing SecureLicenseClient usage
+
+## [0.3.1] - 2026-01-22
+
+### Changed
+
+- Settings page reorganized with sub-tab navigation similar to WooCommerce Advanced tab
+- Settings split into three sections: Plugin License, Default Settings, Notifications
+- Improved settings UI with WooCommerce-style section navigation
+
+### Technical Details
+
+- SettingsController refactored with `getSections()` and `outputSections()` methods
+- Section-specific settings methods using PHP 8 match expression
+- Hooks updated to use `woocommerce_sections_licensed_product` for sub-navigation
+
+## [0.3.0] - 2026-01-22
+
+### Added
+
+- Self-licensing functionality: Plugin validates its own license against a remote server
+- Plugin license settings in WooCommerce > Settings > Licensed Products tab
+- License Server URL, License Key, and optional Server Secret configuration
+- License status display in settings with verify button
+- Localhost bypass: All features work without license when running on localhost
+- Admin notice when plugin license is not configured or invalid
+
+### Changed
+
+- Frontend features now require a valid plugin license to function
+- Disabled features without license: Checkout domain field, customer licenses page, downloads, license generation
+
+### Technical Details
+
+- New `PluginLicenseChecker` singleton class for license validation
+- Integration with `magdev/wc-licensed-product-client` Composer package
+- Caching: 1 hour for valid license, 5 minutes for errors
+- Localhost detection supports: localhost, 127.0.0.1, ::1, and .localhost/.local subdomains
+
 ## [0.2.2] - 2026-01-22
 
 ### Added
@@ -373,7 +897,11 @@ define('WC_LICENSE_SERVER_SECRET', 'your-secure-random-string-min-32-chars');
 - WordPress REST API integration
 - Custom WooCommerce product type extending WC_Product
 
-[Unreleased]: https://src.bundespruefstelle.ch/magdev/wc-licensed-product/compare/v0.2.2...HEAD
+[Unreleased]: https://src.bundespruefstelle.ch/magdev/wc-licensed-product/compare/v0.3.3...HEAD
+[0.3.3]: https://src.bundespruefstelle.ch/magdev/wc-licensed-product/compare/v0.3.2...v0.3.3
+[0.3.2]: https://src.bundespruefstelle.ch/magdev/wc-licensed-product/compare/v0.3.1...v0.3.2
+[0.3.1]: https://src.bundespruefstelle.ch/magdev/wc-licensed-product/compare/v0.3.0...v0.3.1
+[0.3.0]: https://src.bundespruefstelle.ch/magdev/wc-licensed-product/compare/v0.2.2...v0.3.0
 [0.2.2]: https://src.bundespruefstelle.ch/magdev/wc-licensed-product/compare/v0.2.1...v0.2.2
 [0.2.1]: https://src.bundespruefstelle.ch/magdev/wc-licensed-product/compare/v0.2.0...v0.2.1
 [0.2.0]: https://src.bundespruefstelle.ch/magdev/wc-licensed-product/compare/v0.1.0...v0.2.0

README.md

@@ -11,25 +11,35 @@ WC Licensed Product adds a new product type "Licensed Product" to WooCommerce, e
 ### Core Features
 
 - **Licensed Product Type**: New WooCommerce product type for software sales
+- **Variable Licensed Products**: Create product variations with different license durations (monthly, yearly, lifetime)
 - **Automatic License Generation**: License keys generated on order completion (format: XXXX-XXXX-XXXX-XXXX)
 - **Domain Binding**: Licenses are bound to customer-specified domains
+- **Multi-Domain Licensing**: Customers can purchase multiple licenses for different domains in a single order
 - **REST API**: Public endpoints for license validation and management
+- **Response Signing**: Optional HMAC-SHA256 cryptographic signatures for API responses
+- **Per-License Secrets**: Each customer receives a unique verification secret for their license
 - **Version Binding**: Optional binding to major software versions
 - **Expiration Support**: Set license validity periods or lifetime licenses
-- **Rate Limiting**: API endpoints protected with rate limiting (30 requests/minute)
+- **Rate Limiting**: API endpoints protected with configurable rate limiting (default: 30 requests/minute)
+- **Frontend Rate Limiting**: Transfer requests (5/hour) and downloads (30/hour) protected against abuse
+- **Trusted Proxy Support**: Configurable trusted proxies for accurate rate limiting behind CDNs
 - **Checkout Blocks**: Full support for WooCommerce Checkout Blocks (default since WC 8.3+)
+- **Self-Licensing**: The plugin can validate its own license (for commercial distribution)
 
 ### Customer Features
 
-- **My Account Licenses**: Customers can view their licenses in My Account
+- **My Account Licenses**: Customers can view their licenses in My Account (grouped by product)
 - **License Transfers**: Customers can transfer licenses to new domains
 - **Secure Downloads**: Download purchased software versions with license verification
+- **Version History**: Access to older versions with collapsible download section
 - **Copy to Clipboard**: Easy license key copying
+- **API Verification Secret**: Per-license secret displayed for secure API integration
 
 ### Admin Features
 
 - **License Management**: Full CRUD interface for license management
 - **License Dashboard**: Statistics and analytics (WooCommerce > Reports > Licenses)
+- **Dashboard Widgets**: License statistics and download statistics on WordPress admin dashboard
 - **Search & Filtering**: Search by license key, domain, status, or product
 - **Live Search**: AJAX-powered instant search results
 - **Inline Editing**: Edit license status, expiry, and domain directly in the list
@@ -37,8 +47,13 @@ WC Licensed Product adds a new product type "Licensed Product" to WooCommerce, e
 - **License Transfer**: Transfer licenses to new domains
 - **CSV Export/Import**: Export and import licenses via CSV
 - **Order Integration**: View and manage licenses directly from order pages
+- **Generate Licenses**: Manually generate licenses for admin-created orders
 - **Expiration Warnings**: Automatic email notifications before license expiration
+- **Auto-Expire**: Daily cron job automatically expires licenses past their expiration date
+- **License Testing**: Test licenses against the API directly from admin interface
 - **Version Management**: Manage multiple versions per product with file attachments
+- **Download Tracking**: Track download counts per version with statistics widget
+- **SHA256 Checksums**: File integrity verification with SHA256 hash display
 - **Global Settings**: Default license settings via WooCommerce settings tab
 - **WooCommerce HPOS**: Compatible with High-Performance Order Storage
 
@@ -59,13 +74,27 @@ WC Licensed Product adds a new product type "Licensed Product" to WooCommerce, e
 ### Creating a Licensed Product
 
 1. Go to Products > Add New
-2. Select "Licensed Product" from the product type dropdown
+2. Select "Licensed Product" from the product type dropdown (or "Licensed Variable Product" for different license durations)
 3. Configure the product price in the General tab
 4. Set license options in the "License Settings" tab:
    - **Max Activations**: Number of domains allowed per license
    - **License Validity**: Days until expiration (empty = lifetime)
    - **Bind to Major Version**: Lock license to current major version
 
+### Creating Variable Licensed Products
+
+For selling licenses with different durations (monthly, yearly, lifetime):
+
+1. Go to Products > Add New
+2. Select "Licensed Variable Product" from the product type dropdown
+3. Create variations as you would for any variable product (e.g., by "License Duration")
+4. For each variation, set:
+   - **Variation Price**: Different prices for different durations
+   - **License Duration (Days)**: Days until expiration (0 = lifetime)
+   - **Max Activations**: Override parent product setting if needed
+
+Duration labels (Monthly, Yearly, Lifetime) are automatically displayed at checkout.
+
 ### Managing Product Versions
 
 1. Edit a Licensed Product
@@ -77,7 +106,8 @@ WC Licensed Product adds a new product type "Licensed Product" to WooCommerce, e
 
 1. Go to WooCommerce > Settings > Licensed Products
 2. Set default values for Max Activations, License Validity, and Version Binding
-3. Per-product settings override these defaults
+3. Enable Multi-Domain Licensing to allow multiple licenses per cart item
+4. Per-product settings override these defaults
 
 ### Customer Checkout
 
@@ -103,16 +133,109 @@ When a customer purchases a licensed product, they must enter the domain where t
 3. Upload a CSV file (supports exported format or simplified format)
 4. Choose options: skip header row, update existing licenses
 
+**Import Limits (Security):**
+
+- Maximum file size: 2MB
+- Maximum rows per import: 1000
+- Cooldown between imports: 5 minutes
+
+## Security
+
+The plugin implements several security best practices:
+
+- **Input Sanitization**: All user inputs are sanitized using WordPress functions
+- **Output Escaping**: All output is escaped to prevent XSS attacks
+- **XSS-Safe DOM Construction**: JavaScript uses `createElement()` and `textContent` instead of `innerHTML`
+- **CSRF Protection**: Nonce verification on all forms and AJAX requests
+- **SQL Injection Prevention**: All database queries use prepared statements
+- **Capability Checks**: Admin functions require `manage_woocommerce` capability
+- **Secure Downloads**: File downloads use hash-verified URLs with user authentication
+- **Response Signing**: Optional HMAC-SHA256 signatures for API tamper protection
+- **Rate Limiting**: API and frontend operations protected against abuse
+- **Import Limits**: CSV imports limited by file size, row count, and cooldown period
+
+### Trusted Proxy Configuration
+
+If your server is behind a load balancer, reverse proxy, or CDN (like Cloudflare), you need to configure trusted proxies for accurate rate limiting. Without this, the rate limiter uses the direct connection IP which may be your proxy's IP.
+
+**Configuration (wp-config.php):**
+
+```php
+// For Cloudflare (includes all Cloudflare IP ranges)
+define('WC_LICENSE_TRUSTED_PROXIES', 'CLOUDFLARE');
+
+// For specific proxy IPs
+define('WC_LICENSE_TRUSTED_PROXIES', '10.0.0.1,10.0.0.2');
+
+// For CIDR ranges
+define('WC_LICENSE_TRUSTED_PROXIES', '10.0.0.0/8,192.168.1.0/24');
+
+// Combine multiple methods
+define('WC_LICENSE_TRUSTED_PROXIES', 'CLOUDFLARE,10.0.0.1');
+```
+
+**Note**: Only configure trusted proxies if you actually use them. Without this configuration, rate limiting is more secure against IP spoofing attacks.
+
+### Configurable Rate Limiting
+
+The default rate limit is 30 requests per 60 seconds. You can customize this:
+
+```php
+// Requests allowed per window (default: 30)
+define('WC_LICENSE_RATE_LIMIT', 60);
+
+// Window duration in seconds (default: 60)
+define('WC_LICENSE_RATE_WINDOW', 120);
+```
+
 ## REST API
 
 Full API documentation available in `openapi.json` (OpenAPI 3.1 specification).
 
-### Client Examples
+### Response Signing (Optional)
 
-Ready-to-use API client examples are available in `docs/client-examples/`:
+When the server is configured with a shared secret, all API responses include cryptographic signatures for tamper protection:
+
+**Configuration (wp-config.php):**
+
+```php
+define('WC_LICENSE_SERVER_SECRET', 'your-secure-random-string-min-32-chars');
+```
+
+Generate a secure secret using:
+
+```bash
+openssl rand -hex 32
+```
+
+**Response Headers:**
+
+| Header | Description |
+| ------ | ----------- |
+| `X-License-Signature` | HMAC-SHA256 signature of the response body |
+| `X-License-Timestamp` | Unix timestamp when the response was generated |
+
+The signature prevents man-in-the-middle attacks and ensures response integrity. Use the `magdev/wc-licensed-product-client` Composer package with the `SecureLicenseClient` class to automatically verify signatures.
+
+**Per-License Customer Secrets**: Each customer receives a unique verification secret derived from their license key. This secret is displayed in their account page under "API Verification Secret" and can be used with the client library instead of sharing the master server secret.
+
+### Client Libraries & Examples
+
+**PHP (Recommended):** Install the official client library via Composer:
+
+```bash
+composer require magdev/wc-licensed-product-client
+```
+
+The library provides:
+
+- `LicenseClient` - Standard client for API calls
+- `SecureLicenseClient` - Client with automatic response signature verification
+
+**Example clients** for other languages are available in `docs/client-examples/`:
 
 - **cURL** - Shell script examples ([curl.sh](docs/client-examples/curl.sh))
-- **PHP** - Client class with examples ([php-client.php](docs/client-examples/php-client.php))
+- **PHP** - Standalone client example ([php-client.php](docs/client-examples/php-client.php))
 - **Python** - Client class with dataclasses ([python-client.py](docs/client-examples/python-client.py))
 - **JavaScript** - Browser and Node.js client ([javascript-client.js](docs/client-examples/javascript-client.js))
 - **C#** - Async client with System.Text.Json ([csharp-client.cs](docs/client-examples/csharp-client.cs))
@@ -226,11 +349,12 @@ Content-Type: application/json
 
 ## Email Notifications
 
-The plugin sends automatic email notifications:
+The plugin sends automatic email notifications (configurable via WooCommerce > Settings > Emails):
 
 - **Order Completion**: License keys included in order confirmation emails
 - **Expiration Warning (7 days)**: Reminder sent 7 days before expiration
 - **Expiration Warning (1 day)**: Urgent reminder sent 1 day before expiration
+- **License Expired**: Notification when a license auto-expires
 
 ## Changelog
 

assets/css/admin.css

@@ -50,15 +50,21 @@ code.file-hash {
     color: #666;
 }
 
-/* License Product Tab */
-#woocommerce-product-data .show_if_licensed {
-    display: block !important;
+/* License Settings Tab - Hidden by default, shown via JS based on product type */
+/* WooCommerce creates tab with class: {tab_key}_options (licensed_product_options) */
+#woocommerce-product-data ul.wc-tabs li.licensed_product_options {
+    display: none;
 }
 
-#woocommerce-product-data .hide_if_licensed {
-    display: none !important;
+/* When shown, restore proper display for tab list items */
+#woocommerce-product-data ul.wc-tabs li.licensed_product_options.wclp-active {
+    display: block;
 }
 
+/* Variations tab visibility for licensed-variable is handled by WooCommerce */
+/* We add show_if_licensed-variable class to the variations tab via PHP filter */
+
+
 /* Action Buttons */
 .wp-list-table .button-link-delete {
     color: #a00;
@@ -167,6 +173,19 @@ code.file-hash {
     display: none;
 }
 
+/* Version download link - keep filename and icon on single line */
+.version-download-link {
+    display: inline-flex;
+    align-items: center;
+    white-space: nowrap;
+}
+
+.version-download-link .dashicons-media-archive {
+    color: #2271b1;
+    flex-shrink: 0;
+    margin-left: 5px;
+}
+
 #versions-table .dashicons-media-archive {
     color: #2271b1;
     vertical-align: middle;
@@ -188,7 +207,8 @@ code.file-hash {
 }
 
 .licenses-table .row-actions {
-    visibility: visible;
+    visibility: visible !important;
+    position: static !important;
     padding: 2px 0 0;
 }
 

assets/css/frontend.css

@@ -37,13 +37,270 @@
     color: #383d41;
 }
 
-/* License Cards */
+/* Filter Form */
+.wclp-filter-form {
+    margin-bottom: 1.5em;
+    padding: 1em;
+    background-color: #f8f9fa;
+    border: 1px solid #e5e5e5;
+    border-radius: 8px;
+}
+
+.wclp-filter-row {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 1em;
+    align-items: flex-end;
+}
+
+.wclp-filter-field {
+    display: flex;
+    flex-direction: column;
+    gap: 0.3em;
+    flex: 1;
+    min-width: 150px;
+}
+
+.wclp-filter-field label {
+    font-size: 0.85em;
+    font-weight: 600;
+    color: #666;
+}
+
+.wclp-filter-field select {
+    width: 100%;
+    padding: 0.5em 0.75em;
+    border: 1px solid #ddd;
+    border-radius: 4px;
+    background-color: #fff;
+    font-size: 0.95em;
+}
+
+.wclp-filter-field select:focus {
+    border-color: #0073aa;
+    outline: none;
+    box-shadow: 0 0 0 1px #0073aa;
+}
+
+.wclp-filter-actions {
+    display: flex;
+    gap: 0.5em;
+}
+
+.wclp-filter-actions .button {
+    padding: 0.5em 1em;
+    font-size: 0.95em;
+    white-space: nowrap;
+}
+
+@media (max-width: 600px) {
+    .wclp-filter-row {
+        flex-direction: column;
+    }
+
+    .wclp-filter-field {
+        min-width: 100%;
+    }
+
+    .wclp-filter-actions {
+        width: 100%;
+    }
+
+    .wclp-filter-actions .button {
+        flex: 1;
+    }
+}
+
+/* License Packages */
 .woocommerce-licenses {
     display: flex;
     flex-direction: column;
     gap: 1.5em;
 }
 
+.license-package {
+    border: 1px solid #e5e5e5;
+    border-radius: 8px;
+    overflow: hidden;
+    background: #fff;
+}
+
+.package-header {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    padding: 1em 1.5em;
+    background: #f8f9fa;
+    border-bottom: 1px solid #e5e5e5;
+}
+
+.package-title {
+    display: flex;
+    flex-direction: column;
+    gap: 0.25em;
+}
+
+.package-title h3 {
+    margin: 0;
+    font-size: 1.1em;
+}
+
+.package-title h3 a {
+    color: inherit;
+    text-decoration: none;
+}
+
+.package-title h3 a:hover {
+    text-decoration: underline;
+}
+
+.package-order {
+    font-size: 0.85em;
+    color: #666;
+}
+
+.package-order a {
+    color: #2271b1;
+    text-decoration: none;
+}
+
+.package-order a:hover {
+    text-decoration: underline;
+}
+
+.package-license-count {
+    font-size: 0.9em;
+    color: #666;
+    background: #e9ecef;
+    padding: 0.3em 0.8em;
+    border-radius: 12px;
+}
+
+/* Package Licenses - Two Row Layout */
+.package-licenses {
+    padding: 0;
+}
+
+.license-entry {
+    padding: 1em 1.5em;
+    border-bottom: 1px solid #e5e5e5;
+}
+
+.license-entry:last-child {
+    border-bottom: none;
+}
+
+.license-entry:hover {
+    background-color: #fafafa;
+}
+
+.license-row-primary {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 1em;
+    margin-bottom: 0.5em;
+}
+
+.license-key-group {
+    display: flex;
+    align-items: center;
+    gap: 0.75em;
+    flex-shrink: 1;
+    min-width: 0;
+}
+
+.license-entry code.license-key {
+    font-family: 'SF Mono', Monaco, Consolas, monospace;
+    background-color: #f5f5f5;
+    padding: 0.4em 0.75em;
+    border-radius: 4px;
+    font-size: 0.95em;
+    letter-spacing: 0.03em;
+    flex-shrink: 1;
+    min-width: 0;
+    overflow: hidden;
+    text-overflow: ellipsis;
+}
+
+.license-key-group .license-status {
+    flex-shrink: 0;
+}
+
+.license-actions {
+    display: flex;
+    align-items: center;
+    gap: 0.5em;
+    flex-shrink: 0;
+}
+
+.license-row-secondary {
+    display: flex;
+    align-items: center;
+    gap: 1.5em;
+    font-size: 0.9em;
+    color: #666;
+    flex-wrap: wrap;
+}
+
+.license-meta-item {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.35em;
+}
+
+.license-meta-item .dashicons {
+    font-size: 14px;
+    width: 14px;
+    height: 14px;
+    color: #999;
+}
+
+.license-domain {
+    color: #333;
+}
+
+.license-expiry .lifetime {
+    color: #28a745;
+    font-weight: 500;
+}
+
+/* Legacy table styles (kept for backwards compatibility) */
+.licenses-table {
+    width: 100%;
+    border-collapse: collapse;
+    font-size: 0.95em;
+}
+
+.licenses-table th,
+.licenses-table td {
+    padding: 0.75em 1em;
+    text-align: left;
+    border-bottom: 1px solid #e5e5e5;
+}
+
+.licenses-table th {
+    font-weight: 600;
+    background-color: #fafafa;
+    font-size: 0.9em;
+    color: #555;
+}
+
+.licenses-table code.license-key {
+    font-family: 'SF Mono', Monaco, Consolas, monospace;
+    background-color: #f5f5f5;
+    padding: 0.3em 0.6em;
+    border-radius: 4px;
+    font-size: 0.9em;
+    letter-spacing: 0.03em;
+}
+
+.licenses-table .lifetime {
+    color: #28a745;
+    font-weight: 500;
+}
+
+/* Legacy single card styles (kept for backwards compatibility) */
 .license-card {
     border: 1px solid #e5e5e5;
     border-radius: 8px;
@@ -184,12 +441,14 @@
 }
 
 /* Download Section */
+.package-downloads,
 .license-downloads {
     padding: 1em 1.5em;
     background: #f8f9fa;
     border-top: 1px solid #e5e5e5;
 }
 
+.package-downloads h4,
 .license-downloads h4 {
     margin: 0 0 0.75em 0;
     font-size: 0.95em;
@@ -202,18 +461,30 @@
     padding: 0;
 }
 
-.download-list li {
+.download-list li.download-item {
     display: flex;
-    align-items: center;
-    gap: 1em;
-    padding: 0.5em 0;
+    flex-direction: column;
+    gap: 0.35em;
+    padding: 0.75em 0;
     border-bottom: 1px solid #eee;
 }
 
-.download-list li:last-child {
+.download-list li.download-item:last-child {
     border-bottom: none;
 }
 
+.download-row-file {
+    display: flex;
+    align-items: center;
+}
+
+.download-row-meta {
+    display: flex;
+    align-items: center;
+    gap: 1em;
+    padding-left: 1.5em;
+}
+
 .download-link {
     display: inline-flex;
     align-items: center;
@@ -244,7 +515,6 @@
 .download-date {
     color: #999;
     font-size: 0.85em;
-    margin-left: auto;
 }
 
 .download-hash {
@@ -271,6 +541,71 @@
     color: #666;
 }
 
+/* Latest version badge */
+.download-version-badge {
+    display: inline-block;
+    padding: 0.15em 0.5em;
+    margin-left: 0.5em;
+    font-size: 0.75em;
+    font-weight: 600;
+    text-transform: uppercase;
+    background: #d4edda;
+    color: #155724;
+    border-radius: 3px;
+    vertical-align: middle;
+}
+
+/* Older versions collapsible */
+.older-versions-section {
+    margin-top: 0.75em;
+    padding-top: 0.75em;
+    border-top: 1px dashed #ddd;
+}
+
+.older-versions-toggle {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.35em;
+    padding: 0.4em 0.75em;
+    background: transparent;
+    border: 1px solid #ddd;
+    border-radius: 4px;
+    font-size: 0.85em;
+    color: #666;
+    cursor: pointer;
+    transition: all 0.2s ease;
+}
+
+.older-versions-toggle:hover {
+    background: #f5f5f5;
+    border-color: #ccc;
+    color: #333;
+}
+
+.older-versions-toggle .dashicons {
+    font-size: 16px;
+    width: 16px;
+    height: 16px;
+    transition: transform 0.2s ease;
+}
+
+.older-versions-toggle[aria-expanded="true"] .dashicons {
+    transform: rotate(180deg);
+}
+
+.older-versions-list {
+    margin-top: 0.75em;
+    padding-left: 0;
+}
+
+.older-versions-list .download-item {
+    opacity: 0.85;
+}
+
+.older-versions-list .download-item:hover {
+    opacity: 1;
+}
+
 /* Domain Field */
 #licensed-product-domain-field {
     margin-top: 2em;
@@ -322,6 +657,52 @@
 
 /* Responsive */
 @media screen and (max-width: 768px) {
+    /* Package header responsive */
+    .package-header {
+        flex-direction: column;
+        align-items: flex-start;
+        gap: 0.75em;
+    }
+
+    .package-license-count {
+        align-self: flex-start;
+    }
+
+    /* License entry responsive */
+    .license-entry {
+        padding: 1em;
+    }
+
+    .license-row-primary {
+        flex-direction: column;
+        align-items: flex-start;
+        gap: 0.75em;
+    }
+
+    .license-key-group {
+        flex-direction: column;
+        align-items: flex-start;
+        gap: 0.5em;
+        width: 100%;
+    }
+
+    .license-entry code.license-key {
+        font-size: 0.85em;
+        word-break: break-all;
+        white-space: normal;
+    }
+
+    .license-actions {
+        align-self: flex-start;
+    }
+
+    .license-row-secondary {
+        flex-direction: column;
+        align-items: flex-start;
+        gap: 0.5em;
+    }
+
+    /* Legacy card layout responsive */
     .license-header {
         flex-direction: column;
         align-items: flex-start;
@@ -338,42 +719,49 @@
         gap: 0.5em;
     }
 
-    .download-list li {
+    .download-row-meta {
+        padding-left: 0;
         flex-wrap: wrap;
     }
 
-    .download-date {
-        margin-left: 0;
-        width: 100%;
-    }
-
+    /* Legacy table responsive */
     .woocommerce-licenses-table,
     .woocommerce-licenses-table thead,
     .woocommerce-licenses-table tbody,
     .woocommerce-licenses-table th,
     .woocommerce-licenses-table td,
-    .woocommerce-licenses-table tr {
+    .woocommerce-licenses-table tr,
+    .licenses-table,
+    .licenses-table thead,
+    .licenses-table tbody,
+    .licenses-table th,
+    .licenses-table td,
+    .licenses-table tr {
         display: block;
     }
 
-    .woocommerce-licenses-table thead tr {
+    .woocommerce-licenses-table thead tr,
+    .licenses-table thead tr {
         position: absolute;
         top: -9999px;
         left: -9999px;
     }
 
-    .woocommerce-licenses-table tr {
+    .woocommerce-licenses-table tr,
+    .licenses-table tr {
         border: 1px solid #e5e5e5;
         margin-bottom: 1em;
     }
 
-    .woocommerce-licenses-table td {
+    .woocommerce-licenses-table td,
+    .licenses-table td {
         border: none;
         position: relative;
         padding-left: 50%;
     }
 
-    .woocommerce-licenses-table td:before {
+    .woocommerce-licenses-table td:before,
+    .licenses-table td:before {
         content: attr(data-title);
         position: absolute;
         left: 0.75em;
@@ -528,3 +916,139 @@
     color: #721c24;
     border: 1px solid #f5c6cb;
 }
+
+/* Product Version Display (Single Product Page) */
+.wclp-product-version {
+    margin: 0.5em 0 1em 0;
+    font-size: 0.95em;
+    color: #666;
+}
+
+.wclp-product-version .version-label {
+    font-weight: 500;
+    color: #555;
+}
+
+.wclp-product-version .version-number {
+    font-family: 'SF Mono', Monaco, Consolas, monospace;
+    background: #e7f3ff;
+    padding: 0.15em 0.5em;
+    border-radius: 3px;
+    color: #2271b1;
+    font-weight: 500;
+}
+
+/* Customer Secret Section */
+.license-row-secret {
+    margin-top: 0.75em;
+    padding-top: 0.75em;
+    border-top: 1px dashed #e5e5e5;
+}
+
+.secret-toggle {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.35em;
+    padding: 0.4em 0.75em;
+    background: transparent;
+    border: 1px solid #ddd;
+    border-radius: 4px;
+    font-size: 0.85em;
+    color: #666;
+    cursor: pointer;
+    transition: all 0.2s ease;
+}
+
+.secret-toggle:hover {
+    background: #f5f5f5;
+    border-color: #ccc;
+    color: #333;
+}
+
+.secret-toggle .dashicons {
+    font-size: 14px;
+    width: 14px;
+    height: 14px;
+}
+
+.secret-toggle .toggle-arrow {
+    transition: transform 0.2s ease;
+}
+
+.secret-toggle[aria-expanded="true"] .toggle-arrow {
+    transform: rotate(180deg);
+}
+
+.secret-content {
+    margin-top: 0.75em;
+    padding: 1em;
+    background: #f8f9fa;
+    border-radius: 4px;
+    border: 1px solid #e5e5e5;
+}
+
+.secret-description {
+    margin: 0 0 0.75em 0;
+    font-size: 0.85em;
+    color: #666;
+}
+
+.secret-value-wrapper {
+    display: flex;
+    align-items: center;
+    gap: 0.5em;
+}
+
+.secret-value {
+    font-family: 'SF Mono', Monaco, Consolas, monospace;
+    font-size: 0.75em;
+    background: #fff;
+    padding: 0.5em 0.75em;
+    border: 1px solid #ddd;
+    border-radius: 4px;
+    word-break: break-all;
+    flex: 1;
+    min-width: 0;
+    overflow-x: auto;
+}
+
+.copy-secret-btn {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    width: 32px;
+    height: 32px;
+    padding: 0;
+    background: #f0f0f0;
+    border: 1px solid #ddd;
+    border-radius: 4px;
+    cursor: pointer;
+    transition: all 0.2s ease;
+    flex-shrink: 0;
+}
+
+.copy-secret-btn:hover {
+    background: #e5e5e5;
+    border-color: #ccc;
+}
+
+.copy-secret-btn .dashicons {
+    font-size: 18px;
+    width: 18px;
+    height: 18px;
+}
+
+@media screen and (max-width: 768px) {
+    .secret-value-wrapper {
+        flex-direction: column;
+        align-items: stretch;
+    }
+
+    .secret-value {
+        font-size: 0.7em;
+    }
+
+    .copy-secret-btn {
+        align-self: flex-start;
+    }
+}

assets/js/checkout-blocks.js

@@ -1,7 +1,8 @@
 /**
  * WooCommerce Checkout Blocks Integration
  *
- * Adds a domain field to the checkout block for licensed products.
+ * Adds domain fields to the checkout block for licensed products.
+ * Supports single domain mode (legacy) and multi-domain mode (per quantity).
  *
  * @package WcLicensedProduct
  */
@@ -9,92 +10,518 @@
 (function () {
     'use strict';
 
-    const { registerCheckoutBlock } = wc.blocksCheckout;
-    const { createElement, useState, useEffect } = wp.element;
+    // Check dependencies
+    if (typeof wc === 'undefined' ||
+        typeof wc.blocksCheckout === 'undefined' ||
+        typeof wc.wcSettings === 'undefined') {
+        return;
+    }
+
+    const { getSetting } = wc.wcSettings;
+    const { createElement, useState, useEffect, useCallback } = wp.element;
     const { TextControl } = wp.components;
     const { __ } = wp.i18n;
-    const { extensionCartUpdate } = wc.blocksCheckout;
-    const { getSetting } = wc.wcSettings;
 
-    // Get settings passed from PHP
+    // Get available exports from blocksCheckout
+    const { ExperimentalOrderMeta, extensionCartUpdate } = wc.blocksCheckout;
+
+    // Debounce function for API updates
+    function debounce(func, wait) {
+        let timeout;
+        return function executedFunction(...args) {
+            const later = () => {
+                clearTimeout(timeout);
+                func(...args);
+            };
+            clearTimeout(timeout);
+            timeout = setTimeout(later, wait);
+        };
+    }
+
+    // Get settings from PHP
     const settings = getSetting('wc-licensed-product_data', {});
 
+    // Check if we have licensed products
+    if (!settings.hasLicensedProducts) {
+        return;
+    }
+
     /**
      * Validate domain format
      */
     function isValidDomain(domain) {
-        if (!domain || domain.length > 255) {
-            return false;
-        }
+        if (!domain || domain.length > 255) return false;
         const pattern = /^([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/;
         return pattern.test(domain);
     }
 
     /**
-     * Normalize domain (remove protocol and www)
+     * Normalize domain
      */
     function normalizeDomain(domain) {
-        let normalized = domain.toLowerCase().trim();
-        normalized = normalized.replace(/^https?:\/\//, '');
-        normalized = normalized.replace(/^www\./, '');
-        normalized = normalized.replace(/\/.*$/, '');
-        return normalized;
+        return domain.toLowerCase().trim()
+            .replace(/^https?:\/\//, '')
+            .replace(/^www\./, '')
+            .replace(/\/.*$/, '');
     }
 
     /**
-     * License Domain Block Component
+     * Single Domain Component
      */
-    const LicenseDomainBlock = ({ checkoutExtensionData, extensions }) => {
+    const SingleDomainField = () => {
         const [domain, setDomain] = useState('');
         const [error, setError] = useState('');
-        const { setExtensionData } = checkoutExtensionData;
 
-        // Only show if cart has licensed products
-        if (!settings.hasLicensedProducts) {
-            return null;
+        // Debounced API update function
+        const updateStoreApi = useCallback(
+            debounce((normalizedDomain) => {
+                if (extensionCartUpdate) {
+                    extensionCartUpdate({
+                        namespace: 'wc-licensed-product',
+                        data: {
+                            licensed_product_domain: normalizedDomain,
+                        },
+                    }).catch(err => {
+                        console.error('[WCLP] Store API update error:', err);
+                    });
                 }
+            }, 500),
+            []
+        );
 
         const handleChange = (value) => {
             const normalized = normalizeDomain(value);
             setDomain(normalized);
 
-            // Validate
             if (normalized && !isValidDomain(normalized)) {
                 setError(settings.validationError || __('Please enter a valid domain.', 'wc-licensed-product'));
             } else {
                 setError('');
+                // Update Store API when valid
+                updateStoreApi(normalized);
             }
 
-            // Update extension data for server-side processing
-            setExtensionData('wc-licensed-product', 'licensed_product_domain', normalized);
+            // Store in hidden input for form submission (fallback)
+            const hiddenInput = document.getElementById('wclp-domain-hidden');
+            if (hiddenInput) {
+                hiddenInput.value = normalized;
+            }
         };
 
         return createElement(
             'div',
-            { className: 'wc-block-components-licensed-product-domain' },
-            createElement(
-                'h3',
-                { className: 'wc-block-components-title' },
+            {
+                className: 'wc-block-components-licensed-product-domain',
+                style: {
+                    padding: '16px',
+                    backgroundColor: '#f0f0f0',
+                    borderRadius: '4px',
+                    marginBottom: '16px',
+                }
+            },
+            createElement('h4', { style: { marginTop: 0, marginBottom: '8px' } },
                 settings.sectionTitle || __('License Domain', 'wc-licensed-product')
             ),
+            createElement('p', { style: { marginBottom: '12px', color: '#666', fontSize: '0.9em' } },
+                settings.fieldDescription || __('Enter the domain where you will use the license.', 'wc-licensed-product')
+            ),
             createElement(TextControl, {
-                label: settings.fieldLabel || __('Domain for License Activation', 'wc-licensed-product'),
+                label: settings.singleDomainLabel || __('Domain', 'wc-licensed-product'),
                 value: domain,
                 onChange: handleChange,
                 placeholder: settings.fieldPlaceholder || 'example.com',
-                help: error || settings.fieldDescription || __('Enter the domain where you will use this license.', 'wc-licensed-product'),
+                help: error || '',
                 className: error ? 'has-error' : '',
-                required: true,
+            }),
+            createElement('input', {
+                type: 'hidden',
+                id: 'wclp-domain-hidden',
+                name: 'wclp_license_domain',
+                value: domain,
             })
         );
     };
 
-    // Register the checkout block
-    registerCheckoutBlock({
-        metadata: {
-            name: 'wc-licensed-product/domain-field',
-            parent: ['woocommerce/checkout-contact-information-block'],
-        },
-        component: LicenseDomainBlock,
+    /**
+     * Get unique key for product (handles variations)
+     */
+    function getProductKey(product) {
+        if (product.variation_id && product.variation_id > 0) {
+            return `${product.product_id}_${product.variation_id}`;
+        }
+        return String(product.product_id);
+    }
+
+    /**
+     * Multi-Domain Component
+     */
+    const MultiDomainFields = () => {
+        const products = settings.licensedProducts || [];
+        const [domains, setDomains] = useState(() => {
+            const init = {};
+            products.forEach(p => {
+                const key = getProductKey(p);
+                init[key] = Array(p.quantity).fill('');
             });
+            return init;
+        });
+        const [errors, setErrors] = useState({});
+
+        // Debounced API update function
+        const updateStoreApi = useCallback(
+            debounce((domainsData) => {
+                if (extensionCartUpdate) {
+                    extensionCartUpdate({
+                        namespace: 'wc-licensed-product',
+                        data: {
+                            licensed_product_domains: domainsData,
+                        },
+                    }).catch(err => {
+                        console.error('[WCLP] Store API update error:', err);
+                    });
+                }
+            }, 500),
+            []
+        );
+
+        if (!products.length) {
+            return null;
+        }
+
+        const handleChange = (productKey, index, value) => {
+            const normalized = normalizeDomain(value);
+            const newDomains = { ...domains };
+            if (!newDomains[productKey]) newDomains[productKey] = [];
+            newDomains[productKey] = [...newDomains[productKey]];
+            newDomains[productKey][index] = normalized;
+            setDomains(newDomains);
+
+            // Validate
+            const key = `${productKey}_${index}`;
+            const newErrors = { ...errors };
+            if (normalized && !isValidDomain(normalized)) {
+                newErrors[key] = settings.validationError || __('Please enter a valid domain.', 'wc-licensed-product');
+            } else {
+                delete newErrors[key];
+            }
+
+            // Check for duplicates within same product/variation
+            const productDomains = newDomains[productKey].filter(d => d);
+            const uniqueDomains = new Set(productDomains.map(d => normalizeDomain(d)));
+            if (productDomains.length !== uniqueDomains.size) {
+                const seen = new Set();
+                newDomains[productKey].forEach((d, idx) => {
+                    const normalizedD = normalizeDomain(d);
+                    const dupKey = `${productKey}_${idx}`;
+                    if (normalizedD && seen.has(normalizedD)) {
+                        newErrors[dupKey] = settings.duplicateError || __('Each license requires a unique domain.', 'wc-licensed-product');
+                    } else if (normalizedD) {
+                        seen.add(normalizedD);
+                    }
+                });
+            }
+
+            setErrors(newErrors);
+
+            // Build domain data for Store API
+            const data = products.map(p => {
+                const pKey = getProductKey(p);
+                const doms = newDomains[pKey] || [];
+                const entry = {
+                    product_id: p.product_id,
+                    domains: doms.filter(d => d),
+                };
+                if (p.variation_id && p.variation_id > 0) {
+                    entry.variation_id = p.variation_id;
+                }
+                return entry;
+            }).filter(item => item.domains.length > 0);
+
+            // Update Store API
+            updateStoreApi(data);
+
+            // Update hidden field (fallback)
+            const hiddenInput = document.getElementById('wclp-domains-hidden');
+            if (hiddenInput) {
+                hiddenInput.value = JSON.stringify(data);
+            }
+        };
+
+        return createElement(
+            'div',
+            {
+                className: 'wc-block-components-licensed-product-domains',
+                style: {
+                    padding: '16px',
+                    backgroundColor: '#f0f0f0',
+                    borderRadius: '4px',
+                    marginBottom: '16px',
+                }
+            },
+            createElement('h4', { style: { marginTop: 0, marginBottom: '8px' } },
+                settings.sectionTitle || __('License Domains', 'wc-licensed-product')
+            ),
+            createElement('p', { style: { marginBottom: '12px', color: '#666', fontSize: '0.9em' } },
+                settings.fieldDescription || __('Enter a unique domain for each license.', 'wc-licensed-product')
+            ),
+            products.map(product => {
+                const productKey = getProductKey(product);
+                const durationLabel = product.duration_label || '';
+                const displayName = durationLabel
+                    ? `${product.name} (${durationLabel})`
+                    : product.name;
+
+                return createElement(
+                    'div',
+                    {
+                        key: productKey,
+                        style: {
+                            marginBottom: '16px',
+                            padding: '12px',
+                            backgroundColor: '#fff',
+                            borderRadius: '4px',
+                        }
+                    },
+                    createElement('strong', { style: { display: 'block', marginBottom: '8px' } },
+                        displayName + (product.quantity > 1 ? ` ×${product.quantity}` : '')
+                    ),
+                    Array.from({ length: product.quantity }, (_, i) => {
+                        const key = `${productKey}_${i}`;
+                        return createElement(
+                            'div',
+                            { key: i, style: { marginBottom: '8px' } },
+                            createElement(TextControl, {
+                                label: (settings.licenseLabel || __('License %d:', 'wc-licensed-product')).replace('%d', i + 1),
+                                value: domains[productKey]?.[i] || '',
+                                onChange: (val) => handleChange(productKey, i, val),
+                                placeholder: settings.fieldPlaceholder || 'example.com',
+                                help: errors[key] || '',
+                            })
+                        );
+                    })
+                );
+            }),
+            createElement('input', {
+                type: 'hidden',
+                id: 'wclp-domains-hidden',
+                name: 'wclp_license_domains',
+                value: '',
+            })
+        );
+    };
+
+    /**
+     * Main License Domains Block
+     */
+    const LicenseDomainsBlock = () => {
+        if (settings.isMultiDomainEnabled) {
+            return createElement(MultiDomainFields);
+        }
+        return createElement(SingleDomainField);
+    };
+
+    // Register using ExperimentalOrderMeta slot
+    if (ExperimentalOrderMeta) {
+        const { registerPlugin } = wp.plugins || {};
+
+        if (registerPlugin) {
+            registerPlugin('wc-licensed-product-domain-fields', {
+                render: () => {
+                    return createElement(
+                        ExperimentalOrderMeta,
+                        {},
+                        createElement(LicenseDomainsBlock)
+                    );
+                },
+                scope: 'woocommerce-checkout',
+            });
+        }
+    }
+
+    // Fallback: inject into DOM directly if React approach fails
+    setTimeout(function() {
+        const existingComponent = document.querySelector('.wc-block-components-licensed-product-domain, .wc-block-components-licensed-product-domains');
+        if (existingComponent) {
+            return;
+        }
+
+        const checkoutForm = document.querySelector('.wc-block-checkout, .wc-block-checkout__form, form.checkout');
+        if (!checkoutForm) {
+            return;
+        }
+
+        const contactInfo = document.querySelector('.wc-block-checkout__contact-fields, .wp-block-woocommerce-checkout-contact-information-block');
+        const paymentMethods = document.querySelector('.wc-block-checkout__payment-method, .wp-block-woocommerce-checkout-payment-block');
+
+        let insertionPoint = contactInfo || paymentMethods;
+        if (!insertionPoint) {
+            insertionPoint = checkoutForm.querySelector('.wc-block-components-form');
+        }
+
+        if (!insertionPoint) {
+            return;
+        }
+
+        const container = document.createElement('div');
+        container.id = 'wclp-domain-fields-container';
+        container.className = 'wc-block-components-licensed-product-wrapper';
+        container.style.cssText = 'margin: 20px 0; padding: 16px; background: #f0f0f0; border-radius: 4px;';
+
+        // Helper function to create elements with text content (XSS-safe)
+        function createEl(tag, textContent, styles) {
+            var el = document.createElement(tag);
+            if (textContent) el.textContent = textContent;
+            if (styles) el.style.cssText = styles;
+            return el;
+        }
+
+        if (settings.isMultiDomainEnabled && settings.licensedProducts) {
+            // Build header safely using DOM methods
+            var header = createEl('h4', settings.sectionTitle || 'License Domains', 'margin: 0 0 8px 0;');
+            container.appendChild(header);
+
+            var desc = createEl('p', settings.fieldDescription || 'Enter a unique domain for each license.',
+                'margin-bottom: 12px; color: #666; font-size: 0.9em;');
+            container.appendChild(desc);
+
+            // Build product sections
+            settings.licensedProducts.forEach(function(product) {
+                var productKey = product.variation_id && product.variation_id > 0
+                    ? product.product_id + '_' + product.variation_id
+                    : String(product.product_id);
+                var durationLabel = product.duration_label || '';
+                var displayName = durationLabel
+                    ? product.name + ' (' + durationLabel + ')'
+                    : product.name;
+
+                var productDiv = createEl('div', null, 'margin-bottom: 16px; padding: 12px; background: #fff; border-radius: 4px;');
+
+                var nameEl = createEl('strong', displayName + (product.quantity > 1 ? ' ×' + product.quantity : ''),
+                    'display: block; margin-bottom: 8px;');
+                productDiv.appendChild(nameEl);
+
+                // Create input fields for each quantity
+                for (var i = 0; i < product.quantity; i++) {
+                    var fieldDiv = createEl('div', null, 'margin-bottom: 8px;');
+
+                    var label = createEl('label', (settings.licenseLabel || 'License %d:').replace('%d', i + 1),
+                        'display: block; margin-bottom: 4px;');
+                    fieldDiv.appendChild(label);
+
+                    var input = document.createElement('input');
+                    input.type = 'text';
+                    input.name = 'licensed_domains[' + productKey + '][' + i + ']';
+                    input.placeholder = settings.fieldPlaceholder || 'example.com';
+                    input.style.cssText = 'width: 100%; padding: 8px; border: 1px solid #ccc; border-radius: 4px;';
+                    fieldDiv.appendChild(input);
+
+                    // Hidden variation ID if applicable
+                    if (product.variation_id && product.variation_id > 0) {
+                        var hiddenInput = document.createElement('input');
+                        hiddenInput.type = 'hidden';
+                        hiddenInput.name = 'licensed_variation_ids[' + productKey + ']';
+                        hiddenInput.value = String(product.variation_id);
+                        fieldDiv.appendChild(hiddenInput);
+                    }
+
+                    productDiv.appendChild(fieldDiv);
+                }
+
+                container.appendChild(productDiv);
+            });
+        } else {
+            // Single domain mode - build safely using DOM methods
+            var header = createEl('h4', settings.sectionTitle || 'License Domain', 'margin: 0 0 8px 0;');
+            container.appendChild(header);
+
+            var desc = createEl('p', settings.fieldDescription || 'Enter the domain where you will use the license.',
+                'margin-bottom: 12px; color: #666; font-size: 0.9em;');
+            container.appendChild(desc);
+
+            var fieldDiv = createEl('div', null, 'margin-bottom: 8px;');
+
+            var label = createEl('label', settings.singleDomainLabel || 'Domain', 'display: block; margin-bottom: 4px;');
+            fieldDiv.appendChild(label);
+
+            var input = document.createElement('input');
+            input.type = 'text';
+            input.name = 'licensed_product_domain';
+            input.placeholder = settings.fieldPlaceholder || 'example.com';
+            input.style.cssText = 'width: 100%; padding: 8px; border: 1px solid #ccc; border-radius: 4px;';
+            fieldDiv.appendChild(input);
+
+            container.appendChild(fieldDiv);
+        }
+
+        if (contactInfo) {
+            contactInfo.parentNode.insertBefore(container, contactInfo.nextSibling);
+        } else if (paymentMethods) {
+            paymentMethods.parentNode.insertBefore(container, paymentMethods);
+        } else {
+            insertionPoint.appendChild(container);
+        }
+
+        // Add event listeners to sync with Store API
+        const debouncedUpdate = debounce(function() {
+            if (!extensionCartUpdate) {
+                return;
+            }
+
+            if (settings.isMultiDomainEnabled && settings.licensedProducts) {
+                // Collect multi-domain data
+                const domainsData = settings.licensedProducts.map(function(product) {
+                    const productKey = product.variation_id && product.variation_id > 0
+                        ? product.product_id + '_' + product.variation_id
+                        : String(product.product_id);
+
+                    const domains = [];
+                    for (let i = 0; i < product.quantity; i++) {
+                        const input = container.querySelector('input[name="licensed_domains[' + productKey + '][' + i + ']"]');
+                        if (input && input.value.trim()) {
+                            domains.push(normalizeDomain(input.value));
+                        }
+                    }
+
+                    const entry = {
+                        product_id: product.product_id,
+                        domains: domains,
+                    };
+                    if (product.variation_id && product.variation_id > 0) {
+                        entry.variation_id = product.variation_id;
+                    }
+                    return entry;
+                }).filter(function(item) { return item.domains.length > 0; });
+
+                extensionCartUpdate({
+                    namespace: 'wc-licensed-product',
+                    data: {
+                        licensed_product_domains: domainsData,
+                    },
+                }).catch(function(err) {
+                    console.error('[WCLP] Store API update error:', err);
+                });
+            } else {
+                // Single domain
+                const input = container.querySelector('input[name="licensed_product_domain"]');
+                if (input) {
+                    const domain = normalizeDomain(input.value);
+                    extensionCartUpdate({
+                        namespace: 'wc-licensed-product',
+                        data: {
+                            licensed_product_domain: domain,
+                        },
+                    }).catch(function(err) {
+                        console.error('[WCLP] Store API update error:', err);
+                    });
+                }
+            }
+        }, 500);
+
+        // Attach event listeners to all domain inputs
+        container.querySelectorAll('input[type="text"]').forEach(function(input) {
+            input.addEventListener('input', debouncedUpdate);
+            input.addEventListener('change', debouncedUpdate);
+        });
+    }, 2000);
+
 })();

assets/js/frontend.js

@@ -11,6 +11,14 @@
         $modal: null,
         $form: null,
 
+        /**
+         * Sanitize a value for safe use in jQuery selectors
+         * License IDs should be numeric only
+         */
+        sanitizeForSelector: function(value) {
+            return String(value).replace(/[^\d]/g, '');
+        },
+
         init: function() {
             this.$modal = $('#wclp-transfer-modal');
             this.$form = $('#wclp-transfer-form');
@@ -19,12 +27,19 @@
 
         bindEvents: function() {
             $(document).on('click', '.copy-license-btn', this.copyLicenseKey);
+            $(document).on('click', '.copy-secret-btn', this.copySecret);
 
