Add WordPress auto-update functionality (v0.6.0)

- Add UpdateController REST API endpoint for serving update info to licensed plugins
- Add PluginUpdateChecker singleton for client-side update checking
- Hook into WordPress native plugin update system (pre_set_site_transient_update_plugins, plugins_api)
- Add Auto-Updates settings subtab with enable/disable and check frequency options
- Add authentication headers for secure download requests
- Support configurable cache TTL for update checks (default 12 hours)
- Document /update-check endpoint in OpenAPI specification
- Update German translations

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -7,6 +7,387 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.15] - 2026-01-27
+
+### Fixed
+
+- Fixed tab rendering bug in WooCommerce product edit page when switching to licensed or licensed-variable product types
+- Simplified JavaScript to avoid conflicts with WooCommerce's native show/hide logic
+- Removed conflicting CSS rule for `.hide_if_licensed` that was causing layout issues
+- License Settings tab now uses CSS class toggle (`.wclp-active`) instead of jQuery `.show()/.hide()` for proper display
+- Variations tab now properly shows for licensed-variable products via `woocommerce_product_data_tabs` filter
+
+## [0.5.14] - 2026-01-27
+
+### Fixed
+
+- **CRITICAL:** Fixed Product Versions meta box not appearing for licensed-variable products
+- Product Versions meta box now always added to product pages, visibility controlled via CSS/JavaScript
+- Added `Installer::registerProductTypes()` to create product type terms in the `product_type` taxonomy
+- Product type terms are now ensured to exist on `woocommerce_init` hook for existing installations
+- Fixed License Settings tab and Product Versions visibility toggling when changing product types
+
+## [0.5.13] - 2026-01-27
+
+### Fixed
+
+- **CRITICAL:** Fixed licenses not showing in admin order form for licensed-variable products
+- `OrderLicenseController` now uses `LicenseManager::isLicensedProduct()` for consistent product type detection
+- Fixed expected licenses calculation for variable product orders
+- Fixed manual license generation from admin order page for variable products
+
+### Changed
+
+- Removed debug logging from all source files (PHP and JavaScript)
+- Cleaned up checkout blocks integration, Store API extension, and checkout controller
+
+## [0.5.12] - 2026-01-27
+
+### Fixed
+
+- **CRITICAL:** Fixed stock indicator ("1 in stock") appearing in cart for licensed variable product variations
+- Override `get_children()` with direct SQL query to bypass WooCommerce's `is_type('variable')` check
+- Override `get_variation_attributes()` to properly load taxonomy attribute terms
+- Override `get_variation_prices()` to prevent fatal error with null `$this->prices_array`
+- Override `get_available_variations()` with empty `availability_html` for variations
+- Added `is_type()` override to return true for both 'licensed-variable' and 'variable' type checks
+- Added multiple stock-related filters: `woocommerce_get_availability_text`, `woocommerce_product_get_stock_quantity`, `woocommerce_product_variation_get_stock_quantity`
+- Improved `isLicensedProductOrVariation()` check using `WC_Product_Factory::get_product_type()` for reliable parent type detection
+
+### Changed
+
+- `LicensedProductVariation` now includes `get_availability()`, `managing_stock()`, and `is_purchasable()` overrides
+- Simplified `isVirtual()` to use shared `isLicensedProductOrVariation()` helper
+
+## [0.5.11] - 2026-01-27
+
+### Fixed
+
+- **CRITICAL:** Fixed "sold out" message on licensed variable products by correcting `is_purchasable()` method
+- Variable products don't have a direct price - `is_purchasable()` now delegates to parent `WC_Product_Variable` class
+- Fixed variation class detection by using product ID parameter instead of unreliable global `$post`
+- Product class filter now properly accepts all 4 WooCommerce filter parameters for reliable variation detection
+
+## [0.5.10] - 2026-01-27
+
+### Fixed
+
+- Fixed licensed variable products not showing variations even when attributes are defined
+- Re-load product via `wc_get_product()` to ensure correct class instance is used
+- Removed overly strict type check that was preventing variations from displaying
+- Now mirrors WooCommerce's standard `woocommerce_variable_add_to_cart()` implementation
+
+## [0.5.9] - 2026-01-27
+
+### Fixed
+
+- Fixed frontend error on licensed variable products when no attributes are defined
+- Added null checks for `get_variation_attributes()`, `get_available_variations()`, and `get_default_attributes()`
+- Show informative message instead of error when product has no variations configured
+- Changed product type check from `instanceof` to `is_type()` for better compatibility
+
+## [0.5.8] - 2026-01-27
+
+### Fixed
+
+- **CRITICAL:** Fixed critical error on frontend product pages for licensed variable products
+- Variable product add-to-cart template now passes required variables (`available_variations`, `attributes`, `selected_attributes`)
+- Variants tab no longer disappears when saving attributes on licensed variable products
+- Added WooCommerce AJAX event listeners to maintain tab visibility during attribute operations
+
+### Changed
+
+- Improved JavaScript event handling for licensed-variable product type in admin
+- Added listeners for `woocommerce_variations_loaded`, `woocommerce_variations_added`, `woocommerce_variations_saved` events
+- Added AJAX complete handler for attribute save operations
+
+## [0.5.7] - 2026-01-27
+
+### Changed
+
+- Removed "Default" prefix from setting labels on Default Settings page for cleaner UI
+- Labels now read "Max Activations", "License Validity (Days)", and "Bind to Major Version"
+
+## [0.5.6] - 2026-01-27
+
+### Fixed
+
+- License Settings tab now only shows for Licensed Product and Licensed Variable Product types
+- Previously the tab was visible on all product types due to CSS `!important` override
+
+### Changed
+
+- Improved JavaScript for License Settings tab visibility handling on product type change
+- Updated README.md with complete feature documentation for v0.5.x features:
+  - Variable Licensed Products
+  - Multi-Domain Licensing
+  - Per-License Customer Secrets
+  - Download Statistics
+  - Configurable Rate Limiting
+
+## [0.5.5] - 2026-01-26
+
+### Fixed
+
+- **CRITICAL:** Response signing key derivation now uses native `hash_hkdf()` for RFC 5869 compliance
+- Key derivation now matches client library (`SecureLicenseClient`) exactly
+- Added missing domain validation to `/activate` endpoint (1-255 characters)
+
+### Changed
+
+- `ResponseSigner::deriveCustomerSecret()` now uses `hash_hkdf('sha256', $serverSecret, 32, $licenseKey)`
+- Previous custom HKDF-like implementation was incompatible with client library
+
+### Security
+
+- Signatures generated by server now verify correctly with `magdev/wc-licensed-product-client`
+- All three API endpoints now have consistent parameter validation
+
+## [0.5.4] - 2026-01-26
+
+### Fixed
+
+- REST API `/validate` endpoint now returns HTTP 404 for `license_not_found` error (was 403)
+- License key validation now enforces minimum 8 characters per API documentation
+
+### Added
+
+- Configurable rate limiting via `WC_LICENSE_RATE_LIMIT` and `WC_LICENSE_RATE_WINDOW` constants
+- Rate limit now defaults to 30 requests per 60 second window (configurable)
+
+### Changed
+
+- Improved HTTP status code mapping: 404 for not found, 500 for server errors, 403 for all other errors
+- Rate limiting implementation now uses configurable constants instead of hardcoded values
+
+## [0.5.3] - 2026-01-26
+
+### Added
+
+- Variable licensed product type (`licensed-variable`) for selling licenses with different durations
+- Support for monthly, yearly, quarterly, or lifetime license variations
+- `LicensedVariableProduct` class extending `WC_Product_Variable`
+- `LicensedProductVariation` class for individual variation license settings
+- Variation-specific license duration settings in product edit page
+- Duration labels displayed in checkout domain fields (e.g., "Yearly License")
+- Variation ID tracking in order domain meta for proper license generation
+
+### Changed
+
+- Updated `LicenseManager::generateLicense()` to accept optional variation ID
+- Checkout now handles variations with separate domain fields per product/variation
+- WooCommerce Blocks checkout updated to display variation duration labels
+- Store API extension updated to include variation_id in domain data schema
+
+## [0.5.2] - 2026-01-26
+
+### Added
+
+- Per-license customer secrets for API response verification
+- "API Verification Secret" section in customer account licenses page (collapsible)
+- Copy button for customer secrets with clipboard support
+- Documentation for per-license secret derivation and usage
+
+### Security
+
+- Customers no longer need the master server secret for signature verification
+- Each license key has a unique derived secret using HKDF-like key derivation
+- If one customer's secret is compromised, other customers remain unaffected
+
+### Changed
+
+- Updated `ResponseSigner` with static methods for secret derivation
+- Updated `server-implementation.md` with per-license secret documentation
+- Added new translation strings for secret-related UI
+
+## [0.5.1] - 2026-01-26
+
+### Fixed
+
+- Product versions now sort correctly by version DESC when added via AJAX in admin
+- License actions in admin overview are now always visible instead of only on hover
+
+### Changed
+
+- Added `compareVersions()` JavaScript function for proper semantic version comparison
+- Updated CSS with `!important` to override WordPress default hover-only behavior for row actions
+
+## [0.5.0] - 2026-01-25
+
+### Added
+
+- Multi-domain licensing support: Customers can now purchase multiple licenses for different domains in a single order
+- Each cart item quantity requires a unique domain at checkout
+- New "Enable Multi-Domain Licensing" setting in WooCommerce > Settings > Licensed Products
+- Multi-domain checkout UI for WooCommerce Blocks checkout
+- DOM injection fallback for checkout domain fields when React component fails to render
+- Grouped license display in customer account page by product/order
+- "Older versions" collapsible section in customer download area
+- Updated email templates to show licenses grouped by product
+
+### Changed
+
+- Customer account licenses page now shows licenses grouped by product package
+- Order meta now stores `_licensed_product_domains` array for multi-domain orders
+- Updated translations with 19 new strings for multi-domain functionality (de_CH)
+- Refactored checkout blocks JavaScript to use ExperimentalOrderMeta slot pattern
+
+### Technical Details
+
+- `CheckoutBlocksIntegration` now uses `registerPlugin` with `woocommerce-checkout` scope
+- `StoreApiExtension` handles both single-domain and multi-domain data formats
+- `CheckoutController` validates unique domains per product in multi-domain mode
+- `AccountController` groups licenses by product for package-style display
+- Backward compatible: existing single-domain orders continue to work
+
+## [0.4.0] - 2026-01-24
+
+### Added
+
+- Self-licensing prevention: Plugin automatically bypasses license validation when the configured license server URL points to the same WordPress installation
+- New `isSelfLicensing()` method in `PluginLicenseChecker` to detect circular licensing scenarios
+- New `normalizeDomain()` helper method for domain comparison (strips www prefix, lowercases)
+
+### Changed
+
+- `isLicenseValid()` and `validateLicense()` now check for self-licensing before attempting validation
+- Cache clearing now also clears the self-licensing check cache
+
+### Technical Details
+
+- Self-licensing detection compares normalized domains of license server URL and current site URL
+- Prevents circular dependency where plugin would try to validate against itself
+- Plugins can only be validated against the original store from which they were obtained
+
+## [0.3.9] - 2026-01-24
+
+### Added
+
+- "Generate Licenses" button in order meta box for admin-created orders
+- "Generate Missing Licenses" button when some products in an order are missing licenses
+- AJAX handler `ajaxGenerateOrderLicenses()` for manual license generation from admin
+- Warning message when order domain is not set before generating licenses
+
+### Fixed
+
+- **Critical:** Licenses are now generated for orders created manually in admin area
+- Previously, licenses were only generated via checkout hooks, leaving admin-created orders without licenses
+
+### Technical Details
+
+- Added `wclp_generate_order_licenses` AJAX action to `OrderLicenseController`
+- Updated `order-licenses.js` with generate button handler and page reload on success
+- Added CSS styles for generate status messages
+- Updated translations (365 strings)
+
+## [0.3.8] - 2026-01-24
+
+### Fixed
+
+- Fixed duplicate German translation string causing `ArgumentCountError` in settings page
+- The notification settings description had duplicated text with two `%s` placeholders
+
+### Changed
+
+- Updated `magdev/wc-licensed-product-client` to latest version (64d215c)
+
+## [0.3.7] - 2026-01-24
+
+### Added
+
+- Download counter for licensed product versions (tracked per version)
+- Download Statistics admin dashboard widget showing total downloads, top products, and top versions
+- New `DownloadWidgetController` class for download statistics widget
+- New `incrementDownloadCount()`, `getTotalDownloadCount()`, and `getDownloadStatistics()` methods in `VersionManager`
+- New `download_count` column in product versions database table
+
+### Fixed
+
+- Dashboard widget "View All Licenses" link now uses correct page slug (`wc-licenses`)
+- Download links in customer account page no longer result in 404 errors (added query var registration)
+- Added `license-download` endpoint registration during plugin activation
+
+### Changed
+
+- Removed redundant "Status Breakdown" section from dashboard widget (info already shown in stat cards)
+- License Types section in dashboard widget now uses card style matching the stats row above
+- Improved dashboard widget visual consistency
+
+### Technical Details
+
+- Added `addDownloadQueryVar()` method to `DownloadController` for proper endpoint registration
+- Updated `Installer::activate()` to register `license-download` endpoint before flushing rewrite rules
+- Updated translations (356 strings)
+
+## [0.3.6] - 2026-01-23
+
+### Security
+
+- Added CSRF protection (nonce verification) to CSV export functionality
+- Fixed IP header spoofing vulnerability in rate limiting - now requires explicit trusted proxy configuration
+- Enabled explicit Twig autoescape for XSS protection
+- Fixed unescaped status values in CSS classes in Twig templates
+
+### Fixed
+
+- Fixed response signing to use recursive key sorting for client compatibility
+- ResponseSigner now recursively sorts nested array keys alphabetically as required by client implementation
+
+### Changed
+
+- Rate limiting now only trusts proxy headers when `WC_LICENSE_TRUSTED_PROXIES` constant is defined
+- Added Cloudflare IP range support via `WC_LICENSE_TRUSTED_PROXIES = 'CLOUDFLARE'` configuration
+- Improved IP detection with CIDR notation support for trusted proxy ranges
+
+### Technical Details
+
+- Added `recursiveKeySort()` method to `ResponseSigner` for proper response signing
+- Added `isTrustedProxy()`, `isCloudflareIp()`, and `ipMatchesCidr()` methods to `RestApiController`
+- Twig environment now explicitly sets `autoescape => 'html'`
+- Export CSV link now includes nonce via `wp_nonce_url()`
+- Added `export_csv_url()` Twig function for generating export URL with nonce
+
+## [0.3.5] - 2026-01-23
+
+### Added
+
+- Admin dashboard widget showing license statistics on WordPress dashboard
+- Automatic license expiration via daily wp-cron job
+- License expired email notification sent when license auto-expires
+- New `LicenseExpiredEmail` WooCommerce email class (configurable via WooCommerce > Settings > Emails)
+
+### Changed
+
+- Improved download list layout in customer account licenses page
+- Downloads now displayed in two-row format: file link on first row, metadata on second row
+- Better visual separation between download link and version/date/checksum information
+
+### Technical Details
+
+- New `DashboardWidgetController` class in `src/Admin/` for WordPress dashboard widget
+- Widget displays: total licenses, active, expiring soon, expired counts, status breakdown, license types
+- New `LicenseExpiredEmail` class in `src/Email/` for expired license notifications
+- Added `getExpiredActiveLicenses()` and `autoExpireLicense()` methods to `LicenseManager`
+- Daily cron now auto-expires licenses with past expiration date and sends notification emails
+- Updated `templates/frontend/licenses.html.twig` with new two-row structure
+- Added `.download-item`, `.download-row-file`, `.download-row-meta` CSS classes
+- Improved responsive behavior for download metadata
+
+## [0.3.4] - 2026-01-23
+
+### Added
+
+- Current version display on single product pages for licensed products
+- Version number shown directly under the product title
+- Frontend CSS styling for version badge with monospace font
+
+### Technical Details
+
+- Added `displayCurrentVersion()` method to `LicensedProductType` class
+- Hooked to `woocommerce_single_product_summary` at priority 6 (after title)
+- Added `enqueueFrontendStyles()` to load CSS on product pages
+- Uses `LicensedProduct::get_current_version()` to fetch latest version
+
 ## [0.3.3] - 2026-01-22
 