             // Transfer modal events
             $(document).on('click', '.wclp-transfer-btn', this.openTransferModal.bind(this));
             $(document).on('click', '.wclp-modal-close, .wclp-modal-cancel, .wclp-modal-overlay', this.closeTransferModal.bind(this));
             $(document).on('submit', '#wclp-transfer-form', this.submitTransfer.bind(this));
 
+            // Older versions toggle
+            $(document).on('click', '.older-versions-toggle', this.toggleOlderVersions);
+
+            // Secret toggle
+            $(document).on('click', '.secret-toggle', this.toggleSecret);
+
             // Close modal on escape key
             $(document).on('keyup', function(e) {
                 if (e.key === 'Escape') {
@@ -33,6 +48,61 @@
             });
         },
 
+        /**
+         * Toggle older versions visibility
+         */
+        toggleOlderVersions: function(e) {
+            e.preventDefault();
+
+            var $btn = $(this);
+            var $list = $btn.siblings('.older-versions-list');
+            var isExpanded = $btn.attr('aria-expanded') === 'true';
+
+            $btn.attr('aria-expanded', !isExpanded);
+            $list.slideToggle(200);
+        },
+
+        /**
+         * Toggle secret visibility
+         */
+        toggleSecret: function(e) {
+            e.preventDefault();
+
+            var $btn = $(this);
+            var $content = $btn.siblings('.secret-content');
+            var isExpanded = $btn.attr('aria-expanded') === 'true';
+
+            $btn.attr('aria-expanded', !isExpanded);
+            $content.slideToggle(200);
+        },
+
+        /**
+         * Copy secret to clipboard
+         */
+        copySecret: function(e) {
+            e.preventDefault();
+
+            var $btn = $(this);
+            var secret = $btn.data('secret');
+
+            if (!secret) {
+                return;
+            }
+
+            // Use modern clipboard API if available
+            if (navigator.clipboard && navigator.clipboard.writeText) {
+                navigator.clipboard.writeText(secret)
+                    .then(function() {
+                        WCLicensedProductFrontend.showCopyFeedback($btn, true);
+                    })
+                    .catch(function() {
+                        WCLicensedProductFrontend.fallbackCopy(secret, $btn);
+                    });
+            } else {
+                WCLicensedProductFrontend.fallbackCopy(secret, $btn);
+            }
+        },
+
         /**
          * Copy license key to clipboard
          */
@@ -109,6 +179,11 @@
             var licenseId = $btn.data('license-id');
             var currentDomain = $btn.data('current-domain');
 
+            // Validate license ID is numeric
+            if (!licenseId || !/^\d+$/.test(String(licenseId))) {
+                return;
+            }
+
             $('#transfer-license-id').val(licenseId);
             $('#transfer-current-domain').text(currentDomain);
             $('#transfer-new-domain').val('');
@@ -173,9 +248,12 @@
                             .removeClass('error').addClass('success').show();
 
                         // Update the domain display in the license card
-                        var $domainDisplay = $('.license-domain-display[data-license-id="' + licenseId + '"]');
+                        var safeLicenseId = self.sanitizeForSelector(licenseId);
+                        if (safeLicenseId) {
+                            var $domainDisplay = $('.license-domain-display[data-license-id="' + safeLicenseId + '"]');
                             $domainDisplay.find('.domain-value').text(response.data.new_domain);
                             $domainDisplay.find('.wclp-transfer-btn').data('current-domain', response.data.new_domain);
+                        }
 
                         // Close modal after a short delay
                         setTimeout(function() {

assets/js/order-licenses.js

@@ -16,6 +16,9 @@
             // Order domain save
             $('#wclp-save-order-domain').on('click', this.saveOrderDomain.bind(this));
 
+            // Generate licenses button
+            $(document).on('click', '#wclp-generate-licenses', this.generateLicenses.bind(this));
+
             // License domain edit/save/cancel
             $(document).on('click', '.wclp-edit-domain-btn', this.startEditDomain);
             $(document).on('click', '.wclp-save-domain-btn', this.saveLicenseDomain.bind(this));
@@ -135,6 +138,54 @@
             $editBtn.show();
         },
 
+        /**
+         * Generate licenses for order
+         */
+        generateLicenses: function(e) {
+            e.preventDefault();
+
+            var $btn = $(e.currentTarget);
+            var $spinner = $btn.siblings('.spinner');
+            var $status = $btn.siblings('.wclp-generate-status');
+
+            var orderId = $btn.data('order-id');
+
+            $btn.prop('disabled', true);
+            $spinner.addClass('is-active');
+            $status.text('').removeClass('success error');
+
+            $.ajax({
+                url: wclpOrderLicenses.ajaxUrl,
+                type: 'POST',
+                data: {
+                    action: 'wclp_generate_order_licenses',
+                    nonce: wclpOrderLicenses.nonce,
+                    order_id: orderId
+                },
+                success: function(response) {
+                    if (response.success) {
+                        $status.text(response.data.message).addClass('success');
+                        if (response.data.reload) {
+                            // Reload the page after a short delay to show the new licenses
+                            setTimeout(function() {
+                                window.location.reload();
+                            }, 1500);
+                        }
+                    } else {
+                        $status.text(response.data.message || wclpOrderLicenses.strings.error).addClass('error');
+                        $btn.prop('disabled', false);
+                    }
+                },
+                error: function() {
+                    $status.text(wclpOrderLicenses.strings.error).addClass('error');
+                    $btn.prop('disabled', false);
+                },
+                complete: function() {
+                    $spinner.removeClass('is-active');
+                }
+            });
+        },
+
         /**
          * Save license domain
          */

assets/js/versions.js

@@ -174,6 +174,24 @@
             });
         },
 
+        /**
+         * Compare two semantic version strings
+         * Returns: positive if a > b, negative if a < b, 0 if equal
+         */
+        compareVersions: function(a, b) {
+            var partsA = a.split('.').map(Number);
+            var partsB = b.split('.').map(Number);
+
+            for (var i = 0; i < 3; i++) {
+                var numA = partsA[i] || 0;
+                var numB = partsB[i] || 0;
+                if (numA !== numB) {
+                    return numA - numB;
+                }
+            }
+            return 0;
+        },
+
         /**
          * Extract version from filename
          * Supports patterns like: plugin-v1.2.3.zip, plugin-1.2.3.zip, v1.2.3.zip
@@ -244,8 +262,23 @@
                             // Remove "no versions" row if present
                             $('#versions-table tbody .no-versions').remove();
 
-                            // Add new row to table
-                            $('#versions-table tbody').prepend(response.data.html);
+                            // Add new row in sorted position (by version DESC)
+                            var $newRow = $(response.data.html);
+                            var newVersion = (response.data.version && response.data.version.version) || version;
+                            var inserted = false;
+
+                            $('#versions-table tbody tr').each(function() {
+                                var rowVersion = $(this).find('td:first strong').text();
+                                if (self.compareVersions(newVersion, rowVersion) > 0) {
+                                    $newRow.insertBefore($(this));
+                                    inserted = true;
+                                    return false; // break
+                                }
+                            });
+
+                            if (!inserted) {
+                                $('#versions-table tbody').append($newRow);
+                            }
 
                             // Clear form
                             $('#new_version').val('');

composer.json

@@ -10,9 +10,16 @@
             "homepage": "https://src.bundespruefstelle.ch/magdev"
         }
     ],
+    "repositories": [
+        {
+            "type": "vcs",
+            "url": "https://src.bundespruefstelle.ch/magdev/wc-licensed-product-client.git"
+        }
+    ],
     "require": {
         "php": ">=8.3.0",
-        "twig/twig": "^3.0"
+        "twig/twig": "^3.0",
+        "magdev/wc-licensed-product-client": "dev-main"
     },
     "autoload": {
         "psr-4": {

composer.lock

@@ -4,8 +4,313 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "3b63b77b19677953867f471c141fee05",
+    "content-hash": "05af8ab515abe7e689c610724b54e27a",
     "packages": [
+        {
+            "name": "magdev/wc-licensed-product-client",
+            "version": "dev-main",
+            "source": {
+                "type": "git",
+                "url": "https://src.bundespruefstelle.ch/magdev/wc-licensed-product-client.git",
+                "reference": "56abe8a97c72419c07a6daf263ba6f4a9b5fe4b1"
+            },
+            "require": {
+                "php": "^8.3",
+                "psr/cache": "^3.0",
+                "psr/http-client": "^1.0",
+                "psr/log": "^3.0",
+                "symfony/http-client": "^7.0"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^11.0"
+            },
+            "default-branch": true,
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "Magdev\\WcLicensedProductClient\\": "src/"
+                }
+            },
+            "autoload-dev": {
+                "psr-4": {
+                    "Magdev\\WcLicensedProductClient\\Tests\\": "tests/"
+                }
+            },
+            "license": [
+                "GPL-2.0-or-later"
+            ],
+            "authors": [
+                {
+                    "name": "Marco Graetsch",
+                    "email": "magdev3.0@gmail.com",
+                    "homepage": "https://src.bundespruefstelle.ch/magdev"
+                }
+            ],
+            "description": "Client library for WooCommerce Licensed Product Plugin - Activate, validate and check the status of licenses via REST API",
+            "homepage": "https://src.bundespruefstelle.ch/magdev/wc-licensed-product-client",
+            "support": {
+                "issues": "https://src.bundespruefstelle.ch/magdev/wc-licensed-product-client/issues",
+                "source": "https://src.bundespruefstelle.ch/magdev/wc-licensed-product-client"
+            },
+            "time": "2026-01-28T10:56:47+00:00"
+        },
+        {
+            "name": "psr/cache",
+            "version": "3.0.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/php-fig/cache.git",
+                "reference": "aa5030cfa5405eccfdcb1083ce040c2cb8d253bf"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/php-fig/cache/zipball/aa5030cfa5405eccfdcb1083ce040c2cb8d253bf",
+                "reference": "aa5030cfa5405eccfdcb1083ce040c2cb8d253bf",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.0.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "1.0.x-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "Psr\\Cache\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "PHP-FIG",
+                    "homepage": "https://www.php-fig.org/"
+                }
+            ],
+            "description": "Common interface for caching libraries",
+            "keywords": [
+                "cache",
+                "psr",
+                "psr-6"
+            ],
+            "support": {
+                "source": "https://github.com/php-fig/cache/tree/3.0.0"
+            },
+            "time": "2021-02-03T23:26:27+00:00"
+        },
+        {
+            "name": "psr/container",
+            "version": "2.0.2",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/php-fig/container.git",
+                "reference": "c71ecc56dfe541dbd90c5360474fbc405f8d5963"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/php-fig/container/zipball/c71ecc56dfe541dbd90c5360474fbc405f8d5963",
+                "reference": "c71ecc56dfe541dbd90c5360474fbc405f8d5963",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.4.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "2.0.x-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "Psr\\Container\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "PHP-FIG",
+                    "homepage": "https://www.php-fig.org/"
+                }
+            ],
+            "description": "Common Container Interface (PHP FIG PSR-11)",
+            "homepage": "https://github.com/php-fig/container",
+            "keywords": [
+                "PSR-11",
+                "container",
+                "container-interface",
+                "container-interop",
+                "psr"
+            ],
+            "support": {
+                "issues": "https://github.com/php-fig/container/issues",
+                "source": "https://github.com/php-fig/container/tree/2.0.2"
+            },
+            "time": "2021-11-05T16:47:00+00:00"
+        },
+        {
+            "name": "psr/http-client",
+            "version": "1.0.3",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/php-fig/http-client.git",
+                "reference": "bb5906edc1c324c9a05aa0873d40117941e5fa90"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/php-fig/http-client/zipball/bb5906edc1c324c9a05aa0873d40117941e5fa90",
+                "reference": "bb5906edc1c324c9a05aa0873d40117941e5fa90",
+                "shasum": ""
+            },
+            "require": {
+                "php": "^7.0 || ^8.0",
+                "psr/http-message": "^1.0 || ^2.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "1.0.x-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "Psr\\Http\\Client\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "PHP-FIG",
+                    "homepage": "https://www.php-fig.org/"
+                }
+            ],
+            "description": "Common interface for HTTP clients",
+            "homepage": "https://github.com/php-fig/http-client",
+            "keywords": [
+                "http",
+                "http-client",
+                "psr",
+                "psr-18"
+            ],
+            "support": {
+                "source": "https://github.com/php-fig/http-client"
+            },
+            "time": "2023-09-23T14:17:50+00:00"
+        },
+        {
+            "name": "psr/http-message",
+            "version": "2.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/php-fig/http-message.git",
+                "reference": "402d35bcb92c70c026d1a6a9883f06b2ead23d71"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/php-fig/http-message/zipball/402d35bcb92c70c026d1a6a9883f06b2ead23d71",
+                "reference": "402d35bcb92c70c026d1a6a9883f06b2ead23d71",
+                "shasum": ""
+            },
+            "require": {
+                "php": "^7.2 || ^8.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "2.0.x-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "Psr\\Http\\Message\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "PHP-FIG",
+                    "homepage": "https://www.php-fig.org/"
+                }
+            ],
+            "description": "Common interface for HTTP messages",
+            "homepage": "https://github.com/php-fig/http-message",
+            "keywords": [
+                "http",
+                "http-message",
+                "psr",
+                "psr-7",
+                "request",
+                "response"
+            ],
+            "support": {
+                "source": "https://github.com/php-fig/http-message/tree/2.0"
+            },
+            "time": "2023-04-04T09:54:51+00:00"
+        },
+        {
+            "name": "psr/log",
+            "version": "3.0.2",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/php-fig/log.git",
+                "reference": "f16e1d5863e37f8d8c2a01719f5b34baa2b714d3"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/php-fig/log/zipball/f16e1d5863e37f8d8c2a01719f5b34baa2b714d3",
+                "reference": "f16e1d5863e37f8d8c2a01719f5b34baa2b714d3",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.0.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "3.x-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "Psr\\Log\\": "src"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "PHP-FIG",
+                    "homepage": "https://www.php-fig.org/"
+                }
+            ],
+            "description": "Common interface for logging libraries",
+            "homepage": "https://github.com/php-fig/log",
+            "keywords": [
+                "log",
+                "psr",
+                "psr-3"
+            ],
+            "support": {
+                "source": "https://github.com/php-fig/log/tree/3.0.2"
+            },
+            "time": "2024-09-11T13:17:53+00:00"
+        },
         {
             "name": "symfony/deprecation-contracts",
             "version": "v3.6.0",
@@ -73,6 +378,185 @@
             ],
             "time": "2024-09-25T14:21:43+00:00"
         },
+        {
+            "name": "symfony/http-client",
+            "version": "v7.4.5",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/symfony/http-client.git",
+                "reference": "84bb634857a893cc146cceb467e31b3f02c5fe9f"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/symfony/http-client/zipball/84bb634857a893cc146cceb467e31b3f02c5fe9f",
+                "reference": "84bb634857a893cc146cceb467e31b3f02c5fe9f",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.2",
+                "psr/log": "^1|^2|^3",
+                "symfony/deprecation-contracts": "^2.5|^3",
+                "symfony/http-client-contracts": "~3.4.4|^3.5.2",
+                "symfony/polyfill-php83": "^1.29",
+                "symfony/service-contracts": "^2.5|^3"
+            },
+            "conflict": {
+                "amphp/amp": "<2.5",
+                "amphp/socket": "<1.1",
+                "php-http/discovery": "<1.15",
+                "symfony/http-foundation": "<6.4"
+            },
+            "provide": {
+                "php-http/async-client-implementation": "*",
+                "php-http/client-implementation": "*",
+                "psr/http-client-implementation": "1.0",
+                "symfony/http-client-implementation": "3.0"
+            },
+            "require-dev": {
+                "amphp/http-client": "^4.2.1|^5.0",
+                "amphp/http-tunnel": "^1.0|^2.0",
+                "guzzlehttp/promises": "^1.4|^2.0",
+                "nyholm/psr7": "^1.0",
+                "php-http/httplug": "^1.0|^2.0",
+                "psr/http-client": "^1.0",
+                "symfony/amphp-http-client-meta": "^1.0|^2.0",
+                "symfony/cache": "^6.4|^7.0|^8.0",
+                "symfony/dependency-injection": "^6.4|^7.0|^8.0",
+                "symfony/http-kernel": "^6.4|^7.0|^8.0",
+                "symfony/messenger": "^6.4|^7.0|^8.0",
+                "symfony/process": "^6.4|^7.0|^8.0",
+                "symfony/rate-limiter": "^6.4|^7.0|^8.0",
+                "symfony/stopwatch": "^6.4|^7.0|^8.0"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "Symfony\\Component\\HttpClient\\": ""
+                },
+                "exclude-from-classmap": [
+                    "/Tests/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Nicolas Grekas",
+                    "email": "p@tchwork.com"
+                },
+                {
+                    "name": "Symfony Community",
+                    "homepage": "https://symfony.com/contributors"
+                }
+            ],
+            "description": "Provides powerful methods to fetch HTTP resources synchronously or asynchronously",
+            "homepage": "https://symfony.com",
+            "keywords": [
+                "http"
+            ],
+            "support": {
+                "source": "https://github.com/symfony/http-client/tree/v7.4.5"
+            },
+            "funding": [
+                {
+                    "url": "https://symfony.com/sponsor",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/fabpot",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/nicolas-grekas",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2026-01-27T16:16:02+00:00"
+        },
+        {
+            "name": "symfony/http-client-contracts",
+            "version": "v3.6.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/symfony/http-client-contracts.git",
+                "reference": "75d7043853a42837e68111812f4d964b01e5101c"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/symfony/http-client-contracts/zipball/75d7043853a42837e68111812f4d964b01e5101c",
+                "reference": "75d7043853a42837e68111812f4d964b01e5101c",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.1"
+            },
+            "type": "library",
+            "extra": {
+                "thanks": {
+                    "url": "https://github.com/symfony/contracts",
+                    "name": "symfony/contracts"
+                },
+                "branch-alias": {
+                    "dev-main": "3.6-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "Symfony\\Contracts\\HttpClient\\": ""
+                },
+                "exclude-from-classmap": [
+                    "/Test/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Nicolas Grekas",
+                    "email": "p@tchwork.com"
+                },
+                {
+                    "name": "Symfony Community",
+                    "homepage": "https://symfony.com/contributors"
+                }
+            ],
+            "description": "Generic abstractions related to HTTP clients",
+            "homepage": "https://symfony.com",
+            "keywords": [
+                "abstractions",
+                "contracts",
+                "decoupling",
+                "interfaces",
+                "interoperability",
+                "standards"
+            ],
+            "support": {
+                "source": "https://github.com/symfony/http-client-contracts/tree/v3.6.0"
+            },
+            "funding": [
+                {
+                    "url": "https://symfony.com/sponsor",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/fabpot",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2025-04-29T11:18:49+00:00"
+        },
         {
             "name": "symfony/polyfill-ctype",
             "version": "v1.33.0",
@@ -242,17 +726,184 @@
             "time": "2024-12-23T08:48:59+00:00"
         },
         {
-            "name": "twig/twig",
-            "version": "v3.22.2",
+            "name": "symfony/polyfill-php83",
+            "version": "v1.33.0",
             "source": {
                 "type": "git",
-                "url": "https://github.com/twigphp/Twig.git",
-                "reference": "946ddeafa3c9f4ce279d1f34051af041db0e16f2"
+                "url": "https://github.com/symfony/polyfill-php83.git",
+                "reference": "17f6f9a6b1735c0f163024d959f700cfbc5155e5"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/twigphp/Twig/zipball/946ddeafa3c9f4ce279d1f34051af041db0e16f2",
-                "reference": "946ddeafa3c9f4ce279d1f34051af041db0e16f2",
+                "url": "https://api.github.com/repos/symfony/polyfill-php83/zipball/17f6f9a6b1735c0f163024d959f700cfbc5155e5",
+                "reference": "17f6f9a6b1735c0f163024d959f700cfbc5155e5",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.2"
+            },
+            "type": "library",
+            "extra": {
+                "thanks": {
+                    "url": "https://github.com/symfony/polyfill",
+                    "name": "symfony/polyfill"
+                }
+            },
+            "autoload": {
+                "files": [
+                    "bootstrap.php"
+                ],
+                "psr-4": {
+                    "Symfony\\Polyfill\\Php83\\": ""
+                },
+                "classmap": [
+                    "Resources/stubs"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Nicolas Grekas",
+                    "email": "p@tchwork.com"
+                },
+                {
+                    "name": "Symfony Community",
+                    "homepage": "https://symfony.com/contributors"
+                }
+            ],
+            "description": "Symfony polyfill backporting some PHP 8.3+ features to lower PHP versions",
+            "homepage": "https://symfony.com",
+            "keywords": [
+                "compatibility",
+                "polyfill",
+                "portable",
+                "shim"
+            ],
+            "support": {
+                "source": "https://github.com/symfony/polyfill-php83/tree/v1.33.0"
+            },
+            "funding": [
+                {
+                    "url": "https://symfony.com/sponsor",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/fabpot",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/nicolas-grekas",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2025-07-08T02:45:35+00:00"
+        },
+        {
+            "name": "symfony/service-contracts",
+            "version": "v3.6.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/symfony/service-contracts.git",
+                "reference": "45112560a3ba2d715666a509a0bc9521d10b6c43"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/symfony/service-contracts/zipball/45112560a3ba2d715666a509a0bc9521d10b6c43",
+                "reference": "45112560a3ba2d715666a509a0bc9521d10b6c43",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.1",
+                "psr/container": "^1.1|^2.0",
+                "symfony/deprecation-contracts": "^2.5|^3"
+            },
+            "conflict": {
+                "ext-psr": "<1.1|>=2"
+            },
+            "type": "library",
+            "extra": {
+                "thanks": {
+                    "url": "https://github.com/symfony/contracts",
+                    "name": "symfony/contracts"
+                },
+                "branch-alias": {
+                    "dev-main": "3.6-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "Symfony\\Contracts\\Service\\": ""
+                },
+                "exclude-from-classmap": [
+                    "/Test/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Nicolas Grekas",
+                    "email": "p@tchwork.com"
+                },
+                {
+                    "name": "Symfony Community",
+                    "homepage": "https://symfony.com/contributors"
+                }
+            ],
+            "description": "Generic abstractions related to writing services",
+            "homepage": "https://symfony.com",
+            "keywords": [
+                "abstractions",
+                "contracts",
+                "decoupling",
+                "interfaces",
+                "interoperability",
+                "standards"
+            ],
+            "support": {
+                "source": "https://github.com/symfony/service-contracts/tree/v3.6.1"
+            },
+            "funding": [
+                {
+                    "url": "https://symfony.com/sponsor",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/fabpot",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/nicolas-grekas",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2025-07-15T11:30:57+00:00"
+        },
+        {
+            "name": "twig/twig",
+            "version": "v3.23.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/twigphp/Twig.git",
+                "reference": "a64dc5d2cc7d6cafb9347f6cd802d0d06d0351c9"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/twigphp/Twig/zipball/a64dc5d2cc7d6cafb9347f6cd802d0d06d0351c9",
+                "reference": "a64dc5d2cc7d6cafb9347f6cd802d0d06d0351c9",
                 "shasum": ""
             },
             "require": {
@@ -306,7 +957,7 @@
             ],
             "support": {
                 "issues": "https://github.com/twigphp/Twig/issues",
-                "source": "https://github.com/twigphp/Twig/tree/v3.22.2"
+                "source": "https://github.com/twigphp/Twig/tree/v3.23.0"
             },
             "funding": [
                 {
@@ -318,13 +969,15 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2025-12-14T11:28:47+00:00"
+            "time": "2026-01-23T21:00:41+00:00"
         }
     ],
     "packages-dev": [],
     "aliases": [],
     "minimum-stability": "stable",
-    "stability-flags": {},
+    "stability-flags": {
+        "magdev/wc-licensed-product-client": 20
+    },
     "prefer-stable": true,
     "prefer-lowest": false,
     "platform": {

docs/server-implementation.md

@@ -8,18 +8,20 @@ The security model works as follows:
 
 1. Server generates a unique signature for each response using HMAC-SHA256
 2. Signature includes a timestamp to prevent replay attacks
-3. Client verifies the signature using a shared secret
-4. Invalid signatures cause the client to reject the response
+3. Each license key has a unique derived secret (not the master secret)
+4. Client verifies the signature using their per-license secret
+5. Invalid signatures cause the client to reject the response
 
 This prevents attackers from:
 
 - Faking valid license responses
 - Replaying old responses
 - Tampering with response data
+- Using one customer's secret to verify another customer's responses
 
 ## Requirements
 
-- PHP 7.4+ (8.0+ recommended)
+- PHP 8.3+
 - A server secret stored securely (not in version control)
 
 ## Server Configuration
@@ -49,25 +51,33 @@ php -r "echo bin2hex(random_bytes(32));"
 
 ### Key Derivation
 
-Each license key gets a unique signing key derived from the server secret:
+Each license key gets a unique signing key derived from the server secret using RFC 5869 HKDF:
 
 ```php
 /**
  * Derive a unique signing key for a license.
  *
- * @param string $licenseKey The license key
- * @param string $serverSecret The server's master secret
- * @return string The derived key (hex encoded)
+ * Uses PHP's native hash_hkdf() function per RFC 5869.
+ *
+ * @param string $licenseKey The license key (used as "info" context)
+ * @param string $serverSecret The server's master secret (used as IKM)
+ * @return string The derived key (hex encoded, 64 characters)
  */
 function derive_signing_key(string $licenseKey, string $serverSecret): string
 {
-    // HKDF-like key derivation
-    $prk = hash_hmac('sha256', $licenseKey, $serverSecret, true);
-
-    return hash_hmac('sha256', $prk . "\x01", $serverSecret);
+    // HKDF key derivation per RFC 5869
+    // IKM: server_secret, Length: 32 bytes, Info: license_key
+    return bin2hex(hash_hkdf('sha256', $serverSecret, 32, $licenseKey));
 }
 ```
 
+**Important:** This uses PHP's native `hash_hkdf()` function (available since PHP 7.1.2). The parameters are:
+
+- **Algorithm:** sha256
+- **IKM (Input Keying Material):** server_secret
+- **Length:** 32 bytes (256 bits)
+- **Info:** license_key (context-specific information)
+
 ### Response Signing
 
 Sign every API response before sending:
@@ -86,8 +96,8 @@ function sign_response(array $responseData, string $licenseKey, string $serverSe
     $timestamp = time();
     $signingKey = derive_signing_key($licenseKey, $serverSecret);
 
-    // Sort keys for consistent ordering
-    ksort($responseData);
+    // Recursively sort keys for consistent ordering (important for nested arrays!)
+    $responseData = recursive_key_sort($responseData);
 
     // Build signature payload
     $jsonBody = json_encode($responseData, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
@@ -101,6 +111,20 @@ function sign_response(array $responseData, string $licenseKey, string $serverSe
         'X-License-Timestamp' => (string) $timestamp,
     ];
 }
+
+/**
+ * Recursively sort array keys alphabetically.
+ */
+function recursive_key_sort(array $data): array
+{
+    ksort($data);
+    foreach ($data as $key => $value) {
+        if (is_array($value)) {
+            $data[$key] = recursive_key_sort($value);
+        }
+    }
+    return $data;
+}
 ```
 
 ### WordPress REST API Integration
@@ -212,7 +236,7 @@ class ResponseSigner
         $timestamp = time();
         $signingKey = $this->deriveKey($licenseKey);
 
-        ksort($data);
+        $data = $this->recursiveKeySort($data);
         $payload = $timestamp . ':' . json_encode(
             $data,
             JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE
@@ -224,11 +248,21 @@ class ResponseSigner
         ];
     }
 
+    private function recursiveKeySort(array $data): array
+    {
+        ksort($data);
+        foreach ($data as $key => $value) {
+            if (is_array($value)) {
+                $data[$key] = $this->recursiveKeySort($value);
+            }
+        }
+        return $data;
+    }
+
     private function deriveKey(string $licenseKey): string
     {
-        $prk = hash_hmac('sha256', $licenseKey, $this->serverSecret, true);
-
-        return hash_hmac('sha256', $prk . "\x01", $this->serverSecret);
+        // HKDF key derivation per RFC 5869
+        return bin2hex(hash_hkdf('sha256', $this->serverSecret, 32, $licenseKey));
     }
 }
 
@@ -260,8 +294,8 @@ signature = HMAC-SHA256(
 
 Where:
 
-- `derive_signing_key` uses HKDF-like derivation (see above)
-- `canonical_json` sorts keys alphabetically, no escaping of slashes/unicode
+- `derive_signing_key` uses RFC 5869 HKDF: `hash_hkdf('sha256', server_secret, 32, license_key)`
+- `canonical_json` recursively sorts keys alphabetically, no escaping of slashes/unicode
 - Result is hex-encoded (64 characters)
 
 ## Testing
@@ -323,13 +357,49 @@ Adjust if needed:
 $signature = new ResponseSignature($key, timestampTolerance: 600); // 10 minutes
 ```
 
+### Per-License Secrets
+
+Each customer receives a unique secret derived from their license key. This means:
+
+- Customers only know their own secret, not the master server secret
+- If one customer's secret is leaked, other customers are not affected
+- The server uses HKDF-like derivation to create unique secrets
+
+#### How Customers Get Their Secret
+
+Customers can find their per-license verification secret in their account:
+
+1. Log in to the store
+2. Go to My Account > Licenses
+3. Click "API Verification Secret" under any license
+4. Copy the 64-character hex string
+
+This secret is automatically derived from the customer's license key and the server's master secret.
+
+#### Using the Customer Secret
+
+```php
+use Magdev\WcLicensedProductClient\SecureLicenseClient;
+use Symfony\Component\HttpClient\HttpClient;
+
+// Customer uses their per-license secret (from account page)
+$client = new SecureLicenseClient(
+    httpClient: HttpClient::create(),
+    baseUrl: 'https://shop.example.com',
+    serverSecret: 'customer-secret-from-account-page', // 64 hex chars
+);
+
+$info = $client->validate('XXXX-XXXX-XXXX-XXXX', 'example.com');
+```
+
 ### Secret Key Rotation
 
 To rotate the server secret:
 
 1. Deploy new secret to server
-2. Update client configurations
-3. Old signatures become invalid immediately
+2. All per-license secrets change automatically (they're derived)
+3. Customers must copy their new secret from their account page
+4. Old signatures become invalid immediately
 
 For zero-downtime rotation, implement versioned secrets:
 

openapi.json

@@ -2,8 +2,8 @@
   "openapi": "3.1.0",
   "info": {
     "title": "WooCommerce Licensed Product API",
-    "description": "REST API for validating and managing software licenses bound to domains. This API allows external applications to validate license keys, check license status, and activate licenses on specific domains.",
-    "version": "0.0.7",
+    "description": "REST API for validating and managing software licenses bound to domains. This API allows external applications to validate license keys, check license status, and activate licenses on specific domains.\n\n## Response Signing (Optional)\n\nWhen the server is configured with `WC_LICENSE_SERVER_SECRET`, all API responses include cryptographic signatures for tamper protection:\n\n- `X-License-Signature`: HMAC-SHA256 signature of the response\n- `X-License-Timestamp`: Unix timestamp when the response was generated\n\nSignature verification prevents man-in-the-middle attacks and ensures response integrity. Use the `magdev/wc-licensed-product-client` library's `SecureLicenseClient` class to automatically verify signatures.",
+    "version": "0.6.0",
     "contact": {
       "name": "Marco Graetsch",
       "url": "https://src.bundespruefstelle.ch/magdev",
@@ -55,6 +55,14 @@
         "responses": {
           "200": {
             "description": "License is valid for the specified domain",
+            "headers": {
+              "X-License-Signature": {
+                "$ref": "#/components/headers/X-License-Signature"
+              },
+              "X-License-Timestamp": {
+                "$ref": "#/components/headers/X-License-Timestamp"
+              }
+            },
             "content": {
               "application/json": {
                 "schema": {
@@ -156,6 +164,14 @@
         "responses": {
           "200": {
             "description": "License status retrieved successfully",
+            "headers": {
+              "X-License-Signature": {
+                "$ref": "#/components/headers/X-License-Signature"
+              },
+              "X-License-Timestamp": {
+                "$ref": "#/components/headers/X-License-Timestamp"
+              }
+            },
             "content": {
               "application/json": {
                 "schema": {
@@ -221,6 +237,14 @@
         "responses": {
           "200": {
             "description": "License activated successfully or already activated",
+            "headers": {
+              "X-License-Signature": {
+                "$ref": "#/components/headers/X-License-Signature"
+              },
+              "X-License-Timestamp": {
+                "$ref": "#/components/headers/X-License-Timestamp"
+              }
+            },
             "content": {
               "application/json": {
                 "schema": {
@@ -308,6 +332,148 @@
           }
         }
       }
+    },
+    "/update-check": {
+      "post": {
+        "operationId": "checkForUpdates",
+        "summary": "Check for plugin updates",
+        "description": "Checks if a newer version of the licensed product is available. Returns WordPress-compatible update information that can be used to integrate with WordPress's native plugin update system.",
+        "tags": ["Plugin Updates"],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/UpdateCheckRequest"
+              },
+              "example": {
+                "license_key": "ABCD-1234-EFGH-5678",
+                "domain": "example.com",
+                "plugin_slug": "my-licensed-plugin",
+                "current_version": "1.0.0"
+              }
+            },
+            "application/x-www-form-urlencoded": {
+              "schema": {
+                "$ref": "#/components/schemas/UpdateCheckRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Update check completed successfully",
+            "headers": {
+              "X-License-Signature": {
+                "$ref": "#/components/headers/X-License-Signature"
+              },
+              "X-License-Timestamp": {
+                "$ref": "#/components/headers/X-License-Timestamp"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/UpdateCheckResponse"
+                },
+                "examples": {
+                  "update_available": {
+                    "summary": "Update is available",
+                    "value": {
+                      "success": true,
+                      "update_available": true,
+                      "version": "1.2.0",
+                      "slug": "my-licensed-plugin",
+                      "plugin": "my-licensed-plugin/my-licensed-plugin.php",
+                      "download_url": "https://example.com/license-download/123-456-abc123",
+                      "package": "https://example.com/license-download/123-456-abc123",
+                      "last_updated": "2026-01-27",
+                      "tested": "6.7",
+                      "requires": "6.0",
+                      "requires_php": "8.3",
+                      "changelog": "## 1.2.0\n- New feature added\n- Bug fixes",
+                      "package_hash": "sha256:abc123def456...",
+                      "name": "My Licensed Plugin",
+                      "homepage": "https://example.com/product/my-plugin"
+                    }
+                  },
+                  "no_update": {
+                    "summary": "No update available",
+                    "value": {
+                      "success": true,
+                      "update_available": false,
+                      "version": "1.0.0"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "License validation failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                },
+                "examples": {
+                  "license_invalid": {
+                    "summary": "License is not valid",
+                    "value": {
+                      "success": false,
+                      "update_available": false,
+                      "error": "license_invalid",
+                      "message": "License validation failed."
+                    }
+                  },
+                  "domain_mismatch": {
+                    "summary": "Domain mismatch",
+                    "value": {
+                      "success": false,
+                      "update_available": false,
+                      "error": "domain_mismatch",
+                      "message": "This license is not valid for this domain."
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "License or product not found",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                },
+                "examples": {
+                  "license_not_found": {
+                    "summary": "License not found",
+                    "value": {
+                      "success": false,
+                      "update_available": false,
+                      "error": "license_not_found",
+                      "message": "License not found."
+                    }
+                  },
+                  "product_not_found": {
+                    "summary": "Product not found",
+                    "value": {
+                      "success": false,
+                      "update_available": false,
+                      "error": "product_not_found",
+                      "message": "Licensed product not found."
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "429": {
+            "$ref": "#/components/responses/RateLimitExceeded"
+          }
+        }
+      }
     }
   },
   "components": {
@@ -492,6 +658,130 @@
             "description": "Seconds until rate limit resets"
           }
         }
+      },
+      "UpdateCheckRequest": {
+        "type": "object",
+        "required": ["license_key", "domain"],
+        "properties": {
+          "license_key": {
+            "type": "string",
+            "description": "The license key to validate (format: XXXX-XXXX-XXXX-XXXX)",
+            "maxLength": 64,
+            "example": "ABCD-1234-EFGH-5678"
+          },
+          "domain": {
+            "type": "string",
+            "description": "The domain the plugin is installed on",
+            "maxLength": 255,
+            "example": "example.com"
+          },
+          "plugin_slug": {
+            "type": "string",
+            "description": "The plugin slug (optional, for identification)",
+            "example": "my-licensed-plugin"
+          },
+          "current_version": {
+            "type": "string",
+            "description": "Currently installed version for comparison",
+            "example": "1.0.0"
+          }
+        }
+      },
+      "UpdateCheckResponse": {
+        "type": "object",
+        "properties": {
+          "success": {
+            "type": "boolean",
+            "description": "Whether the request was successful"
+          },
+          "update_available": {
+            "type": "boolean",
+            "description": "Whether an update is available"
+          },
+          "version": {
+            "type": "string",
+            "description": "Latest available version"
+          },
+          "slug": {
+            "type": "string",
+            "description": "Plugin slug for WordPress"
+          },
+          "plugin": {
+            "type": "string",
+            "description": "Plugin basename (slug/slug.php)"
+          },
+          "download_url": {
+            "type": "string",
+            "format": "uri",
+            "description": "Secure download URL for the update package"
+          },
+          "package": {
+            "type": "string",
+            "format": "uri",
+            "description": "Alias for download_url (WordPress compatibility)"
+          },
+          "last_updated": {
+            "type": "string",
+            "format": "date",
+            "description": "Date of the latest release"
+          },
+          "tested": {
+            "type": "string",
+            "description": "Highest WordPress version tested with"
+          },
+          "requires": {
+            "type": "string",
+            "description": "Minimum required WordPress version"
+          },
+          "requires_php": {
+            "type": "string",
+            "description": "Minimum required PHP version"
+          },
+          "changelog": {
+            "type": "string",
+            "description": "Release notes/changelog for the update"
+          },
+          "package_hash": {
+            "type": "string",
+            "description": "SHA256 hash of the package for integrity verification",
+            "example": "sha256:abc123..."
+          },
+          "name": {
+            "type": "string",
+            "description": "Product name"
+          },
+          "homepage": {
+            "type": "string",
+            "format": "uri",
+            "description": "Product homepage URL"
+          },
+          "icons": {
+            "type": "object",
+            "description": "Plugin icons for WordPress admin",
+            "properties": {
+              "1x": {
+                "type": "string",
+                "format": "uri"
+              },
+              "2x": {
+                "type": "string",
+                "format": "uri"
+              }
+            }
+          },
+          "sections": {
+            "type": "object",
+            "description": "Content sections for plugin info modal",
+            "properties": {
+              "description": {
+                "type": "string"
+              },
+              "changelog": {
+                "type": "string"
+              }
+            }
+          }
+        }
       }
     },
     "responses": {
@@ -519,6 +809,26 @@
           }
         }
       }
+    },
+    "headers": {
+      "X-License-Signature": {
+        "description": "HMAC-SHA256 signature of the response body for tamper protection. Only present when server is configured with WC_LICENSE_SERVER_SECRET. Signature format: hex-encoded HMAC-SHA256 of (timestamp + ':' + canonical_json_body) using a per-license derived key.",
+        "schema": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$",
+          "example": "a1b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef123456"
+        },
+        "required": false
+      },
+      "X-License-Timestamp": {
+        "description": "Unix timestamp when the response was generated. Used together with X-License-Signature to prevent replay attacks. Only present when server is configured with WC_LICENSE_SERVER_SECRET.",
+        "schema": {
+          "type": "string",
+          "pattern": "^[0-9]+$",
+          "example": "1737550000"
+        },
+        "required": false
+      }
     }
   },
   "tags": [
@@ -533,6 +843,10 @@
     {
       "name": "License Activation",
       "description": "Activate licenses on domains"
+    },
+    {
+      "name": "Plugin Updates",
+      "description": "Check for plugin updates via WordPress-compatible API"
     }
   ]
 }

releases/wc-licensed-product-0.3.3.sha256

@@ -0,0 +1 @@
+a06d29eabc2da08613ae13874ed152b8ea9363b8284a2e9bdda414e32777558c  wc-licensed-product-0.3.3.zip

releases/wc-licensed-product-0.3.4.sha256

@@ -0,0 +1 @@
+36a81c00eb03adf5dfa633891664d44b7e5225bf1ee594904f8acc9adec6bb47  releases/wc-licensed-product-0.3.4.zip

releases/wc-licensed-product-0.3.7.zip.sha256

@@ -0,0 +1 @@
+e93b2ab06f6d43c2179167090e07eda5db6809df6e391baece4ceba321cf33f6  wc-licensed-product-0.3.7.zip

releases/wc-licensed-product-0.3.9.zip.sha256

@@ -0,0 +1 @@
+fdb65200c368da380df0cabb3c6ac6419d5b4731cd528f630f9b432a3ba5c586  releases/wc-licensed-product-0.3.9.zip

releases/wc-licensed-product-0.4.0.zip.sha256

@@ -0,0 +1 @@
+cf8769c861d77c327f178049d5fac0d4e47679cc1a1d35c5b613e4cd3fb8674f  wc-licensed-product-0.4.0.zip

releases/wc-licensed-product-0.5.0.zip.sha256

@@ -0,0 +1 @@
+446804948e5f99d705b548061d5b78180856984c58458640a910ada8f27f5316  wc-licensed-product-0.5.0.zip

releases/wc-licensed-product-0.5.1.zip.sha256

@@ -0,0 +1 @@
+a489f0b8cfcd7d5d9b2021b7ff581b9f1a56468dfde87bbb06bb4555d11f7556  wc-licensed-product-0.5.1.zip

releases/wc-licensed-product-0.5.10.zip.sha256

@@ -0,0 +1 @@
+2bbc0655f724e201367247f0e40974ddce6d7c559987e661f2b06b43294fc99f  wc-licensed-product-0.5.10.zip

releases/wc-licensed-product-0.5.11.zip.sha256

@@ -0,0 +1 @@
+32571178bfa8f0d0a03ed05b498d5f9b3c860104393a96732e86a03b6de298d2  wc-licensed-product-0.5.11.zip

releases/wc-licensed-product-0.5.12.sha256

@@ -0,0 +1 @@
+20bb5cd453de9bca781864430ebd152c82f660b6f9fc3f09107ba03489a71d75  /home/magdev/workspaces/php/wordpress/wp-content/plugins/wc-licensed-product/releases/wc-licensed-product-0.5.12.zip

releases/wc-licensed-product-0.5.13.zip.sha256

@@ -0,0 +1 @@
+814710ad899529d0015494e4b332eace7d8e55aeda381fdf61f99274c0bf910c  wc-licensed-product-0.5.13.zip

releases/wc-licensed-product-0.5.15.sha256

@@ -0,0 +1 @@
+47407de49bae4c649644af64e87b44b32fb30eeb2d50890ff8c4bbb741059278  wc-licensed-product-0.5.15.zip

releases/wc-licensed-product-0.5.3.zip.sha256

@@ -0,0 +1 @@
+bbd0fa8888c6990a4ba00ccfb8b2189ee6ac529a34cc11a5d8d8d28518b1f6dd  wc-licensed-product-0.5.3.zip

releases/wc-licensed-product-0.5.5.zip.sha256

@@ -0,0 +1 @@
+8c37e1c68eb6031c37d35adc516a492abdbea8498bdc3e3fc7d93eda380a4fe0  wc-licensed-product-0.5.5.zip

releases/wc-licensed-product-0.5.6.zip.sha256

@@ -0,0 +1 @@
+4d35a319fe4cb4e7055bae17fc030487ca05e5e9ac905f76d0ac62002bde4336  releases/wc-licensed-product-0.5.6.zip

releases/wc-licensed-product-0.5.7.zip.sha256

@@ -0,0 +1 @@
+ceb4d57598f576f4f172153ff80df8c180ecd4dca873cf109327fc5ac718930f  wc-licensed-product-0.5.7.zip

releases/wc-licensed-product-0.5.8.zip.sha256

@@ -0,0 +1 @@
+670c2f5182ea7140ccf9533c2b4179daf7890019a244973f467f2a5c7622b9f4  wc-licensed-product-0.5.8.zip

releases/wc-licensed-product-0.5.9.zip.sha256

@@ -0,0 +1 @@
+fae77dab56cb8f46693cf44fe6a1dc38ad0526d881cab2cd1f0878b234afaa8b  wc-licensed-product-0.5.9.zip

releases/wc-licensed-product-0.6.0.zip.sha256

@@ -0,0 +1 @@
+171c8195c586b3b20bac4a806e2d698cdaaf15966e2fd6e1670ec39dac8ab027  releases/wc-licensed-product-0.6.0.zip

releases/wc-licensed-product-0.6.1.zip.sha256

@@ -0,0 +1 @@
+f1f1cbdfdd6cda7b20cbd2b88ab4697cde38d987e04cda1f52e885d7818d32f5  wc-licensed-product-0.6.1.zip

releases/wc-licensed-product-0.7.0.zip.sha256

@@ -0,0 +1 @@
+12f8452316e350273003f36bf6d7b7121a7bedc9a6964c3d0732d26318d94c18  wc-licensed-product-0.7.0.zip

src/Admin/AdminController.php

@@ -18,6 +18,21 @@ use Twig\Environment;
  */
 final class AdminController
 {
+    /**
+     * Maximum CSV file size in bytes (2MB)
+     */
+    private const MAX_IMPORT_FILE_SIZE = 2 * 1024 * 1024;
+
+    /**
+     * Maximum rows to import per file
+     */
+    private const MAX_IMPORT_ROWS = 1000;
+
+    /**
+     * Minimum time between imports in seconds (5 minutes)
+     */
+    private const IMPORT_RATE_LIMIT_WINDOW = 300;
+
     private Environment $twig;
     private LicenseManager $licenseManager;
 