 ### Fixed

CLAUDE.md

@@ -32,9 +32,9 @@ This project is proudly **"vibe-coded"** using Claude.AI - the entire codebase w
 
 **Note for AI Assistants:** Clean this section after the specific features are done or new releases are made. Effective changes are tracked in `CHANGELOG.md`. Do not add completed versions here - document them in the Session History section at the end of this file.
 
-### Known Bugs
+### Version 0.6.0
 
-No known bugs at the moment.
+*No planned features yet.*
 
 ## Technical Stack
 
@@ -878,3 +878,781 @@ Updated OpenAPI specification to document response signing feature added in v0.2
 - Created release package: `releases/wc-licensed-product-0.3.2.zip` (810 KB)
 - SHA256: `ca33c81516b5dcf4a80b3192d8ae4ad39a7bf67196a1f729b563c5ae01b1d39c`
 - Tagged as `v0.3.2` and pushed to `main` branch
+
+### 2026-01-22 - Version 0.3.3 - Bug Fix & License Testing
+
+**Overview:**
+
+Fixed version deactivation bug and added license testing functionality.
+
+**Bug Fix:**
+
+- Fixed version deactivation button not working in admin product versions table
+- Root cause: Parameters in wrong order in `VersionAdminController::ajaxToggleVersion()`
+- Changed from `updateVersion($versionId, null, null, !$currentlyActive)` to `updateVersion($versionId, null, !$currentlyActive, null)`
+
+**Implemented:**
+
+- Added "Test" action to license overview to validate licenses against `/validate` API endpoint
+- Test License modal showing license key, domain, and validation results
+- AJAX handler `handleAjaxTestLicense()` for license testing
+
+**Modified files:**
+
+- `src/Admin/VersionAdminController.php` - Fixed parameter order in toggle method
+- `src/Admin/AdminController.php` - Added Test action to PHP fallback and AJAX handler
+- `templates/admin/licenses.html.twig` - Added Test action and modal to Twig template
+
+**Release v0.3.3:**
+
+- Created release package: `releases/wc-licensed-product-0.3.3.zip` (795 KB)
+- SHA256: `a06d29eabc2da08613ae13874ed152b8ea9363b8284a2e9bdda414e32777558c`
+- Tagged as `v0.3.3` and pushed to `main` branch
+
+### 2026-01-23 - Version 0.3.4 - Frontend Version Display
+
+**Overview:**
+
+Added current version display on single product pages for licensed products.
+
+**Implemented:**
+
+- Current version displayed directly under the product title
+- Styled version badge with monospace font and subtle blue background
+- Frontend CSS automatically loaded on licensed product pages
+
+**Modified files:**
+
+- `src/Product/LicensedProductType.php` - Added `displayCurrentVersion()` and `enqueueFrontendStyles()` methods
+- `assets/css/frontend.css` - Added `.wclp-product-version` styles
+
+**Technical notes:**
+
+- Uses `woocommerce_single_product_summary` hook at priority 6 (after title at priority 5)
+- Only displays for licensed product type
+- Only displays if product has at least one version defined
+- Uses `LicensedProduct::get_current_version()` which queries `VersionManager::getLatestVersion()`
+
+### 2026-01-23 - Version 0.3.5 - Dashboard Widget & Auto-Expire
+
+**Overview:**
+
+Added admin dashboard widget for license statistics and automatic license expiration via daily cron job.
+
+**Implemented:**
+
+- Admin dashboard widget showing license statistics (total, active, expiring soon, expired)
+- Status breakdown display with color-coded badges
+- License type breakdown (time-limited vs lifetime)
+- Daily wp-cron job to auto-expire licenses past their expiration date
+- License expired email notification sent when license auto-expires
+- Downloads in customer account now displayed in two-row format
+
+**New files:**
+
+- `src/Admin/DashboardWidgetController.php` - WordPress dashboard widget controller
+- `src/Email/LicenseExpiredEmail.php` - WooCommerce email for expired license notifications
+
+**Modified files:**
+
+- `src/Plugin.php` - Added DashboardWidgetController instantiation
+- `src/License/LicenseManager.php` - Added `getExpiredActiveLicenses()` and `autoExpireLicense()` methods
+- `src/Email/LicenseEmailController.php` - Added auto-expire logic and LicenseExpiredEmail registration
+- `templates/frontend/licenses.html.twig` - Restructured download list with two-row layout
+- `assets/css/frontend.css` - Added dashboard widget and download list styles
+
+**Technical notes:**
+
+- Dashboard widget uses `wp_add_dashboard_widget()` hook, requires `manage_woocommerce` capability
+- Widget displays statistics from existing `LicenseManager::getStatistics()` method
+- Auto-expire runs during daily `wclp_check_expiring_licenses` cron event
+- `getExpiredActiveLicenses()` finds licenses with past expiration date but still active status
+- `autoExpireLicense()` updates status to expired and returns true if changed
+- LicenseExpiredEmail follows same pattern as LicenseExpirationEmail (warning vs expired)
+- Expired notification tracked via user meta to prevent duplicate emails
+
+### 2026-01-23 - Version 0.3.6 - Security Hardening
+
+**Overview:**
+
+Security audit and implementation alignment with client/server documentation. Fixed response signing compatibility, rate limiting security, and XSS prevention.
+
+**Security Fixes:**
+
+- Added CSRF protection (nonce verification) to CSV export functionality
+- Fixed IP header spoofing vulnerability in rate limiting - now requires explicit trusted proxy configuration
+- Enabled explicit Twig autoescape (`'html'`) for XSS protection
+- Fixed unescaped status values in CSS class names in Twig templates
+
+**Implementation Fixes:**
+
+- Fixed response signing to use recursive key sorting for client library compatibility
+- ResponseSigner now recursively sorts nested array keys alphabetically as required by `magdev/wc-licensed-product-client`
+
+**Modified files:**
+
+- `src/Api/ResponseSigner.php` - Added `recursiveKeySort()` method for proper signature generation
+- `src/Api/RestApiController.php` - Added trusted proxy support with `isTrustedProxy()`, `isCloudflareIp()`, `ipMatchesCidr()` methods
+- `src/Plugin.php` - Added explicit `autoescape => 'html'` to Twig environment
+- `src/Admin/AdminController.php` - Added nonce verification to `handleCsvExport()`, added `export_csv_url()` Twig function
+- `templates/frontend/licenses.html.twig` - Added `esc_attr()` for CSS class status
+- `templates/admin/licenses.html.twig` - Added `esc_attr()` for CSS class status, updated export link to use `export_csv_url()`
+
+**Configuration:**
+
+To enable trusted proxy support for rate limiting, add to `wp-config.php`:
+
+```php
+// For Cloudflare
+define('WC_LICENSE_TRUSTED_PROXIES', 'CLOUDFLARE');
+
+// Or for specific IPs/CIDR ranges
+define('WC_LICENSE_TRUSTED_PROXIES', '10.0.0.1,192.168.1.0/24');
+```
+
+**Technical notes:**
+
+- Rate limiting now only trusts proxy headers (`HTTP_CF_CONNECTING_IP`, `HTTP_X_FORWARDED_FOR`, `HTTP_X_REAL_IP`) when `WC_LICENSE_TRUSTED_PROXIES` constant is defined
+- Without trusted proxy configuration, rate limiting uses `REMOTE_ADDR` only (prevents IP spoofing)
+- Cloudflare IP ranges are hardcoded for convenience (as of 2024)
+- CIDR notation supported for custom proxy ranges
+- Recursive key sorting ensures signature compatibility with SecureLicenseClient
+- References: <https://src.bundespruefstelle.ch/magdev/wc-licensed-product-client/raw/branch/main/docs/server-implementation.md>
+
+**Release v0.3.6:**
+
+- Created release package: `releases/wc-licensed-product-0.3.6.zip` (818 KB)