@@ -61,6 +76,9 @@ final class AdminController
         add_action('wp_ajax_wclp_update_license_expiry', [$this, 'handleAjaxExpiryUpdate']);
         add_action('wp_ajax_wclp_update_license_domain', [$this, 'handleAjaxDomainUpdate']);
         add_action('wp_ajax_wclp_revoke_license', [$this, 'handleAjaxRevoke']);
+
+        // AJAX handler for license testing
+        add_action('wp_ajax_wclp_test_license', [$this, 'handleAjaxTestLicense']);
     }
 
     /**
@@ -355,6 +373,43 @@ final class AdminController
         }
     }
 
+    /**
+     * Handle AJAX license test - validates license against the API
+     */
+    public function handleAjaxTestLicense(): void
+    {
+        check_ajax_referer('wclp_inline_edit', 'nonce');
+
+        if (!current_user_can('manage_woocommerce')) {
+            wp_send_json_error(['message' => __('Permission denied.', 'wc-licensed-product')], 403);
+        }
+
+        $licenseKey = isset($_POST['license_key']) ? sanitize_text_field(wp_unslash($_POST['license_key'])) : '';
+        $domain = isset($_POST['domain']) ? sanitize_text_field(wp_unslash($_POST['domain'])) : '';
+
+        if (empty($licenseKey) || empty($domain)) {
+            wp_send_json_error(['message' => __('License key and domain are required.', 'wc-licensed-product')]);
+        }
+
+        // Validate the license using LicenseManager
+        $result = $this->licenseManager->validateLicense($licenseKey, $domain);
+
+        // Enrich result with product name for display in the popup
+        if (!empty($result['valid']) && isset($result['license'])) {
+            // Get product name
+            $productId = $result['license']['product_id'] ?? null;
+            if ($productId) {
+                $product = wc_get_product($productId);
+                $result['product_name'] = $product ? $product->get_name() : __('Unknown Product', 'wc-licensed-product');
+            }
+
+            // Flatten expires_at for easier access in JavaScript
+            $result['expires_at'] = $result['license']['expires_at'] ?? null;
+        }
+
+        wp_send_json_success($result);
+    }
+
     /**
      * Handle admin actions (update, delete licenses)
      */
@@ -545,6 +600,11 @@ final class AdminController
      */
     private function handleCsvExport(): void
     {
+        // Verify nonce for CSRF protection
+        if (!wp_verify_nonce($_GET['_wpnonce'] ?? '', 'export_licenses_csv')) {
+            wp_die(__('Security check failed.', 'wc-licensed-product'));
+        }
+
         if (!current_user_can('manage_woocommerce')) {
             wp_die(__('You do not have permission to export licenses.', 'wc-licensed-product'));
         }
@@ -608,6 +668,23 @@ final class AdminController
             exit;
         }
 
+        // Check file size limit
+        if ($file['size'] > self::MAX_IMPORT_FILE_SIZE) {
+            wp_redirect(admin_url('admin.php?page=wc-licenses&action=import_csv&import_error=size'));
+            exit;
+        }
+
+        // Check rate limit for imports
+        $lastImport = get_transient('wclp_last_csv_import_' . get_current_user_id());
+        if ($lastImport !== false && (time() - $lastImport) < self::IMPORT_RATE_LIMIT_WINDOW) {
+            $retryAfter = self::IMPORT_RATE_LIMIT_WINDOW - (time() - $lastImport);
+            wp_redirect(admin_url('admin.php?page=wc-licenses&action=import_csv&import_error=rate_limit&retry_after=' . $retryAfter));
+            exit;
+        }
+
+        // Set rate limit marker
+        set_transient('wclp_last_csv_import_' . get_current_user_id(), time(), self::IMPORT_RATE_LIMIT_WINDOW);
+
         // Read the CSV file
         $handle = fopen($file['tmp_name'], 'r');
         if (!$handle) {
@@ -634,6 +711,7 @@ final class AdminController
         $updated = 0;
         $skipped = 0;
         $errors = [];
+        $rowCount = 0;
 
         while (($row = fgetcsv($handle)) !== false) {
             // Skip empty rows
@@ -641,6 +719,24 @@ final class AdminController
                 continue;
             }
 
+            // Check row limit
+            $rowCount++;
+            if ($rowCount > self::MAX_IMPORT_ROWS) {
+                fclose($handle);
+                $this->addNotice(
+                    sprintf(
+                        /* translators: %1$d: max rows, %2$d: imported count, %3$d: updated count */
+                        __('Import stopped: Maximum of %1$d rows allowed. %2$d imported, %3$d updated.', 'wc-licensed-product'),
+                        self::MAX_IMPORT_ROWS,
+                        $imported,
+                        $updated
+                    ),
+                    'warning'
+                );
+                wp_redirect(admin_url('admin.php?page=wc-licenses&import_success=partial'));
+                exit;
+            }
+
             // Map CSV columns (expected format from export):
             // ID, License Key, Product, Product ID, Order ID, Order Number, Customer, Customer Email, Customer ID, Domain, Status, Activations, Max Activations, Expires At, Created At, Updated At
             // For import we need: License Key (or generate), Product ID, Customer ID, Domain, Status, Max Activations, Expires At
@@ -927,7 +1023,7 @@ final class AdminController
                             <span class="dashicons dashicons-admin-network"></span>
                             <?php esc_html_e('Manage Licenses', 'wc-licensed-product'); ?>
                         </a>
-                        <a href="<?php echo esc_url(admin_url('admin.php?page=wc-licenses&action=export_csv')); ?>" class="button">
+                        <a href="<?php echo esc_url(wp_nonce_url(admin_url('admin.php?page=wc-licenses&action=export_csv'), 'export_licenses_csv')); ?>" class="button">
                             <span class="dashicons dashicons-download"></span>
                             <?php esc_html_e('Export to CSV', 'wc-licensed-product'); ?>
                         </a>
@@ -1021,6 +1117,12 @@ final class AdminController
         $this->twig->addFunction(new \Twig\TwigFunction('transfer_nonce', function (): string {
             return wp_create_nonce('transfer_license');
         }));
+        $this->twig->addFunction(new \Twig\TwigFunction('export_csv_url', function (): string {
+            return wp_nonce_url(
+                admin_url('admin.php?page=wc-licenses&action=export_csv'),
+                'export_licenses_csv'
+            );
+        }));
 
         try {
             echo $this->twig->render('admin/licenses.html.twig', [
@@ -1160,7 +1262,7 @@ final class AdminController
         ?>
         <div class="wrap">
             <h1 class="wp-heading-inline"><?php esc_html_e('Licenses', 'wc-licensed-product'); ?></h1>
-            <a href="<?php echo esc_url(admin_url('admin.php?page=wc-licenses&action=export_csv')); ?>" class="page-title-action">
+            <a href="<?php echo esc_url(wp_nonce_url(admin_url('admin.php?page=wc-licenses&action=export_csv'), 'export_licenses_csv')); ?>" class="page-title-action">
                 <span class="dashicons dashicons-download" style="vertical-align: middle;"></span>
                 <?php esc_html_e('Export CSV', 'wc-licensed-product'); ?>
             </a>
@@ -1347,7 +1449,20 @@ final class AdminController
                                     </td>
                                     <td class="license-actions">
                                         <div class="row-actions">
+                                            <span class="test">
+                                                <a href="#" class="wclp-test-license-link"
+                                                   data-license-id="<?php echo esc_attr($item['license']->getId()); ?>"
+                                                   data-license-key="<?php echo esc_attr($item['license']->getLicenseKey()); ?>"
+                                                   data-domain="<?php echo esc_attr($item['license']->getDomain()); ?>"
+                                                   title="<?php esc_attr_e('Test license against API', 'wc-licensed-product'); ?>"><?php esc_html_e('Test', 'wc-licensed-product'); ?></a> |
+                                            </span>
                                             <?php if ($item['license']->getStatus() !== License::STATUS_REVOKED): ?>
+                                                <span class="transfer">
+                                                    <a href="#" class="wclp-transfer-link"
+                                                       data-license-id="<?php echo esc_attr($item['license']->getId()); ?>"
+                                                       data-current-domain="<?php echo esc_attr($item['license']->getDomain()); ?>"
+                                                       title="<?php esc_attr_e('Transfer to new domain', 'wc-licensed-product'); ?>"><?php esc_html_e('Transfer', 'wc-licensed-product'); ?></a> |
+                                                </span>
                                                 <span class="extend">
                                                     <a href="<?php echo esc_url(wp_nonce_url(
                                                         admin_url('admin.php?page=wc-licenses&action=extend&license_id=' . $item['license']->getId() . '&days=30'),
@@ -1429,8 +1544,69 @@ final class AdminController
                 </div>
             </form>
 
+            <!-- Test License Modal -->
+            <div id="wclp-test-modal" class="wclp-modal" style="display:none;">
+                <div class="wclp-modal-content">
+                    <span class="wclp-modal-close">&times;</span>
+                    <h2><?php esc_html_e('License Validation Test', 'wc-licensed-product'); ?></h2>
+                    <div class="wclp-test-info">
+                        <table class="form-table">
+                            <tr>
+                                <th scope="row"><?php esc_html_e('License Key', 'wc-licensed-product'); ?></th>
+                                <td><code id="test-license-key"></code></td>
+                            </tr>
+                            <tr>
+                                <th scope="row"><?php esc_html_e('Domain', 'wc-licensed-product'); ?></th>
+                                <td><code id="test-domain"></code></td>
+                            </tr>
+                        </table>
+                    </div>
+                    <div id="wclp-test-loading" style="display:none; text-align:center; padding:20px;">
+                        <span class="spinner is-active" style="float:none;"></span>
+                        <p><?php esc_html_e('Testing license...', 'wc-licensed-product'); ?></p>
+                    </div>
+                    <div id="wclp-test-result" style="display:none;">
+                        <div id="wclp-test-result-content"></div>
+                    </div>
+                    <p class="submit">
+                        <button type="button" class="button wclp-modal-cancel"><?php esc_html_e('Close', 'wc-licensed-product'); ?></button>
+                    </p>
+                </div>
+            </div>
+
+            <!-- Transfer Modal -->
+            <div id="wclp-transfer-modal" class="wclp-modal" style="display:none;">
+                <div class="wclp-modal-content">
+                    <span class="wclp-modal-close">&times;</span>
+                    <h2><?php esc_html_e('Transfer License to New Domain', 'wc-licensed-product'); ?></h2>
+                    <form method="post" action="<?php echo esc_url(admin_url('admin.php?page=wc-licenses')); ?>">
+                        <input type="hidden" name="action" value="transfer_license">
+                        <?php wp_nonce_field('transfer_license', '_wpnonce'); ?>
+                        <input type="hidden" name="license_id" id="transfer-license-id" value="">
+                        <table class="form-table">
+                            <tr>
+                                <th scope="row"><label><?php esc_html_e('Current Domain', 'wc-licensed-product'); ?></label></th>
+                                <td><code id="transfer-current-domain"></code></td>
+                            </tr>
+                            <tr>
+                                <th scope="row"><label for="new_domain"><?php esc_html_e('New Domain', 'wc-licensed-product'); ?></label></th>
+                                <td>
+                                    <input type="text" name="new_domain" id="transfer-new-domain" class="regular-text" placeholder="example.com" required>
+                                    <p class="description"><?php esc_html_e('Enter the new domain without http:// or www.', 'wc-licensed-product'); ?></p>
+                                </td>
+                            </tr>
+                        </table>
+                        <p class="submit">
+                            <button type="submit" class="button button-primary"><?php esc_html_e('Transfer License', 'wc-licensed-product'); ?></button>
+                            <button type="button" class="button wclp-modal-cancel"><?php esc_html_e('Cancel', 'wc-licensed-product'); ?></button>
+                        </p>
+                    </form>
+                </div>
+            </div>
+
             <script>
             (function($) {
+                // Checkbox select all
                 $('#cb-select-all-1, #cb-select-all-2').on('change', function() {
                     $('input[name="license_ids[]"]').prop('checked', this.checked);
                     $('#cb-select-all-1, #cb-select-all-2').prop('checked', this.checked);
@@ -1445,6 +1621,101 @@ final class AdminController
                         $('#bulk-action-selector').val(bottomAction);
                     }
                 });
+
+                // Transfer modal
+                var $transferModal = $('#wclp-transfer-modal');
+                $('.wclp-transfer-link').on('click', function(e) {
+                    e.preventDefault();
+                    var licenseId = $(this).data('license-id');
+                    var currentDomain = $(this).data('current-domain');
+                    $('#transfer-license-id').val(licenseId);
+                    $('#transfer-current-domain').text(currentDomain);
+                    $('#transfer-new-domain').val('');
+                    $transferModal.show();
+                });
+
+                // Test License modal
+                var $testModal = $('#wclp-test-modal');
+                var $testLoading = $('#wclp-test-loading');
+                var $testResult = $('#wclp-test-result');
+                var $testResultContent = $('#wclp-test-result-content');
+
+                $('.wclp-test-license-link').on('click', function(e) {
+                    e.preventDefault();
+                    var licenseKey = $(this).data('license-key');
+                    var domain = $(this).data('domain');
+
+                    $('#test-license-key').text(licenseKey);
+                    $('#test-domain').text(domain);
+                    $testLoading.show();
+                    $testResult.hide();
+                    $testModal.show();
+
+                    $.ajax({
+                        url: wclpAdmin.ajaxUrl,
+                        type: 'POST',
+                        data: {
+                            action: 'wclp_test_license',
+                            nonce: wclpAdmin.editNonce,
+                            license_key: licenseKey,
+                            domain: domain
+                        },
+                        success: function(response) {
+                            $testLoading.hide();
+                            if (response.success) {
+                                var result = response.data;
+                                var html = '';
+
+                                if (result.valid) {
+                                    html = '<div class="notice notice-success inline"><p><strong>✓ <?php echo esc_js(__('License is VALID', 'wc-licensed-product')); ?></strong></p></div>';
+                                    html += '<table class="widefat striped"><tbody>';
+                                    html += '<tr><th><?php echo esc_js(__('Product', 'wc-licensed-product')); ?></th><td><strong>' + escapeHtml(result.product_name || '-') + '</strong></td></tr>';
+                                    if (result.expires_at) {
+                                        html += '<tr><th><?php echo esc_js(__('Expires', 'wc-licensed-product')); ?></th><td>' + escapeHtml(result.expires_at) + '</td></tr>';
+                                    } else {
+                                        html += '<tr><th><?php echo esc_js(__('Expires', 'wc-licensed-product')); ?></th><td><span class="license-lifetime"><?php echo esc_js(__('Lifetime', 'wc-licensed-product')); ?></span></td></tr>';
+                                    }
+                                    html += '</tbody></table>';
+                                } else {
+                                    html = '<div class="notice notice-error inline"><p><strong>✗ <?php echo esc_js(__('License is INVALID', 'wc-licensed-product')); ?></strong></p></div>';
+                                    html += '<table class="widefat striped"><tbody>';
+                                    html += '<tr><th><?php echo esc_js(__('Error Code', 'wc-licensed-product')); ?></th><td><code>' + escapeHtml(result.error || 'unknown') + '</code></td></tr>';
+                                    html += '<tr><th><?php echo esc_js(__('Message', 'wc-licensed-product')); ?></th><td>' + escapeHtml(result.message || '-') + '</td></tr>';
+                                    html += '</tbody></table>';
+                                }
+
+                                $testResultContent.html(html);
+                                $testResult.show();
+                            } else {
+                                $testResultContent.html('<div class="notice notice-error inline"><p>' + escapeHtml(response.data.message || 'Error') + '</p></div>');
+                                $testResult.show();
+                            }
+                        },
+                        error: function() {
+                            $testLoading.hide();
+                            $testResultContent.html('<div class="notice notice-error inline"><p><?php echo esc_js(__('Failed to test license. Please try again.', 'wc-licensed-product')); ?></p></div>');
+                            $testResult.show();
+                        }
+                    });
+                });
+
+                // Close modals
+                $('.wclp-modal-close, .wclp-modal-cancel').on('click', function() {
+                    $(this).closest('.wclp-modal').hide();
+                });
+
+                $(window).on('click', function(e) {
+                    if ($(e.target).hasClass('wclp-modal')) {
+                        $(e.target).hide();
+                    }
+                });
+
+                function escapeHtml(text) {
+                    if (!text) return '';
+                    var div = document.createElement('div');
+                    div.textContent = text;
+                    return div.innerHTML;
+                }
             })(jQuery);
             </script>
         </div>
@@ -1480,6 +1751,21 @@ final class AdminController
                             case 'read':
                                 esc_html_e('Error reading file. Please check the file format.', 'wc-licensed-product');
                                 break;
+                            case 'size':
+                                printf(
+                                    /* translators: %s: max file size */
+                                    esc_html__('File too large. Maximum size is %s.', 'wc-licensed-product'),
+                                    esc_html(size_format(self::MAX_IMPORT_FILE_SIZE))
+                                );
+                                break;
+                            case 'rate_limit':
+                                $retryAfter = isset($_GET['retry_after']) ? absint($_GET['retry_after']) : self::IMPORT_RATE_LIMIT_WINDOW;
+                                printf(
+                                    /* translators: %d: seconds to wait */
+                                    esc_html__('Please wait %d seconds before importing again.', 'wc-licensed-product'),
+                                    $retryAfter
+                                );
+                                break;
                             default:
                                 esc_html_e('An error occurred during import.', 'wc-licensed-product');
                         }
@@ -1488,6 +1774,20 @@ final class AdminController
                 </div>
             <?php endif; ?>
 
+            <div class="notice notice-info" style="max-width: 800px;">
+                <p>
+                    <?php
+                    printf(
+                        /* translators: %1$s: max file size, %2$d: max rows, %3$d: rate limit minutes */
+                        esc_html__('Import limits: Maximum file size %1$s, maximum %2$d rows per import. You can import again after %3$d minutes.', 'wc-licensed-product'),
+                        esc_html(size_format(self::MAX_IMPORT_FILE_SIZE)),
+                        self::MAX_IMPORT_ROWS,
+                        (int) (self::IMPORT_RATE_LIMIT_WINDOW / 60)
+                    );
+                    ?>
+                </p>
+            </div>
+
             <div class="card" style="max-width: 800px; padding: 20px;">
                 <h2><?php esc_html_e('Import Licenses from CSV', 'wc-licensed-product'); ?></h2>
 

src/Admin/DashboardWidgetController.php

@@ -0,0 +1,147 @@
+<?php
+/**
+ * Dashboard Widget Controller
+ *
+ * @package Jeremias\WcLicensedProduct\Admin
+ */
+
+declare(strict_types=1);
+
+namespace Jeremias\WcLicensedProduct\Admin;
+
+use Jeremias\WcLicensedProduct\License\License;
+use Jeremias\WcLicensedProduct\License\LicenseManager;
+
+/**
+ * Handles the WordPress admin dashboard widget for license statistics
+ */
+final class DashboardWidgetController
+{
+    private LicenseManager $licenseManager;
+
+    public function __construct(LicenseManager $licenseManager)
+    {
+        $this->licenseManager = $licenseManager;
+        $this->registerHooks();
+    }
+
+    /**
+     * Register WordPress hooks
+     */
+    private function registerHooks(): void
+    {
+        add_action('wp_dashboard_setup', [$this, 'registerDashboardWidget']);
+    }
+
+    /**
+     * Register the dashboard widget
+     */
+    public function registerDashboardWidget(): void
+    {
+        if (!current_user_can('manage_woocommerce')) {
+            return;
+        }
+
+        wp_add_dashboard_widget(
+            'wclp_license_statistics',
+            __('License Statistics', 'wc-licensed-product'),
+            [$this, 'renderWidget']
+        );
+    }
+
+    /**
+     * Render the dashboard widget content
+     */
+    public function renderWidget(): void
+    {
+        $stats = $this->licenseManager->getStatistics();
+        $licensesUrl = admin_url('admin.php?page=wc-licenses');
+        ?>
+        <style>
+            .wclp-widget-stats {
+                display: grid;
+                grid-template-columns: repeat(2, 1fr);
+                gap: 12px;
+                margin-bottom: 16px;
+            }
+            .wclp-stat-card {
+                background: #f8f9fa;
+                border: 1px solid #e2e4e7;
+                border-radius: 4px;
+                padding: 12px;
+                text-align: center;
+            }
+            .wclp-stat-card.highlight {
+                border-left: 3px solid #7f54b3;
+            }
+            .wclp-stat-card.warning {
+                border-left: 3px solid #f0b849;
+            }
+            .wclp-stat-card.danger {
+                border-left: 3px solid #dc3232;
+            }
+            .wclp-stat-card.success {
+                border-left: 3px solid #46b450;
+            }
+            .wclp-stat-number {
+                font-size: 28px;
+                font-weight: 600;
+                color: #1d2327;
+                line-height: 1.2;
+            }
+            .wclp-stat-label {
+                font-size: 12px;
+                color: #646970;
+                text-transform: uppercase;
+                letter-spacing: 0.5px;
+                margin-top: 4px;
+            }
+            .wclp-widget-footer {
+                margin-top: 16px;
+                padding-top: 12px;
+                border-top: 1px solid #e2e4e7;
+                text-align: center;
+            }
+            .wclp-widget-footer a {
+                text-decoration: none;
+            }
+        </style>
+
+        <div class="wclp-widget-stats">
+            <div class="wclp-stat-card highlight">
+                <div class="wclp-stat-number"><?php echo esc_html(number_format_i18n($stats['total'])); ?></div>
+                <div class="wclp-stat-label"><?php esc_html_e('Total Licenses', 'wc-licensed-product'); ?></div>
+            </div>
+            <div class="wclp-stat-card success">
+                <div class="wclp-stat-number"><?php echo esc_html(number_format_i18n($stats['by_status'][License::STATUS_ACTIVE])); ?></div>
+                <div class="wclp-stat-label"><?php esc_html_e('Active', 'wc-licensed-product'); ?></div>
+            </div>
+            <div class="wclp-stat-card warning">
+                <div class="wclp-stat-number"><?php echo esc_html(number_format_i18n($stats['expiring_soon'])); ?></div>
+                <div class="wclp-stat-label"><?php esc_html_e('Expiring Soon', 'wc-licensed-product'); ?></div>
+            </div>
+            <div class="wclp-stat-card danger">
+                <div class="wclp-stat-number"><?php echo esc_html(number_format_i18n($stats['by_status'][License::STATUS_EXPIRED])); ?></div>
+                <div class="wclp-stat-label"><?php esc_html_e('Expired', 'wc-licensed-product'); ?></div>
+            </div>
+        </div>
+
+        <div class="wclp-widget-stats">
+            <div class="wclp-stat-card">
+                <div class="wclp-stat-number"><?php echo esc_html(number_format_i18n($stats['expiring'])); ?></div>
+                <div class="wclp-stat-label"><?php esc_html_e('Time-limited', 'wc-licensed-product'); ?></div>
+            </div>
+            <div class="wclp-stat-card">
+                <div class="wclp-stat-number"><?php echo esc_html(number_format_i18n($stats['lifetime'])); ?></div>
+                <div class="wclp-stat-label"><?php esc_html_e('Lifetime', 'wc-licensed-product'); ?></div>
+            </div>
+        </div>
+
+        <div class="wclp-widget-footer">
+            <a href="<?php echo esc_url($licensesUrl); ?>" class="button button-secondary">
+                <?php esc_html_e('View All Licenses', 'wc-licensed-product'); ?>
+            </a>
+        </div>
+        <?php
+    }
+}

src/Admin/DownloadWidgetController.php

@@ -0,0 +1,184 @@
+<?php
+/**
+ * Download Statistics Widget Controller
+ *
+ * @package Jeremias\WcLicensedProduct\Admin
+ */
+
+declare(strict_types=1);
+
+namespace Jeremias\WcLicensedProduct\Admin;
+
+use Jeremias\WcLicensedProduct\Product\VersionManager;
+
+/**
+ * Handles the WordPress admin dashboard widget for download statistics
+ */
+final class DownloadWidgetController
+{
+    private VersionManager $versionManager;
+
+    public function __construct(VersionManager $versionManager)
+    {
+        $this->versionManager = $versionManager;
+        $this->registerHooks();
+    }
+
+    /**
+     * Register WordPress hooks
+     */
+    private function registerHooks(): void
+    {
+        add_action('wp_dashboard_setup', [$this, 'registerDashboardWidget']);
+    }
+
+    /**
+     * Register the dashboard widget
+     */
+    public function registerDashboardWidget(): void
+    {
+        if (!current_user_can('manage_woocommerce')) {
+            return;
+        }
+
+        wp_add_dashboard_widget(
+            'wclp_download_statistics',
+            __('Download Statistics', 'wc-licensed-product'),
+            [$this, 'renderWidget']
+        );
+    }
+
+    /**
+     * Render the dashboard widget content
+     */
+    public function renderWidget(): void
+    {
+        $stats = $this->versionManager->getDownloadStatistics();
+        ?>
+        <style>
+            .wclp-download-widget-stats {
+                display: grid;
+                grid-template-columns: 1fr;
+                gap: 12px;
+                margin-bottom: 16px;
+            }
+            .wclp-download-stat-card {
+                background: #f8f9fa;
+                border: 1px solid #e2e4e7;
+                border-radius: 4px;
+                padding: 12px;
+                text-align: center;
+                border-left: 3px solid #2271b1;
+            }
+            .wclp-download-stat-number {
+                font-size: 32px;
+                font-weight: 600;
+                color: #1d2327;
+                line-height: 1.2;
+            }
+            .wclp-download-stat-label {
+                font-size: 12px;
+                color: #646970;
+                text-transform: uppercase;
+                letter-spacing: 0.5px;
+                margin-top: 4px;
+            }
+            .wclp-download-list {
+                margin: 0;
+                padding: 0;
+                list-style: none;
+            }
+            .wclp-download-list li {
+                display: flex;
+                justify-content: space-between;
+                align-items: center;
+                padding: 8px 0;
+                border-bottom: 1px solid #e2e4e7;
+            }
+            .wclp-download-list li:last-child {
+                border-bottom: none;
+            }
+            .wclp-download-list .product-name {
+                font-weight: 500;
+                color: #1d2327;
+                flex: 1;
+                overflow: hidden;
+                text-overflow: ellipsis;
+                white-space: nowrap;
+                margin-right: 12px;
+            }
+            .wclp-download-list .version-info {
+                font-size: 12px;
+                color: #646970;
+            }
+            .wclp-download-list .download-count {
+                background: #e7f5ff;
+                color: #0a4b78;
+                padding: 2px 8px;
+                border-radius: 10px;
+                font-size: 12px;
+                font-weight: 600;
+                white-space: nowrap;
+            }
+            .wclp-download-section-title {
+                margin: 16px 0 8px 0;
+                font-size: 13px;
+                color: #1d2327;
+                font-weight: 600;
+            }
+            .wclp-no-downloads {
+                color: #646970;
+                font-style: italic;
+                text-align: center;
+                padding: 12px 0;
+            }
+        </style>
+
+        <div class="wclp-download-widget-stats">
+            <div class="wclp-download-stat-card">
+                <div class="wclp-download-stat-number"><?php echo esc_html(number_format_i18n($stats['total'])); ?></div>
+                <div class="wclp-download-stat-label"><?php esc_html_e('Total Downloads', 'wc-licensed-product'); ?></div>
+            </div>
+        </div>
+
+        <h4 class="wclp-download-section-title">
+            <?php esc_html_e('Top Products', 'wc-licensed-product'); ?>
+        </h4>
+        <?php if (!empty($stats['by_product'])): ?>
+            <ul class="wclp-download-list">
+                <?php foreach (array_slice($stats['by_product'], 0, 5) as $product): ?>
+                    <li>
+                        <span class="product-name"><?php echo esc_html($product['product_name']); ?></span>
+                        <span class="download-count">
+                            <?php echo esc_html(number_format_i18n($product['downloads'])); ?>
+                        </span>
+                    </li>
+                <?php endforeach; ?>
+            </ul>
+        <?php else: ?>
+            <p class="wclp-no-downloads"><?php esc_html_e('No downloads yet', 'wc-licensed-product'); ?></p>
+        <?php endif; ?>
+
+        <h4 class="wclp-download-section-title">
+            <?php esc_html_e('Top Versions', 'wc-licensed-product'); ?>
+        </h4>
+        <?php if (!empty($stats['by_version'])): ?>
+            <ul class="wclp-download-list">
+                <?php foreach (array_slice($stats['by_version'], 0, 5) as $version): ?>
+                    <li>
+                        <span class="product-name">
+                            <?php echo esc_html($version['product_name']); ?>
+                            <span class="version-info">v<?php echo esc_html($version['version']); ?></span>
+                        </span>
+                        <span class="download-count">
+                            <?php echo esc_html(number_format_i18n($version['downloads'])); ?>
+                        </span>
+                    </li>
+                <?php endforeach; ?>
+            </ul>
+        <?php else: ?>
+            <p class="wclp-no-downloads"><?php esc_html_e('No downloads yet', 'wc-licensed-product'); ?></p>
+        <?php endif; ?>
+        <?php
+    }
+}

src/Admin/OrderLicenseController.php

@@ -36,6 +36,7 @@ final class OrderLicenseController
         // Handle AJAX actions
         add_action('wp_ajax_wclp_update_order_domain', [$this, 'ajaxUpdateOrderDomain']);
         add_action('wp_ajax_wclp_update_license_domain', [$this, 'ajaxUpdateLicenseDomain']);
+        add_action('wp_ajax_wclp_generate_order_licenses', [$this, 'ajaxGenerateOrderLicenses']);
 
         // Enqueue admin scripts
         add_action('admin_enqueue_scripts', [$this, 'enqueueScripts']);
@@ -82,7 +83,7 @@ final class OrderLicenseController
         $hasLicensedProduct = false;
         foreach ($order->get_items() as $item) {
             $product = $item->get_product();
-            if ($product && $product->is_type('licensed')) {
+            if ($product && $this->licenseManager->isLicensedProduct($product)) {
                 $hasLicensedProduct = true;
                 break;
             }
@@ -93,8 +94,10 @@ final class OrderLicenseController
             return;
         }
 
-        // Get order domain
-        $orderDomain = $order->get_meta('_licensed_product_domain');
+        // Check for multi-domain format first, then fall back to legacy single domain
+        $multiDomainData = $order->get_meta('_licensed_product_domains');
+        $legacyDomain = $order->get_meta('_licensed_product_domain');
+        $hasMultiDomain = !empty($multiDomainData) && is_array($multiDomainData);
 
         // Get licenses for this order
         $licenses = $this->licenseManager->getLicensesByOrder($order->get_id());
@@ -103,7 +106,25 @@ final class OrderLicenseController
         ?>
         <div class="wclp-order-licenses">
             <div class="wclp-order-domain-section">
-                <h4><?php esc_html_e('Order Domain', 'wc-licensed-product'); ?></h4>
+                <h4><?php esc_html_e('Order Domains', 'wc-licensed-product'); ?></h4>
+
+                <?php if ($hasMultiDomain): ?>
+                    <p class="description">
+                        <?php esc_html_e('Domains specified during checkout (multi-domain order).', 'wc-licensed-product'); ?>
+                    </p>
+                    <div class="wclp-multi-domain-display" style="margin-top: 10px;">
+                        <?php foreach ($multiDomainData as $item): ?>
+                            <?php
+                            $product = wc_get_product($item['product_id']);
+                            $productName = $product ? $product->get_name() : __('Unknown Product', 'wc-licensed-product');
+                            ?>
+                            <div class="wclp-product-domains-item" style="margin-bottom: 10px; padding: 10px; background: #f8f8f8; border-radius: 4px;">
+                                <strong><?php echo esc_html($productName); ?>:</strong><br>
+                                <code><?php echo esc_html(implode(', ', $item['domains'])); ?></code>
+                            </div>
+                        <?php endforeach; ?>
+                    </div>
+                <?php else: ?>
                     <p class="description">
                         <?php esc_html_e('The domain specified during checkout. Changing this will not automatically update existing license domains.', 'wc-licensed-product'); ?>
                     </p>
@@ -111,7 +132,7 @@ final class OrderLicenseController
                         <input type="text"
                                id="wclp-order-domain"
                                class="regular-text"
-                           value="<?php echo esc_attr($orderDomain); ?>"
+                               value="<?php echo esc_attr($legacyDomain); ?>"
                                data-order-id="<?php echo esc_attr($order->get_id()); ?>"
                                placeholder="<?php esc_attr_e('example.com', 'wc-licensed-product'); ?>" />
                         <button type="button" class="button" id="wclp-save-order-domain">
@@ -120,12 +141,36 @@ final class OrderLicenseController
                         <span class="spinner"></span>
                         <span class="wclp-status-message"></span>
                     </div>
+                <?php endif; ?>
             </div>
 
             <hr />
 
             <h4><?php esc_html_e('Licenses', 'wc-licensed-product'); ?></h4>
 
+            <?php
+            // Count expected licenses based on domain data
+            $expectedLicenses = 0;
+            if ($hasMultiDomain) {
+                // Multi-domain: count total domains across all products
+                foreach ($multiDomainData as $item) {
+                    if (isset($item['domains']) && is_array($item['domains'])) {
+                        $expectedLicenses += count($item['domains']);
+                    }
+                }
+            } else {
+                // Legacy: one license per licensed product
+                foreach ($order->get_items() as $item) {
+                    $product = $item->get_product();
+                    if ($product && $this->licenseManager->isLicensedProduct($product)) {
+                        $expectedLicenses++;
+                    }
+                }
+            }
+            $missingLicenses = $expectedLicenses - count($licenses);
+            $hasDomainData = $hasMultiDomain || !empty($legacyDomain);
+            ?>
+
             <?php if (empty($licenses)): ?>
                 <p class="description">
                     <?php esc_html_e('No licenses have been generated for this order yet.', 'wc-licensed-product'); ?>
@@ -137,6 +182,20 @@ final class OrderLicenseController
                         <em><?php esc_html_e('Licenses will be generated when the order is marked as paid/completed.', 'wc-licensed-product'); ?></em>
                     <?php endif; ?>
                 </p>
+                <?php if ($hasDomainData && $order->is_paid()): ?>
+                    <p style="margin-top: 10px;">
+                        <button type="button" class="button button-primary" id="wclp-generate-licenses" data-order-id="<?php echo esc_attr($order->get_id()); ?>">
+                            <?php esc_html_e('Generate Licenses', 'wc-licensed-product'); ?>
+                        </button>
+                        <span class="spinner" style="float: none; margin-top: 4px;"></span>
+                        <span class="wclp-generate-status"></span>
+                    </p>
+                <?php elseif (!$hasDomainData): ?>
+                    <p class="description" style="margin-top: 10px; color: #d63638;">
+                        <span class="dashicons dashicons-warning"></span>
+                        <?php esc_html_e('Please set the order domain above before generating licenses.', 'wc-licensed-product'); ?>
+                    </p>
+                <?php endif; ?>
             <?php else: ?>
                 <table class="widefat striped wclp-licenses-table">
                     <thead>
@@ -223,6 +282,29 @@ final class OrderLicenseController
                     );
                     ?>
                 </p>
+
+                <?php if ($missingLicenses > 0 && $hasDomainData && $order->is_paid()): ?>
+                    <p style="margin-top: 10px;">
+                        <span class="dashicons dashicons-warning" style="color: #dba617;"></span>
+                        <?php
+                        printf(
+                            /* translators: %d: Number of missing licenses */
+                            esc_html(_n(
+                                '%d licensed product is missing a license.',
+                                '%d licensed products are missing licenses.',
+                                $missingLicenses,
+                                'wc-licensed-product'
+                            )),
+                            $missingLicenses
+                        );
+                        ?>
+                        <button type="button" class="button" id="wclp-generate-licenses" data-order-id="<?php echo esc_attr($order->get_id()); ?>">
+                            <?php esc_html_e('Generate Missing Licenses', 'wc-licensed-product'); ?>
+                        </button>
+                        <span class="spinner" style="float: none; margin-top: 4px;"></span>
+                        <span class="wclp-generate-status"></span>
+                    </p>
+                <?php endif; ?>
             <?php endif; ?>
         </div>
 
@@ -248,6 +330,9 @@ final class OrderLicenseController
             .wclp-lifetime { color: #0073aa; font-weight: 500; }
             .wclp-edit-domain-btn { color: #0073aa; text-decoration: none; }
             .wclp-edit-domain-btn .dashicons { font-size: 16px; width: 16px; height: 16px; }
+            .wclp-generate-status { font-style: italic; margin-left: 8px; }
+            .wclp-generate-status.success { color: #46b450; }
+            .wclp-generate-status.error { color: #dc3232; }
         </style>
         <?php
     }
@@ -284,8 +369,9 @@ final class OrderLicenseController
             'strings' => [
                 'saving' => __('Saving...', 'wc-licensed-product'),
                 'saved' => __('Saved!', 'wc-licensed-product'),
-                'error' => __('Error saving. Please try again.', 'wc-licensed-product'),
+                'error' => __('Error. Please try again.', 'wc-licensed-product'),
                 'invalidDomain' => __('Please enter a valid domain.', 'wc-licensed-product'),
+                'generating' => __('Generating...', 'wc-licensed-product'),
             ],
         ]);
     }
@@ -392,4 +478,166 @@ final class OrderLicenseController
         $pattern = '/^([a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/';
         return (bool) preg_match($pattern, $domain);
     }
+
+    /**
+     * AJAX handler for generating order licenses
+     */
+    public function ajaxGenerateOrderLicenses(): void
+    {
+        check_ajax_referer('wclp_order_license_actions', 'nonce');
+
+        if (!current_user_can('manage_woocommerce')) {
+            wp_send_json_error(['message' => __('Permission denied.', 'wc-licensed-product')]);
+        }
+
+        $orderId = absint($_POST['order_id'] ?? 0);
+
+        if (!$orderId) {
+            wp_send_json_error(['message' => __('Invalid order ID.', 'wc-licensed-product')]);
+        }
+
+        $order = wc_get_order($orderId);
+        if (!$order) {
+            wp_send_json_error(['message' => __('Order not found.', 'wc-licensed-product')]);
+        }
+
+        // Check if order is paid
+        if (!$order->is_paid()) {
+            wp_send_json_error(['message' => __('Order must be paid before licenses can be generated.', 'wc-licensed-product')]);
+        }
+
+        // Check for multi-domain format first
+        $multiDomainData = $order->get_meta('_licensed_product_domains');
+        $legacyDomain = $order->get_meta('_licensed_product_domain');
+
+        if (!empty($multiDomainData) && is_array($multiDomainData)) {
+            // Multi-domain format
+            $result = $this->generateMultiDomainLicenses($order, $multiDomainData);
+        } elseif (!empty($legacyDomain)) {
+            // Legacy single domain format
+            $result = $this->generateLegacyLicenses($order, $legacyDomain);
+        } else {
+            wp_send_json_error(['message' => __('Please set the order domain before generating licenses.', 'wc-licensed-product')]);
+            return;
+        }
+
+        if ($result['generated'] > 0) {
+            wp_send_json_success([
+                'message' => sprintf(
+                    /* translators: %d: Number of licenses generated */
+                    _n(
+                        '%d license generated successfully.',
+                        '%d licenses generated successfully.',
+                        $result['generated'],
+                        'wc-licensed-product'
+                    ),
+                    $result['generated']
+                ),
+                'generated' => $result['generated'],
+                'skipped' => $result['skipped'],
+                'reload' => true,
+            ]);
+        } else {
+            wp_send_json_success([
+                'message' => __('All licenses already exist for this order.', 'wc-licensed-product'),
+                'generated' => 0,
+                'skipped' => $result['skipped'],
+                'reload' => false,
+            ]);
+        }
+    }
+
+    /**
+     * Generate licenses for multi-domain format
+     */
+    private function generateMultiDomainLicenses(\WC_Order $order, array $domainData): array
+    {
+        $generated = 0;
+        $skipped = 0;
+        $orderId = $order->get_id();
+        $customerId = $order->get_customer_id();
+
+        // Index domains by product ID
+        $domainsByProduct = [];
+        foreach ($domainData as $item) {
+            if (isset($item['product_id']) && isset($item['domains']) && is_array($item['domains'])) {
+                $domainsByProduct[(int) $item['product_id']] = $item['domains'];
+            }
+        }
+
+        foreach ($order->get_items() as $item) {
+            $product = $item->get_product();
+            if (!$product || !$this->licenseManager->isLicensedProduct($product)) {
+                continue;
+            }
+
+            $productId = $product->get_id();
+            $domains = $domainsByProduct[$productId] ?? [];
+
+            // Get existing licenses for this product
+            $existingLicenses = $this->licenseManager->getLicensesByOrderAndProduct($orderId, $productId);
+            $existingDomains = array_map(fn($l) => $l->getDomain(), $existingLicenses);
+
+            foreach ($domains as $domain) {
+                $normalizedDomain = $this->licenseManager->normalizeDomain($domain);
+
+                // Skip if license already exists for this domain
+                if (in_array($normalizedDomain, $existingDomains, true)) {
+                    $skipped++;
+                    continue;
+                }
+
+                $license = $this->licenseManager->generateLicense(
+                    $orderId,
+                    $productId,
+                    $customerId,
+                    $normalizedDomain
+                );
+
+                if ($license) {
+                    $generated++;
+                }
+            }
+        }
+
+        return ['generated' => $generated, 'skipped' => $skipped];
+    }
+
+    /**
+     * Generate licenses for legacy single domain format
+     */
+    private function generateLegacyLicenses(\WC_Order $order, string $domain): array
+    {
+        $generated = 0;
+        $skipped = 0;
+        $orderId = $order->get_id();
+        $customerId = $order->get_customer_id();
+
+        foreach ($order->get_items() as $item) {
+            $product = $item->get_product();
+            if (!$product || !$this->licenseManager->isLicensedProduct($product)) {
+                continue;
+            }
+
+            // Check if license already exists
+            $existing = $this->licenseManager->getLicenseByOrderAndProduct($orderId, $product->get_id());
+            if ($existing) {
+                $skipped++;
+                continue;
+            }
+
+            $license = $this->licenseManager->generateLicense(
+                $orderId,
+                $product->get_id(),
+                $customerId,
+                $domain
+            );
+
+            if ($license) {
+                $generated++;
+            }
+        }
+
+        return ['generated' => $generated, 'skipped' => $skipped];
+    }
 }

src/Admin/SettingsController.php

@@ -9,6 +9,8 @@ declare(strict_types=1);
 
 namespace Jeremias\WcLicensedProduct\Admin;
 
+use Jeremias\WcLicensedProduct\License\PluginLicenseChecker;
+
 /**
  * Handles WooCommerce settings tab for license defaults
  */
@@ -19,6 +21,11 @@ final class SettingsController
      */
     public const OPTION_NAME = 'wc_licensed_product_settings';
 
+    /**
+     * Tab ID
+     */
+    private const TAB_ID = 'licensed_product';
+
     /**
      * Constructor
      */
@@ -33,8 +40,10 @@ final class SettingsController
     private function registerHooks(): void
     {
         add_filter('woocommerce_settings_tabs_array', [$this, 'addSettingsTab'], 50);
-        add_action('woocommerce_settings_tabs_licensed_product', [$this, 'renderSettingsTab']);
-        add_action('woocommerce_update_options_licensed_product', [$this, 'saveSettings']);
+        add_action('woocommerce_sections_' . self::TAB_ID, [$this, 'outputSections']);
+        add_action('woocommerce_settings_' . self::TAB_ID, [$this, 'renderSettingsTab']);
+        add_action('woocommerce_update_options_' . self::TAB_ID, [$this, 'saveSettings']);
+        add_action('wp_ajax_wclp_verify_plugin_license', [$this, 'handleVerifyLicense']);
     }
 
     /**
@@ -42,14 +51,171 @@ final class SettingsController
      */
     public function addSettingsTab(array $tabs): array
     {
-        $tabs['licensed_product'] = __('Licensed Products', 'wc-licensed-product');
+        $tabs[self::TAB_ID] = __('Licensed Products', 'wc-licensed-product');
         return $tabs;
     }
 
     /**
-     * Get settings fields
+     * Get available sections
+     */
+    public function getSections(): array
+    {
+        return [
+            '' => __('Plugin License', 'wc-licensed-product'),
+            'auto-updates' => __('Auto-Updates', 'wc-licensed-product'),
+            'defaults' => __('Default Settings', 'wc-licensed-product'),
+            'notifications' => __('Notifications', 'wc-licensed-product'),
+        ];
+    }
+
+    /**
+     * Get current section from URL
+     */
+    private function getCurrentSection(): string
+    {
+        // phpcs:ignore WordPress.Security.NonceVerification.Recommended
+        return isset($_GET['section']) ? sanitize_title(wp_unslash($_GET['section'])) : '';
+    }
+
+    /**
+     * Output sections navigation (sub-tabs)
+     */
+    public function outputSections(): void
+    {
+        $sections = $this->getSections();
+
+        if (empty($sections) || count($sections) <= 1) {
+            return;
+        }
+
+        $currentSection = $this->getCurrentSection();
+
+        echo '<ul class="subsubsub">';
+
+        $arrayKeys = array_keys($sections);
+
+        foreach ($sections as $id => $label) {
+            $url = admin_url('admin.php?page=wc-settings&tab=' . self::TAB_ID . '&section=' . sanitize_title($id));
+            $class = ($currentSection === $id) ? 'current' : '';
+            $separator = (end($arrayKeys) === $id) ? '' : ' | ';
+
+            echo '<li><a href="' . esc_url($url) . '" class="' . esc_attr($class) . '">' . esc_html($label) . '</a>' . $separator . '</li>';
+        }
+
+        echo '</ul><br class="clear" />';
+    }
+
+    /**
+     * Get settings fields for the current section
      */
     public function getSettingsFields(): array
+    {
+        $currentSection = $this->getCurrentSection();
+
+        return match ($currentSection) {
+            'auto-updates' => $this->getAutoUpdatesSettings(),
+            'defaults' => $this->getDefaultsSettings(),
+            'notifications' => $this->getNotificationsSettings(),
+            default => $this->getPluginLicenseSettings(),
+        };
+    }
+
+    /**
+     * Get plugin license settings (default section)
+     */
+    private function getPluginLicenseSettings(): array
+    {
+        return [
+            'plugin_license_section_title' => [
+                'name' => __('Plugin License', 'wc-licensed-product'),
+                'type' => 'title',
+                'desc' => __('Configure the license for this plugin. A valid license is required for frontend features to work.', 'wc-licensed-product'),
+                'id' => 'wc_licensed_product_section_plugin_license',
+            ],
+            'plugin_license_server_url' => [
+                'name' => __('License Server URL', 'wc-licensed-product'),
+                'type' => 'url',
+                'desc' => __('The URL of the license server (e.g., https://shop.example.com).', 'wc-licensed-product'),
+                'id' => 'wc_licensed_product_plugin_license_server_url',
+                'default' => '',
+                'placeholder' => 'https://shop.example.com',
+            ],
+            'plugin_license_key' => [
+                'name' => __('License Key', 'wc-licensed-product'),
+                'type' => 'text',
+                'desc' => __('Your license key in XXXX-XXXX-XXXX-XXXX format.', 'wc-licensed-product'),
+                'id' => 'wc_licensed_product_plugin_license_key',
+                'default' => '',
+                'placeholder' => 'XXXX-XXXX-XXXX-XXXX',
+            ],
+            'plugin_license_server_secret' => [
+                'name' => __('Server Secret (Optional)', 'wc-licensed-product'),
+                'type' => 'password',
+                'desc' => __('If the license server uses signed responses, enter the shared secret here for enhanced security.', 'wc-licensed-product'),
+                'id' => 'wc_licensed_product_plugin_license_server_secret',
+                'default' => '',
+            ],
+            'plugin_license_section_end' => [
+                'type' => 'sectionend',
+                'id' => 'wc_licensed_product_section_plugin_license_end',
+            ],
+        ];
+    }
+
+    /**
+     * Get auto-updates settings
+     */
+    private function getAutoUpdatesSettings(): array
+    {
+        $autoInstallDisabled = !self::isUpdateNotificationEnabled();
+
+        return [
+            'auto_update_section_title' => [
+                'name' => __('Auto-Updates', 'wc-licensed-product'),
+                'type' => 'title',
+                'desc' => __('Configure automatic plugin updates from the license server.', 'wc-licensed-product'),
+                'id' => 'wc_licensed_product_section_auto_update',
+            ],
+            'update_notification_enabled' => [
+                'name' => __('Enable Update Notifications', 'wc-licensed-product'),
+                'type' => 'checkbox',
+                'desc' => __('Check for and display available updates from the license server in WordPress admin.', 'wc-licensed-product'),
+                'id' => 'wc_licensed_product_update_notification_enabled',
+                'default' => 'yes',
+            ],
+            'plugin_auto_install_enabled' => [
+                'name' => __('Automatically Install Updates', 'wc-licensed-product'),
+                'type' => 'checkbox',
+                'desc' => $autoInstallDisabled
+                    ? __('Enable "Update Notifications" above to use this option.', 'wc-licensed-product')
+                    : __('Automatically install updates when they become available (requires update notifications enabled).', 'wc-licensed-product'),
+                'id' => 'wc_licensed_product_plugin_auto_install_enabled',
+                'default' => 'no',
+                'custom_attributes' => $autoInstallDisabled ? ['disabled' => 'disabled'] : [],
+            ],
+            'update_check_frequency' => [
+                'name' => __('Check Frequency (Hours)', 'wc-licensed-product'),
+                'type' => 'number',
+                'desc' => __('How often to check for updates (in hours).', 'wc-licensed-product'),
+                'id' => 'wc_licensed_product_update_check_frequency',
+                'default' => '12',
+                'custom_attributes' => [
+                    'min' => '1',
+                    'max' => '168',
+                    'step' => '1',
+                ],
+            ],
+            'auto_update_section_end' => [
+                'type' => 'sectionend',
+                'id' => 'wc_licensed_product_section_auto_update_end',
+            ],
+        ];
+    }
+
+    /**
+     * Get default license settings
+     */
+    private function getDefaultsSettings(): array
     {
         return [
             'section_title' => [
@@ -59,7 +225,7 @@ final class SettingsController
                 'id' => 'wc_licensed_product_section_defaults',
             ],
             'default_max_activations' => [
-                'name' => __('Default Max Activations', 'wc-licensed-product'),
+                'name' => __('Max Activations', 'wc-licensed-product'),
                 'type' => 'number',
                 'desc' => __('Default maximum number of domain activations per license.', 'wc-licensed-product'),
                 'id' => 'wc_licensed_product_default_max_activations',
@@ -70,7 +236,7 @@ final class SettingsController
                 ],
             ],
             'default_validity_days' => [
-                'name' => __('Default License Validity (Days)', 'wc-licensed-product'),
+                'name' => __('License Validity (Days)', 'wc-licensed-product'),
                 'type' => 'number',
                 'desc' => __('Default number of days a license is valid. Leave empty or set to 0 for lifetime licenses.', 'wc-licensed-product'),
                 'id' => 'wc_licensed_product_default_validity_days',
@@ -82,17 +248,32 @@ final class SettingsController
                 ],
             ],
             'default_bind_to_version' => [
-                'name' => __('Default Bind to Major Version', 'wc-licensed-product'),
+                'name' => __('Bind to Major Version', 'wc-licensed-product'),
                 'type' => 'checkbox',
                 'desc' => __('If enabled, licenses are bound to the major version at purchase time by default.', 'wc-licensed-product'),
                 'id' => 'wc_licensed_product_default_bind_to_version',
                 'default' => 'no',
             ],
+            'enable_multi_domain' => [
+                'name' => __('Enable Multi-Domain Licensing', 'wc-licensed-product'),
+                'type' => 'checkbox',
+                'desc' => __('Allow customers to purchase multiple licenses for different domains at once. Each unit in cart quantity requires a unique domain.', 'wc-licensed-product'),
+                'id' => 'wc_licensed_product_enable_multi_domain',
+                'default' => 'no',
+            ],
             'section_end' => [
                 'type' => 'sectionend',
                 'id' => 'wc_licensed_product_section_defaults_end',
             ],
-            // Email settings section
+        ];
+    }
+
+    /**
+     * Get notifications settings
+     */
+    private function getNotificationsSettings(): array
+    {
+        return [
             'email_section_title' => [
                 'name' => __('Expiration Warning Schedule', 'wc-licensed-product'),
                 'type' => 'title',
@@ -138,9 +319,96 @@ final class SettingsController
      */
     public function renderSettingsTab(): void
     {
+        $currentSection = $this->getCurrentSection();
+
+        // Only show license status on the plugin license section
+        if ($currentSection === '') {
+            $this->renderLicenseStatus();
+        }
+
         woocommerce_admin_fields($this->getSettingsFields());
     }
 
+    /**
+     * Render license status notice
+     */
+    private function renderLicenseStatus(): void
+    {
+        $checker = PluginLicenseChecker::getInstance();
+
+        if ($checker->isLocalhost()) {
+            echo '<div class="notice notice-info inline"><p>';
+            echo '<span class="dashicons dashicons-info" style="color: #00a0d2;"></span> ';
+            echo esc_html__('Running on localhost - license validation bypassed.', 'wc-licensed-product');
+            echo '</p></div>';
+            return;
+        }
+
+        if ($checker->isLicenseValid()) {
+            echo '<div class="notice notice-success inline"><p>';
+            echo '<span class="dashicons dashicons-yes-alt" style="color: #46b450;"></span> ';
+            echo esc_html__('License is valid and active.', 'wc-licensed-product');
+            echo '</p></div>';
+        } else {
+            $error = $checker->getLastError();
+            echo '<div class="notice notice-error inline"><p>';
+            echo '<span class="dashicons dashicons-warning" style="color: #dc3232;"></span> ';
+            echo esc_html__('License is not valid. Frontend features are disabled.', 'wc-licensed-product');
+            if ($error) {
+                echo '<br><small>' . esc_html($error) . '</small>';
+            }
+            echo '</p></div>';
+        }
+
+        // Add verify button
+        $nonce = wp_create_nonce('wclp_verify_license');
+        echo '<p>';
+        echo '<button type="button" class="button" id="wclp-verify-license" data-nonce="' . esc_attr($nonce) . '">';
+        echo esc_html__('Verify License', 'wc-licensed-product');
+        echo '</button>';
+        echo '<span id="wclp-verify-result" style="margin-left: 10px;"></span>';
+        echo '</p>';
+
+        // Inline script for verify button
+        ?>
+        <script type="text/javascript">
+        jQuery(function($) {
+            $('#wclp-verify-license').on('click', function() {
+                var $btn = $(this);
+                var $result = $('#wclp-verify-result');
+                var nonce = $btn.data('nonce');
+
+                $btn.prop('disabled', true).text('<?php echo esc_js(__('Verifying...', 'wc-licensed-product')); ?>');
+                $result.text('');
+
+                $.ajax({
+                    url: ajaxurl,
+                    type: 'POST',
+                    data: {
+                        action: 'wclp_verify_plugin_license',
+                        nonce: nonce
+                    },
+                    success: function(response) {
+                        if (response.success) {
+                            $result.html('<span style="color: #46b450;">' + response.data.message + '</span>');
+                            location.reload();
+                        } else {
+                            $result.html('<span style="color: #dc3232;">' + response.data.message + '</span>');
+                        }
+                    },
+                    error: function() {
+                        $result.html('<span style="color: #dc3232;"><?php echo esc_js(__('Request failed.', 'wc-licensed-product')); ?></span>');
+                    },
+                    complete: function() {
+                        $btn.prop('disabled', false).text('<?php echo esc_js(__('Verify License', 'wc-licensed-product')); ?>');
+                    }
+                });
+            });
+        });
+        </script>
+        <?php
+    }
+
     /**
      * Save settings
      */
@@ -178,6 +446,14 @@ final class SettingsController
         return get_option('wc_licensed_product_default_bind_to_version', 'no') === 'yes';
     }
 
+    /**
+     * Check if multi-domain licensing is enabled
+     */
+    public static function isMultiDomainEnabled(): bool
+    {
+        return get_option('wc_licensed_product_enable_multi_domain', 'no') === 'yes';
+    }
+
     /**
      * Check if expiration warning emails are enabled
      * This checks both the WooCommerce email setting and the old setting for backwards compatibility
@@ -210,4 +486,93 @@ final class SettingsController
         $value = get_option('wc_licensed_product_expiration_warning_days_second', 1);
         return max(0, (int) $value);
     }
+
+    /**
+     * Get plugin license server URL
+     */
+    public static function getPluginLicenseServerUrl(): string
+    {
+        return (string) get_option('wc_licensed_product_plugin_license_server_url', '');
+    }
+
+    /**
+     * Get plugin license key
+     */
+    public static function getPluginLicenseKey(): string
+    {
+        return (string) get_option('wc_licensed_product_plugin_license_key', '');
+    }
+
+    /**
+     * Get plugin license server secret
+     */
+    public static function getPluginLicenseServerSecret(): ?string
+    {
+        $secret = get_option('wc_licensed_product_plugin_license_server_secret', '');
+        return !empty($secret) ? (string) $secret : null;
+    }
+
+    /**
+     * Check if update notifications are enabled
+     */
+    public static function isUpdateNotificationEnabled(): bool
+    {
+        return get_option('wc_licensed_product_update_notification_enabled', 'yes') === 'yes';
+    }
+
+    /**
+     * Check if auto-updates are enabled (legacy alias for isUpdateNotificationEnabled)
+     */
+    public static function isAutoUpdateEnabled(): bool
+    {
+        return self::isUpdateNotificationEnabled();
+    }
+
+    /**
+     * Check if automatic installation of updates is enabled
+     */
+    public static function isAutoInstallEnabled(): bool
+    {
+        // Auto-install requires notifications to be enabled first
+        if (!self::isUpdateNotificationEnabled()) {
+            return false;
+        }
+
+        return get_option('wc_licensed_product_plugin_auto_install_enabled', 'no') === 'yes';
+    }
+
+    /**
+     * Get update check frequency in hours
+     */
+    public static function getUpdateCheckFrequency(): int
+    {
+        $value = get_option('wc_licensed_product_update_check_frequency', 12);
+        return max(1, min(168, (int) $value));
+    }
+
+    /**
+     * Handle AJAX verify license request
+     */
+    public function handleVerifyLicense(): void
+    {
+        if (!check_ajax_referer('wclp_verify_license', 'nonce', false)) {
+            wp_send_json_error(['message' => __('Security check failed.', 'wc-licensed-product')], 403);
+        }
+
+        if (!current_user_can('manage_woocommerce')) {
+            wp_send_json_error(['message' => __('Insufficient permissions.', 'wc-licensed-product')], 403);
+        }
+
+        $checker = PluginLicenseChecker::getInstance();
+        $checker->clearCache();
+
+        $valid = $checker->validateLicense(true);
+
+        if ($valid) {
+            wp_send_json_success(['message' => __('License verified successfully!', 'wc-licensed-product')]);
+        } else {
+            $error = $checker->getLastError() ?: __('License validation failed.', 'wc-licensed-product');
+            wp_send_json_error(['message' => $error]);
+        }
+    }
 }

src/Admin/VersionAdminController.php

@@ -43,16 +43,13 @@ final class VersionAdminController
 
     /**
      * Add versions meta box to product edit page
+     * Always adds the meta box - visibility is controlled via CSS/JavaScript based on product type
      */
     public function addVersionsMetaBox(): void
     {
         global $post;
 
-        // Only add meta box for licensed products or new products
         if ($post && $post->post_type === 'product') {
-            $product = wc_get_product($post->ID);
-            // Show for licensed products or new products (where type might be selected later)
-            if (!$product || $product->is_type('licensed') || $post->post_status === 'auto-draft') {
             add_meta_box(
                 'wc_licensed_product_versions',
                 __('Product Versions', 'wc-licensed-product'),
@@ -63,7 +60,6 @@ final class VersionAdminController
             );
         }
     }
-    }
 
     /**
      * Render versions meta box
@@ -157,12 +153,14 @@ final class VersionAdminController
                                     $filename = $version->getDownloadFilename();
                                     if ($effectiveUrl):
                                     ?>
+                                        <span class="version-download-link">
                                             <a href="<?php echo esc_url($effectiveUrl); ?>" target="_blank">
                                                 <?php echo esc_html($filename ?: wp_basename($effectiveUrl)); ?>
                                             </a>
                                             <?php if ($version->getAttachmentId()): ?>
                                                 <span class="dashicons dashicons-media-archive" title="<?php esc_attr_e('Uploaded file', 'wc-licensed-product'); ?>"></span>
                                             <?php endif; ?>
+                                        </span>
                                     <?php else: ?>
                                         <em><?php esc_html_e('No download file', 'wc-licensed-product'); ?></em>
                                     <?php endif; ?>
@@ -278,12 +276,13 @@ final class VersionAdminController
         }
 
         // Verify product exists and is of type licensed
-        $product = wc_get_product($productId);
-        if (!$product) {
+        // Use WC_Product_Factory::get_product_type() for reliable type detection
+        $productType = \WC_Product_Factory::get_product_type($productId);
+        if (!$productType) {
             wp_send_json_error(['message' => __('Product not found.', 'wc-licensed-product')]);
         }
 
-        if (!$product->is_type('licensed')) {
+        if (!in_array($productType, ['licensed', 'licensed-variable'], true)) {
             wp_send_json_error(['message' => __('This product is not a licensed product.', 'wc-licensed-product')]);
         }
 
@@ -359,7 +358,7 @@ final class VersionAdminController
             wp_send_json_error(['message' => __('Version ID is required.', 'wc-licensed-product')]);
         }
 
-        $result = $this->versionManager->updateVersion($versionId, null, null, !$currentlyActive);
+        $result = $this->versionManager->updateVersion($versionId, null, !$currentlyActive, null);
 
         if (!$result) {
             wp_send_json_error(['message' => __('Failed to update version.', 'wc-licensed-product')]);
@@ -386,12 +385,14 @@ final class VersionAdminController
                 $filename = $version->getDownloadFilename();
                 if ($effectiveUrl):
                 ?>
+                    <span class="version-download-link">
                         <a href="<?php echo esc_url($effectiveUrl); ?>" target="_blank">
                             <?php echo esc_html($filename ?: wp_basename($effectiveUrl)); ?>
                         </a>
                         <?php if ($version->getAttachmentId()): ?>
                             <span class="dashicons dashicons-media-archive" title="<?php esc_attr_e('Uploaded file', 'wc-licensed-product'); ?>"></span>
                         <?php endif; ?>
+                    </span>
                 <?php else: ?>
                     <em><?php esc_html_e('No download file', 'wc-licensed-product'); ?></em>
                 <?php endif; ?>

src/Api/IpDetectionTrait.php

@@ -0,0 +1,168 @@
+<?php
+/**
+ * IP Detection Trait
+ *
+ * Provides shared IP detection logic for API controllers with proxy support.
+ *
+ * @package Jeremias\WcLicensedProduct\Api
+ */
+
+declare(strict_types=1);
+
+namespace Jeremias\WcLicensedProduct\Api;
+
+/**
+ * Trait for detecting client IP addresses with proxy support
+ *
+ * Security note: Only trust proxy headers when explicitly configured.
+ * Set WC_LICENSE_TRUSTED_PROXIES constant in wp-config.php to enable proxy header support.
+ *
+ * Examples:
+ *   define('WC_LICENSE_TRUSTED_PROXIES', 'CLOUDFLARE');
+ *   define('WC_LICENSE_TRUSTED_PROXIES', '10.0.0.1,192.168.1.0/24');
+ */
+trait IpDetectionTrait
+{
+    /**
+     * Get client IP address with proxy support
+     *
+     * @return string Client IP address
+     */
+    protected function getClientIp(): string
+    {
+        // Get the direct connection IP first
+        $remoteAddr = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
+
+        // Only check proxy headers if we're behind a trusted proxy
+        if ($this->isTrustedProxy($remoteAddr)) {
+            // Check headers in order of trust preference
+            $headers = [
+                'HTTP_CF_CONNECTING_IP', // Cloudflare
+                'HTTP_X_FORWARDED_FOR',
+                'HTTP_X_REAL_IP',
+            ];
+
+            foreach ($headers as $header) {
+                if (!empty($_SERVER[$header])) {
+                    $ips = explode(',', $_SERVER[$header]);
+                    $ip = trim($ips[0]);
+                    if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
+                        return $ip;
+                    }
+                }
+            }
+        }
+
+        // Validate and return direct connection IP
+        if (filter_var($remoteAddr, FILTER_VALIDATE_IP)) {
+            return $remoteAddr;
+        }
+
+        return '0.0.0.0';
+    }
+
+    /**
+     * Check if the given IP is a trusted proxy
+     *
+     * @param string $ip The IP address to check
+     * @return bool Whether the IP is a trusted proxy
+     */
+    protected function isTrustedProxy(string $ip): bool
+    {
+        // Check if trusted proxies are configured
+        if (!defined('WC_LICENSE_TRUSTED_PROXIES')) {
+            return false;
+        }
+
+        $trustedProxies = WC_LICENSE_TRUSTED_PROXIES;
+
+        // Handle string constant (comma-separated list)
+        if (is_string($trustedProxies)) {
+            $trustedProxies = array_map('trim', explode(',', $trustedProxies));
+        }
+
+        if (!is_array($trustedProxies)) {
+            return false;
+        }
+
+        // Check for special keywords
+        if (in_array('CLOUDFLARE', $trustedProxies, true)) {
+            if ($this->isCloudflareIp($ip)) {
+                return true;
+            }
+        }
+
+        // Check direct IP match or CIDR notation
+        foreach ($trustedProxies as $proxy) {
+            if ($proxy === $ip) {
+                return true;
+            }
+
+            // Support CIDR notation
+            if (str_contains($proxy, '/') && $this->ipMatchesCidr($ip, $proxy)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * Check if IP is in Cloudflare range
+     *
+     * @param string $ip The IP to check
+     * @return bool Whether IP belongs to Cloudflare
+     */
+    protected function isCloudflareIp(string $ip): bool
+    {
+        // Cloudflare IPv4 ranges (as of 2024)
+        $cloudflareRanges = [
+            '173.245.48.0/20',
+            '103.21.244.0/22',
+            '103.22.200.0/22',
+            '103.31.4.0/22',
+            '141.101.64.0/18',
+            '108.162.192.0/18',
+            '190.93.240.0/20',
+            '188.114.96.0/20',
+            '197.234.240.0/22',
+            '198.41.128.0/17',
+            '162.158.0.0/15',
+            '104.16.0.0/13',
+            '104.24.0.0/14',
+            '172.64.0.0/13',
+            '131.0.72.0/22',
+        ];
+
+        foreach ($cloudflareRanges as $range) {
+            if ($this->ipMatchesCidr($ip, $range)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * Check if an IP matches a CIDR range
+     *
+     * @param string $ip The IP to check
+     * @param string $cidr The CIDR range (e.g., "192.168.1.0/24")
+     * @return bool Whether the IP matches the CIDR range
+     */
+    protected function ipMatchesCidr(string $ip, string $cidr): bool
+    {
+        [$subnet, $bits] = explode('/', $cidr);
+
+        if (!filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) ||
+            !filter_var($subnet, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
+            return false;
+        }
+
+        $ipLong = ip2long($ip);
+        $subnetLong = ip2long($subnet);
+        $mask = -1 << (32 - (int) $bits);
+
+        return ($ipLong & $mask) === ($subnetLong & $mask);
+    }
+}

src/Api/ResponseSigner.php

@@ -79,7 +79,8 @@ final class ResponseSigner
 
         return str_starts_with($route, '/wc-licensed-product/v1/validate')
             || str_starts_with($route, '/wc-licensed-product/v1/status')
-            || str_starts_with($route, '/wc-licensed-product/v1/activate');
+            || str_starts_with($route, '/wc-licensed-product/v1/activate')
+            || str_starts_with($route, '/wc-licensed-product/v1/update-check');
     }
 
     /**
@@ -94,8 +95,8 @@ final class ResponseSigner
         $timestamp = time();
         $signingKey = $this->deriveKey($licenseKey);
 
-        // Sort keys for consistent ordering
-        ksort($data);
+        // Recursively sort keys for consistent ordering (required by client implementation)
+        $data = $this->recursiveKeySort($data);
 
         // Build signature payload
         $payload = $timestamp . ':' . json_encode(
@@ -109,6 +110,33 @@ final class ResponseSigner
         ];
     }
 
+    /**
+     * Recursively sort array keys alphabetically
+     *
+     * @param mixed $data The data to sort
+     * @return mixed The sorted data
+     */
+    private function recursiveKeySort(mixed $data): mixed
+    {
+        if (!is_array($data)) {
+            return $data;
+        }
+
+        // Check if array is associative (has string keys)
+        $isAssociative = array_keys($data) !== range(0, count($data) - 1);
+
+        if ($isAssociative) {
+            ksort($data);
+        }
+
+        // Recursively sort nested arrays
+        foreach ($data as $key => $value) {
+            $data[$key] = $this->recursiveKeySort($value);
+        }
+
+        return $data;
+    }
+
     /**
      * Derive a unique signing key for a license
      *
@@ -120,9 +148,59 @@ final class ResponseSigner
      */
     private function deriveKey(string $licenseKey): string
     {
-        // HKDF-like key derivation
-        $prk = hash_hmac('sha256', $licenseKey, $this->serverSecret, true);
+        return self::deriveCustomerSecret($licenseKey, $this->serverSecret);
+    }
 
-        return hash_hmac('sha256', $prk . "\x01", $this->serverSecret);
+    /**
+     * Derive a customer-specific secret from a license key
+     *
+     * This secret is unique per license and can be shared with the customer
+     * to verify signed API responses. Each customer gets their own secret
+     * derived from their license key.
+     *
+     * Uses RFC 5869 HKDF via PHP's native hash_hkdf() function.
+     * Parameters match the client library (SecureLicenseClient):
+     * - IKM (input keying material): server_secret
+     * - Length: 32 bytes (256 bits for SHA-256)
+     * - Info: license_key (context-specific info)
+     *
+     * @param string $licenseKey   The customer's license key
+     * @param string $serverSecret The server's master secret
+     * @return string The derived secret (64 hex characters)
+     */
+    public static function deriveCustomerSecret(string $licenseKey, string $serverSecret): string
+    {
+        // RFC 5869 HKDF using PHP's native implementation
+        // Must match client's ResponseSignature::deriveKey() exactly
+        $binaryKey = hash_hkdf('sha256', $serverSecret, 32, $licenseKey);
+
+        return bin2hex($binaryKey);
+    }
+
+    /**
+     * Get the customer secret for a license key using the configured server secret
+     *
+     * @param string $licenseKey The customer's license key
+     * @return string|null The derived secret, or null if server secret is not configured
+     */
+    public static function getCustomerSecretForLicense(string $licenseKey): ?string
+    {
+        $serverSecret = defined('WC_LICENSE_SERVER_SECRET') ? WC_LICENSE_SERVER_SECRET : '';
+
+        if (empty($serverSecret)) {
+            return null;
+        }
+
+        return self::deriveCustomerSecret($licenseKey, $serverSecret);
+    }
+
+    /**
+     * Check if response signing is enabled
+     *
+     * @return bool True if server secret is configured
+     */
+    public static function isSigningEnabled(): bool
+    {
+        return defined('WC_LICENSE_SERVER_SECRET') && !empty(WC_LICENSE_SERVER_SECRET);
     }
 }

src/Api/RestApiController.php

@@ -19,17 +19,38 @@ use WP_REST_Server;
  */
 final class RestApiController
 {
+    use IpDetectionTrait;
     private const NAMESPACE = 'wc-licensed-product/v1';
 
     /**
-     * Rate limit: requests per minute per IP
+     * Default rate limit: requests per window per IP
      */
-    private const RATE_LIMIT_REQUESTS = 30;
+    private const DEFAULT_RATE_LIMIT = 30;
 
     /**
-     * Rate limit window in seconds
+     * Default rate limit window in seconds
      */
-    private const RATE_LIMIT_WINDOW = 60;
+    private const DEFAULT_RATE_WINDOW = 60;
+
+    /**
+     * Get the configured rate limit (requests per window)
+     */
+    private function getRateLimit(): int
+    {
+        return defined('WC_LICENSE_RATE_LIMIT')
+            ? (int) WC_LICENSE_RATE_LIMIT
+            : self::DEFAULT_RATE_LIMIT;
+    }
+
+    /**
+     * Get the configured rate limit window in seconds
+     */
+    private function getRateWindow(): int
+    {
+        return defined('WC_LICENSE_RATE_WINDOW')
+            ? (int) WC_LICENSE_RATE_WINDOW
+            : self::DEFAULT_RATE_WINDOW;
+    }
 
     private LicenseManager $licenseManager;
 
@@ -56,12 +77,14 @@ final class RestApiController
     {
         $ip = $this->getClientIp();
         $transientKey = 'wclp_rate_' . md5($ip);
+        $rateLimit = $this->getRateLimit();
+        $rateWindow = $this->getRateWindow();
 
         $data = get_transient($transientKey);
 
         if ($data === false) {
             // First request, start counting
-            set_transient($transientKey, ['count' => 1, 'start' => time()], self::RATE_LIMIT_WINDOW);
+            set_transient($transientKey, ['count' => 1, 'start' => time()], $rateWindow);
             return null;
         }
 
@@ -69,15 +92,15 @@ final class RestApiController
         $start = (int) ($data['start'] ?? time());
 
         // Check if window has expired
-        if (time() - $start >= self::RATE_LIMIT_WINDOW) {
+        if (time() - $start >= $rateWindow) {
             // Reset counter
-            set_transient($transientKey, ['count' => 1, 'start' => time()], self::RATE_LIMIT_WINDOW);
+            set_transient($transientKey, ['count' => 1, 'start' => time()], $rateWindow);
             return null;
         }
 
         // Check if limit exceeded
-        if ($count >= self::RATE_LIMIT_REQUESTS) {
-            $retryAfter = self::RATE_LIMIT_WINDOW - (time() - $start);
+        if ($count >= $rateLimit) {
+            $retryAfter = $rateWindow - (time() - $start);
             $response = new WP_REST_Response([
                 'success' => false,
                 'error' => 'rate_limit_exceeded',
@@ -89,35 +112,10 @@ final class RestApiController
         }
 
         // Increment counter
-        set_transient($transientKey, ['count' => $count + 1, 'start' => $start], self::RATE_LIMIT_WINDOW);
+        set_transient($transientKey, ['count' => $count + 1, 'start' => $start], $rateWindow);
         return null;
     }
 
-    /**
-     * Get client IP address
-     */
-    private function getClientIp(): string
-    {
-        $headers = [
-            'HTTP_CF_CONNECTING_IP', // Cloudflare
-            'HTTP_X_FORWARDED_FOR',
-            'HTTP_X_REAL_IP',
-            'REMOTE_ADDR',
-        ];
-
-        foreach ($headers as $header) {
-            if (!empty($_SERVER[$header])) {
-                $ips = explode(',', $_SERVER[$header]);
-                $ip = trim($ips[0]);
-                if (filter_var($ip, FILTER_VALIDATE_IP)) {
-                    return $ip;
-                }
-            }
-        }
-
-        return '0.0.0.0';
-    }
-
     /**
      * Register REST API routes
      */
@@ -134,7 +132,8 @@ final class RestApiController
                     'type' => 'string',
                     'sanitize_callback' => 'sanitize_text_field',
                     'validate_callback' => function ($value): bool {
-                        return !empty($value) && strlen($value) <= 64;
+                        $len = strlen($value);
+                        return !empty($value) && $len >= 8 && $len <= 64;
                     },
                 ],
                 'domain' => [
@@ -158,6 +157,10 @@ final class RestApiController
                     'required' => true,
                     'type' => 'string',
                     'sanitize_callback' => 'sanitize_text_field',
+                    'validate_callback' => function ($value): bool {
+                        $len = strlen($value);
+                        return !empty($value) && $len >= 8 && $len <= 64;
+                    },
                 ],
             ],
         ]);
@@ -172,11 +175,18 @@ final class RestApiController
                     'required' => true,
                     'type' => 'string',
                     'sanitize_callback' => 'sanitize_text_field',
+                    'validate_callback' => function ($value): bool {
+                        $len = strlen($value);
+                        return !empty($value) && $len >= 8 && $len <= 64;
+                    },
                 ],
                 'domain' => [
                     'required' => true,
                     'type' => 'string',
                     'sanitize_callback' => 'sanitize_text_field',
+                    'validate_callback' => function ($value): bool {
+                        return !empty($value) && strlen($value) <= 255;
+                    },
                 ],
             ],
         ]);
@@ -197,11 +207,32 @@ final class RestApiController
 
         $result = $this->licenseManager->validateLicense($licenseKey, $domain);
 
-        $statusCode = $result['valid'] ? 200 : 403;
+        $statusCode = $this->getStatusCodeForResult($result);
 
         return new WP_REST_Response($result, $statusCode);
     }
 
+    /**
+     * Get HTTP status code based on validation result
+     *
+     * @param array $result The validation result
+     * @return int HTTP status code
+     */
+    private function getStatusCodeForResult(array $result): int
+    {
+        if ($result['valid']) {
+            return 200;
+        }
+
+        $error = $result['error'] ?? '';
+
+        return match ($error) {
+            'license_not_found' => 404,
+            'activation_failed' => 500,
+            default => 403,
+        };
+    }
+
     /**
      * Check license status endpoint
      */

src/Api/UpdateController.php

@@ -0,0 +1,353 @@
+<?php
+/**
+ * Update Controller
+ *
+ * REST API endpoint for plugin update checks
+ *
+ * @package Jeremias\WcLicensedProduct\Api
+ */
+
+declare(strict_types=1);
+
+namespace Jeremias\WcLicensedProduct\Api;
+
+use Jeremias\WcLicensedProduct\License\LicenseManager;
+use Jeremias\WcLicensedProduct\Product\VersionManager;
+use Jeremias\WcLicensedProduct\Product\ProductVersion;
+use WP_REST_Request;
+use WP_REST_Response;
+use WP_REST_Server;
+
+/**
+ * Handles REST API endpoint for plugin update checks
+ *
+ * This endpoint allows licensed plugins to check for updates from this WooCommerce store.
+ * It validates the license and returns WordPress-compatible update information.
+ */
+final class UpdateController
+{
+    use IpDetectionTrait;
+    private const NAMESPACE = 'wc-licensed-product/v1';
+
+    /**
+     * Default rate limit: requests per window per IP
+     */
+    private const DEFAULT_RATE_LIMIT = 30;
+
+    /**
+     * Default rate limit window in seconds
+     */
+    private const DEFAULT_RATE_WINDOW = 60;
+
+    private LicenseManager $licenseManager;
+    private VersionManager $versionManager;
+
+    public function __construct(LicenseManager $licenseManager, VersionManager $versionManager)
+    {
+        $this->licenseManager = $licenseManager;
+        $this->versionManager = $versionManager;
+        $this->registerHooks();
+    }
+
+    /**
+     * Register WordPress hooks
+     */
+    private function registerHooks(): void
+    {
+        add_action('rest_api_init', [$this, 'registerRoutes']);
+    }
+
+    /**
+     * Get the configured rate limit (requests per window)
+     */
+    private function getRateLimit(): int
+    {
+        return defined('WC_LICENSE_RATE_LIMIT')
+            ? (int) WC_LICENSE_RATE_LIMIT
+            : self::DEFAULT_RATE_LIMIT;
+    }
+
+    /**
+     * Get the configured rate limit window in seconds
+     */
+    private function getRateWindow(): int
+    {
+        return defined('WC_LICENSE_RATE_WINDOW')
+            ? (int) WC_LICENSE_RATE_WINDOW
+            : self::DEFAULT_RATE_WINDOW;
+    }
+
+    /**
+     * Check rate limit for current IP
+     *
+     * @return WP_REST_Response|null Returns error response if rate limited, null if OK
+     */
+    private function checkRateLimit(): ?WP_REST_Response
+    {
+        $ip = $this->getClientIp();
+        $transientKey = 'wclp_update_rate_' . md5($ip);
+        $rateLimit = $this->getRateLimit();
+        $rateWindow = $this->getRateWindow();
+
+        $data = get_transient($transientKey);
+
+        if ($data === false) {
+            set_transient($transientKey, ['count' => 1, 'start' => time()], $rateWindow);
+            return null;
+        }
+
+        $count = (int) ($data['count'] ?? 0);
+        $start = (int) ($data['start'] ?? time());
+
+        if (time() - $start >= $rateWindow) {
+            set_transient($transientKey, ['count' => 1, 'start' => time()], $rateWindow);
+            return null;
+        }
+
+        if ($count >= $rateLimit) {
+            $retryAfter = $rateWindow - (time() - $start);
+            $response = new WP_REST_Response([
+                'success' => false,
+                'error' => 'rate_limit_exceeded',
+                'message' => __('Too many requests. Please try again later.', 'wc-licensed-product'),
+                'retry_after' => $retryAfter,
+            ], 429);
+            $response->header('Retry-After', (string) $retryAfter);
+            return $response;
+        }
+
+        set_transient($transientKey, ['count' => $count + 1, 'start' => $start], $rateWindow);
+        return null;
+    }
+
+    /**
+     * Register REST API routes
+     */
+    public function registerRoutes(): void
+    {
+        register_rest_route(self::NAMESPACE, '/update-check', [
+            'methods' => WP_REST_Server::CREATABLE,
+            'callback' => [$this, 'handleUpdateCheck'],
+            'permission_callback' => '__return_true',
+            'args' => [
+                'license_key' => [
+                    'required' => true,
+                    'type' => 'string',
+                    'sanitize_callback' => 'sanitize_text_field',
+                    'validate_callback' => function ($value): bool {
+                        $len = strlen($value);
+                        return !empty($value) && $len >= 8 && $len <= 64;
+                    },
+                ],
+                'domain' => [
+                    'required' => true,
+                    'type' => 'string',
+                    'sanitize_callback' => 'sanitize_text_field',
+                    'validate_callback' => function ($value): bool {
+                        return !empty($value) && strlen($value) <= 255;
+                    },
+                ],
+                'plugin_slug' => [
+                    'required' => false,
+                    'type' => 'string',
+                    'sanitize_callback' => 'sanitize_text_field',
+                ],
+                'current_version' => [
+                    'required' => false,
+                    'type' => 'string',
+                    'sanitize_callback' => 'sanitize_text_field',
+                ],
+            ],
+        ]);
+    }
+
+    /**
+     * Handle update check request
+     */
+    public function handleUpdateCheck(WP_REST_Request $request): WP_REST_Response
+    {
+        $rateLimitResponse = $this->checkRateLimit();
+        if ($rateLimitResponse !== null) {
+            return $rateLimitResponse;
+        }
+
+        $licenseKey = $request->get_param('license_key');
+        $domain = $request->get_param('domain');
+        $currentVersion = $request->get_param('current_version');
+
+        // Validate license
+        $validationResult = $this->licenseManager->validateLicense($licenseKey, $domain);
+
+        if (!$validationResult['valid']) {
+            return new WP_REST_Response([
+                'success' => false,
+                'update_available' => false,
+                'error' => $validationResult['error'] ?? 'license_invalid',
+                'message' => $validationResult['message'] ?? __('License validation failed.', 'wc-licensed-product'),
+            ], $validationResult['error'] === 'license_not_found' ? 404 : 403);
+        }
+
+        // Get license to access product ID
+        $license = $this->licenseManager->getLicenseByKey($licenseKey);
+        if (!$license) {
+            return new WP_REST_Response([
+                'success' => false,
+                'update_available' => false,
+                'error' => 'license_not_found',
+                'message' => __('License not found.', 'wc-licensed-product'),
+            ], 404);
+        }
+
+        $productId = $license->getProductId();
+        $product = wc_get_product($productId);
+
+        if (!$product) {
+            return new WP_REST_Response([
+                'success' => false,
+                'update_available' => false,
+                'error' => 'product_not_found',
+                'message' => __('Licensed product not found.', 'wc-licensed-product'),
+            ], 404);
+        }
+
+        // Get latest version based on major version binding
+        $latestVersion = $this->getLatestVersionForLicense($license);
+
+        if (!$latestVersion) {
+            return new WP_REST_Response([
+                'success' => true,
+                'update_available' => false,
+                'version' => $currentVersion ?? '0.0.0',
+                'message' => __('No versions available for this product.', 'wc-licensed-product'),
+            ]);
+        }
+
+        // Check if update is available
+        $updateAvailable = $currentVersion
+            ? version_compare($latestVersion->getVersion(), $currentVersion, '>')
+            : true;
+
+        // Build response
+        $response = $this->buildUpdateResponse($product, $latestVersion, $license, $updateAvailable);
+
+        return new WP_REST_Response($response);
+    }
+
+    /**
+     * Get latest version for a license, respecting major version binding
+     */
+    private function getLatestVersionForLicense($license): ?ProductVersion
+    {
+        $productId = $license->getProductId();
+
+        // Check if license is bound to a specific version
+        $versionId = $license->getVersionId();
+        if ($versionId) {
+            $boundVersion = $this->versionManager->getVersionById($versionId);
+            if ($boundVersion) {
+                // Get latest version for this major version
+                return $this->versionManager->getLatestVersionForMajor(
+                    $productId,
+                    $boundVersion->getMajorVersion()
+                );
+            }
+        }
+
+        // No version binding, return latest overall
+        return $this->versionManager->getLatestVersion($productId);
+    }
+
+    /**
+     * Build WordPress-compatible update response
+     */
+    private function buildUpdateResponse($product, ProductVersion $version, $license, bool $updateAvailable): array
+    {
+        $productSlug = $product->get_slug();
+
+        // Generate secure download URL
+        $downloadUrl = $this->generateUpdateDownloadUrl($license->getId(), $version->getId());
+
+        $response = [
+            'success' => true,
+            'update_available' => $updateAvailable,
+            'version' => $version->getVersion(),
+            'slug' => $productSlug,
+            'plugin' => $productSlug . '/' . $productSlug . '.php',
+            'download_url' => $downloadUrl,
+            'package' => $downloadUrl,
+            'last_updated' => $version->getReleasedAt()->format('Y-m-d'),
+            'tested' => $this->getTestedWpVersion(),
+            'requires' => $this->getRequiredWpVersion(),
+            'requires_php' => $this->getRequiredPhpVersion(),
+        ];
+
+        // Add changelog if available
+        if ($version->getReleaseNotes()) {
+            $response['changelog'] = $version->getReleaseNotes();
+            $response['sections'] = [
+                'description' => $product->get_short_description() ?: $product->get_description(),
+                'changelog' => $version->getReleaseNotes(),
+            ];
+        }
+
+        // Add package hash for integrity verification
+        if ($version->getFileHash()) {
+            $response['package_hash'] = 'sha256:' . $version->getFileHash();
+        }
+
+        // Add product name and homepage
+        $response['name'] = $product->get_name();
+        $response['homepage'] = get_permalink($product->get_id());
+
+        // Add icons if product has featured image
+        $imageId = $product->get_image_id();
+        if ($imageId) {
+            $iconUrl = wp_get_attachment_image_url($imageId, 'thumbnail');
+            $iconUrl2x = wp_get_attachment_image_url($imageId, 'medium');
+            if ($iconUrl) {
+                $response['icons'] = [
+                    '1x' => $iconUrl,
+                    '2x' => $iconUrl2x ?: $iconUrl,
+                ];
+            }
+        }
+
+        return $response;
+    }
+
+    /**
+     * Generate secure download URL for updates
+     */
+    private function generateUpdateDownloadUrl(int $licenseId, int $versionId): string
+    {
+        $data = $licenseId . '-' . $versionId . '-' . wp_salt('auth');
+        $hash = substr(hash('sha256', $data), 0, 16);
+        $downloadKey = $licenseId . '-' . $versionId . '-' . $hash;
+
+        return home_url('license-download/' . $downloadKey);
+    }
+
+    /**
+     * Get tested WordPress version from plugin headers
+     */
+    private function getTestedWpVersion(): string
+    {
+        return get_option('wc_licensed_product_tested_wp', '6.7');
+    }
+
+    /**
+     * Get required WordPress version from plugin headers
+     */
+    private function getRequiredWpVersion(): string
+    {
+        return get_option('wc_licensed_product_requires_wp', '6.0');
+    }
+
+    /**
+     * Get required PHP version
+     */
+    private function getRequiredPhpVersion(): string
+    {
+        return get_option('wc_licensed_product_requires_php', '8.3');
+    }
+}

src/Checkout/CheckoutBlocksIntegration.php

@@ -10,6 +10,8 @@ declare(strict_types=1);
 namespace Jeremias\WcLicensedProduct\Checkout;
 
 use Automattic\WooCommerce\Blocks\Integrations\IntegrationInterface;
+use Jeremias\WcLicensedProduct\Admin\SettingsController;
+use Jeremias\WcLicensedProduct\Product\LicensedProductVariation;
 
 /**
  * Integration with WooCommerce Checkout Blocks
@@ -30,7 +32,7 @@ final class CheckoutBlocksIntegration implements IntegrationInterface
     public function initialize(): void
     {
         $this->registerScripts();
-        $this->registerBlockExtensionData();
+        $this->registerAdditionalCheckoutFields();
     }
 
     /**
@@ -45,7 +47,7 @@ final class CheckoutBlocksIntegration implements IntegrationInterface
             wp_register_script(
                 'wc-licensed-product-checkout-blocks',
                 $scriptUrl,
-                ['wc-blocks-checkout', 'wp-element', 'wp-components', 'wp-i18n'],
+                ['wc-blocks-checkout', 'wp-element', 'wp-components', 'wp-i18n', 'wp-plugins', 'wp-data'],
                 WC_LICENSED_PRODUCT_VERSION,
                 true
             );
@@ -59,20 +61,33 @@ final class CheckoutBlocksIntegration implements IntegrationInterface
     }
 
     /**
-     * Register block extension data
+     * Register additional checkout fields using WooCommerce Blocks API
      */
-    private function registerBlockExtensionData(): void
+    private function registerAdditionalCheckoutFields(): void
     {
-        // Pass data to the checkout block script
-        add_filter(
-            'woocommerce_blocks_checkout_block_registration_data',
-            function (array $data): array {
-                $data['wc-licensed-product'] = [
-                    'hasLicensedProducts' => $this->cartHasLicensedProducts(),
-                ];
-                return $data;
+        add_action('woocommerce_blocks_loaded', function (): void {
+            // Check if the function exists (WooCommerce 8.9+)
+            if (!function_exists('woocommerce_register_additional_checkout_field')) {
+                return;
             }
-        );
+
+            // Register the domain field using WooCommerce's checkout fields API
+            // For single domain mode only (multi-domain uses custom JS component)
+            if (!SettingsController::isMultiDomainEnabled()) {
+                woocommerce_register_additional_checkout_field([
+                    'id' => 'wc-licensed-product/domain',
+                    'label' => __('License Domain', 'wc-licensed-product'),
+                    'location' => 'order',
+                    'type' => 'text',
+                    'required' => false,
+                    'attributes' => [
+                        'placeholder' => __('example.com', 'wc-licensed-product'),
+                        'pattern' => '^([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$',
+                        'title' => __('Enter a valid domain (without http:// or www)', 'wc-licensed-product'),
+                    ],
+                ]);
+            }
+        });
     }
 
     /**
@@ -96,13 +111,25 @@ final class CheckoutBlocksIntegration implements IntegrationInterface
      */
     public function get_script_data(): array
     {
+        $isMultiDomain = SettingsController::isMultiDomainEnabled();
+        $licensedProducts = $this->getLicensedProductsFromCart();
+        $hasLicensedProducts = !empty($licensedProducts);
+
         return [
-            'hasLicensedProducts' => $this->cartHasLicensedProducts(),
-            'fieldLabel' => __('Domain for License Activation', 'wc-licensed-product'),
+            'hasLicensedProducts' => $hasLicensedProducts,
+            'licensedProducts' => $licensedProducts,
+            'isMultiDomainEnabled' => $isMultiDomain,
             'fieldPlaceholder' => __('example.com', 'wc-licensed-product'),
-            'fieldDescription' => __('Enter the domain where you will use this license (without http:// or www).', 'wc-licensed-product'),
-            'sectionTitle' => __('License Domain', 'wc-licensed-product'),
-            'validationError' => __('Please enter a valid domain for your license activation.', 'wc-licensed-product'),
+            'fieldDescription' => $isMultiDomain
+                ? __('Enter a unique domain for each license (without http:// or www).', 'wc-licensed-product')
+                : __('Enter the domain where you will use the license (without http:// or www).', 'wc-licensed-product'),
+            'sectionTitle' => $isMultiDomain
+                ? __('License Domains', 'wc-licensed-product')
+                : __('License Domain', 'wc-licensed-product'),
+            'validationError' => __('Please enter a valid domain.', 'wc-licensed-product'),
+            'duplicateError' => __('Each license requires a unique domain.', 'wc-licensed-product'),
+            'licenseLabel' => __('License %d:', 'wc-licensed-product'),
+            'singleDomainLabel' => __('Domain', 'wc-licensed-product'),
         ];
     }
 