+- SHA256: `b0063f0312759f090e12faba83de730baf4114139d763e46fad2b781d4b38270`
+- Tagged as `v0.3.6` and pushed to `main` branch
+
+### 2026-01-24 - Version 0.3.7 - Dashboard Improvements & Download Counter
+
+**Overview:**
+
+Fixed dashboard widget bugs, improved UI consistency, and added download tracking functionality with a new statistics widget.
+
+**Bug Fixes:**
+
+- Fixed: Dashboard widget "View All Licenses" link used wrong page slug (`wc-licensed-product-licenses` instead of `wc-licenses`)
+- Fixed: Download links in customer account resulted in 404 errors due to missing query var registration
+- Added `license-download` endpoint registration during plugin activation in `Installer::activate()`
+- Added `addDownloadQueryVar()` method to `DownloadController` for proper WordPress endpoint recognition
+
+**UI Improvements:**
+
+- Removed redundant "Status Breakdown" section from license statistics widget (info already shown in stat cards above)
+- Changed License Types section to use card-style layout matching the stats row above
+- Cleaned up unused CSS for status badges
+
+**New Features:**
+
+- Download counter for licensed product versions (tracked per version in database)
+- New Download Statistics admin dashboard widget showing:
+  - Total downloads count
+  - Top 5 products by downloads
+  - Top 5 versions by downloads
+
+**New files:**
+
+- `src/Admin/DownloadWidgetController.php` - Dashboard widget for download statistics
+
+**New methods in VersionManager:**
+
+- `incrementDownloadCount()` - Atomically increment download count for a version
+- `getTotalDownloadCount()` - Get total downloads across all versions
+- `getDownloadStatistics()` - Get download stats grouped by product and version
+
+**Modified files:**
+
+- `src/Installer.php` - Added `download_count` column to versions table, added `license-download` endpoint registration
+- `src/Product/ProductVersion.php` - Added `downloadCount` property and `getDownloadCount()` method
+- `src/Product/VersionManager.php` - Added download counting methods
+- `src/Frontend/DownloadController.php` - Added query var registration, increment download count on file serve
+- `src/Admin/DashboardWidgetController.php` - Fixed URL, removed Status Breakdown, changed License Types to cards
+- `src/Plugin.php` - Added DownloadWidgetController instantiation
+
+**Technical notes:**
+
+- Download count is incremented atomically using SQL `download_count = download_count + 1`
+- Statistics queries use SQL aggregation with product name enrichment via `wc_get_product()`
+- WordPress endpoints require both `add_rewrite_endpoint()` AND `query_vars` filter registration
+- Existing installations need to flush rewrite rules (Settings > Permalinks > Save) or reactivate plugin
+
+**Release v0.3.7:**
+
+- Created release package: `releases/wc-licensed-product-0.3.7.zip` (827 KB)
+- SHA256: `e93b2ab06f6d43c2179167090e07eda5db6809df6e391baece4ceba321cf33f6`
+- Tagged as `v0.3.7` and pushed to `main` branch
+
+### 2026-01-24 - Version 0.3.8 - Translation Bug Fix
+
+**Overview:**
+
+Fixed a critical translation bug that caused the settings page to crash with an `ArgumentCountError`.
+
+**Bug Fix:**
+
+- Fixed: Duplicate German translation string in `wc-licensed-product-de_CH.po` causing `ArgumentCountError` in settings page
+- Root cause: The notification settings description was duplicated in the translation, resulting in two `%s` placeholders when only one argument was passed to `sprintf()`
+- Location: [wc-licensed-product-de_CH.po:322-328](languages/wc-licensed-product-de_CH.po#L322-L328)
+
+**Modified files:**
+
+- `languages/wc-licensed-product-de_CH.po` - Removed duplicated translation string
+- `languages/wc-licensed-product-de_CH.mo` - Recompiled binary translation
+
+**Technical notes:**
+
+- Error was logged to `tmp/fatal-errors-2026-01-24.log`
+- The German `msgstr` contained the same text twice, each with a `%s` placeholder
+- `sprintf()` at `SettingsController.php:221` only provided one argument for the single `%s` in the English source
+- Translation strings with `%s` placeholders must have exactly matching placeholder counts between source and translation
+
+**Dependency Updates:**
+
+- Updated `magdev/wc-licensed-product-client` from `9f513a8` to `64d215c`
+
+**Release v0.3.8:**
+
+- Created release package: `releases/wc-licensed-product-0.3.8.zip` (829 KB)
+- SHA256: `50ad6966c5ab8db2257572084d2d8a820448df62615678e1576696f2c0cb383d`
+- Tagged as `v0.3.8` and pushed to `main` branch
+
+### 2026-01-24 - Version 0.3.9 - Admin Order License Generation Fix
+
+**Overview:**
+
+Fixed a critical bug where licenses were not generated for orders created manually in the WordPress admin area.
+
+**Bug Fix:**
+
+- **Critical:** Licenses are now generated for orders created manually in admin area
+- Previously, licenses were only generated via checkout hooks (`woocommerce_order_status_completed`, `woocommerce_order_status_processing`, `woocommerce_payment_complete`)
+- Admin-created orders bypassed checkout, so the `_licensed_product_domain` meta was never set and licenses were never generated
+
+**Implemented:**
+
+- "Generate Licenses" button in order meta box for admin-created orders
+- "Generate Missing Licenses" button when some products in an order already have licenses
+- Warning message when order domain is not set before generating licenses
+- AJAX handler `ajaxGenerateOrderLicenses()` for manual license generation
+
+**Modified files:**
+
+- `src/Admin/OrderLicenseController.php` - Added Generate button, AJAX handler, CSS styles
+- `assets/js/order-licenses.js` - Added `generateLicenses()` function with page reload on success
+
+**Technical notes:**
+
+- Button only appears when order is paid and domain is set
+- Uses existing `LicenseManager::generateLicense()` which handles duplicate prevention
+- Page reloads after successful generation to show new licenses in table
+- Tracks generated vs skipped licenses for accurate feedback messages
+- Updated translations (365 strings)
+
+**Release v0.3.9:**
+
+- Created release package: `releases/wc-licensed-product-0.3.9.zip` (851 KB)
+- SHA256: `fdb65200c368da380df0cabb3c6ac6419d5b4731cd528f630f9b432a3ba5c586`
+- Tagged as `v0.3.9` and pushed to `main` branch
+
+### 2026-01-24 - Version 0.4.0 - Self-Licensing Prevention
+
+**Overview:**
+
+Added self-licensing prevention to avoid circular dependency when the plugin tries to validate its license against itself.
+
+**Implemented:**
+
+- Self-licensing detection: Plugin automatically bypasses license validation when the configured license server URL points to the same WordPress installation
+- New `isSelfLicensing()` method in `PluginLicenseChecker` to detect circular licensing scenarios
+- New `normalizeDomain()` helper method for domain comparison (strips www prefix, lowercases)
+- Cache property `$isSelfLicensingCached` for efficient repeated checks
+
+**Modified files:**
+
+- `src/License/PluginLicenseChecker.php` - Added self-licensing detection methods and bypass logic
+
+**Technical notes:**
+
+- Self-licensing detection compares normalized domains of license server URL and current site URL
+- Prevents circular dependency where plugin would try to validate against itself
+- Plugins can only be validated against the original store from which they were obtained
+- Bypass check added to both `isLicenseValid()` and `validateLicense()` methods
+- Cache clearing via `clearCache()` also clears the self-licensing check cache
+
+**Release v0.4.0:**
+
+- Created release package: `releases/wc-licensed-product-0.4.0.zip` (852 KB)
+- SHA256: `cf8769c861d77c327f178049d5fac0d4e47679cc1a1d35c5b613e4cd3fb8674f`
+- Tagged as `v0.4.0` and pushed to `main` branch
+
+### 2026-01-25 - Version 0.5.0 - Multi-Domain Licensing
+
+**Overview:**
+
+Major feature release enabling customers to purchase multiple licenses for different domains in a single order. Each cart item quantity requires a unique domain at checkout.
+
+**Implemented:**
+
+- Multi-domain licensing support with new setting "Enable Multi-Domain Licensing"
+- Multi-domain checkout UI for both classic checkout and WooCommerce Blocks
+- Grouped license display in customer account page by product/order (package view)
+- "Older versions" collapsible section in customer download area
+- Updated email templates to show licenses grouped by product
+- DOM injection fallback for WooCommerce Blocks when React component fails
+
+**New Setting:**
+
+- `wclp_enable_multi_domain` - Enable/disable multi-domain licensing mode
+
+**New Order Meta:**
+
+- `_licensed_product_domains` - Array of domain data for multi-domain orders:
+
+  ```php
+  [
+      ['product_id' => 123, 'domains' => ['site1.com', 'site2.com']],
+      ['product_id' => 456, 'domains' => ['another.com']],
+  ]
+  ```
+
+**Modified files:**
+
+- `src/Admin/SettingsController.php` - Added multi-domain setting
+- `src/Checkout/CheckoutController.php` - Multi-domain field rendering and validation
+- `src/Checkout/CheckoutBlocksIntegration.php` - WooCommerce Blocks multi-domain support
+- `src/Checkout/StoreApiExtension.php` - Multi-domain data handling in Store API
+- `src/Frontend/AccountController.php` - Grouped license display by product
+- `src/Email/LicenseEmailController.php` - Grouped license email templates
+- `src/Plugin.php` - Multi-domain license generation
+- `src/License/LicenseManager.php` - Multi-domain license creation
+- `src/Admin/OrderLicenseController.php` - Multi-domain order display
+- `assets/js/checkout-blocks.js` - Complete rewrite for ExperimentalOrderMeta slot
+- `assets/js/frontend.js` - Older versions toggle functionality
+- `assets/css/frontend.css` - Package-based layout styles
+- `templates/frontend/licenses.html.twig` - Grouped license template
+
+**Technical notes:**
+
+- WooCommerce Blocks integration uses `ExperimentalOrderMeta` slot with `registerPlugin`
+- DOM injection fallback activates after 2 seconds if React component fails to render
+- Multi-domain validation ensures unique domains per product
+- Backward compatible: existing single-domain orders continue to work
+- New `getLicensesByOrderAndProduct()` method returns all licenses for a product in an order
+- Customer account groups licenses by product for package-style display
+- Email templates show licenses in table format grouped by product
+
+**Bug Fix:**
+
+- Fixed: Domain fields not rendering in WooCommerce Blocks checkout
+- Root cause: `registerCheckoutBlock` approach requires manual block editor configuration
+- Fix: Switched to `ExperimentalOrderMeta` slot pattern with `registerPlugin` + DOM injection fallback
+
+**Translation Updates:**
+
+- Added 19 new strings for multi-domain functionality
+- Fixed all fuzzy translations in German (de_CH)
+- Updated .pot template and compiled .mo files
+
+**Release v0.5.0:**
+
+- Created release package: `releases/wc-licensed-product-0.5.0.zip` (863 KB)
+- SHA256: `446804948e5f99d705b548061d5b78180856984c58458640a910ada8f27f5316`
+- Tagged as `v0.5.0` and pushed to `main` branch
+
+### 2026-01-26 - Version 0.5.1 - Admin UI Fixes
+
+**Overview:**
+
+Bug fix release improving admin UI usability for version management and license overview.
+
+**Bug Fixes:**
+
+- Fixed: Product versions in admin now sort by version DESC when adding via AJAX
+- Fixed: License actions in admin overview are now always visible (not just on hover)
+
+**Modified files:**
+
+- `assets/css/admin.css` - Added `!important` to `.licenses-table .row-actions` for permanent visibility
+- `assets/js/versions.js` - Added `compareVersions()` function and sorted insertion for AJAX-added versions
+
+**Technical notes:**
+
+- Version sorting uses semantic version comparison (major.minor.patch)
+- New versions are inserted in correct sorted position in the table instead of always appending
+- CSS override uses `!important` to overcome WordPress default hover-only behavior for row actions
+- `compareVersions()` function compares version strings numerically (1.10.0 > 1.9.0)
+
+**Release v0.5.1:**
+
+- Created release package: `releases/wc-licensed-product-0.5.1.zip` (863 KB)
+- SHA256: `a489f0b8cfcd7d5d9b2021b7ff581b9f1a56468dfde87bbb06bb4555d11f7556`
+- Tagged as `v0.5.1` and pushed to `main` branch
+
+### 2026-01-26 - Version 0.5.2 - Per-License Customer Secrets
+
+**Overview:**
+
+Security enhancement release adding per-license customer secrets for API response verification. Each customer now receives a unique secret derived from their license key, eliminating the need to share a global server secret.
+
+**Implemented:**
+
+- Per-license secret derivation using HKDF-like approach
+- Customer account UI showing API verification secret with collapsible section
+- Copy-to-clipboard functionality for customer secrets
+- Static helper methods in ResponseSigner for secret derivation
+
+**New methods in ResponseSigner:**
+
+- `deriveCustomerSecret()` - Static method to derive customer secret from license key and server secret
+- `getCustomerSecretForLicense()` - Static method to get customer secret using configured server secret
+- `isSigningEnabled()` - Static method to check if response signing is configured
+
+**Modified files:**
+
+- `src/Api/ResponseSigner.php` - Added static methods for customer secret derivation
+- `src/Frontend/AccountController.php` - Added `signing_enabled` and `customer_secret` to template data
+- `templates/frontend/licenses.html.twig` - Added collapsible secret section with toggle and copy button
+- `assets/css/frontend.css` - Added styles for `.license-row-secret`, `.secret-toggle`, `.secret-content`
+- `assets/js/frontend.js` - Added `toggleSecret()` and `copySecret()` event handlers
+- `docs/server-implementation.md` - Added documentation for per-license secrets
+
+**Technical notes:**
+
+- Secret derivation uses HKDF-like approach: `HMAC-SHA256(HMAC-SHA256(license_key, server_secret) + "\x01", server_secret)`
+- Each license gets a unique 64-character hex secret
+- Secrets are only shown when `WC_LICENSE_SERVER_SECRET` is configured
+- Collapsible UI prevents accidental secret exposure
+- If server secret is rotated, all customer secrets change automatically
+
+**Security improvement:**
+
+- Customers no longer need access to the master `WC_LICENSE_SERVER_SECRET`
+- If one customer's secret is leaked, other customers are not affected
+- Each license key derives its own unique verification secret
+
+**Release v0.5.2:**
+
+- Created release package: `releases/wc-licensed-product-0.5.2.zip` (845 KB)
+- SHA256: `2d61a78ac5ba0f1d115a6401e6dded5b872b18f5530027c371604cbd18e9e27c`
+- Tagged as `v0.5.2` and pushed to `main` branch
+
+### 2026-01-26 - Version 0.5.3 - Variable Licensed Products
+
+**Overview:**
+