@@ -110,18 +137,74 @@ final class CheckoutBlocksIntegration implements IntegrationInterface
      * Check if cart contains licensed products
      */
     private function cartHasLicensedProducts(): bool
+    {
+        return !empty($this->getLicensedProductsFromCart());
+    }
+
+    /**
+     * Get licensed products from cart with quantities
+     *
+     * @return array<string, array{product_id: int, variation_id: int, name: string, quantity: int, duration_label: string}>
+     */
+    private function getLicensedProductsFromCart(): array
     {
         if (!WC()->cart) {
-            return false;
+            return [];
         }
 
-        foreach (WC()->cart->get_cart() as $cartItem) {
+        $licensedProducts = [];
+        $cartContents = WC()->cart->get_cart();
+
+        foreach ($cartContents as $cartKey => $cartItem) {
             $product = $cartItem['data'];
-            if ($product && $product->is_type('licensed')) {
-                return true;
+
+            if (!$product) {
+                continue;
+            }
+
+            // Check for simple licensed products
+            if ($product->is_type('licensed')) {
+                $productId = $product->get_id();
+                $licensedProducts[] = [
+                    'product_id' => $productId,
+                    'variation_id' => 0,
+                    'name' => $product->get_name(),
+                    'quantity' => (int) $cartItem['quantity'],
+                    'duration_label' => '',
+                ];
+                continue;
+            }
+
+            // Check for variations of licensed-variable products
+            // Use WC_Product_Factory::get_product_type() for reliable parent type check
+            $parentId = $product->get_parent_id();
+            if ($parentId) {
+                $parentType = \WC_Product_Factory::get_product_type($parentId);
+
+                if ($parentType === 'licensed-variable') {
+                    $variationId = $product->get_id();
+
+                    // Get duration label if it's a LicensedProductVariation
+                    $durationLabel = '';
+                    if ($product instanceof LicensedProductVariation) {
+                        $durationLabel = $product->get_license_duration_label();
+                    } else {
+                        // Try to instantiate as LicensedProductVariation
+                        $variation = new LicensedProductVariation($variationId);
+                        $durationLabel = $variation->get_license_duration_label();
+                    }
+
+                    $licensedProducts[] = [
+                        'product_id' => $parentId,
+                        'variation_id' => $variationId,
+                        'name' => $product->get_name(),
+                        'quantity' => (int) $cartItem['quantity'],
+                        'duration_label' => $durationLabel,
+                    ];
+                }
             }
         }
 
-        return false;
+        return $licensedProducts;
     }
 }

src/Checkout/CheckoutController.php

@@ -10,6 +10,8 @@ declare(strict_types=1);
 namespace Jeremias\WcLicensedProduct\Checkout;
 
 use Jeremias\WcLicensedProduct\License\LicenseManager;
+use Jeremias\WcLicensedProduct\Admin\SettingsController;
+use Jeremias\WcLicensedProduct\Product\LicensedProductVariation;
 
 /**
  * Handles checkout modifications for licensed products
@@ -50,35 +52,116 @@ final class CheckoutController
      */
     private function cartHasLicensedProducts(): bool
     {
-        if (!WC()->cart) {
-            return false;
-        }
-
-        foreach (WC()->cart->get_cart() as $cartItem) {
-            $product = $cartItem['data'];
-            if ($product && $product->is_type('licensed')) {
-                return true;
-            }
-        }
-
-        return false;
+        return !empty($this->getLicensedProductsFromCart());
     }
 
     /**
-     * Add domain field to checkout form
+     * Get licensed products from cart with quantities
+     *
+     * @return array<string, array{product_id: int, variation_id: int, name: string, quantity: int, duration_label: string}>
+     */
+    private function getLicensedProductsFromCart(): array
+    {
+        if (!WC()->cart) {
+            return [];
+        }
+
+        $licensedProducts = [];
+        foreach (WC()->cart->get_cart() as $cartItemKey => $cartItem) {
+            $product = $cartItem['data'];
+
+            if (!$product) {
+                continue;
+            }
+
+            // Check for simple licensed products
+            if ($product->is_type('licensed')) {
+                $productId = $product->get_id();
+                $licensedProducts[$productId] = [
+                    'product_id' => $productId,
+                    'variation_id' => 0,
+                    'name' => $product->get_name(),
+                    'quantity' => (int) $cartItem['quantity'],
+                    'duration_label' => '',
+                ];
+                continue;
+            }
+
+            // Check for variations of licensed-variable products
+            // Use WC_Product_Factory::get_product_type() for reliable parent type check
+            $parentId = $product->get_parent_id();
+            if ($parentId) {
+                $parentType = \WC_Product_Factory::get_product_type($parentId);
+
+                if ($parentType === 'licensed-variable') {
+                    $variationId = $product->get_id();
+                    // Use combination key to allow same product with different variations
+                    $key = "{$parentId}_{$variationId}";
+
+                    // Get duration label if it's a LicensedProductVariation
+                    $durationLabel = '';
+                    if ($product instanceof LicensedProductVariation) {
+                        $durationLabel = $product->get_license_duration_label();
+                    } else {
+                        // Try to instantiate as LicensedProductVariation
+                        $variation = new LicensedProductVariation($variationId);
+                        $durationLabel = $variation->get_license_duration_label();
+                    }
+
+                    $licensedProducts[$key] = [
+                        'product_id' => $parentId,
+                        'variation_id' => $variationId,
+                        'name' => $product->get_name(),
+                        'quantity' => (int) $cartItem['quantity'],
+                        'duration_label' => $durationLabel,
+                    ];
+                }
+            }
+        }
+
+        return $licensedProducts;
+    }
+
+    /**
+     * Add domain fields to checkout form
+     * Shows multiple domain fields if multi-domain is enabled, otherwise single field
      */
     public function addDomainField(): void
     {
-        if (!$this->cartHasLicensedProducts()) {
+        $licensedProducts = $this->getLicensedProductsFromCart();
+
+        if (empty($licensedProducts)) {
             return;
         }
 
+        // Check if multi-domain licensing is enabled
+        if (SettingsController::isMultiDomainEnabled()) {
+            $this->renderMultiDomainFields($licensedProducts);
+        } else {
+            $this->renderSingleDomainField();
+        }
+    }
+
+    /**
+     * Render single domain field (legacy mode)
+     */
+    private function renderSingleDomainField(): void
+    {
+        $savedValue = '';
+
+        // Check POST data first (validation failure case)
+        if (isset($_POST['licensed_product_domain'])) {
+            $savedValue = sanitize_text_field($_POST['licensed_product_domain']);
+        } elseif (WC()->session) {
+            $savedValue = WC()->session->get('licensed_product_domain', '');
+        }
+
         ?>
         <div id="licensed-product-domain-field">
             <h3><?php esc_html_e('License Domain', 'wc-licensed-product'); ?></h3>
             <p class="form-row form-row-wide">
                 <label for="licensed_product_domain">
-                    <?php esc_html_e('Domain for License Activation', 'wc-licensed-product'); ?>
+                    <?php esc_html_e('Domain', 'wc-licensed-product'); ?>
                     <abbr class="required" title="<?php esc_attr_e('required', 'wc-licensed-product'); ?>">*</abbr>
                 </label>
                 <input
@@ -87,10 +170,10 @@ final class CheckoutController
                     name="licensed_product_domain"
                     id="licensed_product_domain"
                     placeholder="<?php esc_attr_e('example.com', 'wc-licensed-product'); ?>"
-                    value="<?php echo esc_attr(WC()->checkout->get_value('licensed_product_domain')); ?>"
+                    value="<?php echo esc_attr($savedValue); ?>"
                 />
                 <span class="description">
-                    <?php esc_html_e('Enter the domain where you will use this license (without http:// or www).', 'wc-licensed-product'); ?>
+                    <?php esc_html_e('Enter the domain where you will use the license (without http:// or www).', 'wc-licensed-product'); ?>
                 </span>
             </p>
         </div>
@@ -98,62 +181,319 @@ final class CheckoutController
     }
 
     /**
-     * Validate domain field during checkout
+     * Render multi-domain fields (one per quantity)
+     */
+    private function renderMultiDomainFields(array $licensedProducts): void
+    {
+        ?>
+        <div id="licensed-product-domain-fields">
+            <h3><?php esc_html_e('License Domains', 'wc-licensed-product'); ?></h3>
+            <p class="wclp-domain-description">
+                <?php esc_html_e('Enter a unique domain for each license (without http:// or www).', 'wc-licensed-product'); ?>
+            </p>
+
+            <?php foreach ($licensedProducts as $key => $productData): ?>
+                <?php
+                $productId = $productData['product_id'];
+                $variationId = $productData['variation_id'] ?? 0;
+                $durationLabel = $productData['duration_label'] ?? '';
+                // Use key for field names to handle variations
+                $fieldKey = $variationId > 0 ? "{$productId}_{$variationId}" : $productId;
+                ?>
+                <div class="wclp-product-domains" data-product-id="<?php echo esc_attr($productId); ?>" data-variation-id="<?php echo esc_attr($variationId); ?>">
+                    <h4>
+                        <?php
+                        echo esc_html($productData['name']);
+                        if (!empty($durationLabel)) {
+                            echo ' <span class="wclp-duration-badge">(' . esc_html($durationLabel) . ')</span>';
+                        }
+                        if ($productData['quantity'] > 1) {
+                            printf(' ×%d', $productData['quantity']);
+                        }
+                        ?>
+                    </h4>
+
+                    <?php for ($i = 0; $i < $productData['quantity']; $i++): ?>
+                        <?php
+                        $fieldName = sprintf('licensed_domains[%s][%d]', $fieldKey, $i);
+                        $fieldId = sprintf('licensed_domain_%s_%d', str_replace('_', '-', $fieldKey), $i);
+                        $savedValue = $this->getSavedDomainValue($productId, $i, $variationId);
+                        ?>
+                        <p class="form-row form-row-wide wclp-domain-row">
+                            <label for="<?php echo esc_attr($fieldId); ?>">
+                                <?php
+                                printf(
+                                    /* translators: %d: license number */
+                                    esc_html__('License %d:', 'wc-licensed-product'),
+                                    $i + 1
+                                );
+                                ?>
+                                <abbr class="required" title="<?php esc_attr_e('required', 'wc-licensed-product'); ?>">*</abbr>
+                            </label>
+                            <input
+                                type="text"
+                                class="input-text wclp-domain-input"
+                                name="<?php echo esc_attr($fieldName); ?>"
+                                id="<?php echo esc_attr($fieldId); ?>"
+                                placeholder="<?php esc_attr_e('example.com', 'wc-licensed-product'); ?>"
+                                value="<?php echo esc_attr($savedValue); ?>"
+                            />
+                            <?php if ($variationId > 0): ?>
+                                <input type="hidden" name="licensed_variation_ids[<?php echo esc_attr($fieldKey); ?>]" value="<?php echo esc_attr($variationId); ?>" />
+                            <?php endif; ?>
+                        </p>
+                    <?php endfor; ?>
+                </div>
+            <?php endforeach; ?>
+        </div>
+        <style>
+            #licensed-product-domain-fields { margin-bottom: 20px; }
+            #licensed-product-domain-fields h3 { margin-bottom: 10px; }
+            .wclp-domain-description { margin-bottom: 15px; color: #666; }
+            .wclp-product-domains { margin-bottom: 20px; padding: 15px; background: #f8f8f8; border-radius: 4px; }
+            .wclp-product-domains h4 { margin: 0 0 10px 0; font-size: 1em; }
+            .wclp-duration-badge { color: #0073aa; font-weight: normal; }
+            .wclp-domain-row { margin-bottom: 10px; }
+            .wclp-domain-row:last-child { margin-bottom: 0; }
+            .wclp-domain-row label { display: block; margin-bottom: 5px; }
+        </style>
+        <?php
+    }
+
+    /**
+     * Get saved domain value from session/POST
+     */
+    private function getSavedDomainValue(int $productId, int $index, int $variationId = 0): string
+    {
+        // Build the field key (with or without variation)
+        $fieldKey = $variationId > 0 ? "{$productId}_{$variationId}" : (string) $productId;
+
+        // Check POST data first (validation failure case)
+        if (isset($_POST['licensed_domains'][$fieldKey][$index])) {
+            return sanitize_text_field($_POST['licensed_domains'][$fieldKey][$index]);
+        }
+
+        // Also try numeric key for backward compatibility
+        if (isset($_POST['licensed_domains'][$productId][$index])) {
+            return sanitize_text_field($_POST['licensed_domains'][$productId][$index]);
+        }
+
+        // Check session for blocks checkout
+        if (WC()->session) {
+            $sessionDomains = WC()->session->get('licensed_product_domains', []);
+            foreach ($sessionDomains as $item) {
+                $itemProductId = (int) ($item['product_id'] ?? 0);
+                $itemVariationId = (int) ($item['variation_id'] ?? 0);
+
+                // Match by product and variation
+                if ($itemProductId === $productId && $itemVariationId === $variationId) {
+                    if (isset($item['domains'][$index])) {
+                        return $item['domains'][$index];
+                    }
+                }
+            }
+        }
+
+        return '';
+    }
+
+    /**
+     * Validate domain fields during checkout
      */
     public function validateDomainField(): void
     {
-        if (!$this->cartHasLicensedProducts()) {
+        $licensedProducts = $this->getLicensedProductsFromCart();
+        if (empty($licensedProducts)) {
             return;
         }
 
-        $domain = isset($_POST['licensed_product_domain'])
-            ? sanitize_text_field($_POST['licensed_product_domain'])
-            : '';
+        // Check if multi-domain licensing is enabled
+        if (SettingsController::isMultiDomainEnabled()) {
+            $this->validateMultiDomainFields($licensedProducts);
+        } else {
+            $this->validateSingleDomainField();
+        }
+    }
+
+    /**
+     * Validate single domain field
+     */
+    private function validateSingleDomainField(): void
+    {
+        $domain = isset($_POST['licensed_product_domain']) ? sanitize_text_field($_POST['licensed_product_domain']) : '';
 
+        if (empty($domain)) {
+            wc_add_notice(__('Please enter a domain for your license.', 'wc-licensed-product'), 'error');
+            return;
+        }
+
+        $normalizedDomain = $this->licenseManager->normalizeDomain($domain);
+        if (!$this->isValidDomain($normalizedDomain)) {
+            wc_add_notice(__('Please enter a valid domain for your license.', 'wc-licensed-product'), 'error');
+        }
+    }
+
+    /**
+     * Validate multi-domain fields
+     */
+    private function validateMultiDomainFields(array $licensedProducts): void
+    {
+        $licensedDomains = $_POST['licensed_domains'] ?? [];
+
+        foreach ($licensedProducts as $key => $productData) {
+            $productId = $productData['product_id'];
+            $variationId = $productData['variation_id'] ?? 0;
+            $fieldKey = $variationId > 0 ? "{$productId}_{$variationId}" : (string) $productId;
+
+            $productDomains = $licensedDomains[$fieldKey] ?? $licensedDomains[$productId] ?? [];
+            $normalizedDomains = [];
+
+            for ($i = 0; $i < $productData['quantity']; $i++) {
+                $domain = isset($productDomains[$i]) ? sanitize_text_field($productDomains[$i]) : '';
+
+                // Check if domain is empty
                 if (empty($domain)) {
                     wc_add_notice(
-                __('Please enter a domain for your license activation.', 'wc-licensed-product'),
+                        sprintf(
+                            /* translators: 1: product name, 2: license number */
+                            __('Please enter a domain for %1$s (License %2$d).', 'wc-licensed-product'),
+                            $productData['name'],
+                            $i + 1
+                        ),
                         'error'
                     );
-            return;
+                    continue;
                 }
 
                 // Validate domain format
                 $normalizedDomain = $this->licenseManager->normalizeDomain($domain);
                 if (!$this->isValidDomain($normalizedDomain)) {
                     wc_add_notice(
-                __('Please enter a valid domain name.', 'wc-licensed-product'),
+                        sprintf(
+                            /* translators: 1: product name, 2: license number */
+                            __('Please enter a valid domain for %1$s (License %2$d).', 'wc-licensed-product'),
+                            $productData['name'],
+                            $i + 1
+                        ),
                         'error'
                     );
+                    continue;
+                }
+
+                // Check for duplicate domains within same product/variation
+                if (in_array($normalizedDomain, $normalizedDomains, true)) {
+                    wc_add_notice(
+                        sprintf(
+                            /* translators: 1: domain name, 2: product name */
+                            __('The domain "%1$s" is used multiple times for %2$s. Each license requires a unique domain.', 'wc-licensed-product'),
+                            $normalizedDomain,
+                            $productData['name']
+                        ),
+                        'error'
+                    );
+                } else {
+                    $normalizedDomains[] = $normalizedDomain;
+                }
+            }
         }
     }
 
     /**
-     * Save domain field to order meta
+     * Save domain fields to order meta
      */
     public function saveDomainField(int $orderId): void
     {
-        if (!$this->cartHasLicensedProducts()) {
+        $licensedProducts = $this->getLicensedProductsFromCart();
+
+        if (empty($licensedProducts)) {
             return;
         }
 
-        if (isset($_POST['licensed_product_domain']) && !empty($_POST['licensed_product_domain'])) {
-            $domain = sanitize_text_field($_POST['licensed_product_domain']);
-            $normalizedDomain = $this->licenseManager->normalizeDomain($domain);
-
         $order = wc_get_order($orderId);
-            if ($order) {
+        if (!$order) {
+            return;
+        }
+
+        // Check if multi-domain licensing is enabled
+        if (SettingsController::isMultiDomainEnabled()) {
+            $this->saveMultiDomainFields($order, $licensedProducts);
+        } else {
+            $this->saveSingleDomainField($order);
+        }
+    }
+
+    /**
+     * Save single domain field to order meta (legacy format)
+     */
+    private function saveSingleDomainField(\WC_Order $order): void
+    {
+        $domain = isset($_POST['licensed_product_domain']) ? sanitize_text_field($_POST['licensed_product_domain']) : '';
+
+        if (!empty($domain)) {
+            $normalizedDomain = $this->licenseManager->normalizeDomain($domain);
             $order->update_meta_data('_licensed_product_domain', $normalizedDomain);
             $order->save();
         }
     }
+
+    /**
+     * Save multi-domain fields to order meta
+     */
+    private function saveMultiDomainFields(\WC_Order $order, array $licensedProducts): void
+    {
+        $licensedDomains = $_POST['licensed_domains'] ?? [];
+        $licensedVariationIds = $_POST['licensed_variation_ids'] ?? [];
+        $domainData = [];
+
+        foreach ($licensedProducts as $key => $productData) {
+            $productId = $productData['product_id'];
+            $variationId = $productData['variation_id'] ?? 0;
+            $fieldKey = $variationId > 0 ? "{$productId}_{$variationId}" : (string) $productId;
+
+            $productDomains = $licensedDomains[$fieldKey] ?? $licensedDomains[$productId] ?? [];
+            $normalizedDomains = [];
+
+            for ($i = 0; $i < $productData['quantity']; $i++) {
+                $domain = isset($productDomains[$i]) ? sanitize_text_field($productDomains[$i]) : '';
+                if (!empty($domain)) {
+                    $normalizedDomains[] = $this->licenseManager->normalizeDomain($domain);
+                }
+            }
+
+            if (!empty($normalizedDomains)) {
+                $entry = [
+                    'product_id' => $productId,
+                    'domains' => $normalizedDomains,
+                ];
+
+                // Include variation_id if present
+                if ($variationId > 0) {
+                    $entry['variation_id'] = $variationId;
+                }
+
+                $domainData[] = $entry;
+            }
+        }
+
+        if (!empty($domainData)) {
+            $order->update_meta_data('_licensed_product_domains', $domainData);
+            $order->save();
+        }
     }
 
     /**
-     * Display domain in admin order view
+     * Display domains in admin order view
      */
     public function displayDomainInAdmin(\WC_Order $order): void
     {
+        // Try new multi-domain format first
+        $domainData = $order->get_meta('_licensed_product_domains');
+        if (!empty($domainData) && is_array($domainData)) {
+            $this->displayMultiDomainsInAdmin($domainData);
+            return;
+        }
+
+        // Fall back to legacy single domain
         $domain = $order->get_meta('_licensed_product_domain');
         if (!$domain) {
             return;
@@ -168,10 +508,54 @@ final class CheckoutController
     }
 
     /**
-     * Display domain in order emails
+     * Display multi-domain data in admin
+     */
+    private function displayMultiDomainsInAdmin(array $domainData): void
+    {
+        ?>
+        <div class="wclp-order-domains">
+            <strong><?php esc_html_e('License Domains:', 'wc-licensed-product'); ?></strong>
+            <?php foreach ($domainData as $item): ?>
+                <?php
+                $productId = $item['product_id'];
+                $variationId = $item['variation_id'] ?? 0;
+
+                // Get product name
+                if ($variationId > 0) {
+                    $variation = wc_get_product($variationId);
+                    $productName = $variation ? $variation->get_name() : __('Unknown Variation', 'wc-licensed-product');
+
+                    // Add duration label if available
+                    if ($variation instanceof LicensedProductVariation) {
+                        $productName .= ' (' . $variation->get_license_duration_label() . ')';
+                    }
+                } else {
+                    $product = wc_get_product($productId);
+                    $productName = $product ? $product->get_name() : __('Unknown Product', 'wc-licensed-product');
+                }
+                ?>
+                <p style="margin: 5px 0 5px 15px;">
+                    <em><?php echo esc_html($productName); ?>:</em><br>
+                    <?php echo esc_html(implode(', ', $item['domains'])); ?>
+                </p>
+            <?php endforeach; ?>
+        </div>
+        <?php
+    }
+
+    /**
+     * Display domains in order emails
      */
     public function displayDomainInEmail(\WC_Order $order, bool $sentToAdmin, bool $plainText): void
     {
+        // Try new multi-domain format first
+        $domainData = $order->get_meta('_licensed_product_domains');
+        if (!empty($domainData) && is_array($domainData)) {
+            $this->displayMultiDomainsInEmail($domainData, $plainText);
+            return;
+        }
+
+        // Fall back to legacy single domain
         $domain = $order->get_meta('_licensed_product_domain');
         if (!$domain) {
             return;
@@ -189,6 +573,60 @@ final class CheckoutController
         }
     }
 
+    /**
+     * Display multi-domain data in email
+     */
+    private function displayMultiDomainsInEmail(array $domainData, bool $plainText): void
+    {
+        if ($plainText) {
+            echo "\n" . esc_html__('License Domains:', 'wc-licensed-product') . "\n";
+            foreach ($domainData as $item) {
+                $productId = $item['product_id'];
+                $variationId = $item['variation_id'] ?? 0;
+
+                if ($variationId > 0) {
+                    $variation = wc_get_product($variationId);
+                    $productName = $variation ? $variation->get_name() : __('Unknown Variation', 'wc-licensed-product');
+                    if ($variation instanceof LicensedProductVariation) {
+                        $productName .= ' (' . $variation->get_license_duration_label() . ')';
+                    }
+                } else {
+                    $product = wc_get_product($productId);
+                    $productName = $product ? $product->get_name() : __('Unknown Product', 'wc-licensed-product');
+                }
+
+                echo '  ' . esc_html($productName) . ': ' . esc_html(implode(', ', $item['domains'])) . "\n";
+            }
+        } else {
+            ?>
+            <div style="margin-bottom: 15px;">
+                <strong><?php esc_html_e('License Domains:', 'wc-licensed-product'); ?></strong>
+                <?php foreach ($domainData as $item): ?>
+                    <?php
+                    $productId = $item['product_id'];
+                    $variationId = $item['variation_id'] ?? 0;
+
+                    if ($variationId > 0) {
+                        $variation = wc_get_product($variationId);
+                        $productName = $variation ? $variation->get_name() : __('Unknown Variation', 'wc-licensed-product');
+                        if ($variation instanceof LicensedProductVariation) {
+                            $productName .= ' (' . $variation->get_license_duration_label() . ')';
+                        }
+                    } else {
+                        $product = wc_get_product($productId);
+                        $productName = $product ? $product->get_name() : __('Unknown Product', 'wc-licensed-product');
+                    }
+                    ?>
+                    <p style="margin: 5px 0 5px 15px;">
+                        <em><?php echo esc_html($productName); ?>:</em><br>
+                        <?php echo esc_html(implode(', ', $item['domains'])); ?>
+                    </p>
+                <?php endforeach; ?>
+            </div>
+            <?php
+        }
+    }
+
     /**
      * Validate domain format
      */

src/Checkout/StoreApiExtension.php

@@ -12,6 +12,7 @@ namespace Jeremias\WcLicensedProduct\Checkout;
 use Automattic\WooCommerce\StoreApi\Schemas\V1\CheckoutSchema;
 use Automattic\WooCommerce\StoreApi\StoreApi;
 use Automattic\WooCommerce\StoreApi\Schemas\ExtendSchema;
+use Jeremias\WcLicensedProduct\Admin\SettingsController;
 use Jeremias\WcLicensedProduct\License\LicenseManager;
 
 /**
@@ -70,6 +71,12 @@ final class StoreApiExtension
      */
     public function getExtensionData(): array
     {
+        if (SettingsController::isMultiDomainEnabled()) {
+            return [
+                'licensed_product_domains' => WC()->session ? WC()->session->get('licensed_product_domains', []) : [],
+            ];
+        }
+
         return [
             'licensed_product_domain' => WC()->session ? WC()->session->get('licensed_product_domain', '') : '',
         ];
@@ -80,6 +87,34 @@ final class StoreApiExtension
      */
     public function getExtensionSchema(): array
     {
+        if (SettingsController::isMultiDomainEnabled()) {
+            return [
+                'licensed_product_domains' => [
+                    'description' => __('Domains for license activation by product', 'wc-licensed-product'),
+                    'type' => 'array',
+                    'context' => ['view', 'edit'],
+                    'readonly' => false,
+                    'items' => [
+                        'type' => 'object',
+                        'properties' => [
+                            'product_id' => [
+                                'type' => 'integer',
+                            ],
+                            'variation_id' => [
+                                'type' => 'integer',
+                            ],
+                            'domains' => [
+                                'type' => 'array',
+                                'items' => [
+                                    'type' => 'string',
+                                ],
+                            ],
+                        ],
+                    ],
+                ],
+            ];
+        }
+
         return [
             'licensed_product_domain' => [
                 'description' => __('Domain for license activation', 'wc-licensed-product'),
@@ -95,30 +130,116 @@ final class StoreApiExtension
      */
     public function handleExtensionUpdate(array $data): void
     {
-        if (isset($data['licensed_product_domain'])) {
-            $domain = sanitize_text_field($data['licensed_product_domain']);
-            $normalizedDomain = $this->licenseManager->normalizeDomain($domain);
+        if (SettingsController::isMultiDomainEnabled()) {
+            // Multi-domain mode
+            if (isset($data['licensed_product_domains']) && is_array($data['licensed_product_domains'])) {
+                $normalizedData = $this->normalizeDomainsData($data['licensed_product_domains']);
 
                 if (WC()->session) {
-                WC()->session->set('licensed_product_domain', $normalizedDomain);
+                    WC()->session->set('licensed_product_domains', $normalizedData);
+                }
+            }
+        } else {
+            // Single domain mode
+            if (isset($data['licensed_product_domain'])) {
+                $sanitized = sanitize_text_field($data['licensed_product_domain']);
+                $normalized = $this->licenseManager->normalizeDomain($sanitized);
+
+                if (WC()->session) {
+                    WC()->session->set('licensed_product_domain', $normalized);
+                }
             }
         }
     }
 
     /**
-     * Process the checkout order - save domain to order meta
+     * Normalize domains data from frontend
+     */
+    private function normalizeDomainsData(array $domainsData): array
+    {
+        $normalized = [];
+
+        foreach ($domainsData as $item) {
+            if (!isset($item['product_id']) || !isset($item['domains']) || !is_array($item['domains'])) {
+                continue;
+            }
+
+            $productId = (int) $item['product_id'];
+            $variationId = isset($item['variation_id']) ? (int) $item['variation_id'] : 0;
+            $domains = [];
+
+            foreach ($item['domains'] as $domain) {
+                $sanitized = sanitize_text_field($domain);
+                if (!empty($sanitized)) {
+                    $domains[] = $this->licenseManager->normalizeDomain($sanitized);
+                }
+            }
+
+            if (!empty($domains)) {
+                $entry = [
+                    'product_id' => $productId,
+                    'domains' => $domains,
+                ];
+
+                // Include variation_id if present
+                if ($variationId > 0) {
+                    $entry['variation_id'] = $variationId;
+                }
+
+                $normalized[] = $entry;
+            }
+        }
+
+        return $normalized;
+    }
+
+    /**
+     * Process the checkout order - save domains to order meta
      */
     public function processCheckoutOrder(\WC_Order $order): void
     {
-        $domain = WC()->session ? WC()->session->get('licensed_product_domain', '') : '';
-
-        // Also check in the request data for block checkout
-        if (empty($domain)) {
         $requestData = json_decode(file_get_contents('php://input'), true);
-            if (isset($requestData['extensions'][self::IDENTIFIER]['licensed_product_domain'])) {
-                $domain = sanitize_text_field($requestData['extensions'][self::IDENTIFIER]['licensed_product_domain']);
-                $domain = $this->licenseManager->normalizeDomain($domain);
+
+        // Handle JSON decode errors gracefully
+        if (json_last_error() !== JSON_ERROR_NONE) {
+            $requestData = null;
         }
+
+        if (SettingsController::isMultiDomainEnabled()) {
+            $this->processMultiDomainOrder($order, $requestData);
+        } else {
+            $this->processSingleDomainOrder($order, $requestData);
+        }
+    }
+
+    /**
+     * Process order in single domain mode (legacy)
+     */
+    private function processSingleDomainOrder(\WC_Order $order, ?array $requestData): void
+    {
+        $domain = '';
+
+        // Check session first
+        if (WC()->session) {
+            $domain = WC()->session->get('licensed_product_domain', '');
+        }
+
+        // Check in the request data for block checkout (extension data)
+        if (empty($domain) && isset($requestData['extensions'][self::IDENTIFIER]['licensed_product_domain'])) {
+            $sanitized = sanitize_text_field($requestData['extensions'][self::IDENTIFIER]['licensed_product_domain']);
+            $domain = $this->licenseManager->normalizeDomain($sanitized);
+        }
+
+        // Check for wclp_license_domain (from our hidden input)
+        if (empty($domain) && isset($requestData['wclp_license_domain'])) {
+            $sanitized = sanitize_text_field($requestData['wclp_license_domain']);
+            $domain = $this->licenseManager->normalizeDomain($sanitized);
+        }
+
+        // Check for additional_fields (WC Blocks API)
+        if (empty($domain) && isset($requestData['additional_fields']['wc-licensed-product/domain'])) {
+            $sanitized = sanitize_text_field($requestData['additional_fields']['wc-licensed-product/domain']);
+            $domain = $this->licenseManager->normalizeDomain($sanitized);
         }
 
         if (!empty($domain)) {
@@ -131,4 +252,84 @@ final class StoreApiExtension
             }
         }
     }
+
+    /**
+     * Process order in multi-domain mode
+     */
+    private function processMultiDomainOrder(\WC_Order $order, ?array $requestData): void
+    {
+        $domainData = [];
+
+        // Check session first
+        if (WC()->session) {
+            $domainData = WC()->session->get('licensed_product_domains', []);
+        }
+
+        // Check in the request data for block checkout (extension data)
+        if (empty($domainData) && isset($requestData['extensions'][self::IDENTIFIER]['licensed_product_domains'])) {
+            $domainData = $this->normalizeDomainsData(
+                $requestData['extensions'][self::IDENTIFIER]['licensed_product_domains']
+            );
+        }
+
+        // Check for wclp_license_domains (from our hidden input - JSON string)
+        if (empty($domainData) && isset($requestData['wclp_license_domains'])) {
+            $parsed = json_decode($requestData['wclp_license_domains'], true);
+            if (json_last_error() === JSON_ERROR_NONE && is_array($parsed)) {
+                $domainData = $this->normalizeDomainsData($parsed);
+            }
+        }
+
+        // Check for licensed_domains in classic format (from DOM injection)
+        if (empty($domainData) && isset($requestData['licensed_domains']) && is_array($requestData['licensed_domains'])) {
+            $domainData = [];
+            $variationIds = $requestData['licensed_variation_ids'] ?? [];
+
+            foreach ($requestData['licensed_domains'] as $key => $domains) {
+                if (!is_array($domains)) {
+                    continue;
+                }
+
+                // Parse key - could be "productId" or "productId_variationId"
+                $parts = explode('_', (string) $key);
+                $productId = (int) $parts[0];
+                $variationId = isset($parts[1]) ? (int) $parts[1] : 0;
+
+                // Also check for hidden variation ID field
+                if ($variationId === 0 && isset($variationIds[$key])) {
+                    $variationId = (int) $variationIds[$key];
+                }
+
+                $normalizedDomains = [];
+                foreach ($domains as $domain) {
+                    $sanitized = sanitize_text_field($domain);
+                    if (!empty($sanitized)) {
+                        $normalizedDomains[] = $this->licenseManager->normalizeDomain($sanitized);
+                    }
+                }
+                if (!empty($normalizedDomains)) {
+                    $entry = [
+                        'product_id' => $productId,
+                        'domains' => $normalizedDomains,
+                    ];
+
+                    if ($variationId > 0) {
+                        $entry['variation_id'] = $variationId;
+                    }
+
+                    $domainData[] = $entry;
+                }
+            }
+        }
+
+        if (!empty($domainData)) {
+            $order->update_meta_data('_licensed_product_domains', $domainData);
+            $order->save();
+
+            // Clear session data
+            if (WC()->session) {
+                WC()->session->set('licensed_product_domains', []);
+            }
+        }
+    }
 }

src/Common/RateLimitTrait.php

@@ -0,0 +1,91 @@
+<?php
+/**
+ * Rate Limit Trait
+ *
+ * Provides rate limiting functionality for frontend operations.
+ *
+ * @package Jeremias\WcLicensedProduct\Common
+ */
+
+declare(strict_types=1);
+
+namespace Jeremias\WcLicensedProduct\Common;
+
+/**
+ * Trait for implementing rate limiting on user actions
+ *
+ * Uses WordPress transients for storage. Rate limits are per-user when logged in,
+ * or per-IP when not logged in.
+ */
+trait RateLimitTrait
+{
+    /**
+     * Check rate limit for a user action
+     *
+     * @param string $action Action identifier (e.g., 'transfer', 'download')
+     * @param int $limit Maximum attempts per window
+     * @param int $window Time window in seconds
+     * @return bool True if within limit, false if exceeded
+     */
+    protected function checkUserRateLimit(string $action, int $limit, int $window): bool
+    {
+        $userId = get_current_user_id();
+        $key = $userId > 0
+            ? (string) $userId
+            : 'ip_' . md5($_SERVER['REMOTE_ADDR'] ?? '0.0.0.0');
+
+        $transientKey = 'wclp_rate_' . $action . '_' . $key;
+        $data = get_transient($transientKey);
+
+        if ($data === false) {
+            // First request, start counting
+            set_transient($transientKey, ['count' => 1, 'start' => time()], $window);
+            return true;
+        }
+
+        $count = (int) ($data['count'] ?? 0);
+        $start = (int) ($data['start'] ?? time());
+
+        // Check if window has expired
+        if (time() - $start >= $window) {
+            // Reset counter
+            set_transient($transientKey, ['count' => 1, 'start' => time()], $window);
+            return true;
+        }
+
+        // Check if limit exceeded
+        if ($count >= $limit) {
+            return false;
+        }
+
+        // Increment counter
+        set_transient($transientKey, ['count' => $count + 1, 'start' => $start], $window);
+        return true;
+    }
+
+    /**
+     * Get remaining time until rate limit resets
+     *
+     * @param string $action Action identifier
+     * @param int $window Time window in seconds (must match the one used in checkUserRateLimit)
+     * @return int Seconds until rate limit resets, or 0 if not rate limited
+     */
+    protected function getRateLimitRetryAfter(string $action, int $window): int
+    {
+        $userId = get_current_user_id();
+        $key = $userId > 0
+            ? (string) $userId
+            : 'ip_' . md5($_SERVER['REMOTE_ADDR'] ?? '0.0.0.0');
+
+        $transientKey = 'wclp_rate_' . $action . '_' . $key;
+        $data = get_transient($transientKey);
+
+        if ($data === false) {
+            return 0;
+        }
+
+        $start = (int) ($data['start'] ?? time());
+
+        return max(0, $window - (time() - $start));
+    }
+}

src/Email/LicenseEmailController.php

@@ -55,6 +55,7 @@ final class LicenseEmailController
     public function registerEmailClasses(array $email_classes): array
     {
         $email_classes['WCLP_License_Expiration'] = new LicenseExpirationEmail();
+        $email_classes['WCLP_License_Expired'] = new LicenseExpiredEmail();
         return $email_classes;
     }
 
@@ -69,10 +70,13 @@ final class LicenseEmailController
     }
 
     /**
-     * Send expiration warning emails
+     * Send expiration warning emails and auto-expire licenses
      */
     public function sendExpirationWarnings(): void
     {
+        // First, auto-expire licenses that have passed their expiration date
+        $this->autoExpireAndNotify();
+
         // Check if expiration emails are enabled in settings
         if (!SettingsController::isExpirationEmailsEnabled()) {
             return;
@@ -107,6 +111,41 @@ final class LicenseEmailController
         }
     }
 
+    /**
+     * Auto-expire licenses and send expired notifications
+     */
+    private function autoExpireAndNotify(): void
+    {
+        // Get licenses that should be auto-expired
+        $expiredActiveLicenses = $this->licenseManager->getExpiredActiveLicenses();
+
+        if (empty($expiredActiveLicenses)) {
+            return;
+        }
+
+        // Get the WooCommerce email instance for expired notifications
+        $mailer = WC()->mailer();
+        $emails = $mailer->get_emails();
+
+        /** @var LicenseExpiredEmail|null $expiredEmail */
+        $expiredEmail = $emails['WCLP_License_Expired'] ?? null;
+
+        foreach ($expiredActiveLicenses as $license) {
+            // Auto-expire the license
+            $wasExpired = $this->licenseManager->autoExpireLicense($license->getId());
+
+            if ($wasExpired && $expiredEmail && $expiredEmail->is_enabled()) {
+                // Check if we haven't already sent an expired notification
+                if (!$this->licenseManager->wasExpirationNotified($license->getId(), 'license_expired')) {
+                    // Send expired notification email
+                    if ($expiredEmail->trigger($license)) {
+                        $this->licenseManager->markExpirationNotified($license->getId(), 'license_expired');
+                    }
+                }
+            }
+        }
+    }
+
     /**
      * Process and send expiration warnings for a specific time frame
      *
@@ -155,7 +194,7 @@ final class LicenseEmailController
     }
 
     /**
-     * Add license key to order item in email
+     * Add license key(s) to order item in email
      */
     public function addLicenseToOrderItem(int $itemId, \WC_Order_Item $item, \WC_Order $order, bool $plainText): void
     {
@@ -164,85 +203,106 @@ final class LicenseEmailController
             return;
         }
 
-        $license = $this->licenseManager->getLicenseByOrderAndProduct($order->get_id(), $product->get_id());
-        if (!$license) {
+        $licenses = $this->licenseManager->getLicensesByOrderAndProduct($order->get_id(), $product->get_id());
+        if (empty($licenses)) {
             return;
         }
 
         if ($plainText) {
-            echo "\n" . esc_html__('License Key:', 'wc-licensed-product') . ' ' . esc_html($license->getLicenseKey()) . "\n";
+            echo "\n" . esc_html__('License Keys:', 'wc-licensed-product') . "\n";
+            foreach ($licenses as $license) {
+                echo '  - ' . esc_html($license->getLicenseKey());
+                echo ' (' . esc_html($license->getDomain()) . ')' . "\n";
+            }
         } else {
             ?>
             <div style="margin-top: 10px; padding: 10px; background-color: #f8f9fa; border-left: 3px solid #7f54b3;">
-                <strong><?php esc_html_e('License Key:', 'wc-licensed-product'); ?></strong>
-                <code style="display: block; margin-top: 5px; padding: 5px; background: #fff; font-family: monospace;">
+                <strong><?php esc_html_e('License Keys:', 'wc-licensed-product'); ?></strong>
+                <?php foreach ($licenses as $license) : ?>
+                    <div style="margin-top: 5px; padding: 5px; background: #fff;">
+                        <code style="font-family: monospace;">
                             <?php echo esc_html($license->getLicenseKey()); ?>
                         </code>
+                        <span style="color: #666; margin-left: 10px;">
+                            <?php echo esc_html($license->getDomain()); ?>
+                        </span>
+                    </div>
+                <?php endforeach; ?>
             </div>
             <?php
         }
     }
 
     /**
-     * Get all licenses for an order
+     * Get all licenses for an order grouped by product
+     *
+     * @return array Array of products with their licenses
      */
     private function getLicensesForOrder(\WC_Order $order): array
     {
-        $licenses = [];
+        $products = [];
 
         foreach ($order->get_items() as $item) {
             $product = $item->get_product();
             if ($product && $product->is_type('licensed')) {
-                $license = $this->licenseManager->getLicenseByOrderAndProduct($order->get_id(), $product->get_id());
-                if ($license) {
-                    $licenses[] = [
-                        'license' => $license,
+                $licenses = $this->licenseManager->getLicensesByOrderAndProduct($order->get_id(), $product->get_id());
+                if (!empty($licenses)) {
+                    $products[] = [
                         'product_name' => $product->get_name(),
+                        'licenses' => $licenses,
                     ];
                 }
             }
         }
 
-        return $licenses;
+        return $products;
     }
 
     /**
      * Render license info in HTML format
      */
-    private function renderHtmlLicenseInfo(array $licenses, \WC_Order $order): void
+    private function renderHtmlLicenseInfo(array $products, \WC_Order $order): void
     {
-        $domain = $order->get_meta('_licensed_product_domain');
         ?>
         <div style="margin: 20px 0; padding: 20px; background-color: #f8f9fa; border: 1px solid #e5e5e5; border-radius: 4px;">
             <h2 style="margin-top: 0; color: #333;"><?php esc_html_e('Your License Keys', 'wc-licensed-product'); ?></h2>
 
-            <?php if ($domain) : ?>
-                <p style="margin-bottom: 15px;">
-                    <strong><?php esc_html_e('Licensed Domain:', 'wc-licensed-product'); ?></strong>
-                    <?php echo esc_html($domain); ?>
-                </p>
-            <?php endif; ?>
+            <?php foreach ($products as $product) : ?>
+                <div style="margin-bottom: 20px;">
+                    <h3 style="margin: 0 0 10px 0; font-size: 1.1em; color: #333;">
+                        <?php echo esc_html($product['product_name']); ?>
+                        <span style="font-weight: normal; color: #666; font-size: 0.9em;">
+                            (<?php
+                            printf(
+                                esc_html(_n('%d license', '%d licenses', count($product['licenses']), 'wc-licensed-product')),
+                                count($product['licenses'])
+                            );
+                            ?>)
+                        </span>
+                    </h3>
 
-            <table style="width: 100%; border-collapse: collapse;">
+                    <table style="width: 100%; border-collapse: collapse; background: #fff;">
                         <thead>
                             <tr>
-                        <th style="text-align: left; padding: 10px; border-bottom: 2px solid #ddd;"><?php esc_html_e('Product', 'wc-licensed-product'); ?></th>
-                        <th style="text-align: left; padding: 10px; border-bottom: 2px solid #ddd;"><?php esc_html_e('License Key', 'wc-licensed-product'); ?></th>
-                        <th style="text-align: left; padding: 10px; border-bottom: 2px solid #ddd;"><?php esc_html_e('Expires', 'wc-licensed-product'); ?></th>
+                                <th style="text-align: left; padding: 8px 10px; border-bottom: 2px solid #ddd; font-size: 0.9em;"><?php esc_html_e('License Key', 'wc-licensed-product'); ?></th>
+                                <th style="text-align: left; padding: 8px 10px; border-bottom: 2px solid #ddd; font-size: 0.9em;"><?php esc_html_e('Domain', 'wc-licensed-product'); ?></th>
+                                <th style="text-align: left; padding: 8px 10px; border-bottom: 2px solid #ddd; font-size: 0.9em;"><?php esc_html_e('Expires', 'wc-licensed-product'); ?></th>
                             </tr>
                         </thead>
                         <tbody>
-                    <?php foreach ($licenses as $item) : ?>
+                            <?php foreach ($product['licenses'] as $license) : ?>
                                 <tr>
-                            <td style="padding: 10px; border-bottom: 1px solid #eee;"><?php echo esc_html($item['product_name']); ?></td>
-                            <td style="padding: 10px; border-bottom: 1px solid #eee;">
-                                <code style="background: #fff; padding: 3px 6px; font-family: monospace;">
-                                    <?php echo esc_html($item['license']->getLicenseKey()); ?>
+                                    <td style="padding: 8px 10px; border-bottom: 1px solid #eee;">
+                                        <code style="background: #f5f5f5; padding: 3px 6px; font-family: monospace; font-size: 0.9em;">
+                                            <?php echo esc_html($license->getLicenseKey()); ?>
                                         </code>
                                     </td>
-                            <td style="padding: 10px; border-bottom: 1px solid #eee;">
+                                    <td style="padding: 8px 10px; border-bottom: 1px solid #eee;">
+                                        <?php echo esc_html($license->getDomain()); ?>
+                                    </td>
+                                    <td style="padding: 8px 10px; border-bottom: 1px solid #eee;">
                                         <?php
-                                $expiresAt = $item['license']->getExpiresAt();
+                                        $expiresAt = $license->getExpiresAt();
                                         echo $expiresAt
                                             ? esc_html($expiresAt->format(get_option('date_format')))
                                             : esc_html__('Never', 'wc-licensed-product');
@@ -252,6 +312,8 @@ final class LicenseEmailController
                             <?php endforeach; ?>
                         </tbody>
                     </table>
+                </div>
+            <?php endforeach; ?>
 
             <p style="margin-top: 15px; margin-bottom: 0; font-size: 0.9em; color: #666;">
                 <?php esc_html_e('You can also view your licenses in your account under "Licenses".', 'wc-licensed-product'); ?>
@@ -263,30 +325,34 @@ final class LicenseEmailController
     /**
      * Render license info in plain text format
      */
-    private function renderPlainTextLicenseInfo(array $licenses, \WC_Order $order): void
+    private function renderPlainTextLicenseInfo(array $products, \WC_Order $order): void
     {
-        $domain = $order->get_meta('_licensed_product_domain');
-
         echo "\n\n";
         echo "==========================================================\n";
         echo esc_html__('YOUR LICENSE KEYS', 'wc-licensed-product') . "\n";
         echo "==========================================================\n\n";
 
-        if ($domain) {
-            echo esc_html__('Licensed Domain:', 'wc-licensed-product') . ' ' . esc_html($domain) . "\n\n";
-        }
+        foreach ($products as $product) {
+            echo esc_html($product['product_name']);
+            echo ' (' . count($product['licenses']) . ' ' .
+                _n('license', 'licenses', count($product['licenses']), 'wc-licensed-product') . ')';
+            echo "\n";
+            echo "-----------------------------------------------------------\n";
 
-        foreach ($licenses as $item) {
-            echo esc_html($item['product_name']) . "\n";
-            echo esc_html__('License Key:', 'wc-licensed-product') . ' ' . esc_html($item['license']->getLicenseKey()) . "\n";
-
-            $expiresAt = $item['license']->getExpiresAt();
+            foreach ($product['licenses'] as $license) {
+                echo esc_html__('License Key:', 'wc-licensed-product') . ' ';
+                echo esc_html($license->getLicenseKey()) . "\n";
+                echo esc_html__('Domain:', 'wc-licensed-product') . ' ';
+                echo esc_html($license->getDomain()) . "\n";
                 echo esc_html__('Expires:', 'wc-licensed-product') . ' ';
+
+                $expiresAt = $license->getExpiresAt();
                 echo $expiresAt
                     ? esc_html($expiresAt->format(get_option('date_format')))
                     : esc_html__('Never', 'wc-licensed-product');
                 echo "\n\n";
             }
+        }
 
         echo esc_html__('You can also view your licenses in your account under "Licenses".', 'wc-licensed-product') . "\n";
         echo "==========================================================\n\n";

src/Email/LicenseExpiredEmail.php

@@ -0,0 +1,335 @@
+<?php
+/**
+ * License Expired Email
+ *
+ * @package Jeremias\WcLicensedProduct\Email
+ */
+
+declare(strict_types=1);
+
+namespace Jeremias\WcLicensedProduct\Email;
+
+use Jeremias\WcLicensedProduct\License\License;
+use WC_Email;
+
+/**
+ * License Expired Email class
+ *
+ * Sends email notifications to customers when their licenses have expired.
+ * Uses WooCommerce's transactional email system for consistent styling and customization.
+ */
+class LicenseExpiredEmail extends WC_Email
+{
+    /**
+     * License object
+     */
+    public ?License $license = null;
+
+    /**
+     * Product name
+     */
+    public string $product_name = '';
+
+    /**
+     * Expiration date formatted
+     */
+    public string $expiration_date = '';
+
+    /**
+     * Customer display name
+     */
+    public string $customer_name = '';
+
+    /**
+     * Constructor
+     */
+    public function __construct()
+    {
+        $this->id = 'wclp_license_expired';
+        $this->customer_email = true;
+        $this->title = __('License Expired', 'wc-licensed-product');
+        $this->description = __('License expired emails are sent to customers when their licenses have expired.', 'wc-licensed-product');
+
+        $this->placeholders = [
+            '{site_title}' => $this->get_blogname(),
+            '{product_name}' => '',
+            '{expiration_date}' => '',
+        ];
+
+        // Call parent constructor
+        parent::__construct();
+    }
+
+    /**
+     * Get email subject
+     */
+    public function get_default_subject(): string
+    {
+        return __('[{site_title}] Your license for {product_name} has expired', 'wc-licensed-product');
+    }
+
+    /**
+     * Get email heading
+     */
+    public function get_default_heading(): string
+    {
+        return __('License Expired', 'wc-licensed-product');
+    }
+
+    /**
+     * Trigger the email
+     *
+     * @param License $license License object
+     */
+    public function trigger(License $license): bool
+    {
+        $this->setup_locale();
+
+        $customer = get_userdata($license->getCustomerId());
+        if (!$customer || !$customer->user_email) {
+            $this->restore_locale();
+            return false;
+        }
+
+        $this->license = $license;
+        $this->recipient = $customer->user_email;
+        $this->customer_name = $customer->display_name ?: __('Customer', 'wc-licensed-product');
+
+        $product = wc_get_product($license->getProductId());
+        $this->product_name = $product ? $product->get_name() : __('Unknown Product', 'wc-licensed-product');
+
+        $expiresAt = $license->getExpiresAt();
+        $this->expiration_date = $expiresAt ? $expiresAt->format(get_option('date_format')) : '';
+
+        // Update placeholders
+        $this->placeholders['{product_name}'] = $this->product_name;
+        $this->placeholders['{expiration_date}'] = $this->expiration_date;
+
+        if (!$this->is_enabled() || !$this->get_recipient()) {
+            $this->restore_locale();
+            return false;
+        }
+
+        $result = $this->send(
+            $this->get_recipient(),
+            $this->get_subject(),
+            $this->get_content(),
+            $this->get_headers(),
+            $this->get_attachments()
+        );
+
+        $this->restore_locale();
+
+        return $result;
+    }
+
+    /**
+     * Get content HTML
+     */
+    public function get_content_html(): string
+    {
+        ob_start();
+
+        // Use WooCommerce's email header
+        wc_get_template('emails/email-header.php', ['email_heading' => $this->get_heading()]);
+
+        $this->render_email_body_html();
+
+        // Use WooCommerce's email footer
+        wc_get_template('emails/email-footer.php', ['email' => $this]);
+
+        return ob_get_clean();
+    }
+
+    /**
+     * Get content plain text
+     */
+    public function get_content_plain(): string
+    {
+        ob_start();
+
+        echo "=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n";
+        echo esc_html(wp_strip_all_tags($this->get_heading()));
+        echo "\n=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n\n";
+
+        $this->render_email_body_plain();
+
+        return ob_get_clean();
+    }
+
+    /**
+     * Render HTML email body content
+     */
+    private function render_email_body_html(): void
+    {
+        $account_url = wc_get_account_endpoint_url('licenses');
+        ?>
+        <p><?php printf(esc_html__('Hello %s,', 'wc-licensed-product'), esc_html($this->customer_name)); ?></p>
+
+        <p style="color: #dc3232; font-weight: 600;">
+            <?php printf(
+                esc_html__('Your license for %1$s has expired on %2$s.', 'wc-licensed-product'),
+                '<strong>' . esc_html($this->product_name) . '</strong>',
+                esc_html($this->expiration_date)
+            ); ?>
+        </p>
+
+        <p>
+            <?php esc_html_e('Your license is no longer valid and the product will stop working until you renew.', 'wc-licensed-product'); ?>
+        </p>
+
+        <h2><?php esc_html_e('Expired License Details', 'wc-licensed-product'); ?></h2>
+
+        <div style="margin-bottom: 40px;">
+            <table class="td" cellspacing="0" cellpadding="6" style="width: 100%; font-family: 'Helvetica Neue', Helvetica, Roboto, Arial, sans-serif;" border="1">
+                <tbody>
+                    <tr>
+                        <th class="td" scope="row" style="text-align:<?php echo is_rtl() ? 'right' : 'left'; ?>;"><?php esc_html_e('Product:', 'wc-licensed-product'); ?></th>
+                        <td class="td" style="text-align:<?php echo is_rtl() ? 'right' : 'left'; ?>;"><?php echo esc_html($this->product_name); ?></td>
+                    </tr>
+                    <tr>
+                        <th class="td" scope="row" style="text-align:<?php echo is_rtl() ? 'right' : 'left'; ?>;"><?php esc_html_e('License Key:', 'wc-licensed-product'); ?></th>
+                        <td class="td" style="text-align:<?php echo is_rtl() ? 'right' : 'left'; ?>;">
+                            <code style="background: #f5f5f5; padding: 3px 8px; border-radius: 3px; font-family: monospace;">
+                                <?php echo esc_html($this->license->getLicenseKey()); ?>
+                            </code>
+                        </td>
+                    </tr>
+                    <tr>
+                        <th class="td" scope="row" style="text-align:<?php echo is_rtl() ? 'right' : 'left'; ?>;"><?php esc_html_e('Domain:', 'wc-licensed-product'); ?></th>
+                        <td class="td" style="text-align:<?php echo is_rtl() ? 'right' : 'left'; ?>;"><?php echo esc_html($this->license->getDomain()); ?></td>
+                    </tr>
+                    <tr>
+                        <th class="td" scope="row" style="text-align:<?php echo is_rtl() ? 'right' : 'left'; ?>;"><?php esc_html_e('Expired on:', 'wc-licensed-product'); ?></th>
+                        <td class="td" style="text-align:<?php echo is_rtl() ? 'right' : 'left'; ?>; color: #dc3232; font-weight: 600;"><?php echo esc_html($this->expiration_date); ?></td>
+                    </tr>
+                    <tr>
+                        <th class="td" scope="row" style="text-align:<?php echo is_rtl() ? 'right' : 'left'; ?>;"><?php esc_html_e('Status:', 'wc-licensed-product'); ?></th>
+                        <td class="td" style="text-align:<?php echo is_rtl() ? 'right' : 'left'; ?>;">
+                            <span style="background: #f8d7da; color: #721c24; padding: 3px 10px; border-radius: 12px; font-size: 12px; font-weight: 500;">
+                                <?php esc_html_e('Expired', 'wc-licensed-product'); ?>
+                            </span>
+                        </td>
+                    </tr>
+                </tbody>
+            </table>
+        </div>
+
+        <?php
+        $additional_content = $this->get_additional_content();
+        if ($additional_content) :
+            ?>
+            <p><?php echo wp_kses_post($additional_content); ?></p>
+        <?php endif; ?>
+
+        <p style="margin-top: 25px;">
+            <a href="<?php echo esc_url($account_url); ?>" class="button" style="display: inline-block; background-color: #7f54b3; color: #ffffff; padding: 12px 24px; text-decoration: none; border-radius: 4px; font-weight: 600;">
+                <?php esc_html_e('View My Licenses', 'wc-licensed-product'); ?>
+            </a>
+        </p>
+        <?php
+    }
+
+    /**
+     * Render plain text email body content
+     */
+    private function render_email_body_plain(): void
+    {
+        printf(esc_html__('Hello %s,', 'wc-licensed-product'), esc_html($this->customer_name));
+        echo "\n\n";
+
+        printf(
+            esc_html__('Your license for %1$s has expired on %2$s.', 'wc-licensed-product'),
+            esc_html($this->product_name),
+            esc_html($this->expiration_date)
+        );
+        echo "\n\n";
+
+        echo esc_html__('Your license is no longer valid and the product will stop working until you renew.', 'wc-licensed-product');
+        echo "\n\n";
+
+        echo "----------\n";
+        echo esc_html__('Expired License Details', 'wc-licensed-product') . "\n";
+        echo "----------\n\n";
+
+        echo esc_html__('Product:', 'wc-licensed-product') . ' ' . esc_html($this->product_name) . "\n";
+        echo esc_html__('License Key:', 'wc-licensed-product') . ' ' . esc_html($this->license->getLicenseKey()) . "\n";
+        echo esc_html__('Domain:', 'wc-licensed-product') . ' ' . esc_html($this->license->getDomain()) . "\n";
+        echo esc_html__('Expired on:', 'wc-licensed-product') . ' ' . esc_html($this->expiration_date) . "\n";
+        echo esc_html__('Status:', 'wc-licensed-product') . ' ' . esc_html__('Expired', 'wc-licensed-product') . "\n\n";
+
+        $additional_content = $this->get_additional_content();
+        if ($additional_content) {
+            echo "----------\n\n";
+            echo esc_html(wp_strip_all_tags(wptexturize($additional_content)));
+            echo "\n\n";
+        }
+
+        echo esc_html__('View My Licenses', 'wc-licensed-product') . ': ' . esc_url(wc_get_account_endpoint_url('licenses')) . "\n\n";
+
+        echo "=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n";
+    }
+
+    /**
+     * Default content to show below main email content
+     */
+    public function get_default_additional_content(): string
+    {
+        return __('To continue using this product, please renew your license.', 'wc-licensed-product');
+    }
+
+    /**
+     * Initialize settings form fields
+     */
+    public function init_form_fields(): void
+    {
+        $placeholder_text = sprintf(
+            /* translators: %s: list of placeholders */
+            __('Available placeholders: %s', 'wc-licensed-product'),
+            '<code>{site_title}, {product_name}, {expiration_date}</code>'
+        );
+
+        $this->form_fields = [
+            'enabled' => [
+                'title' => __('Enable/Disable', 'wc-licensed-product'),
+                'type' => 'checkbox',
+                'label' => __('Enable this email notification', 'wc-licensed-product'),
+                'default' => 'yes',
+            ],
+            'subject' => [
+                'title' => __('Subject', 'wc-licensed-product'),
+                'type' => 'text',
+                'desc_tip' => true,
+                'description' => $placeholder_text,
+                'placeholder' => $this->get_default_subject(),
+                'default' => '',
+            ],
+            'heading' => [
+                'title' => __('Email heading', 'wc-licensed-product'),
+                'type' => 'text',
+                'desc_tip' => true,
+                'description' => $placeholder_text,
+                'placeholder' => $this->get_default_heading(),
+                'default' => '',
+            ],
+            'additional_content' => [
+                'title' => __('Additional content', 'wc-licensed-product'),
+                'description' => __('Text to appear below the main email content.', 'wc-licensed-product') . ' ' . $placeholder_text,
+                'css' => 'width:400px; height: 75px;',
+                'placeholder' => $this->get_default_additional_content(),
+                'type' => 'textarea',
+                'default' => '',
+                'desc_tip' => true,
+            ],
+            'email_type' => [
+                'title' => __('Email type', 'wc-licensed-product'),
+                'type' => 'select',
+                'description' => __('Choose which format of email to send.', 'wc-licensed-product'),
+                'default' => 'html',
+                'class' => 'email_type wc-enhanced-select',
+                'options' => $this->get_email_type_options(),
+                'desc_tip' => true,
+            ],
+        ];
+    }
+}

src/Frontend/AccountController.php

@@ -9,6 +9,8 @@ declare(strict_types=1);
 
 namespace Jeremias\WcLicensedProduct\Frontend;
 
+use Jeremias\WcLicensedProduct\Api\ResponseSigner;
+use Jeremias\WcLicensedProduct\Common\RateLimitTrait;
 use Jeremias\WcLicensedProduct\License\LicenseManager;
 use Jeremias\WcLicensedProduct\Product\VersionManager;
 use Twig\Environment;
@@ -18,6 +20,8 @@ use Twig\Environment;
  */
 final class AccountController
 {
+    use RateLimitTrait;
+
     private Environment $twig;
     private LicenseManager $licenseManager;
     private VersionManager $versionManager;
@@ -105,18 +109,175 @@ final class AccountController
             return;
         }
 
+        // Get filter parameters from URL
+        $filterProductId = isset($_GET['filter_product']) ? absint($_GET['filter_product']) : 0;
+        $filterDomain = isset($_GET['filter_domain']) ? sanitize_text_field(wp_unslash($_GET['filter_domain'])) : '';
+
         $licenses = $this->licenseManager->getLicensesByCustomer($customerId);
 
-        // Enrich licenses with product data and downloads
-        $enrichedLicenses = [];
-        foreach ($licenses as $license) {
-            $product = wc_get_product($license->getProductId());
-            $order = wc_get_order($license->getOrderId());
+        // Apply filters
+        $filteredLicenses = $this->applyLicenseFilters($licenses, $filterProductId, $filterDomain);
 
-            // Get available downloads for this license
-            $downloads = [];
+        // Group licenses by product+order into "packages"
+        $packages = $this->groupLicensesIntoPackages($filteredLicenses);
+
+        // Get unique products and domains for filter dropdowns
+        $filterOptions = $this->getFilterOptions($licenses);
+
+        try {
+            echo $this->twig->render('frontend/licenses.html.twig', [
+                'packages' => $packages,
+                'has_packages' => !empty($packages),
+                'signing_enabled' => ResponseSigner::isSigningEnabled(),
+                'filter_products' => $filterOptions['products'],
+                'filter_domains' => $filterOptions['domains'],
+                'current_filter_product' => $filterProductId,
+                'current_filter_domain' => $filterDomain,
+                'is_filtered' => $filterProductId > 0 || !empty($filterDomain),
+                'licenses_url' => wc_get_account_endpoint_url('licenses'),
+            ]);
+        } catch (\Exception $e) {
+            // Fallback to PHP template if Twig fails
+            $this->displayLicensesFallback($packages, $filterOptions, $filterProductId, $filterDomain);
+        }
+    }
+
+    /**
+     * Apply filters to licenses
+     *
+     * @param array $licenses Array of License objects
+     * @param int $productId Filter by product ID (0 for all)
+     * @param string $domain Filter by domain (empty for all)
+     * @return array Filtered array of License objects
+     */
+    private function applyLicenseFilters(array $licenses, int $productId, string $domain): array
+    {
+        if ($productId === 0 && empty($domain)) {
+            return $licenses;
+        }
+
+        return array_filter($licenses, function ($license) use ($productId, $domain) {
+            // Filter by product
+            if ($productId > 0 && $license->getProductId() !== $productId) {
+                return false;
+            }
+
+            // Filter by domain (partial match)
+            if (!empty($domain) && stripos($license->getDomain(), $domain) === false) {
+                return false;
+            }
+
+            return true;
+        });
+    }
+
+    /**
+     * Get unique filter options from licenses
+     *
+     * @param array $licenses Array of License objects
+     * @return array Array with 'products' and 'domains' keys
+     */
+    private function getFilterOptions(array $licenses): array
+    {
+        $products = [];
+        $domains = [];
+
+        foreach ($licenses as $license) {
+            // Collect unique products
+            $productId = $license->getProductId();
+            if (!isset($products[$productId])) {
+                $product = wc_get_product($productId);
+                $products[$productId] = $product ? $product->get_name() : __('Unknown Product', 'wc-licensed-product');
+            }
+
+            // Collect unique domains
+            $domain = $license->getDomain();
+            if (!in_array($domain, $domains, true)) {
+                $domains[] = $domain;
+            }
+        }
+
+        // Sort products by name, domains alphabetically
+        asort($products);
+        sort($domains);
+
+        return [
+            'products' => $products,
+            'domains' => $domains,
+        ];
+    }
+
+    /**
+     * Group licenses into packages by product+order
+     *
+     * @param array $licenses Array of License objects
+     * @return array Array of package data
+     */
+    private function groupLicensesIntoPackages(array $licenses): array
+    {
+        $grouped = [];
+
+        foreach ($licenses as $license) {
+            $productId = $license->getProductId();
+            $orderId = $license->getOrderId();
+            $key = $productId . '_' . $orderId;
+
+            if (!isset($grouped[$key])) {
+                $product = wc_get_product($productId);
+                $order = wc_get_order($orderId);
+
+                $grouped[$key] = [
+                    'product_id' => $productId,
+                    'order_id' => $orderId,
+                    'product_name' => $product ? $product->get_name() : __('Unknown Product', 'wc-licensed-product'),
+                    'product_url' => $product ? $product->get_permalink() : '',
+                    'order_number' => $order ? $order->get_order_number() : '',
+                    'order_url' => $order ? $order->get_view_order_url() : '',
+                    'licenses' => [],
+                    'downloads' => [],
+                    'has_active_license' => false,
+                ];
+            }
+
+            // Add license to package
+            $grouped[$key]['licenses'][] = [
+                'id' => $license->getId(),
+                'license_key' => $license->getLicenseKey(),
+                'domain' => $license->getDomain(),
+                'status' => $license->getStatus(),
+                'expires_at' => $license->getExpiresAt(),
+                'is_transferable' => in_array($license->getStatus(), ['active', 'inactive'], true),
+                'customer_secret' => ResponseSigner::getCustomerSecretForLicense($license->getLicenseKey()),
+            ];
+
+            // Track if package has at least one active license
             if ($license->getStatus() === 'active') {
-                $versions = $this->versionManager->getVersionsByProduct($license->getProductId());
+                $grouped[$key]['has_active_license'] = true;
+            }
+        }
+
+        // Add downloads for packages with active licenses
+        foreach ($grouped as $key => &$package) {
+            if ($package['has_active_license']) {
+                $package['downloads'] = $this->getDownloadsForProduct(
+                    $package['product_id'],
+                    $package['licenses'][0]['id'] // Use first license for download URL
+                );
+            }
+        }
+
+        // Sort by order date (newest first) - re-index array
+        return array_values($grouped);
+    }
+
+    /**
+     * Get downloads for a product
+     */
+    private function getDownloadsForProduct(int $productId, int $licenseId): array
+    {
+        $downloads = [];
+        $versions = $this->versionManager->getVersionsByProduct($productId);
+
         foreach ($versions as $version) {
             if ($version->isActive() && ($version->getAttachmentId() || $version->getDownloadUrl())) {
                 $downloads[] = [
@@ -124,7 +285,7 @@ final class AccountController
                     'version_id' => $version->getId(),
                     'filename' => $version->getDownloadFilename(),
                     'download_url' => $this->downloadController->generateDownloadUrl(
-                                $license->getId(),
+                        $licenseId,
                         $version->getId()
                     ),
                     'release_notes' => $version->getReleaseNotes(),
@@ -133,112 +294,228 @@ final class AccountController
                 ];
             }
         }
-            }
 
-            $enrichedLicenses[] = [
-                'license' => $license,
-                'product_name' => $product ? $product->get_name() : __('Unknown Product', 'wc-licensed-product'),
-                'product_url' => $product ? $product->get_permalink() : '',
-                'order_number' => $order ? $order->get_order_number() : '',
-                'order_url' => $order ? $order->get_view_order_url() : '',
-                'downloads' => $downloads,
-            ];
-        }
-
-        try {
-            echo $this->twig->render('frontend/licenses.html.twig', [
-                'licenses' => $enrichedLicenses,
-                'has_licenses' => !empty($enrichedLicenses),
-            ]);
-        } catch (\Exception $e) {
-            // Fallback to PHP template if Twig fails
-            $this->displayLicensesFallback($enrichedLicenses);
-        }
+        return $downloads;
     }
 
     /**
      * Fallback display method if Twig is unavailable
      */
-    private function displayLicensesFallback(array $enrichedLicenses): void
-    {
-        if (empty($enrichedLicenses)) {
+    private function displayLicensesFallback(
+        array $packages,
+        array $filterOptions = [],
+        int $currentFilterProduct = 0,
+        string $currentFilterDomain = ''
+    ): void {
+        $isFiltered = $currentFilterProduct > 0 || !empty($currentFilterDomain);
+        $licensesUrl = wc_get_account_endpoint_url('licenses');
+
+        // Display filter form if we have filter options
+        if (!empty($filterOptions['products']) || !empty($filterOptions['domains'])) {
+            ?>
+            <div class="wclp-filter-form">
+                <form method="get" action="<?php echo esc_url($licensesUrl); ?>">
+                    <div class="wclp-filter-row">
+                        <?php if (!empty($filterOptions['products'])): ?>
+                            <div class="wclp-filter-field">
+                                <label for="filter_product"><?php esc_html_e('Product', 'wc-licensed-product'); ?></label>
+                                <select name="filter_product" id="filter_product">
+                                    <option value=""><?php esc_html_e('All Products', 'wc-licensed-product'); ?></option>
+                                    <?php foreach ($filterOptions['products'] as $id => $name): ?>
+                                        <option value="<?php echo esc_attr($id); ?>" <?php selected($currentFilterProduct, $id); ?>>
+                                            <?php echo esc_html($name); ?>
+                                        </option>
+                                    <?php endforeach; ?>
+                                </select>
+                            </div>
+                        <?php endif; ?>
+
+                        <?php if (!empty($filterOptions['domains'])): ?>
+                            <div class="wclp-filter-field">
+                                <label for="filter_domain"><?php esc_html_e('Domain', 'wc-licensed-product'); ?></label>
+                                <select name="filter_domain" id="filter_domain">
+                                    <option value=""><?php esc_html_e('All Domains', 'wc-licensed-product'); ?></option>
+                                    <?php foreach ($filterOptions['domains'] as $domain): ?>
+                                        <option value="<?php echo esc_attr($domain); ?>" <?php selected($currentFilterDomain, $domain); ?>>
+                                            <?php echo esc_html($domain); ?>
+                                        </option>
+                                    <?php endforeach; ?>
+                                </select>
+                            </div>
+                        <?php endif; ?>
+
+                        <div class="wclp-filter-actions">
+                            <button type="submit" class="button"><?php esc_html_e('Filter', 'wc-licensed-product'); ?></button>
+                            <?php if ($isFiltered): ?>
+                                <a href="<?php echo esc_url($licensesUrl); ?>" class="button"><?php esc_html_e('Clear', 'wc-licensed-product'); ?></a>
+                            <?php endif; ?>
+                        </div>
+                    </div>
+                </form>
+            </div>
+            <?php
+        }
+
+        if (empty($packages)) {
+            if ($isFiltered) {
+                echo '<p>' . esc_html__('No licenses found matching your filters.', 'wc-licensed-product') . '</p>';
+            } else {
                 echo '<p>' . esc_html__('You have no licenses yet.', 'wc-licensed-product') . '</p>';
+            }
             return;
         }
 
         ?>
         <div class="woocommerce-licenses">
-            <?php foreach ($enrichedLicenses as $item): ?>
-                <div class="license-card">
-                    <div class="license-header">
+            <?php foreach ($packages as $package): ?>
+                <div class="license-package">
+                    <div class="package-header">
                         <h3>
-                            <?php if ($item['product_url']): ?>
-                                <a href="<?php echo esc_url($item['product_url']); ?>">
-                                    <?php echo esc_html($item['product_name']); ?>
+                            <?php if ($package['product_url']): ?>
+                                <a href="<?php echo esc_url($package['product_url']); ?>">
+                                    <?php echo esc_html($package['product_name']); ?>
                                 </a>
                             <?php else: ?>
-                                <?php echo esc_html($item['product_name']); ?>
+                                <?php echo esc_html($package['product_name']); ?>
                             <?php endif; ?>
                         </h3>
-                        <span class="license-status license-status-<?php echo esc_attr($item['license']->getStatus()); ?>">
-                            <?php echo esc_html(ucfirst($item['license']->getStatus())); ?>
-                        </span>
-                    </div>
-
-                    <div class="license-details">
-                        <div class="license-key-row">
-                            <label><?php esc_html_e('License Key:', 'wc-licensed-product'); ?></label>
-                            <code class="license-key" data-license-key="<?php echo esc_attr($item['license']->getLicenseKey()); ?>">
-                                <?php echo esc_html($item['license']->getLicenseKey()); ?>
-                            </code>
-                            <button type="button" class="copy-license-btn" data-license-key="<?php echo esc_attr($item['license']->getLicenseKey()); ?>" title="<?php esc_attr_e('Copy to clipboard', 'wc-licensed-product'); ?>">
-                                <span class="dashicons dashicons-clipboard"></span>
-                            </button>
-                        </div>
-
-                        <div class="license-info-row">
-                            <span class="license-domain-display" data-license-id="<?php echo esc_attr($item['license']->getId()); ?>">
-                                <strong><?php esc_html_e('Domain:', 'wc-licensed-product'); ?></strong>
-                                <span class="domain-value"><?php echo esc_html($item['license']->getDomain()); ?></span>
-                                <?php if (in_array($item['license']->getStatus(), ['active', 'inactive'], true)): ?>
-                                    <button type="button" class="wclp-transfer-btn"
-                                            data-license-id="<?php echo esc_attr($item['license']->getId()); ?>"
-                                            data-current-domain="<?php echo esc_attr($item['license']->getDomain()); ?>"
-                                            title="<?php esc_attr_e('Transfer to new domain', 'wc-licensed-product'); ?>">
-                                        <span class="dashicons dashicons-randomize"></span>
-                                        <?php esc_html_e('Transfer', 'wc-licensed-product'); ?>
-                                    </button>
-                                <?php endif; ?>
-                            </span>
-                            <span><strong><?php esc_html_e('Expires:', 'wc-licensed-product'); ?></strong>
+                        <span class="package-order">
                             <?php
-                                $expiresAt = $item['license']->getExpiresAt();
-                                echo $expiresAt
-                                    ? esc_html($expiresAt->format(get_option('date_format')))
-                                    : esc_html__('Never', 'wc-licensed-product');
+                            printf(
+                                /* translators: %s: order number */
+                                esc_html__('Order #%s', 'wc-licensed-product'),
+                                esc_html($package['order_number'])
+                            );
                             ?>
                         </span>
                     </div>
+
+                    <div class="package-licenses">
+                        <?php foreach ($package['licenses'] as $license): ?>
+                            <div class="license-entry license-entry-<?php echo esc_attr($license['status']); ?>">
+                                <div class="license-row-primary">
+                                    <div class="license-key-group">
+                                        <code class="license-key"><?php echo esc_html($license['license_key']); ?></code>
+                                        <span class="license-status license-status-<?php echo esc_attr($license['status']); ?>">
+                                            <?php echo esc_html(ucfirst($license['status'])); ?>
+                                        </span>
+                                    </div>
+                                    <div class="license-actions">
+                                        <button type="button" class="copy-license-btn" data-license-key="<?php echo esc_attr($license['license_key']); ?>" title="<?php esc_attr_e('Copy to clipboard', 'wc-licensed-product'); ?>">
+                                            <span class="dashicons dashicons-clipboard"></span>
+                                        </button>
+                                        <?php if ($license['is_transferable']): ?>
+                                            <button type="button" class="wclp-transfer-btn"
+                                                    data-license-id="<?php echo esc_attr($license['id']); ?>"
+                                                    data-current-domain="<?php echo esc_attr($license['domain']); ?>"
+                                                    title="<?php esc_attr_e('Transfer to new domain', 'wc-licensed-product'); ?>">
+                                                <span class="dashicons dashicons-randomize"></span>
+                                            </button>
+                                        <?php endif; ?>
+                                    </div>
+                                </div>
+                                <div class="license-row-secondary">
+                                    <span class="license-meta-item license-domain">
+                                        <span class="dashicons dashicons-admin-site-alt3"></span>
+                                        <?php echo esc_html($license['domain']); ?>
+                                    </span>
+                                    <span class="license-meta-item license-expiry">
+                                        <span class="dashicons dashicons-calendar-alt"></span>
+                                        <?php
+                                        echo $license['expires_at']
+                                            ? esc_html($license['expires_at']->format('Y-m-d'))
+                                            : '<span class="lifetime">' . esc_html__('Lifetime', 'wc-licensed-product') . '</span>';
+                                        ?>
+                                    </span>
+                                </div>
+                                <?php if (ResponseSigner::isSigningEnabled() && !empty($license['customer_secret'])): ?>
+                                    <div class="license-row-secret">
+                                        <button type="button" class="secret-toggle" aria-expanded="false">
+                                            <span class="dashicons dashicons-lock"></span>
+                                            <?php esc_html_e('API Verification Secret', 'wc-licensed-product'); ?>
+                                            <span class="dashicons dashicons-arrow-down-alt2 toggle-arrow"></span>
+                                        </button>
+                                        <div class="secret-content" style="display: none;">
+                                            <p class="secret-description">
+                                                <?php esc_html_e('Use this secret to verify signed API responses. Keep it secure.', 'wc-licensed-product'); ?>
+                                            </p>
+                                            <div class="secret-value-wrapper">
+                                                <code class="secret-value"><?php echo esc_html($license['customer_secret']); ?></code>
+                                                <button type="button" class="copy-secret-btn" data-secret="<?php echo esc_attr($license['customer_secret']); ?>" title="<?php esc_attr_e('Copy to clipboard', 'wc-licensed-product'); ?>">
+                                                    <span class="dashicons dashicons-clipboard"></span>
+                                                </button>
+                                            </div>
+                                        </div>
+                                    </div>
+                                <?php endif; ?>
+                            </div>
+                        <?php endforeach; ?>
                     </div>
 
-                    <?php if (!empty($item['downloads'])): ?>
-                        <div class="license-downloads">
+                    <?php if (!empty($package['downloads'])): ?>
+                        <div class="package-downloads">
                             <h4><?php esc_html_e('Available Downloads', 'wc-licensed-product'); ?></h4>
                             <ul class="download-list">
-                                <?php foreach ($item['downloads'] as $download): ?>
-                                    <li>
+                                <?php
+                                $latest = $package['downloads'][0];
+                                ?>
+                                <li class="download-item download-item-latest">
+                                    <div class="download-row-file">
+                                        <a href="<?php echo esc_url($latest['download_url']); ?>" class="download-link">
+                                            <span class="dashicons dashicons-download"></span>
+                                            <?php echo esc_html($latest['filename'] ?: sprintf(__('Version %s', 'wc-licensed-product'), $latest['version'])); ?>
+                                        </a>
+                                        <span class="download-version-badge"><?php esc_html_e('Latest', 'wc-licensed-product'); ?></span>
+                                    </div>
+                                    <div class="download-row-meta">
+                                        <span class="download-date"><?php echo esc_html($latest['released_at']); ?></span>
+                                        <?php if (!empty($latest['file_hash'])): ?>
+                                            <span class="download-hash" title="<?php echo esc_attr($latest['file_hash']); ?>">
+                                                <span class="dashicons dashicons-shield"></span>
+                                                <code><?php echo esc_html(substr($latest['file_hash'], 0, 12)); ?>...</code>
+                                            </span>
+                                        <?php endif; ?>
+                                    </div>
+                                </li>
+                            </ul>
+
+                            <?php if (count($package['downloads']) > 1): ?>
+                                <div class="older-versions-section">
+                                    <button type="button" class="older-versions-toggle" aria-expanded="false">
+                                        <span class="dashicons dashicons-arrow-down-alt2"></span>
+                                        <?php
+                                        printf(
+                                            esc_html__('Older versions (%d)', 'wc-licensed-product'),
+                                            count($package['downloads']) - 1
+                                        );
+                                        ?>
+                                    </button>
+                                    <ul class="download-list older-versions-list" style="display: none;">
+                                        <?php foreach (array_slice($package['downloads'], 1) as $download): ?>
+                                            <li class="download-item">
+                                                <div class="download-row-file">
                                                     <a href="<?php echo esc_url($download['download_url']); ?>" class="download-link">
                                                         <span class="dashicons dashicons-download"></span>
                                                         <?php echo esc_html($download['filename'] ?: sprintf(__('Version %s', 'wc-licensed-product'), $download['version'])); ?>
                                                     </a>
-                                        <span class="download-version">v<?php echo esc_html($download['version']); ?></span>
+                                                </div>
+                                                <div class="download-row-meta">
                                                     <span class="download-date"><?php echo esc_html($download['released_at']); ?></span>
+                                                    <?php if (!empty($download['file_hash'])): ?>
+                                                        <span class="download-hash" title="<?php echo esc_attr($download['file_hash']); ?>">
+                                                            <span class="dashicons dashicons-shield"></span>
+                                                            <code><?php echo esc_html(substr($download['file_hash'], 0, 12)); ?>...</code>
+                                                        </span>
+                                                    <?php endif; ?>
+                                                </div>
                                             </li>
                                         <?php endforeach; ?>
                                     </ul>
                                 </div>
                             <?php endif; ?>
                         </div>
+                    <?php endif; ?>
+                </div>
             <?php endforeach; ?>
         </div>
 
@@ -321,6 +598,15 @@ final class AccountController
      */
     public function handleTransferRequest(): void
     {
+        // Rate limit: 5 transfer attempts per hour per user
+        if (!$this->checkUserRateLimit('transfer', 5, 3600)) {
+            $retryAfter = $this->getRateLimitRetryAfter('transfer', 3600);
+            wp_send_json_error([
+                'message' => __('Too many transfer attempts. Please try again later.', 'wc-licensed-product'),
+                'retry_after' => $retryAfter,
+            ], 429);
+        }
+
         // Verify nonce
         if (!check_ajax_referer('wclp_customer_transfer', 'nonce', false)) {
             wp_send_json_error(['message' => __('Security check failed.', 'wc-licensed-product')], 403);

src/Frontend/DownloadController.php

@@ -9,6 +9,7 @@ declare(strict_types=1);
 
 namespace Jeremias\WcLicensedProduct\Frontend;
 
+use Jeremias\WcLicensedProduct\Common\RateLimitTrait;
 use Jeremias\WcLicensedProduct\License\LicenseManager;
 use Jeremias\WcLicensedProduct\Product\VersionManager;
 
@@ -17,6 +18,8 @@ use Jeremias\WcLicensedProduct\Product\VersionManager;
  */
 final class DownloadController
 {
+    use RateLimitTrait;
+
     private LicenseManager $licenseManager;
     private VersionManager $versionManager;
 
@@ -35,6 +38,9 @@ final class DownloadController
         // Add download endpoint
         add_action('init', [$this, 'addDownloadEndpoint']);
 
+        // Register query var for the endpoint
+        add_filter('query_vars', [$this, 'addDownloadQueryVar']);
+
         // Handle download requests
         add_action('template_redirect', [$this, 'handleDownloadRequest']);
     }
@@ -47,6 +53,15 @@ final class DownloadController
         add_rewrite_endpoint('license-download', EP_ROOT | EP_PAGES);
     }
 
+    /**
+     * Register the download query var
+     */
+    public function addDownloadQueryVar(array $vars): array
+    {
+        $vars[] = 'license-download';
+        return $vars;
+    }
+
     /**
      * Handle download request
      */
@@ -98,6 +113,15 @@ final class DownloadController
             exit;
         }
 
+        // Rate limit: 30 downloads per hour per user
+        if (!$this->checkUserRateLimit('download', 30, 3600)) {
+            wp_die(
+                __('Too many download attempts. Please try again later.', 'wc-licensed-product'),
+                __('Download Error', 'wc-licensed-product'),
+                ['response' => 429]
+            );
+        }
+
         // Get license
         $license = $this->licenseManager->getLicenseById($licenseId);
         if (!$license) {
@@ -160,8 +184,12 @@ final class DownloadController
         $downloadUrl = $version->getDownloadUrl();
 
         if ($attachmentId) {
+            // Increment download count before serving
+            $this->versionManager->incrementDownloadCount($versionId);
             $this->serveAttachment($attachmentId, $version->getVersion());
         } elseif ($downloadUrl) {
+            // Increment download count before redirect
+            $this->versionManager->incrementDownloadCount($versionId);
             // Redirect to external URL
             wp_redirect($downloadUrl);
             exit;

src/Installer.php

@@ -31,17 +31,41 @@ final class Installer
     {
         self::createTables();
         self::createCacheDir();
+        self::registerProductTypes();
 
         // Set version in options
         update_option('wc_licensed_product_version', WC_LICENSED_PRODUCT_VERSION);
 
-        // Register the licenses endpoint before flushing rewrite rules
+        // Register endpoints before flushing rewrite rules
         add_rewrite_endpoint('licenses', EP_ROOT | EP_PAGES);
+        add_rewrite_endpoint('license-download', EP_ROOT | EP_PAGES);
 
         // Flush rewrite rules for REST API and My Account endpoints
         flush_rewrite_rules();
     }
 
+    /**
+     * Register custom product type terms in the product_type taxonomy
+     * This is required for WC_Product_Factory::get_product_type() to work correctly
+     */
+    public static function registerProductTypes(): void
+    {
+        // Ensure WooCommerce taxonomies are registered
+        if (!taxonomy_exists('product_type')) {
+            return;
+        }
+
+        // Register 'licensed' product type term if it doesn't exist
+        if (!term_exists('licensed', 'product_type')) {
+            wp_insert_term('licensed', 'product_type');
+        }
+
+        // Register 'licensed-variable' product type term if it doesn't exist
+        if (!term_exists('licensed-variable', 'product_type')) {
+            wp_insert_term('licensed-variable', 'product_type');
+        }
+    }
+
     /**
      * Run on plugin deactivation
      */
@@ -103,6 +127,7 @@ final class Installer
             download_url VARCHAR(512) DEFAULT NULL,
             attachment_id BIGINT UNSIGNED DEFAULT NULL,
             file_hash VARCHAR(64) DEFAULT NULL,
+            download_count BIGINT UNSIGNED NOT NULL DEFAULT 0,
             is_active TINYINT(1) NOT NULL DEFAULT 1,
             released_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
             created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,

src/License/LicenseManager.php

@@ -11,12 +11,51 @@ namespace Jeremias\WcLicensedProduct\License;
 
 use Jeremias\WcLicensedProduct\Installer;
 use Jeremias\WcLicensedProduct\Product\LicensedProduct;
+use Jeremias\WcLicensedProduct\Product\LicensedProductVariation;
+use Jeremias\WcLicensedProduct\Product\LicensedVariableProduct;
 
 /**
  * Manages license operations (CRUD, validation, generation)
  */
 class LicenseManager
 {
+    /**
+     * Check if a product is any type of licensed product
+     *
+     * @param \WC_Product $product Product to check
+     * @return bool True if product is licensed (simple or variable or variation)
+     */
+    public function isLicensedProduct(\WC_Product $product): bool
+    {
+        // Simple licensed product
+        if ($product->is_type('licensed')) {
+            return true;
+        }
+
+        // Variable licensed product
+        if ($product->is_type('licensed-variable')) {
+            return true;
+        }
+
+        // Check for our custom variation class
+        if ($product instanceof LicensedProductVariation) {
+            return true;
+        }
+
+        // Variation of a licensed-variable product
+        // Use WC_Product_Factory::get_product_type() for reliable parent type check
+        // This queries the database directly and doesn't depend on product class loading
+        $parentId = $product->get_parent_id();
+        if ($parentId) {
+            $parentType = \WC_Product_Factory::get_product_type($parentId);
+            if ($parentType === 'licensed-variable') {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
     /**
      * Generate a unique license key
      */
@@ -40,29 +79,63 @@ class LicenseManager
 
     /**
      * Generate a license for a completed order
+     *
+     * @param int $orderId Order ID
+     * @param int $productId Product ID (parent product for variations)
+     * @param int $customerId Customer ID
+     * @param string $domain Domain to bind the license to
+     * @param int|null $variationId Optional variation ID for variable licensed products
+     * @return License|null Generated license or null on failure
      */
     public function generateLicense(
         int $orderId,
         int $productId,
         int $customerId,
-        string $domain
+        string $domain,
+        ?int $variationId = null
     ): ?License {
         global $wpdb;
 
-        // Check if license already exists for this order and product
-        $existing = $this->getLicenseByOrderAndProduct($orderId, $productId);
+        // Normalize domain first for duplicate detection
+        $normalizedDomain = $this->normalizeDomain($domain);
+
+        // Check if license already exists for this order, product, domain, and variation
+        $existing = $this->getLicenseByOrderProductDomainAndVariation($orderId, $productId, $normalizedDomain, $variationId);
         if ($existing) {
             return $existing;
         }
 
-        $product = wc_get_product($productId);
-        if (!$product || !$product->is_type('licensed')) {
+        // Load the product that has the license settings
+        // For variations, load the variation; otherwise load the parent product
+        if ($variationId) {
+            $settingsProduct = wc_get_product($variationId);
+
+            // Verify parent is licensed-variable using DB-level type check
+            $parentType = \WC_Product_Factory::get_product_type($productId);
+            if ($parentType !== 'licensed-variable') {
+                return null;
+            }
+
+            // Ensure we have the proper variation class
+            if ($settingsProduct && !$settingsProduct instanceof LicensedProductVariation) {
+                $settingsProduct = new LicensedProductVariation($variationId);
+            }
+        } else {
+            $settingsProduct = wc_get_product($productId);
+
+            // Check if this is a licensed product (simple)
+            if (!$settingsProduct || !$settingsProduct->is_type('licensed')) {
                 return null;
             }
 
             // Ensure we have the LicensedProduct instance for type hints
-        if (!$product instanceof LicensedProduct) {
-            $product = new LicensedProduct($productId);
+            if (!$settingsProduct instanceof LicensedProduct) {
+                $settingsProduct = new LicensedProduct($productId);
+            }
+        }
+
+        if (!$settingsProduct) {
+            return null;
         }
 
         // Generate unique license key
@@ -71,16 +144,16 @@ class LicenseManager
             $licenseKey = $this->generateLicenseKey();
         }
 
-        // Calculate expiration date
+        // Calculate expiration date from the settings product (variation or parent)
         $expiresAt = null;
-        $validityDays = $product->get_validity_days();
+        $validityDays = $settingsProduct->get_validity_days();
         if ($validityDays !== null && $validityDays > 0) {
             $expiresAt = (new \DateTimeImmutable())->modify("+{$validityDays} days")->format('Y-m-d H:i:s');
         }
 
-        // Determine version ID if bound to version
+        // Determine version ID if bound to version (always use parent product ID for versions)
         $versionId = null;
-        if ($product->is_bound_to_version()) {
+        if ($settingsProduct->is_bound_to_version()) {
             $versionId = $this->getCurrentVersionId($productId);
         }
 
@@ -96,7 +169,7 @@ class LicenseManager
                 'version_id' => $versionId,
                 'status' => License::STATUS_ACTIVE,
                 'activations_count' => 1,
-                'max_activations' => $product->get_max_activations(),
+                'max_activations' => $settingsProduct->get_max_activations(),
                 'expires_at' => $expiresAt,
             ],
             ['%s', '%d', '%d', '%d', '%s', '%d', '%s', '%d', '%d', '%s']
@@ -109,6 +182,16 @@ class LicenseManager
         return $this->getLicenseById((int) $wpdb->insert_id);
     }
 
+    /**
+     * Get license by order, product, domain, and optional variation
+     */
+    public function getLicenseByOrderProductDomainAndVariation(int $orderId, int $productId, string $domain, ?int $variationId = null): ?License
+    {
+        // For now, just use the existing method since we don't store variation_id in licenses table yet
+        // In the future, we could add a variation_id column to the licenses table
+        return $this->getLicenseByOrderProductAndDomain($orderId, $productId, $domain);
+    }
+
     /**
      * Get license by ID
      */
@@ -161,6 +244,49 @@ class LicenseManager
         return $row ? License::fromArray($row) : null;
     }
 