+Major feature release adding support for WooCommerce variable products. Customers can now purchase licenses with different durations (monthly, yearly, lifetime) as product variations.
+
+**New files:**
+
+- `src/Product/LicensedVariableProduct.php` - Variable product class extending `WC_Product_Variable`
+- `src/Product/LicensedProductVariation.php` - Variation class with license settings
+
+**Implemented:**
+
+- New `licensed-variable` product type for selling licenses with different durations
+- `LicensedVariableProduct` class extending WooCommerce variable products
+- `LicensedProductVariation` class for individual variation license settings
+- Variation-specific license duration fields in product edit page (days, max activations)
+- Duration labels (Monthly, Quarterly, Yearly, Lifetime) displayed in checkout
+- Variation ID tracking in order domain meta for proper license generation
+- WooCommerce Blocks checkout updated to handle variations with duration labels
+
+**Modified files:**
+
+- `src/Product/LicensedProductType.php` - Added licensed-variable type registration, variation hooks
+- `src/License/LicenseManager.php` - Added `isLicensedProduct()` helper, variation support in `generateLicense()`
+- `src/Plugin.php` - Updated license generation to handle variations
+- `src/Checkout/CheckoutController.php` - Variation support in domain field rendering
+- `src/Checkout/CheckoutBlocksIntegration.php` - Variation data in blocks checkout
+- `src/Checkout/StoreApiExtension.php` - Variation ID in Store API schema
+- `assets/js/checkout-blocks.js` - Variation handling in React components and DOM fallback
+
+**Technical notes:**
+
+- Variable product type shows in WooCommerce product type selector as "Licensed Variable Product"
+- Each variation can override parent's license duration and max activations
+- Variations are always virtual (licensed products don't ship)
+- `LicensedProductVariation::get_license_duration_label()` returns human-readable duration
+- Order meta `_licensed_product_domains` now includes optional `variation_id` field
+- License generation uses variation settings when `variation_id` is present in order item
+- Backward compatible: existing simple licensed products continue to work unchanged
+
+### 2026-01-26 - Version 0.5.4 - API Compliance
+
+**Overview:**
+
+Bug fix release aligning server implementation with client documentation at `magdev/wc-licensed-product-client`.
+
+**Fixed:**
+
+- `/validate` endpoint now returns HTTP 404 for `license_not_found` error (was returning 403)
+- License key validation now enforces minimum 8 characters across all API endpoints
+
+**Implemented:**
+
+- Configurable rate limiting via `WC_LICENSE_RATE_LIMIT` constant (default: 30 requests)
+- Configurable rate window via `WC_LICENSE_RATE_WINDOW` constant (default: 60 seconds)
+- HTTP status code mapping: 404 for not found, 500 for server errors, 403 for all other errors
+
+**Modified files:**
+
+- `src/Api/RestApiController.php` - Added configurable rate limiting, fixed HTTP status codes, added license_key validation
+
+**Technical notes:**
+
+- Rate limiting now uses `getRateLimit()` and `getRateWindow()` methods instead of constants
+- New `getStatusCodeForResult()` method maps error codes to HTTP status codes
+- License key validation callback added to all three endpoints (validate, status, activate)
+- Uses PHP 8 match expression for status code mapping
+
+### 2026-01-26 - Version 0.5.5 - Critical Signature Fix
+
+**Overview:**
+
+Critical bug fix for response signing. The key derivation algorithm was incompatible with the client library, causing signature verification failures.
+
+**Critical Fix:**
+
+- Key derivation now uses PHP's native `hash_hkdf()` function per RFC 5869
+- Previous custom implementation produced different keys than the client library
+- Signatures now verify correctly with `magdev/wc-licensed-product-client`
+
+**Additional Fix:**
+
+- Added missing domain validation to `/activate` endpoint (1-255 characters)
+
+**Modified files:**
+
+- `src/Api/ResponseSigner.php` - Fixed key derivation to use `hash_hkdf()`
+- `src/Api/RestApiController.php` - Added domain validation to `/activate` endpoint
+
+**Technical notes:**
+
+- Old implementation: `hash_hmac('sha256', $prk . "\x01", $serverSecret)` - custom HKDF-like
+- New implementation: `bin2hex(hash_hkdf('sha256', $serverSecret, 32, $licenseKey))` - RFC 5869
+- Parameters match client's `ResponseSignature::deriveKey()` exactly:
+  - IKM (input keying material): server_secret
+  - Length: 32 bytes (256 bits)
+  - Info: license_key (context-specific info)
+- **Breaking change for existing signatures** - customer secrets will change after upgrade
+
+### 2026-01-27 - Version 0.5.6 - License Settings Tab Visibility Fix
+
+**Overview:**
+
+Fixed License Settings tab visibility for non-licensed product types and updated README with v0.5.x features.
+
+**Bug Fix:**
+
+- License Settings tab now only shows for Licensed Product and Licensed Variable Product types
+- Previously the tab was visible on all product types due to CSS `!important` override forcing `display: block`
+
+**Modified files:**
+
+- `assets/css/admin.css` - Changed from `display: block !important` to `display: none` for `.show_if_licensed` and `.show_if_licensed-variable`
+- `src/Product/LicensedProductType.php` - Added consolidated `toggleLicensedProductOptions()` JavaScript function
+- `README.md` - Updated with complete feature documentation for v0.5.x features
+
+**Technical notes:**
+
+- CSS now hides License Settings tab by default
+- JavaScript `toggleLicensedProductOptions()` function shows/hides tab based on product type selector
+- Function is called both on page load and on product type change
+- README updated with: Variable Licensed Products, Multi-Domain Licensing, Per-License Secrets, Download Statistics, Configurable Rate Limiting
+
+**Release v0.5.6:**
+
+- Created release package: `releases/wc-licensed-product-0.5.6.zip` (1.1 MB)
+- SHA256: `4d35a319fe4cb4e7055bae17fc030487ca05e5e9ac905f76d0ac62002bde4336`
+- Tagged as `v0.5.6` and pushed to `main` branch
+
+### 2026-01-27 - Version 0.5.7 - Settings UI Cleanup
+
+**Overview:**
+
+Removed redundant "Default" prefix from setting labels on the Default Settings page for cleaner UI.
+
+**Changed:**
+
+- "Max Activations" (was "Default Max Activations")
+- "License Validity (Days)" (was "Default License Validity (Days)")
+- "Bind to Major Version" (was "Default Bind to Major Version")
+
+**Modified files:**
+
+- `src/Admin/SettingsController.php` - Removed "Default" prefix from three setting labels
+
+**Technical notes:**
+
+- Labels are cleaner since the page section itself is already named "Default Settings"
+- No functional changes, purely UI improvement
+- Updated all translations (388 strings)
+
+**Release v0.5.7:**
+
+- Created release package: `releases/wc-licensed-product-0.5.7.zip` (856 KB)
+- SHA256: `ceb4d57598f576f4f172153ff80df8c180ecd4dca873cf109327fc5ac718930f`
+- Tagged as `v0.5.7` and pushed to `main` branch
+
+### 2026-01-27 - Version 0.5.8-0.5.11 - Licensed Variable Product Fixes
+
+**Overview:**
+
+Series of bug fixes for licensed variable products that were showing frontend errors and not displaying properly.
+
+**v0.5.8 - Initial Fix:**
+
+- Fixed critical error on frontend product pages for licensed variable products