+    /**
+     * Get all licenses for an order and product
+     *
+     * @return License[]
+     */
+    public function getLicensesByOrderAndProduct(int $orderId, int $productId): array
+    {
+        global $wpdb;
+
+        $tableName = Installer::getLicensesTable();
+        $rows = $wpdb->get_results(
+            $wpdb->prepare(
+                "SELECT * FROM {$tableName} WHERE order_id = %d AND product_id = %d ORDER BY created_at ASC",
+                $orderId,
+                $productId
+            ),
+            ARRAY_A
+        );
+
+        return array_map(fn(array $row) => License::fromArray($row), $rows ?: []);
+    }
+
+    /**
+     * Get license by order, product, and domain
+     */
+    public function getLicenseByOrderProductAndDomain(int $orderId, int $productId, string $domain): ?License
+    {
+        global $wpdb;
+
+        $tableName = Installer::getLicensesTable();
+        $row = $wpdb->get_row(
+            $wpdb->prepare(
+                "SELECT * FROM {$tableName} WHERE order_id = %d AND product_id = %d AND domain = %s",
+                $orderId,
+                $productId,
+                $domain
+            ),
+            ARRAY_A
+        );
+
+        return $row ? License::fromArray($row) : null;
+    }
+
     /**
      * Get all licenses for an order
      */
@@ -862,6 +988,56 @@ class LicenseManager
         return (bool) get_user_meta($license->getCustomerId(), $metaKey, true);
     }
 
+    /**
+     * Get licenses that have passed their expiration date but are still marked as active
+     *
+     * @return array Array of License objects that need to be auto-expired
+     */
+    public function getExpiredActiveLicenses(): array
+    {
+        global $wpdb;
+
+        $tableName = Installer::getLicensesTable();
+        $now = new \DateTimeImmutable();
+
+        $sql = "SELECT * FROM {$tableName}
+                WHERE expires_at IS NOT NULL
+                AND expires_at < %s
+                AND status = %s";
+
+        $rows = $wpdb->get_results(
+            $wpdb->prepare($sql, $now->format('Y-m-d H:i:s'), License::STATUS_ACTIVE),
+            ARRAY_A
+        );
+
+        return array_map(fn(array $row) => License::fromArray($row), $rows ?: []);
+    }
+
+    /**
+     * Auto-expire a license and return true if status was changed
+     *
+     * @param int $licenseId License ID
+     * @return bool True if license was expired, false if already expired or error
+     */
+    public function autoExpireLicense(int $licenseId): bool
+    {
+        $license = $this->getLicenseById($licenseId);
+        if (!$license) {
+            return false;
+        }
+
+        // Only expire if currently active and past expiration date
+        if ($license->getStatus() !== License::STATUS_ACTIVE) {
+            return false;
+        }
+
+        if (!$license->isExpired()) {
+            return false;
+        }
+
+        return $this->updateLicenseStatus($licenseId, License::STATUS_EXPIRED);
+    }
+
     /**
      * Import a license from CSV data
      *

src/License/PluginLicenseChecker.php

@@ -0,0 +1,357 @@
+<?php
+/**
+ * Plugin License Checker
+ *
+ * Validates the plugin's own license against a remote server.
+ *
+ * @package Jeremias\WcLicensedProduct\License
+ */
+
+declare(strict_types=1);
+
+namespace Jeremias\WcLicensedProduct\License;
+
+use Magdev\WcLicensedProductClient\LicenseClient;
+use Magdev\WcLicensedProductClient\LicenseClientInterface;
+use Magdev\WcLicensedProductClient\SecureLicenseClient;
+use Magdev\WcLicensedProductClient\Exception\LicenseException;
+use Symfony\Component\HttpClient\HttpClient;
+
+/**
+ * Handles validation of this plugin's license
+ */
+final class PluginLicenseChecker
+{
+    /**
+     * Cache key for license validation result
+     */
+    private const CACHE_KEY = 'wclp_plugin_license_valid';
+
+    /**
+     * Cache TTL for successful validation (1 hour)
+     */
+    private const CACHE_TTL = 3600;
+
+    /**
+     * Cache key for error messages
+     */
+    private const ERROR_CACHE_KEY = 'wclp_plugin_license_error';
+
+    /**
+     * Cache TTL for errors (5 minutes)
+     */
+    private const ERROR_CACHE_TTL = 300;
+
+    /**
+     * Singleton instance
+     */
+    private static ?self $instance = null;
+
+    /**
+     * Cached localhost check result
+     */
+    private ?bool $isLocalhostCached = null;
+
+    /**
+     * Cached self-licensing check result
+     */
+    private ?bool $isSelfLicensingCached = null;
+
+    /**
+     * Get singleton instance
+     */
+    public static function getInstance(): self
+    {
+        if (self::$instance === null) {
+            self::$instance = new self();
+        }
+
+        return self::$instance;
+    }
+
+    /**
+     * Private constructor for singleton
+     */
+    private function __construct()
+    {
+        // Private constructor
+    }
+
+    /**
+     * Check if the plugin license is valid
+     *
+     * Returns cached result if available, otherwise validates against server.
+     */
+    public function isLicenseValid(): bool
+    {
+        // Always valid on localhost
+        if ($this->isLocalhost()) {
+            return true;
+        }
+
+        // Always valid when self-licensing (server URL points to this installation)
+        if ($this->isSelfLicensing()) {
+            return true;
+        }
+
+        // Check cache first
+        $cached = get_transient(self::CACHE_KEY);
+        if ($cached !== false) {
+            return (bool) $cached;
+        }
+
+        // Validate against server
+        return $this->validateLicense();
+    }
+
+    /**
+     * Validate license against the server
+     *
+     * @param bool $forceRefresh Force refresh even if cached
+     * @return bool True if license is valid
+     */
+    public function validateLicense(bool $forceRefresh = false): bool
+    {
+        // Always valid on localhost
+        if ($this->isLocalhost()) {
+            return true;
+        }
+
+        // Always valid when self-licensing (server URL points to this installation)
+        if ($this->isSelfLicensing()) {
+            return true;
+        }
+
+        // Check settings are configured
+        $serverUrl = $this->getLicenseServerUrl();
+        $licenseKey = $this->getLicenseKey();
+
+        if (empty($serverUrl) || empty($licenseKey)) {
+            set_transient(
+                self::ERROR_CACHE_KEY,
+                __('License settings not configured.', 'wc-licensed-product'),
+                self::ERROR_CACHE_TTL
+            );
+            return false;
+        }
+
+        // Check cache unless force refresh
+        if (!$forceRefresh) {
+            $cached = get_transient(self::CACHE_KEY);
+            if ($cached !== false) {
+                return (bool) $cached;
+            }
+        }
+
+        try {
+            $client = $this->createLicenseClient();
+            $domain = $this->getCurrentDomain();
+
+            // Validate the license
+            $client->validate($licenseKey, $domain);
+
+            // Valid license - cache success
+            set_transient(self::CACHE_KEY, 1, self::CACHE_TTL);
+            delete_transient(self::ERROR_CACHE_KEY);
+
+            return true;
+        } catch (LicenseException $e) {
+            // License-specific error (invalid, expired, revoked, etc.)
+            set_transient(self::CACHE_KEY, 0, self::CACHE_TTL);
+            set_transient(self::ERROR_CACHE_KEY, $e->getMessage(), self::ERROR_CACHE_TTL);
+
+            return false;
+        } catch (\Throwable $e) {
+            // Network/server error - use shorter cache to allow retry
+            set_transient(
+                self::ERROR_CACHE_KEY,
+                __('Could not connect to license server.', 'wc-licensed-product') . ' ' . $e->getMessage(),
+                self::ERROR_CACHE_TTL
+            );
+
+            // Don't cache validation failure on network errors - allow retry on next page load
+            return false;
+        }
+    }
+
+    /**
+     * Get the last error message
+     */
+    public function getLastError(): ?string
+    {
+        $error = get_transient(self::ERROR_CACHE_KEY);
+        return $error !== false ? (string) $error : null;
+    }
+
+    /**
+     * Clear the validation cache
+     */
+    public function clearCache(): void
+    {
+        delete_transient(self::CACHE_KEY);
+        delete_transient(self::ERROR_CACHE_KEY);
+        $this->isLocalhostCached = null;
+        $this->isSelfLicensingCached = null;
+    }
+
+    /**
+     * Check if running on localhost
+     *
+     * Matches localhost, 127.0.0.1, ::1, and any port number.
+     */
+    public function isLocalhost(): bool
+    {
+        if ($this->isLocalhostCached !== null) {
+            return $this->isLocalhostCached;
+        }
+
+        $domain = $this->getCurrentDomain();
+
+        // Remove port number if present
+        $domainWithoutPort = preg_replace('/:[\d]+$/', '', $domain);
+
+        // Check for localhost variants
+        $localhostNames = ['localhost', '127.0.0.1', '::1'];
+
+        if (in_array($domainWithoutPort, $localhostNames, true)) {
+            $this->isLocalhostCached = true;
+            return true;
+        }
+
+        // Check for .localhost and .local subdomains
+        if (
+            str_ends_with($domainWithoutPort, '.localhost') ||
+            str_ends_with($domainWithoutPort, '.local')
+        ) {
+            $this->isLocalhostCached = true;
+            return true;
+        }
+
+        $this->isLocalhostCached = false;
+        return false;
+    }
+
+    /**
+     * Check if self-licensing (license server URL points to this installation)
+     *
+     * Prevents circular dependency where plugin tries to validate against itself.
+     * Plugins can only be validated against the original store from which they were obtained.
+     */
+    public function isSelfLicensing(): bool
+    {
+        if ($this->isSelfLicensingCached !== null) {
+            return $this->isSelfLicensingCached;
+        }
+
+        $serverUrl = $this->getLicenseServerUrl();
+
+        // No server URL configured - not self-licensing
+        if (empty($serverUrl)) {
+            $this->isSelfLicensingCached = false;
+            return false;
+        }
+
+        // Parse both URLs to compare domains
+        $serverParsed = parse_url($serverUrl);
+        $siteUrl = get_site_url();
+        $siteParsed = parse_url($siteUrl);
+
+        // Get normalized domains (lowercase, no www prefix)
+        $serverDomain = $this->normalizeDomain($serverParsed['host'] ?? '');
+        $siteDomain = $this->normalizeDomain($siteParsed['host'] ?? '');
+
+        // If domains match, this is self-licensing
+        if ($serverDomain === $siteDomain) {
+            $this->isSelfLicensingCached = true;
+            return true;
+        }
+
+        $this->isSelfLicensingCached = false;
+        return false;
+    }
+
+    /**
+     * Normalize a domain for comparison (lowercase, strip www)
+     */
+    private function normalizeDomain(string $domain): string
+    {
+        $domain = strtolower(trim($domain));
+
+        // Strip www. prefix
+        if (str_starts_with($domain, 'www.')) {
+            $domain = substr($domain, 4);
+        }
+
+        return $domain;
+    }
+
+    /**
+     * Get the current domain from the site URL
+     */
+    private function getCurrentDomain(): string
+    {
+        $siteUrl = get_site_url();
+        $parsed = parse_url($siteUrl);
+        $host = $parsed['host'] ?? 'localhost';
+
+        // Include port if non-standard
+        if (isset($parsed['port'])) {
+            $host .= ':' . $parsed['port'];
+        }
+
+        return strtolower($host);
+    }
+
+    /**
+     * Get the license server URL from settings
+     */
+    private function getLicenseServerUrl(): string
+    {
+        return (string) get_option('wc_licensed_product_plugin_license_server_url', '');
+    }
+
+    /**
+     * Get the license key from settings
+     */
+    private function getLicenseKey(): string
+    {
+        return (string) get_option('wc_licensed_product_plugin_license_key', '');
+    }
+
+    /**
+     * Get the server secret from settings (optional)
+     */
+    private function getServerSecret(): ?string
+    {
+        $secret = get_option('wc_licensed_product_plugin_license_server_secret', '');
+        return !empty($secret) ? (string) $secret : null;
+    }
+
+    /**
+     * Create the license client instance
+     */
+    private function createLicenseClient(): LicenseClientInterface
+    {
+        $httpClient = HttpClient::create([
+            'timeout' => 10,
+            'verify_peer' => true,
+        ]);
+
+        $serverUrl = $this->getLicenseServerUrl();
+        $serverSecret = $this->getServerSecret();
+
+        // Use secure client if server secret is configured
+        if ($serverSecret !== null) {
+            return new SecureLicenseClient(
+                httpClient: $httpClient,
+                baseUrl: $serverUrl,
+                serverSecret: $serverSecret,
+            );
+        }
+
+        return new LicenseClient(
+            httpClient: $httpClient,
+            baseUrl: $serverUrl,
+        );
+    }
+}

src/Plugin.php

@@ -10,11 +10,14 @@ declare(strict_types=1);
 namespace Jeremias\WcLicensedProduct;
 
 use Jeremias\WcLicensedProduct\Admin\AdminController;
+use Jeremias\WcLicensedProduct\Admin\DashboardWidgetController;
+use Jeremias\WcLicensedProduct\Admin\DownloadWidgetController;
 use Jeremias\WcLicensedProduct\Admin\OrderLicenseController;
 use Jeremias\WcLicensedProduct\Admin\SettingsController;
 use Jeremias\WcLicensedProduct\Admin\VersionAdminController;
 use Jeremias\WcLicensedProduct\Api\ResponseSigner;
 use Jeremias\WcLicensedProduct\Api\RestApiController;
+use Jeremias\WcLicensedProduct\Api\UpdateController;
 use Jeremias\WcLicensedProduct\Checkout\CheckoutBlocksIntegration;
 use Jeremias\WcLicensedProduct\Checkout\CheckoutController;
 use Jeremias\WcLicensedProduct\Checkout\StoreApiExtension;
@@ -22,8 +25,10 @@ use Jeremias\WcLicensedProduct\Email\LicenseEmailController;
 use Jeremias\WcLicensedProduct\Frontend\AccountController;
 use Jeremias\WcLicensedProduct\Frontend\DownloadController;
 use Jeremias\WcLicensedProduct\License\LicenseManager;
+use Jeremias\WcLicensedProduct\License\PluginLicenseChecker;
 use Jeremias\WcLicensedProduct\Product\LicensedProductType;
 use Jeremias\WcLicensedProduct\Product\VersionManager;
+use Jeremias\WcLicensedProduct\Update\PluginUpdateChecker;
 use Twig\Environment;
 use Twig\Loader\FilesystemLoader;
 
@@ -96,6 +101,7 @@ final class Plugin
         $this->twig = new Environment($loader, [
             'cache' => WP_CONTENT_DIR . '/cache/wc-licensed-product/twig',
             'auto_reload' => true, // Always check for template changes
+            'autoescape' => 'html', // Explicitly enable HTML autoescape for XSS protection
         ]);
 
         // Add WordPress functions as Twig functions
@@ -119,14 +125,25 @@ final class Plugin
         $this->licenseManager = new LicenseManager();
         $this->versionManager = new VersionManager();
 
-        // Initialize controllers
+        // Check plugin license
+        $licenseChecker = PluginLicenseChecker::getInstance();
+        $isLicensed = $licenseChecker->isLicenseValid();
+
+        // Always initialize product type (needed for existing orders)
         new LicensedProductType();
+
+        // Only initialize frontend components if licensed or on localhost
+        if ($isLicensed) {
             new CheckoutController($this->licenseManager);
             new StoreApiExtension($this->licenseManager);
             $this->registerCheckoutBlocksIntegration();
             $this->downloadController = new DownloadController($this->licenseManager, $this->versionManager);
             new AccountController($this->twig, $this->licenseManager, $this->versionManager, $this->downloadController);
+        }
+
+        // Always initialize REST API, update API, and email controller
         new RestApiController($this->licenseManager);
+        new UpdateController($this->licenseManager, $this->versionManager);
         new LicenseEmailController($this->licenseManager);
 
         // Initialize response signing if server secret is configured
@@ -134,11 +151,25 @@ final class Plugin
             (new ResponseSigner())->register();
         }
 
+        // Admin always available
         if (is_admin()) {
             new AdminController($this->twig, $this->licenseManager);
             new VersionAdminController($this->versionManager);
             new OrderLicenseController($this->licenseManager);
             new SettingsController();
+            new DashboardWidgetController($this->licenseManager);
+            new DownloadWidgetController($this->versionManager);
+
+            // Show admin notice if unlicensed and not on localhost
+            if (!$isLicensed && !$licenseChecker->isLocalhost()) {
+                add_action('admin_notices', [$this, 'showUnlicensedNotice']);
+            }
+        }
+
+        // Initialize update checker if license server is configured (client-side updates)
+        $serverUrl = SettingsController::getPluginLicenseServerUrl();
+        if (!empty($serverUrl) && !$licenseChecker->isSelfLicensing()) {
+            PluginUpdateChecker::getInstance()->register();
         }
     }
 
@@ -164,6 +195,9 @@ final class Plugin
      */
     private function registerHooks(): void
     {
+        // Only register order hooks if licensed (license generation requires valid license)
+        $licenseChecker = PluginLicenseChecker::getInstance();
+        if ($licenseChecker->isLicenseValid()) {
             // Generate license on order completion (multiple hooks for compatibility)
             add_action('woocommerce_order_status_completed', [$this, 'onOrderCompleted']);
             add_action('woocommerce_order_status_processing', [$this, 'onOrderCompleted']);
@@ -171,6 +205,7 @@ final class Plugin
             // Also hook into payment complete for immediate license generation
             add_action('woocommerce_payment_complete', [$this, 'onOrderCompleted']);
         }
+    }
 
     /**
      * Handle order completion - generate licenses
@@ -182,22 +217,106 @@ final class Plugin
             return;
         }
 
+        // Try new multi-domain format first
+        $domainData = $order->get_meta('_licensed_product_domains');
+
+        if (!empty($domainData) && is_array($domainData)) {
+            $this->generateLicensesMultiDomain($order, $domainData);
+            return;
+        }
+
+        // Fall back to legacy single domain format
+        $this->generateLicensesSingleDomain($order);
+    }
+
+    /**
+     * Generate licenses for new multi-domain format
+     */
+    private function generateLicensesMultiDomain(\WC_Order $order, array $domainData): void
+    {
+        $orderId = $order->get_id();
+        $customerId = $order->get_customer_id();
+
+        // Index domains by product ID (and variation ID for variable products)
+        $domainsByProduct = [];
+        foreach ($domainData as $item) {
+            if (isset($item['product_id']) && isset($item['domains']) && is_array($item['domains'])) {
+                $productId = (int) $item['product_id'];
+                $variationId = isset($item['variation_id']) ? (int) $item['variation_id'] : 0;
+                $key = $variationId > 0 ? "{$productId}_{$variationId}" : (string) $productId;
+                $domainsByProduct[$key] = [
+                    'domains' => $item['domains'],
+                    'variation_id' => $variationId,
+                ];
+            }
+        }
+
+        // Generate licenses for each licensed product
         foreach ($order->get_items() as $item) {
             $product = $item->get_product();
-            if ($product && $product->is_type('licensed')) {
-                $domain = $order->get_meta('_licensed_product_domain');
-                if ($domain) {
+
+            if (!$product) {
+                continue;
+            }
+
+            if (!$this->licenseManager->isLicensedProduct($product)) {
+                continue;
+            }
+
+            // Get the parent product ID (for variations, this is the main product)
+            $productId = $product->is_type('variation') ? $product->get_parent_id() : $product->get_id();
+            $variationId = $item->get_variation_id();
+
+            // Look up domains - first try with variation, then without
+            $key = $variationId > 0 ? "{$productId}_{$variationId}" : (string) $productId;
+            $domainInfo = $domainsByProduct[$key] ?? $domainsByProduct[(string) $productId] ?? null;
+            $domains = $domainInfo['domains'] ?? [];
+
+            // Generate a license for each domain
+            foreach ($domains as $domain) {
+                if (!empty($domain)) {
                     $this->licenseManager->generateLicense(
                         $orderId,
-                        $product->get_id(),
-                        $order->get_customer_id(),
-                        $domain
+                        $productId,
+                        $customerId,
+                        $domain,
+                        $variationId > 0 ? $variationId : null
                     );
                 }
             }
         }
     }
 
+    /**
+     * Generate licenses for legacy single domain format
+     */
+    private function generateLicensesSingleDomain(\WC_Order $order): void
+    {
+        $domain = $order->get_meta('_licensed_product_domain');
+
+        if (empty($domain)) {
+            return;
+        }
+
+        foreach ($order->get_items() as $item) {
+            $product = $item->get_product();
+
+            if ($product && $this->licenseManager->isLicensedProduct($product)) {
+                // Get the parent product ID (for variations, this is the main product)
+                $productId = $product->is_type('variation') ? $product->get_parent_id() : $product->get_id();
+                $variationId = $item->get_variation_id();
+
+                $this->licenseManager->generateLicense(
+                    $order->get_id(),
+                    $productId,
+                    $order->get_customer_id(),
+                    $domain,
+                    $variationId > 0 ? $variationId : null
+                );
+            }
+        }
+    }
+
     /**
      * Get Twig environment
      */
@@ -221,4 +340,29 @@ final class Plugin
     {
         return $this->twig->render($template, $context);
     }
+
+    /**
+     * Show admin notice when plugin is unlicensed
+     */
+    public function showUnlicensedNotice(): void
+    {
+        $settingsUrl = admin_url('admin.php?page=wc-settings&tab=licensed_product');
+        ?>
+        <div class="notice notice-warning is-dismissible">
+            <p>
+                <strong><?php esc_html_e('WC Licensed Product', 'wc-licensed-product'); ?>:</strong>
+                <?php esc_html_e('Plugin license is not configured or invalid. Frontend features are disabled.', 'wc-licensed-product'); ?>
+                <a href="<?php echo esc_url($settingsUrl); ?>"><?php esc_html_e('Configure License', 'wc-licensed-product'); ?></a>
+            </p>
+        </div>
+        <?php
+    }
+
+    /**
+     * Get the plugin license checker instance
+     */
+    public function getLicenseChecker(): PluginLicenseChecker
+    {
+        return PluginLicenseChecker::getInstance();
+    }
 }

src/Product/LicensedProduct.php

@@ -55,6 +55,14 @@ class LicensedProduct extends WC_Product
         return $this->exists() && $this->get_price() !== '';
     }
 
+    /**
+     * Licensed products are always in stock (virtual, no inventory)
+     */
+    public function is_in_stock(): bool
+    {
+        return true;
+    }
+
     /**
      * Get max activations for this product
      * Falls back to default settings if not set on product

src/Product/LicensedProductType.php

@@ -12,7 +12,8 @@ namespace Jeremias\WcLicensedProduct\Product;
 use Jeremias\WcLicensedProduct\Admin\SettingsController;
 
 /**
- * Registers and handles the Licensed product type for WooCommerce
+ * Registers and handles the Licensed product types for WooCommerce
+ * Supports both simple licensed products and variable licensed products
  */
 final class LicensedProductType
 {
@@ -29,9 +30,12 @@ final class LicensedProductType
      */
     private function registerHooks(): void
     {
-        // Register product type
+        // Ensure product type terms exist in taxonomy (for WC_Product_Factory::get_product_type())
+        add_action('woocommerce_init', [$this, 'ensureProductTypeTermsExist']);
+
+        // Register product types
         add_filter('product_type_selector', [$this, 'addProductType']);
-        add_filter('woocommerce_product_class', [$this, 'getProductClass'], 10, 2);
+        add_filter('woocommerce_product_class', [$this, 'getProductClass'], 10, 4);
 
         // Add product data tabs
         add_filter('woocommerce_product_data_tabs', [$this, 'addProductDataTab']);
@@ -39,45 +43,121 @@ final class LicensedProductType
 
         // Save product meta
         add_action('woocommerce_process_product_meta_licensed', [$this, 'saveProductMeta']);
+        add_action('woocommerce_process_product_meta_licensed-variable', [$this, 'saveProductMeta']);
 
         // Show price and add to cart for licensed products
         add_action('woocommerce_licensed_add_to_cart', [$this, 'addToCartTemplate']);
+        add_action('woocommerce_licensed-variable_add_to_cart', [$this, 'variableAddToCartTemplate']);
+
+        // Use variable product add-to-cart handler for licensed-variable products
+        add_filter('woocommerce_add_to_cart_handler', [$this, 'addToCartHandler'], 10, 2);
 
         // Make product virtual by default
         add_filter('woocommerce_product_is_virtual', [$this, 'isVirtual'], 10, 2);
+
+        // Hide stock HTML for licensed products
+        add_filter('woocommerce_get_stock_html', [$this, 'hideStockHtml'], 10, 2);
+        add_filter('woocommerce_get_availability', [$this, 'hideAvailability'], 10, 2);
+        add_filter('woocommerce_get_availability_text', [$this, 'hideAvailabilityText'], 10, 2);
+        add_filter('woocommerce_product_get_stock_quantity', [$this, 'hideStockQuantity'], 10, 2);
+        add_filter('woocommerce_product_variation_get_stock_quantity', [$this, 'hideStockQuantity'], 10, 2);
+
+        // Display current version under product title on single product page
+        add_action('woocommerce_single_product_summary', [$this, 'displayCurrentVersion'], 6);
+
+        // Enqueue frontend CSS for licensed products on single product pages
+        add_action('wp_enqueue_scripts', [$this, 'enqueueFrontendStyles']);
+
+        // Variable product support - variation settings
+        add_action('woocommerce_variation_options', [$this, 'addVariationOptions'], 10, 3);
+        add_action('woocommerce_product_after_variable_attributes', [$this, 'addVariationFields'], 10, 3);
+        add_action('woocommerce_save_product_variation', [$this, 'saveVariationFields'], 10, 2);
+
+        // Admin scripts for licensed-variable type
+        add_action('admin_footer', [$this, 'addVariableProductScripts']);
     }
 
     /**
-     * Add product type to selector
+     * Ensure product type terms exist in the product_type taxonomy
+     * This is required for WC_Product_Factory::get_product_type() to work correctly
+     */
+    public function ensureProductTypeTermsExist(): void
+    {
+        \Jeremias\WcLicensedProduct\Installer::registerProductTypes();
+    }
+
+    /**
+     * Add product types to selector
      */
     public function addProductType(array $types): array
     {
         $types['licensed'] = __('Licensed Product', 'wc-licensed-product');
+        $types['licensed-variable'] = __('Licensed Variable Product', 'wc-licensed-product');
         return $types;
     }
 
     /**
-     * Get product class for licensed type
+     * Get product class for licensed types
+     *
+     * @param string $className Default class name
+     * @param string $productType Product type
+     * @param string $postType Post type (usually 'product' or 'product_variation')
+     * @param mixed  $productId Product ID (can be int or string)
      */
-    public function getProductClass(string $className, string $productType): string
+    public function getProductClass(string $className, string $productType, string $postType = '', $productId = 0): string
     {
         if ($productType === 'licensed') {
             return LicensedProduct::class;
         }
+        if ($productType === 'licensed-variable') {
+            return LicensedVariableProduct::class;
+        }
+        // Handle variations of licensed-variable products
+        // Check both by product type and by post type for variations
+        if ($productType === 'variation' || $postType === 'product_variation') {
+            // Get parent ID from the product post
+            $parentId = 0;
+            $productIdInt = (int) $productId;
+            if ($productIdInt > 0) {
+                $parentId = wp_get_post_parent_id($productIdInt);
+            }
+            // Fallback to global $post if product ID not available
+            if (!$parentId) {
+                global $post;
+                if ($post && $post->post_parent) {
+                    $parentId = (int) $post->post_parent;
+                }
+            }
+
+            if ($parentId) {
+                $parentType = \WC_Product_Factory::get_product_type($parentId);
+                if ($parentType === 'licensed-variable') {
+                    return LicensedProductVariation::class;
+                }
+            }
+        }
         return $className;
     }
 
     /**
      * Add product data tab for license settings
+     * Also modify variations tab to show for licensed-variable products
      */
     public function addProductDataTab(array $tabs): array
     {
+        // Add our License Settings tab
         $tabs['licensed_product'] = [
             'label' => __('License Settings', 'wc-licensed-product'),
             'target' => 'licensed_product_data',
-            'class' => ['show_if_licensed'],
+            'class' => ['show_if_licensed', 'show_if_licensed-variable'],
             'priority' => 21,
         ];
+
+        // Make Variations tab also show for licensed-variable products
+        if (isset($tabs['variations'])) {
+            $tabs['variations']['class'][] = 'show_if_licensed-variable';
+        }
+
         return $tabs;
     }
 
@@ -167,27 +247,6 @@ final class LicensedProductType
                 ?>
             </div>
         </div>
-        <script type="text/javascript">
-            jQuery(document).ready(function($) {
-                // Show/hide panels based on product type
-                $('select#product-type').change(function() {
-                    if ($(this).val() === 'licensed') {
-                        $('.show_if_licensed').show();
-                        $('.general_options').show();
-                        $('.pricing').show();
-                    } else {
-                        $('.show_if_licensed').hide();
-                    }
-                }).change();
-
-                // Show general tab for licensed products
-                $('#product-type').on('change', function() {
-                    if ($(this).val() === 'licensed') {
-                        $('.general_tab').show();
-                    }
-                });
-            });
-        </script>
         <?php
     }
 
@@ -225,14 +284,432 @@ final class LicensedProductType
         wc_get_template('single-product/add-to-cart/simple.php');
     }
 
+    /**
+     * Use the variable product add-to-cart handler for licensed-variable products
+     * WooCommerce uses product type to determine which handler to use
+     */
+    public function addToCartHandler(string $handler, \WC_Product $product): string
+    {
+        if ($product->is_type('licensed-variable')) {
+            return 'variable';
+        }
+        return $handler;
+    }
+
+    /**
+     * Hide stock HTML for licensed products (they're always virtual/in-stock)
+     */
+    public function hideStockHtml(string $html, \WC_Product $product): string
+    {
+        if ($this->isLicensedProductOrVariation($product)) {
+            return '';
+        }
+        return $html;
+    }
+
+    /**
+     * Hide availability data for licensed products (they're always virtual/in-stock)
+     */
+    public function hideAvailability(array $availability, \WC_Product $product): array
+    {
+        if ($this->isLicensedProductOrVariation($product)) {
+            return [
+                'availability' => '',
+                'class'        => '',
+            ];
+        }
+        return $availability;
+    }
+
+    /**
+     * Hide availability text for licensed products
+     */
+    public function hideAvailabilityText(string $availability, \WC_Product $product): string
+    {
+        if ($this->isLicensedProductOrVariation($product)) {
+            return '';
+        }
+        return $availability;
+    }
+
+    /**
+     * Hide stock quantity for licensed products (return null = no stock display)
+     *
+     * @param int|null $quantity
+     * @param \WC_Product $product
+     * @return int|null
+     */
+    public function hideStockQuantity($quantity, \WC_Product $product)
+    {
+        if ($this->isLicensedProductOrVariation($product)) {
+            return null;
+        }
+        return $quantity;
+    }
+
+    /**
+     * Check if product is a licensed product or variation of one
+     */
+    private function isLicensedProductOrVariation(\WC_Product $product): bool
+    {
+        // Direct licensed products
+        if ($product->is_type('licensed') || $product->is_type('licensed-variable')) {
+            return true;
+        }
+
+        // Check by class name for our custom variation class
+        if ($product instanceof LicensedProductVariation) {
+            return true;
+        }
+
+        // Check if this is a variation with a licensed-variable parent
+        // Use WC_Product_Factory::get_product_type() to get parent type directly from DB
+        // This is more reliable than loading the full product object
+        $parentId = $product->get_parent_id();
+        if ($parentId) {
+            $parentType = \WC_Product_Factory::get_product_type($parentId);
+            if ($parentType === 'licensed-variable') {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
     /**
      * Make licensed products virtual by default
      */
     public function isVirtual(bool $isVirtual, \WC_Product $product): bool
     {
-        if ($product->is_type('licensed')) {
+        if ($this->isLicensedProductOrVariation($product)) {
             return true;
         }
         return $isVirtual;
     }
+
+    /**
+     * Enqueue frontend styles and scripts for licensed products on single product pages
+     */
+    public function enqueueFrontendStyles(): void
+    {
+        if (!is_product()) {
+            return;
+        }
+
+        global $product;
+
+        if (!$product || (!$product->is_type('licensed') && !$product->is_type('licensed-variable'))) {
+            return;
+        }
+
+        wp_enqueue_style(
+            'wc-licensed-product-frontend',
+            WC_LICENSED_PRODUCT_PLUGIN_URL . 'assets/css/frontend.css',
+            [],
+            WC_LICENSED_PRODUCT_VERSION
+        );
+
+        // For licensed-variable products, enqueue WooCommerce variation scripts
+        if ($product->is_type('licensed-variable')) {
+            wp_enqueue_script('wc-add-to-cart-variation');
+        }
+    }
+
+    /**
+     * Display current version under product title on single product page
+     */
+    public function displayCurrentVersion(): void
+    {
+        global $product;
+
+        if (!$product || (!$product->is_type('licensed') && !$product->is_type('licensed-variable'))) {
+            return;
+        }
+
+        /** @var LicensedProduct|LicensedVariableProduct $product */
+        $version = $product->get_current_version();
+
+        if (empty($version)) {
+            return;
+        }
+
+        printf(
+            '<p class="wclp-product-version"><span class="version-label">%s</span> <span class="version-number">%s</span></p>',
+            esc_html__('Version:', 'wc-licensed-product'),
+            esc_html($version)
+        );
+    }
+
+    /**
+     * Add to cart template for variable licensed products
+     * This mirrors WooCommerce's woocommerce_variable_add_to_cart() function
+     */
+    public function variableAddToCartTemplate(): void
+    {
+        global $product;
+
+        // The hook woocommerce_licensed-variable_add_to_cart only fires for this product type
+        // so we just need to verify the product exists
+        if (!$product) {
+            return;
+        }
+
+        // Ensure we're working with a product that has variable product methods
+        // Re-load the product to ensure we get the correct class instance
+        $productId = $product->get_id();
+        $variableProduct = wc_get_product($productId);
+
+        if (!$variableProduct || !method_exists($variableProduct, 'get_variation_attributes')) {
+            // Fallback to simple add to cart if not a variable product
+            wc_get_template('single-product/add-to-cart/simple.php');
+            return;
+        }
+
+        // Update global $product to use the correctly loaded instance
+        // This ensures the template has the right product type
+        $product = $variableProduct;
+
+        // Get variations count to determine if we should load them via AJAX
+        $children = $variableProduct->get_children();
+        $getVariations = count($children) <= apply_filters('woocommerce_ajax_variation_threshold', 30, $variableProduct);
+
+        // Get template variables - WooCommerce expects these to be set
+        $availableVariations = $getVariations ? $variableProduct->get_available_variations() : false;
+        $attributes = $variableProduct->get_variation_attributes();
+        $selectedAttributes = $variableProduct->get_default_attributes();
+
+        // Ensure arrays (WooCommerce template expects arrays, not null)
+        if (!is_array($attributes)) {
+            $attributes = [];
+        }
+        if (!is_array($selectedAttributes)) {
+            $selectedAttributes = [];
+        }
+
+        wc_get_template(
+            'single-product/add-to-cart/variable.php',
+            [
+                'available_variations' => $availableVariations,
+                'attributes'           => $attributes,
+                'selected_attributes'  => $selectedAttributes,
+            ]
+        );
+    }
+
+    /**
+     * Add variation options (checkboxes next to variation header)
+     */
+    public function addVariationOptions(int $loop, array $variationData, \WP_Post $variation): void
+    {
+        // Check if parent is licensed-variable
+        $parentId = $variation->post_parent;
+        $parentProduct = wc_get_product($parentId);
+
+        if (!$parentProduct || !$parentProduct->is_type('licensed-variable')) {
+            return;
+        }
+
+        $isVirtual = get_post_meta($variation->ID, '_virtual', true);
+        ?>
+        <label class="tips" data-tip="<?php esc_attr_e('Licensed products are always virtual', 'wc-licensed-product'); ?>">
+            <input type="checkbox" class="checkbox" disabled checked />
+            <?php esc_html_e('Virtual', 'wc-licensed-product'); ?>
+        </label>
+        <?php
+    }
+
+    /**
+     * Add variation fields for license settings
+     */
+    public function addVariationFields(int $loop, array $variationData, \WP_Post $variation): void
+    {
+        // Check if parent is licensed-variable
+        $parentId = $variation->post_parent;
+        $parentProduct = wc_get_product($parentId);
+
+        if (!$parentProduct || !$parentProduct->is_type('licensed-variable')) {
+            return;
+        }
+
+        // Get variation values
+        $validityDays = get_post_meta($variation->ID, '_licensed_validity_days', true);
+        $maxActivations = get_post_meta($variation->ID, '_licensed_max_activations', true);
+
+        // Get parent defaults for placeholder
+        $parentValidityDays = $parentProduct->get_validity_days();
+        $parentMaxActivations = $parentProduct->get_max_activations();
+
+        $parentValidityDisplay = $parentValidityDays !== null
+            ? sprintf(__('%d days', 'wc-licensed-product'), $parentValidityDays)
+            : __('Lifetime', 'wc-licensed-product');
+
+        ?>
+        <div class="wclp-variation-license-settings">
+            <p class="form-row form-row-first">
+                <label><?php esc_html_e('License Duration (Days)', 'wc-licensed-product'); ?></label>
+                <input type="number"
+                       name="wclp_validity_days[<?php echo esc_attr($loop); ?>]"
+                       class="short"
+                       min="0"
+                       step="1"
+                       placeholder="<?php echo esc_attr($parentValidityDisplay); ?>"
+                       value="<?php echo esc_attr($validityDays); ?>"
+                />
+                <span class="description"><?php esc_html_e('Leave empty for parent default. 0 = Lifetime.', 'wc-licensed-product'); ?></span>
+            </p>
+            <p class="form-row form-row-last">
+                <label><?php esc_html_e('Max Activations', 'wc-licensed-product'); ?></label>
+                <input type="number"
+                       name="wclp_max_activations[<?php echo esc_attr($loop); ?>]"
+                       class="short"
+                       min="1"
+                       step="1"
+                       placeholder="<?php echo esc_attr($parentMaxActivations); ?>"
+                       value="<?php echo esc_attr($maxActivations); ?>"
+                />
+                <span class="description"><?php esc_html_e('Leave empty for parent default.', 'wc-licensed-product'); ?></span>
+            </p>
+        </div>
+        <style>
+            .wclp-variation-license-settings {
+                background: #f8f8f8;
+                border: 1px solid #e5e5e5;
+                padding: 10px;
+                margin: 10px 0;
+                border-radius: 4px;
+            }
+            .wclp-variation-license-settings .description {
+                display: block;
+                font-style: italic;
+                color: #666;
+                margin-top: 4px;
+            }
+        </style>
+        <?php
+    }
+
+    /**
+     * Save variation fields
+     */
+    public function saveVariationFields(int $variationId, int $loop): void
+    {
+        // Check if parent is licensed-variable
+        $variation = wc_get_product($variationId);
+        if (!$variation) {
+            return;
+        }
+
+        $parentProduct = wc_get_product($variation->get_parent_id());
+        if (!$parentProduct || !$parentProduct->is_type('licensed-variable')) {
+            return;
+        }
+
+        // Save validity days
+        // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce is verified by WooCommerce
+        if (isset($_POST['wclp_validity_days'][$loop])) {
+            // phpcs:ignore WordPress.Security.NonceVerification.Missing
+            $validityDays = sanitize_text_field($_POST['wclp_validity_days'][$loop]);
+            if ($validityDays !== '') {
+                update_post_meta($variationId, '_licensed_validity_days', absint($validityDays));
+            } else {
+                delete_post_meta($variationId, '_licensed_validity_days');
+            }
+        }
+
+        // Save max activations
+        // phpcs:ignore WordPress.Security.NonceVerification.Missing
+        if (isset($_POST['wclp_max_activations'][$loop])) {
+            // phpcs:ignore WordPress.Security.NonceVerification.Missing
+            $maxActivations = sanitize_text_field($_POST['wclp_max_activations'][$loop]);
+            if ($maxActivations !== '') {
+                update_post_meta($variationId, '_licensed_max_activations', absint($maxActivations));
+            } else {
+                delete_post_meta($variationId, '_licensed_max_activations');
+            }
+        }
+
+        // Set variation as virtual (licensed products are always virtual)
+        update_post_meta($variationId, '_virtual', 'yes');
+    }
+
+    /**
+     * Add JavaScript for licensed product types in admin
+     * Handles visibility of License Settings tab and Product Versions meta box
+     */
+    public function addVariableProductScripts(): void
+    {
+        global $post, $pagenow;
+
+        if ($pagenow !== 'post.php' && $pagenow !== 'post-new.php') {
+            return;
+        }
+
+        if (!$post || get_post_type($post) !== 'product') {
+            return;
+        }
+
+        ?>
+        <script type="text/javascript">
+            jQuery(document).ready(function($) {
+                // Handle our custom License Settings tab, Product Versions meta box,
+                // and show_if_licensed-variable elements
+                function toggleOurElements() {
+                    var productType = $('#product-type').val();
+                    var isLicensed = productType === 'licensed';
+                    var isLicensedVariable = productType === 'licensed-variable';
+
+                    // License Settings tab - use CSS class for visibility
+                    var $licenseTab = $('li.licensed_product_options');
+                    if (isLicensed || isLicensedVariable) {
+                        $licenseTab.addClass('wclp-active');
+                    } else {
+                        $licenseTab.removeClass('wclp-active');
+                        // If License Settings panel is active, switch to General tab
+                        if ($('#licensed_product_data').is(':visible')) {
+                            $('li.general_options a').trigger('click');
+                        }
+                    }
+
+                    // Product Versions meta box
+                    var $metaBox = $('#wc_licensed_product_versions');
+                    if (isLicensed || isLicensedVariable) {
+                        $metaBox.css('display', '');
+                    } else {
+                        $metaBox.css('display', 'none');
+                    }
+
+                    // Handle show_if_licensed-variable elements (like Variations tab)
+                    // WooCommerce doesn't know about our custom product types
+                    if (isLicensedVariable) {
+                        $('.show_if_licensed-variable').show();
+                        // Also show elements that should be visible for variable products
+                        // since licensed-variable is a variable product type
+                        $('.show_if_variable').show();
+                        $('.hide_if_variable').hide();
+                    } else {
+                        // Let WooCommerce handle show_if_variable elements
+                        // We only need to hide our custom class when not licensed-variable
+                        // Don't hide show_if_licensed-variable when it's licensed (simple)
+                        if (!isLicensed) {
+                            $('.show_if_licensed-variable').not('.show_if_licensed').hide();
+                        }
+                    }
+                }
+
+                // Initial setup - run after WooCommerce has initialized
+                setTimeout(toggleOurElements, 10);
+
+                // On product type change - run after WooCommerce has processed
+                $('#product-type').on('change', function() {
+                    setTimeout(toggleOurElements, 100);
+                });
+
+                // Re-apply after WooCommerce AJAX operations
+                $(document).on('woocommerce_variations_loaded woocommerce_variations_added woocommerce_variations_saved', function() {
+                    setTimeout(toggleOurElements, 10);
+                });
+            });
+        </script>
+        <?php
+    }
 }

src/Product/LicensedProductVariation.php

@@ -0,0 +1,251 @@
+<?php
+/**
+ * Licensed Product Variation Class
+ *
+ * @package Jeremias\WcLicensedProduct\Product
+ */
+
+declare(strict_types=1);
+
+namespace Jeremias\WcLicensedProduct\Product;
+
+use Jeremias\WcLicensedProduct\Admin\SettingsController;
+use WC_Product_Variation;
+
+/**
+ * Licensed Product Variation type extending WooCommerce Product Variation
+ *
+ * Each variation can have its own license duration settings.
+ */
+class LicensedProductVariation extends WC_Product_Variation
+{
+    /**
+     * Constructor
+     */
+    public function __construct($product = 0)
+    {
+        parent::__construct($product);
+    }
+
+    /**
+     * Licensed products are always virtual
+     */
+    public function is_virtual(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Licensed products are always in stock (virtual, no inventory)
+     */
+    public function is_in_stock(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get availability - empty for licensed products (no stock indicator)
+     */
+    public function get_availability(): array
+    {
+        return [
+            'availability' => '',
+            'class'        => '',
+        ];
+    }
+
+    /**
+     * Don't manage stock for licensed products
+     */
+    public function managing_stock(): bool
+    {
+        return false;
+    }
+
+    /**
+     * Check if variation is purchasable
+     * Override to handle custom parent product type
+     */
+    public function is_purchasable(): bool
+    {
+        // Check if variation exists
+        if (!$this->exists()) {
+            return false;
+        }
+
+        // Check parent product status
+        $parentId = $this->get_parent_id();
+        $parentStatus = get_post_status($parentId);
+
+        if ($parentStatus !== 'publish' && !current_user_can('edit_post', $parentId)) {
+            return false;
+        }
+
+        // Check if variation has a price
+        $price = $this->get_price();
+        if ($price === '' || $price === null) {
+            return false;
+        }
+
+        return apply_filters('woocommerce_variation_is_purchasable', true, $this);
+    }
+
+    /**
+     * Get max activations for this variation
+     * Falls back to parent product, then to default settings
+     */
+    public function get_max_activations(): int
+    {
+        // Check variation-specific setting first
+        $value = $this->get_meta('_licensed_max_activations', true);
+        if ($value !== '' && $value !== null) {
+            return max(1, (int) $value);
+        }
+
+        // Fall back to parent product
+        $parent = wc_get_product($this->get_parent_id());
+        if ($parent && method_exists($parent, 'get_max_activations')) {
+            return $parent->get_max_activations();
+        }
+
+        return SettingsController::getDefaultMaxActivations();
+    }
+
+    /**
+     * Check if variation has custom max activations set
+     */
+    public function has_custom_max_activations(): bool
+    {
+        $value = $this->get_meta('_licensed_max_activations', true);
+        return $value !== '' && $value !== null;
+    }
+
+    /**
+     * Get validity days for this variation
+     * This is the primary license setting that varies per variation
+     * Falls back to parent product, then to default settings
+     */
+    public function get_validity_days(): ?int
+    {
+        // Check variation-specific setting first
+        $value = $this->get_meta('_licensed_validity_days', true);
+        if ($value !== '' && $value !== null) {
+            $days = (int) $value;
+            // 0 means lifetime
+            return $days > 0 ? $days : null;
+        }
+
+        // Fall back to parent product
+        $parent = wc_get_product($this->get_parent_id());
+        if ($parent && method_exists($parent, 'get_validity_days')) {
+            return $parent->get_validity_days();
+        }
+
+        return SettingsController::getDefaultValidityDays();
+    }
+
+    /**
+     * Check if variation has custom validity days set
+     */
+    public function has_custom_validity_days(): bool
+    {
+        $value = $this->get_meta('_licensed_validity_days', true);
+        return $value !== '' && $value !== null;
+    }
+
+    /**
+     * Check if license should be bound to major version
+     * Falls back to parent product, then to default settings
+     */
+    public function is_bound_to_version(): bool
+    {
+        // Check variation-specific setting first
+        $value = $this->get_meta('_licensed_bind_to_version', true);
+        if ($value !== '' && $value !== null) {
+            return $value === 'yes';
+        }
+
+        // Fall back to parent product
+        $parent = wc_get_product($this->get_parent_id());
+        if ($parent && method_exists($parent, 'is_bound_to_version')) {
+            return $parent->is_bound_to_version();
+        }
+
+        return SettingsController::getDefaultBindToVersion();
+    }
+
+    /**
+     * Check if variation has custom bind to version setting
+     */
+    public function has_custom_bind_to_version(): bool
+    {
+        $value = $this->get_meta('_licensed_bind_to_version', true);
+        return $value !== '' && $value !== null;
+    }
+
+    /**
+     * Get the license duration label for display
+     */
+    public function get_license_duration_label(): string
+    {
+        $days = $this->get_validity_days();
+
+        if ($days === null) {
+            return __('Lifetime', 'wc-licensed-product');
+        }
+
+        if ($days === 30) {
+            return __('Monthly', 'wc-licensed-product');
+        }
+
+        if ($days === 90) {
+            return __('Quarterly', 'wc-licensed-product');
+        }
+
+        if ($days === 365) {
+            return __('Yearly', 'wc-licensed-product');
+        }
+
+        return sprintf(
+            /* translators: %d: number of days */
+            _n('%d day', '%d days', $days, 'wc-licensed-product'),
+            $days
+        );
+    }
+
+    /**
+     * Get current software version from parent product
+     */
+    public function get_current_version(): string
+    {
+        $parent = wc_get_product($this->get_parent_id());
+        if ($parent && method_exists($parent, 'get_current_version')) {
+            return $parent->get_current_version();
+        }
+
+        $versionManager = new VersionManager();
+        $latestVersion = $versionManager->getLatestVersion($this->get_parent_id());
+
+        return $latestVersion ? $latestVersion->getVersion() : '';
+    }
+
+    /**
+     * Get major version number from parent product
+     */
+    public function get_major_version(): int
+    {
+        $parent = wc_get_product($this->get_parent_id());
+        if ($parent && method_exists($parent, 'get_major_version')) {
+            return $parent->get_major_version();
+        }
+
+        $versionManager = new VersionManager();
+        $latestVersion = $versionManager->getLatestVersion($this->get_parent_id());
+
+        if ($latestVersion) {
+            return $latestVersion->getMajorVersion();
+        }
+
+        return 1;
+    }
+}