+- Variable product add-to-cart template now passes required variables (`available_variations`, `attributes`, `selected_attributes`)
+- Added JavaScript event listeners for WooCommerce AJAX events to maintain admin variants tab visibility
+
+**v0.5.9 - Null Checks:**
+
+- Added null checks for `get_variation_attributes()`, `get_available_variations()`, and `get_default_attributes()`
+- Show informative message instead of error when product has no variations configured
+- Changed product type check from `instanceof` to `is_type()` for better compatibility
+
+**v0.5.10 - Product Loading:**
+
+- Re-load product via `wc_get_product()` to ensure correct class instance is used
+- Removed overly strict type check that was preventing variations from displaying
+
+**v0.5.11 - Final Fix:**
+
+- **CRITICAL:** Fixed "sold out" message on licensed variable products
+- `LicensedVariableProduct::is_purchasable()` now delegates to parent `WC_Product_Variable` class (variable products don't have direct prices - only variations do)
+- Fixed `getProductClass()` filter to accept all 4 WooCommerce parameters and use product_id for reliable variation parent detection
+- Added fallback to global `$post` when product_id not available
+
+**Modified files:**
+
+- `src/Product/LicensedProductType.php` - Fixed `variableAddToCartTemplate()` and `getProductClass()` methods
+- `src/Product/LicensedVariableProduct.php` - Fixed `is_purchasable()` method
+- `wc-licensed-product.php` - Version bumps
+
+**Technical notes:**
+
+- WooCommerce `woocommerce_product_class` filter has 4 parameters: `$className`, `$productType`, `$postType`, `$productId`
+- Variable products delegate purchasability to their variations - checking `get_price()` on parent is incorrect
+- Variation parent detection must use product ID, not global `$post` which may not be set on frontend
+
+**Release v0.5.11:**
+
+- Created release package: `releases/wc-licensed-product-0.5.11.zip` (857 KB)
+- SHA256: `32571178bfa8f0d0a03ed05b498d5f9b3c860104393a96732e86a03b6de298d2`
+- Committed to `dev` branch
+
+### 2026-01-27 - Version 0.5.12 - Stock Display Fix
+
+**Overview:**
+
+Fixed stock indicator appearing in cart for licensed variable product variations.
+
+**Bug Fix:**
+
+- Fixed "1 in stock" message appearing in cart for licensed variable product variations
+- Added multiple WooCommerce filter overrides to suppress stock display
+
+**Modified files:**
+
+- `src/Product/LicensedVariableProduct.php` - Override `get_children()`, `get_variation_attributes()`, `get_variation_prices()`, `get_available_variations()`, `is_type()`
+- `src/Product/LicensedProductVariation.php` - Added `get_availability()`, `managing_stock()`, `is_purchasable()` overrides
+- `src/Product/LicensedProductType.php` - Added stock-related filter hooks
+
+**Technical notes:**
+
+- `get_children()` uses direct SQL query to bypass WooCommerce's `is_type('variable')` check
+- `is_type()` override returns true for both 'licensed-variable' and 'variable' type checks
+- Stock filters: `woocommerce_get_availability_text`, `woocommerce_product_get_stock_quantity`, `woocommerce_product_variation_get_stock_quantity`
+
+### 2026-01-27 - Version 0.5.13 - Admin Order License Display Fix
+
+**Overview:**
+
+Fixed licenses not showing in admin order form for licensed-variable products and removed debug logging.
+
+**Bug Fixes:**
+
+- **CRITICAL:** Fixed licenses not appearing in admin order form for orders containing licensed-variable products
+- `OrderLicenseController` now uses `LicenseManager::isLicensedProduct()` for consistent product type detection across 4 locations
+- Fixed expected licenses calculation for variable product orders
+- Fixed manual license generation from admin order page for variable products
+
+**Cleanup:**
+
+- Removed all debug `error_log()` calls from PHP source files
+- Removed all debug `console.log()` calls from JavaScript files
+- Files cleaned: Plugin.php, CheckoutBlocksIntegration.php, StoreApiExtension.php, CheckoutController.php, checkout-blocks.js
+
+**Modified files:**
+
+- `src/Admin/OrderLicenseController.php` - Use `isLicensedProduct()` in 4 locations
+- `src/Plugin.php` - Remove debug logging
+- `src/Checkout/CheckoutBlocksIntegration.php` - Remove debug logging
+- `src/Checkout/StoreApiExtension.php` - Remove debug logging
+- `src/Checkout/CheckoutController.php` - Remove debug logging
+- `assets/js/checkout-blocks.js` - Remove debug logging
+
+**Release v0.5.13:**
+
+- Created release package: `releases/wc-licensed-product-0.5.13.zip` (1.0 MB)
+- SHA256: `814710ad899529d0015494e4b332eace7d8e55aeda381fdf61f99274c0bf910c`
+- Committed to `dev` branch
+
+### 2026-01-27 - Version 0.5.14 - Product Versions Meta Box Fix
+
+**Overview:**
+
+Fixed Product Versions meta box not appearing for licensed-variable products in admin.
+
+**Bug Fixes:**
+
+- Product Versions meta box now always added to product pages, visibility controlled via CSS/JavaScript
+- Added `Installer::registerProductTypes()` to create product type terms in the `product_type` taxonomy
+- Product type terms are now ensured to exist on `woocommerce_init` hook for existing installations
+
+**Modified files:**
+
+- `src/Admin/VersionAdminController.php` - Simplified `addVersionsMetaBox()` to always add meta box
+- `src/Installer.php` - Added `registerProductTypes()` method
+- `src/Product/LicensedProductType.php` - Added `ensureProductTypeTermsExist()` hook
+
+**Technical notes:**
+
+- WooCommerce's `WC_Product_Factory::get_product_type()` requires product type terms to exist in the `product_type` taxonomy
+- Meta box visibility is controlled via JavaScript based on selected product type
+- Taxonomy terms are registered on `woocommerce_init` hook to ensure WooCommerce is fully loaded
+
+### 2026-01-27 - Version 0.5.15 - Tab Rendering Fix
+
+**Overview:**
+
+Fixed tab rendering bug in WooCommerce product edit page when switching to licensed or licensed-variable product types.
+
+**Bug Fixes:**
+
+- Fixed tab rendering issue where License Settings and Variations tabs appeared shifted/overlapping
+- Simplified JavaScript to avoid conflicts with WooCommerce's native show/hide logic
+- Removed conflicting CSS rule for `.hide_if_licensed` that was causing layout issues
+- License Settings tab now uses CSS class toggle (`.wclp-active`) instead of jQuery `.show()/.hide()`
+- Variations tab properly shows for licensed-variable products via `woocommerce_product_data_tabs` filter
+
+**Modified files:**
+
+- `src/Product/LicensedProductType.php` - Simplified `toggleOurElements()` JavaScript function, added `show_if_licensed-variable` class to variations tab
+- `assets/css/admin.css` - Removed `.hide_if_licensed` rule, updated tab visibility CSS to target `li.licensed_product_options`
+
+**Technical notes:**
+
+- jQuery's `.show()` sets `display: block` which can break `<li>` element layouts in tab lists
+- Using CSS class toggle (`addClass/removeClass`) preserves proper display values
+- WooCommerce product data tabs use class pattern `{tab_key}_options` (e.g., `licensed_product_options`)
+- The `woocommerce_product_data_tabs` filter allows adding classes to existing tabs like variations
+
+**Release v0.5.15:**
+
+- Created release package: `releases/wc-licensed-product-0.5.15.zip` (862 KB)
+- SHA256: `47407de49bae4c649644af64e87b44b32fb30eeb2d50890ff8c4bbb741059278`
+- Committed to `dev` branch