src/Product/LicensedVariableProduct.php

@@ -0,0 +1,350 @@
+<?php
+/**
+ * Licensed Variable Product Class
+ *
+ * @package Jeremias\WcLicensedProduct\Product
+ */
+
+declare(strict_types=1);
+
+namespace Jeremias\WcLicensedProduct\Product;
+
+use Jeremias\WcLicensedProduct\Admin\SettingsController;
+use WC_Product_Variable;
+
+/**
+ * Licensed Variable Product type extending WooCommerce Variable Product
+ *
+ * This allows selling license subscriptions with different durations
+ * (e.g., monthly, yearly, lifetime) as product variations.
+ */
+class LicensedVariableProduct extends WC_Product_Variable
+{
+    /**
+     * Product type
+     */
+    protected $product_type = 'licensed-variable';
+
+    /**
+     * Constructor
+     */
+    public function __construct($product = 0)
+    {
+        parent::__construct($product);
+    }
+
+    /**
+     * Get product type
+     */
+    public function get_type(): string
+    {
+        return 'licensed-variable';
+    }
+
+    /**
+     * Check if product is of a certain type
+     * Override to return true for 'variable' as well, so WooCommerce internal
+     * checks pass (many methods in WC_Product_Variable check is_type('variable'))
+     */
+    public function is_type($type): bool
+    {
+        if (is_array($type)) {
+            return in_array($this->get_type(), $type, true) || in_array('variable', $type, true);
+        }
+        return $this->get_type() === $type || 'variable' === $type;
+    }
+
+    /**
+     * Licensed products are always virtual
+     */
+    public function is_virtual(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Licensed variable products are purchasable if the parent check passes
+     * Variable products don't have a direct price - their variations do
+     */
+    public function is_purchasable(): bool
+    {
+        // Use the parent WC_Product_Variable logic
+        // which checks exists() and status, not price
+        return parent::is_purchasable();
+    }
+
+    /**
+     * Licensed products are always in stock (virtual, no inventory)
+     */
+    public function is_in_stock(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get children (variations) for this product
+     * Override because WC_Product_Variable::get_children() checks is_type('variable')
+     * which fails for our 'licensed-variable' type
+     */
+    public function get_children($context = 'view'): array
+    {
+        if (!$this->get_id()) {
+            return [];
+        }
+
+        // Query variations directly from database since WooCommerce's data store
+        // doesn't work properly with custom variable product types
+        global $wpdb;
+        $children = $wpdb->get_col($wpdb->prepare(
+            "SELECT ID FROM {$wpdb->posts}
+             WHERE post_parent = %d
+             AND post_type = 'product_variation'
+             AND post_status IN ('publish', 'private')
+             ORDER BY menu_order ASC, ID ASC",
+            $this->get_id()
+        ));
+
+        $children = array_map('intval', $children);
+
+        if ('view' === $context) {
+            $children = apply_filters('woocommerce_get_children', $children, $this, false);
+        }
+
+        return is_array($children) ? $children : [];
+    }
+
+    /**
+     * Get variation attributes for this product
+     * Override because WC_Product_Variable uses data_store which doesn't work
+     * properly with custom variable product types
+     */
+    public function get_variation_attributes(): array
+    {
+        $attributes = $this->get_attributes();
+
+        if (!$attributes || !is_array($attributes)) {
+            return [];
+        }
+
+        $variation_attributes = [];
+
+        foreach ($attributes as $attribute) {
+            // For WC_Product_Attribute objects
+            if ($attribute instanceof \WC_Product_Attribute) {
+                if ($attribute->get_variation()) {
+                    $attribute_name = $attribute->get_name();
+
+                    // For taxonomy attributes, get term slugs
+                    if ($attribute->is_taxonomy()) {
+                        $attribute_terms = wc_get_product_terms(
+                            $this->get_id(),
+                            $attribute_name,
+                            ['fields' => 'slugs']
+                        );
+                        $variation_attributes[$attribute_name] = $attribute_terms;
+                    } else {
+                        // For custom attributes, get options directly
+                        $variation_attributes[$attribute_name] = $attribute->get_options();
+                    }
+                }
+            }
+            // For array-based attributes (older format)
+            elseif (is_array($attribute) && !empty($attribute['is_variation'])) {
+                $attribute_name = $attribute['name'];
+                $values = isset($attribute['value']) ? explode('|', $attribute['value']) : [];
+                $variation_attributes[$attribute_name] = array_map('trim', $values);
+            }
+        }
+
+        return $variation_attributes;
+    }
+
+    /**
+     * Get variation prices (regular, sale, and final prices)
+     * Override because WC_Product_Variable uses data_store which doesn't work
+     * properly with custom variable product types
+     */
+    public function get_variation_prices($for_display = false): array
+    {
+        $children = $this->get_children();
+
+        if (empty($children)) {
+            return [
+                'price' => [],
+                'regular_price' => [],
+                'sale_price' => [],
+            ];
+        }
+
+        $prices = [
+            'price' => [],
+            'regular_price' => [],
+            'sale_price' => [],
+        ];
+
+        foreach ($children as $child_id) {
+            $variation = wc_get_product($child_id);
+            if ($variation) {
+                $price = $variation->get_price();
+                $regular_price = $variation->get_regular_price();
+                $sale_price = $variation->get_sale_price();
+
+                if ('' !== $price) {
+                    $prices['price'][$child_id] = $price;
+                }
+                if ('' !== $regular_price) {
+                    $prices['regular_price'][$child_id] = $regular_price;
+                }
+                if ('' !== $sale_price) {
+                    $prices['sale_price'][$child_id] = $sale_price;
+                }
+            }
+        }
+
+        // Sort prices
+        asort($prices['price']);
+        asort($prices['regular_price']);
+        asort($prices['sale_price']);
+
+        $this->prices_array = $prices;
+
+        return $this->prices_array;
+    }
+
+    /**
+     * Get available variations for this product
+     * Override because WC_Product_Variable uses data_store which doesn't work
+     * properly with custom variable product types
+     */
+    public function get_available_variations($return = 'array')
+    {
+        $children = $this->get_children();
+        $available_variations = [];
+
+        foreach ($children as $child_id) {
+            $variation = wc_get_product($child_id);
+
+            if (!$variation) {
+                continue;
+            }
+
+            // Check if variation should be available
+            if (!$variation->exists()) {
+                continue;
+            }
+
+            // Check if purchasable (has price)
+            if (!$variation->is_purchasable()) {
+                continue;
+            }
+
+            // Build variation data
+            if ($return === 'array') {
+                $variationData = $this->get_available_variation($variation);
+                // Override availability_html to be empty for licensed products
+                $variationData['availability_html'] = '';
+                $available_variations[] = $variationData;
+            } else {
+                $available_variations[] = $variation;
+            }
+        }
+
+        if ($return === 'array') {
+            $available_variations = array_values(array_filter($available_variations));
+        }
+
+        return $available_variations;
+    }
+
+    /**
+     * Get max activations for this product (parent default)
+     * Falls back to default settings if not set on product
+     */
+    public function get_max_activations(): int
+    {
+        $value = $this->get_meta('_licensed_max_activations', true);
+        if ($value !== '' && $value !== null) {
+            return max(1, (int) $value);
+        }
+        return SettingsController::getDefaultMaxActivations();
+    }
+
+    /**
+     * Check if product has custom max activations set
+     */
+    public function has_custom_max_activations(): bool
+    {
+        $value = $this->get_meta('_licensed_max_activations', true);
+        return $value !== '' && $value !== null;
+    }
+
+    /**
+     * Get validity days (parent default - variations override this)
+     * Falls back to default settings if not set on product
+     */
+    public function get_validity_days(): ?int
+    {
+        $value = $this->get_meta('_licensed_validity_days', true);
+        if ($value !== '' && $value !== null) {
+            return (int) $value > 0 ? (int) $value : null;
+        }
+        return SettingsController::getDefaultValidityDays();
+    }
+
+    /**
+     * Check if product has custom validity days set
+     */
+    public function has_custom_validity_days(): bool
+    {
+        $value = $this->get_meta('_licensed_validity_days', true);
+        return $value !== '' && $value !== null;
+    }
+
+    /**
+     * Check if license should be bound to major version
+     * Falls back to default settings if not set on product
+     */
+    public function is_bound_to_version(): bool
+    {
+        $value = $this->get_meta('_licensed_bind_to_version', true);
+        if ($value !== '' && $value !== null) {
+            return $value === 'yes';
+        }
+        return SettingsController::getDefaultBindToVersion();
+    }
+
+    /**
+     * Check if product has custom bind to version setting
+     */
+    public function has_custom_bind_to_version(): bool
+    {
+        $value = $this->get_meta('_licensed_bind_to_version', true);
+        return $value !== '' && $value !== null;
+    }
+
+    /**
+     * Get current software version (derived from latest product version)
+     */
+    public function get_current_version(): string
+    {
+        $versionManager = new VersionManager();
+        $latestVersion = $versionManager->getLatestVersion($this->get_id());
+
+        return $latestVersion ? $latestVersion->getVersion() : '';
+    }
+
+    /**
+     * Get major version number from version string
+     */
+    public function get_major_version(): int
+    {
+        $versionManager = new VersionManager();
+        $latestVersion = $versionManager->getLatestVersion($this->get_id());
+
+        if ($latestVersion) {
+            return $latestVersion->getMajorVersion();
+        }
+
+        return 1;
+    }
+}

src/Product/ProductVersion.php

@@ -24,6 +24,7 @@ class ProductVersion
     private ?string $downloadUrl;
     private ?int $attachmentId;
     private ?string $fileHash;
+    private int $downloadCount;
     private bool $isActive;
     private \DateTimeInterface $releasedAt;
     private \DateTimeInterface $createdAt;
@@ -44,6 +45,7 @@ class ProductVersion
         $version->downloadUrl = $data['download_url'] ?: null;
         $version->attachmentId = !empty($data['attachment_id']) ? (int) $data['attachment_id'] : null;
         $version->fileHash = $data['file_hash'] ?? null;
+        $version->downloadCount = (int) ($data['download_count'] ?? 0);
         $version->isActive = (bool) $data['is_active'];
         $version->releasedAt = new \DateTimeImmutable($data['released_at']);
         $version->createdAt = new \DateTimeImmutable($data['created_at']);
@@ -144,6 +146,11 @@ class ProductVersion
         return $this->fileHash;
     }
 
+    public function getDownloadCount(): int
+    {
+        return $this->downloadCount;
+    }
+
     /**
      * Get the download URL from attachment
      */
@@ -197,6 +204,7 @@ class ProductVersion
             'download_url' => $this->downloadUrl,
             'attachment_id' => $this->attachmentId,
             'file_hash' => $this->fileHash,
+            'download_count' => $this->downloadCount,
             'is_active' => $this->isActive,
             'released_at' => $this->releasedAt->format('Y-m-d H:i:s'),
             'created_at' => $this->createdAt->format('Y-m-d H:i:s'),

src/Product/VersionManager.php

@@ -276,4 +276,98 @@ class VersionManager
 
         return (int) $count > 0;
     }
+
+    /**
+     * Increment download count for a version
+     */
+    public function incrementDownloadCount(int $versionId): bool
+    {
+        global $wpdb;
+
+        $tableName = Installer::getVersionsTable();
+        $result = $wpdb->query(
+            $wpdb->prepare(
+                "UPDATE {$tableName} SET download_count = download_count + 1 WHERE id = %d",
+                $versionId
+            )
+        );
+
+        return $result !== false;
+    }
+
+    /**
+     * Get total download count across all versions
+     */
+    public function getTotalDownloadCount(): int
+    {
+        global $wpdb;
+
+        $tableName = Installer::getVersionsTable();
+        $count = $wpdb->get_var("SELECT COALESCE(SUM(download_count), 0) FROM {$tableName}");
+
+        return (int) $count;
+    }
+
+    /**
+     * Get download statistics per product
+     */
+    public function getDownloadStatistics(): array
+    {
+        global $wpdb;
+
+        $tableName = Installer::getVersionsTable();
+
+        // Get total downloads
+        $totalDownloads = $this->getTotalDownloadCount();
+
+        // Get downloads per product (top 10)
+        $byProduct = $wpdb->get_results(
+            "SELECT product_id, SUM(download_count) as downloads
+             FROM {$tableName}
+             GROUP BY product_id
+             ORDER BY downloads DESC
+             LIMIT 10",
+            ARRAY_A
+        );
+
+        // Get downloads per version (top 10)
+        $byVersion = $wpdb->get_results(
+            "SELECT id, product_id, version, download_count
+             FROM {$tableName}
+             WHERE download_count > 0
+             ORDER BY download_count DESC
+             LIMIT 10",
+            ARRAY_A
+        );
+
+        // Enrich product data with names
+        $productsWithNames = [];
+        foreach ($byProduct ?: [] as $row) {
+            $product = wc_get_product((int) $row['product_id']);
+            $productsWithNames[] = [
+                'product_id' => (int) $row['product_id'],
+                'product_name' => $product ? $product->get_name() : __('Unknown Product', 'wc-licensed-product'),
+                'downloads' => (int) $row['downloads'],
+            ];
+        }
+
+        // Enrich version data with product names
+        $versionsWithNames = [];
+        foreach ($byVersion ?: [] as $row) {
+            $product = wc_get_product((int) $row['product_id']);
+            $versionsWithNames[] = [
+                'version_id' => (int) $row['id'],
+                'product_id' => (int) $row['product_id'],
+                'product_name' => $product ? $product->get_name() : __('Unknown Product', 'wc-licensed-product'),
+                'version' => $row['version'],
+                'downloads' => (int) $row['download_count'],
+            ];
+        }
+
+        return [
+            'total' => $totalDownloads,
+            'by_product' => $productsWithNames,
+            'by_version' => $versionsWithNames,
+        ];
+    }
 }

src/Update/PluginUpdateChecker.php

@@ -0,0 +1,439 @@
+<?php
+/**
+ * Plugin Update Checker
+ *
+ * Checks for plugin updates from the configured license server.
+ *
+ * @package Jeremias\WcLicensedProduct\Update
+ */
+
+declare(strict_types=1);
+
+namespace Jeremias\WcLicensedProduct\Update;
+
+use Jeremias\WcLicensedProduct\Admin\SettingsController;
+use Jeremias\WcLicensedProduct\License\PluginLicenseChecker;
+use Symfony\Component\HttpClient\HttpClient;
+
+/**
+ * Handles checking for plugin updates from the license server
+ *
+ * This class hooks into WordPress's native plugin update system to check for
+ * updates from the configured license server. It validates the license and
+ * provides download authentication.
+ */
+final class PluginUpdateChecker
+{
+    /**
+     * Cache key for update info
+     */
+    private const CACHE_KEY = 'wclp_update_info';
+
+    /**
+     * Default cache TTL (12 hours)
+     */
+    private const DEFAULT_CACHE_TTL = 43200;
+
+    /**
+     * Singleton instance
+     */
+    private static ?self $instance = null;
+
+    /**
+     * Plugin slug
+     */
+    private string $pluginSlug;
+
+    /**
+     * Plugin basename (slug/slug.php)
+     */
+    private string $pluginBasename;
+
+    /**
+     * Get singleton instance
+     */
+    public static function getInstance(): self
+    {
+        if (self::$instance === null) {
+            self::$instance = new self();
+        }
+
+        return self::$instance;
+    }
+
+    /**
+     * Private constructor for singleton
+     */
+    private function __construct()
+    {
+        $this->pluginSlug = 'wc-licensed-product';
+        $this->pluginBasename = WC_LICENSED_PRODUCT_PLUGIN_BASENAME;
+    }
+
+    /**
+     * Register WordPress hooks for update checking
+     */
+    public function register(): void
+    {
+        // Skip if update notifications are disabled
+        if ($this->isUpdateNotificationDisabled()) {
+            return;
+        }
+
+        // Check for updates
+        add_filter('pre_set_site_transient_update_plugins', [$this, 'checkForUpdates']);
+
+        // Provide plugin information for the update modal
+        add_filter('plugins_api', [$this, 'getPluginInfo'], 10, 3);
+
+        // Add authentication headers to download requests
+        add_filter('http_request_args', [$this, 'addAuthHeaders'], 10, 2);
+
+        // Handle auto-install setting
+        add_filter('auto_update_plugin', [$this, 'handleAutoInstall'], 10, 2);
+
+        // Clear cache on settings save
+        add_action('update_option_wc_licensed_product_plugin_license_key', [$this, 'clearCache']);
+        add_action('update_option_wc_licensed_product_plugin_license_server_url', [$this, 'clearCache']);
+        add_action('update_option_wc_licensed_product_update_notification_enabled', [$this, 'clearCache']);
+    }
+
+    /**
+     * Check if update notifications are disabled
+     */
+    private function isUpdateNotificationDisabled(): bool
+    {
+        // Check constant
+        if (defined('WC_LICENSE_DISABLE_AUTO_UPDATE') && WC_LICENSE_DISABLE_AUTO_UPDATE) {
+            return true;
+        }
+
+        // Check setting
+        return !SettingsController::isUpdateNotificationEnabled();
+    }
+
+    /**
+     * Handle auto-install setting for WordPress automatic updates
+     *
+     * @param bool|null $update The update decision
+     * @param object $item The plugin update object
+     * @return bool|null Whether to auto-update this plugin
+     */
+    public function handleAutoInstall($update, $item): ?bool
+    {
+        // Only handle our plugin
+        if (!isset($item->plugin) || $item->plugin !== $this->pluginBasename) {
+            return $update;
+        }
+
+        // Return true to enable auto-install, false to disable, or null to use default
+        return SettingsController::isAutoInstallEnabled() ? true : $update;
+    }
+
+    /**
+     * Check for plugin updates
+     *
+     * @param object $transient The update_plugins transient
+     * @return object Modified transient
+     */
+    public function checkForUpdates($transient)
+    {
+        if (empty($transient->checked)) {
+            return $transient;
+        }
+
+        // Get cached update info or fetch fresh
+        $updateInfo = $this->getUpdateInfo();
+
+        if (!$updateInfo || !isset($updateInfo['update_available']) || !$updateInfo['update_available']) {
+            return $transient;
+        }
+
+        // Compare versions
+        $currentVersion = $transient->checked[$this->pluginBasename] ?? WC_LICENSED_PRODUCT_VERSION;
+
+        if (version_compare($updateInfo['version'], $currentVersion, '>')) {
+            $transient->response[$this->pluginBasename] = $this->buildUpdateObject($updateInfo);
+        }
+
+        return $transient;
+    }
+
+    /**
+     * Get plugin information for the update modal
+     *
+     * @param false|object|array $result The result object or array
+     * @param string $action The API action
+     * @param object $args Request arguments
+     * @return false|object
+     */
+    public function getPluginInfo($result, string $action, object $args)
+    {
+        if ($action !== 'plugin_information') {
+            return $result;
+        }
+
+        if (!isset($args->slug) || $args->slug !== $this->pluginSlug) {
+            return $result;
+        }
+
+        // Get update info
+        $updateInfo = $this->getUpdateInfo(true);
+
+        if (!$updateInfo) {
+            return $result;
+        }
+
+        return $this->buildPluginInfoObject($updateInfo);
+    }
+
+    /**
+     * Add authentication headers to download requests
+     *
+     * @param array $args HTTP request arguments
+     * @param string $url Request URL
+     * @return array Modified arguments
+     */
+    public function addAuthHeaders(array $args, string $url): array
+    {
+        // Only modify requests to our license server
+        $serverUrl = $this->getLicenseServerUrl();
+        if (empty($serverUrl) || strpos($url, parse_url($serverUrl, PHP_URL_HOST)) === false) {
+            return $args;
+        }
+
+        // Only modify download requests
+        if (strpos($url, 'license-download') === false) {
+            return $args;
+        }
+
+        // Add license key to headers for potential server-side verification
+        $licenseKey = $this->getLicenseKey();
+        if (!empty($licenseKey)) {
+            $args['headers']['X-License-Key'] = $licenseKey;
+        }
+
+        return $args;
+    }
+
+    /**
+     * Get update info from cache or server
+     *
+     * @param bool $forceRefresh Force refresh from server
+     * @return array|null Update info or null if unavailable
+     */
+    public function getUpdateInfo(bool $forceRefresh = false): ?array
+    {
+        // Check cache unless force refresh
+        if (!$forceRefresh) {
+            $cached = get_transient(self::CACHE_KEY);
+            if ($cached !== false) {
+                return $cached;
+            }
+        }
+
+        // Fetch from server
+        $updateInfo = $this->fetchUpdateInfo();
+
+        if ($updateInfo) {
+            // Cache the result
+            $cacheTtl = $this->getCacheTtl();
+            set_transient(self::CACHE_KEY, $updateInfo, $cacheTtl);
+        }
+
+        return $updateInfo;
+    }
+
+    /**
+     * Fetch update info from the license server
+     */
+    private function fetchUpdateInfo(): ?array
+    {
+        $serverUrl = $this->getLicenseServerUrl();
+        $licenseKey = $this->getLicenseKey();
+
+        if (empty($serverUrl) || empty($licenseKey)) {
+            return null;
+        }
+
+        try {
+            $httpClient = HttpClient::create([
+                'timeout' => 15,
+                'verify_peer' => true,
+            ]);
+
+            $updateCheckUrl = rtrim($serverUrl, '/') . '/wp-json/wc-licensed-product/v1/update-check';
+
+            $response = $httpClient->request('POST', $updateCheckUrl, [
+                'json' => [
+                    'license_key' => $licenseKey,
+                    'domain' => $this->getCurrentDomain(),
+                    'plugin_slug' => $this->pluginSlug,
+                    'current_version' => WC_LICENSED_PRODUCT_VERSION,
+                ],
+            ]);
+
+            if ($response->getStatusCode() !== 200) {
+                return null;
+            }
+
+            $data = $response->toArray();
+
+            // Verify response structure
+            if (!isset($data['success']) || !$data['success']) {
+                return null;
+            }
+
+            return $data;
+        } catch (\Throwable $e) {
+            // Log error but don't break the site
+            if (defined('WP_DEBUG') && WP_DEBUG) {
+                error_log('WC Licensed Product: Update check failed - ' . $e->getMessage());
+            }
+            return null;
+        }
+    }
+
+    /**
+     * Build WordPress update object for transient
+     */
+    private function buildUpdateObject(array $updateInfo): object
+    {
+        $update = new \stdClass();
+        $update->id = $this->pluginSlug;
+        $update->slug = $updateInfo['slug'] ?? $this->pluginSlug;
+        $update->plugin = $this->pluginBasename;
+        $update->new_version = $updateInfo['version'];
+        $update->url = $updateInfo['homepage'] ?? '';
+        $update->package = $updateInfo['download_url'] ?? $updateInfo['package'] ?? '';
+
+        if (isset($updateInfo['tested'])) {
+            $update->tested = $updateInfo['tested'];
+        }
+
+        if (isset($updateInfo['requires'])) {
+            $update->requires = $updateInfo['requires'];
+        }
+
+        if (isset($updateInfo['requires_php'])) {
+            $update->requires_php = $updateInfo['requires_php'];
+        }
+
+        if (isset($updateInfo['icons'])) {
+            $update->icons = $updateInfo['icons'];
+        }
+
+        return $update;
+    }
+
+    /**
+     * Build plugin info object for plugins_api
+     */
+    private function buildPluginInfoObject(array $updateInfo): object
+    {
+        $info = new \stdClass();
+        $info->name = $updateInfo['name'] ?? 'WC Licensed Product';
+        $info->slug = $updateInfo['slug'] ?? $this->pluginSlug;
+        $info->version = $updateInfo['version'];
+        $info->author = '<a href="https://src.bundespruefstelle.ch/magdev">Marco Graetsch</a>';
+        $info->homepage = $updateInfo['homepage'] ?? '';
+        $info->requires = $updateInfo['requires'] ?? '6.0';
+        $info->tested = $updateInfo['tested'] ?? '';
+        $info->requires_php = $updateInfo['requires_php'] ?? '8.3';
+        $info->downloaded = 0;
+        $info->last_updated = $updateInfo['last_updated'] ?? '';
+        $info->download_link = $updateInfo['download_url'] ?? $updateInfo['package'] ?? '';
+
+        // Sections for the modal
+        $info->sections = [];
+
+        if (isset($updateInfo['sections']['description'])) {
+            $info->sections['description'] = $updateInfo['sections']['description'];
+        } else {
+            $info->sections['description'] = __(
+                'WooCommerce plugin for selling licensed software products with domain-bound license keys.',
+                'wc-licensed-product'
+            );
+        }
+
+        if (isset($updateInfo['sections']['changelog']) || isset($updateInfo['changelog'])) {
+            $info->sections['changelog'] = $updateInfo['sections']['changelog'] ?? $updateInfo['changelog'];
+        }
+
+        // Banners and icons
+        if (isset($updateInfo['banners'])) {
+            $info->banners = $updateInfo['banners'];
+        }
+
+        if (isset($updateInfo['icons'])) {
+            $info->icons = $updateInfo['icons'];
+        }
+
+        return $info;
+    }
+
+    /**
+     * Clear the update cache
+     */
+    public function clearCache(): void
+    {
+        delete_transient(self::CACHE_KEY);
+    }
+
+    /**
+     * Get cache TTL from settings or default
+     */
+    private function getCacheTtl(): int
+    {
+        $hours = (int) get_option('wc_licensed_product_update_check_frequency', 12);
+        return max(1, $hours) * HOUR_IN_SECONDS;
+    }
+
+    /**
+     * Get the license server URL from settings
+     */
+    private function getLicenseServerUrl(): string
+    {
+        // Check constant override first
+        if (defined('WC_LICENSE_UPDATE_CHECK_URL') && WC_LICENSE_UPDATE_CHECK_URL) {
+            return WC_LICENSE_UPDATE_CHECK_URL;
+        }
+
+        return (string) get_option('wc_licensed_product_plugin_license_server_url', '');
+    }
+
+    /**
+     * Get the license key from settings
+     */
+    private function getLicenseKey(): string
+    {
+        return (string) get_option('wc_licensed_product_plugin_license_key', '');
+    }
+
+    /**
+     * Get the current domain from the site URL
+     */
+    private function getCurrentDomain(): string
+    {
+        $siteUrl = get_site_url();
+        $parsed = parse_url($siteUrl);
+        $host = $parsed['host'] ?? 'localhost';
+
+        if (isset($parsed['port'])) {
+            $host .= ':' . $parsed['port'];
+        }
+
+        return strtolower($host);
+    }
+
+    /**
+     * Force an immediate update check
+     *
+     * Useful for admin interfaces where user clicks "Check for updates"
+     */
+    public function forceUpdateCheck(): ?array
+    {
+        $this->clearCache();
+        return $this->getUpdateInfo(true);
+    }
+}

templates/admin/licenses.html.twig

@@ -1,6 +1,6 @@
 <div class="wrap">
     <h1 class="wp-heading-inline">{{ __('Licenses') }}</h1>
-    <a href="{{ admin_url }}?action=export_csv" class="page-title-action">
+    <a href="{{ export_csv_url() }}" class="page-title-action">
         <span class="dashicons dashicons-download" style="vertical-align: middle;"></span>
         {{ __('Export CSV') }}
     </a>
@@ -143,8 +143,8 @@
                             </td>
                             <td class="wclp-editable-cell" data-field="status" data-license-id="{{ item.license.id }}">
                                 <span class="wclp-display-value">
-                                    <span class="license-status license-status-{{ item.license.status }}">
-                                        {{ item.license.status|capitalize }}
+                                    <span class="license-status license-status-{{ esc_attr(item.license.status) }}">
+                                        {{ esc_html(item.license.status)|capitalize }}
                                     </span>
                                 </span>
                                 <button type="button" class="wclp-edit-btn button-link" title="{{ __('Edit') }}">
@@ -184,6 +184,13 @@
                             </td>
                             <td class="license-actions">
                                 <div class="row-actions">
+                                    <span class="test">
+                                        <a href="#" class="wclp-test-license-link"
+                                           data-license-id="{{ item.license.id }}"
+                                           data-license-key="{{ esc_attr(item.license.licenseKey) }}"
+                                           data-domain="{{ esc_attr(item.license.domain) }}"
+                                           title="{{ __('Test license against API') }}">{{ __('Test') }}</a> |
+                                    </span>
                                     {% if item.license.status != 'revoked' %}
                                         <span class="transfer">
                                             <a href="#" class="wclp-transfer-link"
@@ -272,6 +279,36 @@
     </form>
 </div>
 
+<!-- Test License Modal -->
+<div id="wclp-test-modal" class="wclp-modal" style="display:none;">
+    <div class="wclp-modal-content">
+        <span class="wclp-modal-close">&times;</span>
+        <h2>{{ __('License Validation Test') }}</h2>
+        <div class="wclp-test-info">
+            <table class="form-table">
+                <tr>
+                    <th scope="row">{{ __('License Key') }}</th>
+                    <td><code id="test-license-key"></code></td>
+                </tr>
+                <tr>
+                    <th scope="row">{{ __('Domain') }}</th>
+                    <td><code id="test-domain"></code></td>
+                </tr>
+            </table>
+        </div>
+        <div id="wclp-test-loading" style="display:none; text-align:center; padding:20px;">
+            <span class="spinner is-active" style="float:none;"></span>
+            <p>{{ __('Testing license...') }}</p>
+        </div>
+        <div id="wclp-test-result" style="display:none;">
+            <div id="wclp-test-result-content"></div>
+        </div>
+        <p class="submit">
+            <button type="button" class="button wclp-modal-cancel">{{ __('Close') }}</button>
+        </p>
+    </div>
+</div>
+
 <!-- Transfer Modal -->
 <div id="wclp-transfer-modal" class="wclp-modal" style="display:none;">
     <div class="wclp-modal-content">
@@ -349,5 +386,90 @@
             $modal.hide();
         }
     });
+
+    // Test License modal
+    var $testModal = $('#wclp-test-modal');
+    var $testLoading = $('#wclp-test-loading');
+    var $testResult = $('#wclp-test-result');
+    var $testResultContent = $('#wclp-test-result-content');
+
+    $('.wclp-test-license-link').on('click', function(e) {
+        e.preventDefault();
+        var licenseKey = $(this).data('license-key');
+        var domain = $(this).data('domain');
+
+        // Show modal with info
+        $('#test-license-key').text(licenseKey);
+        $('#test-domain').text(domain);
+        $testLoading.show();
+        $testResult.hide();
+        $testModal.show();
+
+        // Call the test endpoint
+        $.ajax({
+            url: wclpAdmin.ajaxUrl,
+            type: 'POST',
+            data: {
+                action: 'wclp_test_license',
+                nonce: wclpAdmin.editNonce,
+                license_key: licenseKey,
+                domain: domain
+            },
+            success: function(response) {
+                $testLoading.hide();
+                if (response.success) {
+                    var result = response.data;
+                    var html = '';
+
+                    if (result.valid) {
+                        html = '<div class="notice notice-success inline"><p><strong>✓ {{ __('License is VALID') }}</strong></p></div>';
+                        html += '<table class="widefat striped"><tbody>';
+                        html += '<tr><th>{{ __('Product') }}</th><td><strong>' + escapeHtml(result.product_name || '-') + '</strong></td></tr>';
+                        if (result.expires_at) {
+                            html += '<tr><th>{{ __('Expires') }}</th><td>' + escapeHtml(result.expires_at) + '</td></tr>';
+                        } else {
+                            html += '<tr><th>{{ __('Expires') }}</th><td><span class="license-lifetime">{{ __('Lifetime') }}</span></td></tr>';
+                        }
+                        html += '</tbody></table>';
+                    } else {
+                        html = '<div class="notice notice-error inline"><p><strong>✗ {{ __('License is INVALID') }}</strong></p></div>';
+                        html += '<table class="widefat striped"><tbody>';
+                        html += '<tr><th>{{ __('Error Code') }}</th><td><code>' + escapeHtml(result.error || 'unknown') + '</code></td></tr>';
+                        html += '<tr><th>{{ __('Message') }}</th><td>' + escapeHtml(result.message || '-') + '</td></tr>';
+                        html += '</tbody></table>';
+                    }
+
+                    $testResultContent.html(html);
+                    $testResult.show();
+                } else {
+                    $testResultContent.html('<div class="notice notice-error inline"><p>' + escapeHtml(response.data.message || 'Error') + '</p></div>');
+                    $testResult.show();
+                }
+            },
+            error: function() {
+                $testLoading.hide();
+                $testResultContent.html('<div class="notice notice-error inline"><p>{{ __('Failed to test license. Please try again.') }}</p></div>');
+                $testResult.show();
+            }
+        });
+    });
+
+    // Close test modal
+    $testModal.find('.wclp-modal-close, .wclp-modal-cancel').on('click', function() {
+        $testModal.hide();
+    });
+
+    $(window).on('click', function(e) {
+        if ($(e.target).is($testModal)) {
+            $testModal.hide();
+        }
+    });
+
+    function escapeHtml(text) {
+        if (!text) return '';
+        var div = document.createElement('div');
+        div.textContent = text;
+        return div.innerHTML;
+    }
 })(jQuery);
 </script>

templates/frontend/licenses.html.twig

@@ -1,68 +1,185 @@
-{% if not has_licenses %}
+{# License Filter Form #}
+{% if filter_products is defined and filter_products|length > 0 or filter_domains is defined and filter_domains|length > 0 %}
+    <div class="wclp-filter-form">
+        <form method="get" action="{{ esc_url(licenses_url) }}">
+            <div class="wclp-filter-row">
+                {% if filter_products is defined and filter_products|length > 0 %}
+                    <div class="wclp-filter-field">
+                        <label for="filter_product">{{ __('Product') }}</label>
+                        <select name="filter_product" id="filter_product">
+                            <option value="">{{ __('All Products') }}</option>
+                            {% for id, name in filter_products %}
+                                <option value="{{ id }}" {{ current_filter_product == id ? 'selected' : '' }}>
+                                    {{ esc_html(name) }}
+                                </option>
+                            {% endfor %}
+                        </select>
+                    </div>
+                {% endif %}
+
+                {% if filter_domains is defined and filter_domains|length > 0 %}
+                    <div class="wclp-filter-field">
+                        <label for="filter_domain">{{ __('Domain') }}</label>
+                        <select name="filter_domain" id="filter_domain">
+                            <option value="">{{ __('All Domains') }}</option>
+                            {% for domain in filter_domains %}
+                                <option value="{{ esc_attr(domain) }}" {{ current_filter_domain == domain ? 'selected' : '' }}>
+                                    {{ esc_html(domain) }}
+                                </option>
+                            {% endfor %}
+                        </select>
+                    </div>
+                {% endif %}
+
+                <div class="wclp-filter-actions">
+                    <button type="submit" class="button">{{ __('Filter') }}</button>
+                    {% if is_filtered %}
+                        <a href="{{ esc_url(licenses_url) }}" class="button">{{ __('Clear') }}</a>
+                    {% endif %}
+                </div>
+            </div>
+        </form>
+    </div>
+{% endif %}
+
+{% if not has_packages %}
+    {% if is_filtered %}
+        <p>{{ __('No licenses found matching your filters.') }}</p>
+    {% else %}
         <p>{{ __('You have no licenses yet.') }}</p>
+    {% endif %}
 {% else %}
     <div class="woocommerce-licenses">
-        {% for item in licenses %}
-            <div class="license-card">
-                <div class="license-header">
+        {% for package in packages %}
+            <div class="license-package">
+                <div class="package-header">
+                    <div class="package-title">
                         <h3>
-                        {% if item.product_url %}
-                            <a href="{{ esc_url(item.product_url) }}">{{ esc_html(item.product_name) }}</a>
+                            {% if package.product_url %}
+                                <a href="{{ esc_url(package.product_url) }}">{{ esc_html(package.product_name) }}</a>
                             {% else %}
-                            {{ esc_html(item.product_name) }}
+                                {{ esc_html(package.product_name) }}
                             {% endif %}
                         </h3>
-                    <span class="license-status license-status-{{ item.license.status }}">
-                        {{ item.license.status|capitalize }}
+                        <span class="package-order">
+                            {{ __('Order') }}
+                            {% if package.order_url %}
+                                <a href="{{ esc_url(package.order_url) }}">#{{ esc_html(package.order_number) }}</a>
+                            {% else %}
+                                #{{ esc_html(package.order_number) }}
+                            {% endif %}
+                        </span>
+                    </div>
+                    <span class="package-license-count">
+                        {{ package.licenses|length }} {{ package.licenses|length == 1 ? __('License') : __('Licenses') }}
                     </span>
                 </div>
 
-                <div class="license-details">
-                    <div class="license-key-row">
-                        <label>{{ __('License Key:') }}</label>
-                        <code class="license-key" data-license-key="{{ esc_attr(item.license.licenseKey) }}">
-                            {{ esc_html(item.license.licenseKey) }}
-                        </code>
-                        <button type="button" class="copy-license-btn" data-license-key="{{ esc_attr(item.license.licenseKey) }}" title="{{ __('Copy to clipboard') }}">
+                <div class="package-licenses">
+                    {% for license in package.licenses %}
+                        <div class="license-entry license-entry-{{ esc_attr(license.status) }}">
+                            <div class="license-row-primary">
+                                <div class="license-key-group">
+                                    <code class="license-key">{{ esc_html(license.license_key) }}</code>
+                                    <span class="license-status license-status-{{ esc_attr(license.status) }}">
+                                        {{ esc_html(license.status)|capitalize }}
+                                    </span>
+                                </div>
+                                <div class="license-actions">
+                                    <button type="button" class="copy-license-btn" data-license-key="{{ esc_attr(license.license_key) }}" title="{{ __('Copy to clipboard') }}">
+                                        <span class="dashicons dashicons-clipboard"></span>
+                                    </button>
+                                    {% if license.is_transferable %}
+                                        <button type="button" class="wclp-transfer-btn"
+                                                data-license-id="{{ license.id }}"
+                                                data-current-domain="{{ esc_attr(license.domain) }}"
+                                                title="{{ __('Transfer to new domain') }}">
+                                            <span class="dashicons dashicons-randomize"></span>
+                                        </button>
+                                    {% endif %}
+                                </div>
+                            </div>
+                            <div class="license-row-secondary">
+                                <span class="license-meta-item license-domain">
+                                    <span class="dashicons dashicons-admin-site-alt3"></span>
+                                    {{ esc_html(license.domain) }}
+                                </span>
+                                <span class="license-meta-item license-expiry">
+                                    <span class="dashicons dashicons-calendar-alt"></span>
+                                    {% if license.expires_at %}
+                                        {{ license.expires_at|date('Y-m-d') }}
+                                    {% else %}
+                                        <span class="lifetime">{{ __('Lifetime') }}</span>
+                                    {% endif %}
+                                </span>
+                            </div>
+                            {% if signing_enabled and license.customer_secret %}
+                                <div class="license-row-secret">
+                                    <button type="button" class="secret-toggle" aria-expanded="false">
+                                        <span class="dashicons dashicons-lock"></span>
+                                        {{ __('API Verification Secret') }}
+                                        <span class="dashicons dashicons-arrow-down-alt2 toggle-arrow"></span>
+                                    </button>
+                                    <div class="secret-content" style="display: none;">
+                                        <p class="secret-description">
+                                            {{ __('Use this secret to verify signed API responses. Keep it secure.') }}
+                                        </p>
+                                        <div class="secret-value-wrapper">
+                                            <code class="secret-value">{{ esc_html(license.customer_secret) }}</code>
+                                            <button type="button" class="copy-secret-btn" data-secret="{{ esc_attr(license.customer_secret) }}" title="{{ __('Copy to clipboard') }}">
                                                 <span class="dashicons dashicons-clipboard"></span>
                                             </button>
                                         </div>
-
-                    <div class="license-info-row">
-                        <span class="license-domain-display" data-license-id="{{ item.license.id }}">
-                            <strong>{{ __('Domain:') }}</strong>
-                            <span class="domain-value">{{ esc_html(item.license.domain) }}</span>
-                            {% if item.license.status == 'active' or item.license.status == 'inactive' %}
-                                <button type="button" class="wclp-transfer-btn"
-                                        data-license-id="{{ item.license.id }}"
-                                        data-current-domain="{{ esc_attr(item.license.domain) }}"
-                                        title="{{ __('Transfer to new domain') }}">
-                                    <span class="dashicons dashicons-randomize"></span>
-                                    {{ __('Transfer') }}
-                                </button>
-                            {% endif %}
-                        </span>
-                        <span><strong>{{ __('Expires:') }}</strong>
-                            {% if item.license.expiresAt %}
-                                {{ item.license.expiresAt|date('Y-m-d') }}
-                            {% else %}
-                                {{ __('Never') }}
-                            {% endif %}
-                        </span>
                                     </div>
                                 </div>
+                            {% endif %}
+                        </div>
+                    {% endfor %}
+                </div>
 
-                {% if item.downloads is defined and item.downloads is not empty %}
-                    <div class="license-downloads">
+                {% if package.downloads is defined and package.downloads is not empty %}
+                    <div class="package-downloads">
                         <h4>{{ __('Available Downloads') }}</h4>
                         <ul class="download-list">
-                            {% for download in item.downloads %}
-                                <li>
+                            {# Show only the latest version (first item) #}
+                            {% set latest = package.downloads|first %}
+                            <li class="download-item download-item-latest">
+                                <div class="download-row-file">
+                                    <a href="{{ esc_url(latest.download_url) }}" class="download-link">
+                                        <span class="dashicons dashicons-download"></span>
+                                        {{ esc_html(latest.filename ?: 'Version ' ~ latest.version) }}
+                                    </a>
+                                    <span class="download-version-badge">{{ __('Latest') }}</span>
+                                </div>
+                                <div class="download-row-meta">
+                                    <span class="download-date">{{ esc_html(latest.released_at) }}</span>
+                                    {% if latest.file_hash %}
+                                        <span class="download-hash" title="{{ esc_attr(latest.file_hash) }}">
+                                            <span class="dashicons dashicons-shield"></span>
+                                            <code>{{ latest.file_hash[:12] }}...</code>
+                                        </span>
+                                    {% endif %}
+                                </div>
+                            </li>
+                        </ul>
+
+                        {# Show older versions in collapsible if more than one version exists #}
+                        {% if package.downloads|length > 1 %}
+                            <div class="older-versions-section">
+                                <button type="button" class="older-versions-toggle" aria-expanded="false">
+                                    <span class="dashicons dashicons-arrow-down-alt2"></span>
+                                    {{ __('Older versions') }} ({{ package.downloads|length - 1 }})
+                                </button>
+                                <ul class="download-list older-versions-list" style="display: none;">
+                                    {% for download in package.downloads|slice(1) %}
+                                        <li class="download-item">
+                                            <div class="download-row-file">
                                                 <a href="{{ esc_url(download.download_url) }}" class="download-link">
                                                     <span class="dashicons dashicons-download"></span>
                                                     {{ esc_html(download.filename ?: 'Version ' ~ download.version) }}
                                                 </a>
-                                    <span class="download-version">v{{ esc_html(download.version) }}</span>
+                                            </div>
+                                            <div class="download-row-meta">
                                                 <span class="download-date">{{ esc_html(download.released_at) }}</span>
                                                 {% if download.file_hash %}
                                                     <span class="download-hash" title="{{ esc_attr(download.file_hash) }}">
@@ -70,12 +187,15 @@
                                                         <code>{{ download.file_hash[:12] }}...</code>
                                                     </span>
                                                 {% endif %}
+                                            </div>
                                         </li>
                                     {% endfor %}
                                 </ul>
                             </div>
                         {% endif %}
                     </div>
+                {% endif %}
+            </div>
         {% endfor %}
     </div>
 

wc-licensed-product.php

@@ -3,7 +3,7 @@
  * Plugin Name: WooCommerce Licensed Product
  * Plugin URI: https://src.bundespruefstelle.ch/magdev/wc-licensed-product
  * Description: WooCommerce plugin to sell software products using license keys with domain-based validation.
- * Version: 0.2.2
+ * Version: 0.7.1
  * Author: Marco Graetsch
  * Author URI: https://src.bundespruefstelle.ch/magdev
  * License: GPL-2.0-or-later
@@ -28,7 +28,7 @@ if (!defined('ABSPATH')) {
 }
 
 // Plugin constants
-define('WC_LICENSED_PRODUCT_VERSION', '0.2.2');
+define('WC_LICENSED_PRODUCT_VERSION', '0.7.1');
 define('WC_LICENSED_PRODUCT_PLUGIN_FILE', __FILE__);
 define('WC_LICENSED_PRODUCT_PLUGIN_DIR', plugin_dir_path(__FILE__));
 define('WC_LICENSED_PRODUCT_PLUGIN_URL', plugin_dir_url(__FILE__));