README.md

@@ -11,25 +11,34 @@ WC Licensed Product adds a new product type "Licensed Product" to WooCommerce, e
 ### Core Features
 
 - **Licensed Product Type**: New WooCommerce product type for software sales
+- **Variable Licensed Products**: Create product variations with different license durations (monthly, yearly, lifetime)
 - **Automatic License Generation**: License keys generated on order completion (format: XXXX-XXXX-XXXX-XXXX)
 - **Domain Binding**: Licenses are bound to customer-specified domains
+- **Multi-Domain Licensing**: Customers can purchase multiple licenses for different domains in a single order
 - **REST API**: Public endpoints for license validation and management
+- **Response Signing**: Optional HMAC-SHA256 cryptographic signatures for API responses
+- **Per-License Secrets**: Each customer receives a unique verification secret for their license
 - **Version Binding**: Optional binding to major software versions
 - **Expiration Support**: Set license validity periods or lifetime licenses
-- **Rate Limiting**: API endpoints protected with rate limiting (30 requests/minute)
+- **Rate Limiting**: API endpoints protected with configurable rate limiting (default: 30 requests/minute)
+- **Trusted Proxy Support**: Configurable trusted proxies for accurate rate limiting behind CDNs
 - **Checkout Blocks**: Full support for WooCommerce Checkout Blocks (default since WC 8.3+)
+- **Self-Licensing**: The plugin can validate its own license (for commercial distribution)
 
 ### Customer Features
 
-- **My Account Licenses**: Customers can view their licenses in My Account
+- **My Account Licenses**: Customers can view their licenses in My Account (grouped by product)
 - **License Transfers**: Customers can transfer licenses to new domains
 - **Secure Downloads**: Download purchased software versions with license verification
+- **Version History**: Access to older versions with collapsible download section
 - **Copy to Clipboard**: Easy license key copying
+- **API Verification Secret**: Per-license secret displayed for secure API integration
 
 ### Admin Features
 
 - **License Management**: Full CRUD interface for license management
 - **License Dashboard**: Statistics and analytics (WooCommerce > Reports > Licenses)
+- **Dashboard Widgets**: License statistics and download statistics on WordPress admin dashboard
 - **Search & Filtering**: Search by license key, domain, status, or product
 - **Live Search**: AJAX-powered instant search results
 - **Inline Editing**: Edit license status, expiry, and domain directly in the list
@@ -37,8 +46,13 @@ WC Licensed Product adds a new product type "Licensed Product" to WooCommerce, e
 - **License Transfer**: Transfer licenses to new domains
 - **CSV Export/Import**: Export and import licenses via CSV
 - **Order Integration**: View and manage licenses directly from order pages
+- **Generate Licenses**: Manually generate licenses for admin-created orders
 - **Expiration Warnings**: Automatic email notifications before license expiration
+- **Auto-Expire**: Daily cron job automatically expires licenses past their expiration date
+- **License Testing**: Test licenses against the API directly from admin interface
 - **Version Management**: Manage multiple versions per product with file attachments
+- **Download Tracking**: Track download counts per version with statistics widget
+- **SHA256 Checksums**: File integrity verification with SHA256 hash display
 - **Global Settings**: Default license settings via WooCommerce settings tab
 - **WooCommerce HPOS**: Compatible with High-Performance Order Storage
 
@@ -59,13 +73,27 @@ WC Licensed Product adds a new product type "Licensed Product" to WooCommerce, e
 ### Creating a Licensed Product
 
 1. Go to Products > Add New
-2. Select "Licensed Product" from the product type dropdown
+2. Select "Licensed Product" from the product type dropdown (or "Licensed Variable Product" for different license durations)
 3. Configure the product price in the General tab
 4. Set license options in the "License Settings" tab:
    - **Max Activations**: Number of domains allowed per license
    - **License Validity**: Days until expiration (empty = lifetime)
    - **Bind to Major Version**: Lock license to current major version
 
+### Creating Variable Licensed Products
+
+For selling licenses with different durations (monthly, yearly, lifetime):
+
+1. Go to Products > Add New
+2. Select "Licensed Variable Product" from the product type dropdown
+3. Create variations as you would for any variable product (e.g., by "License Duration")
+4. For each variation, set:
+   - **Variation Price**: Different prices for different durations
+   - **License Duration (Days)**: Days until expiration (0 = lifetime)
+   - **Max Activations**: Override parent product setting if needed
+
+Duration labels (Monthly, Yearly, Lifetime) are automatically displayed at checkout.
+
 ### Managing Product Versions
 
 1. Edit a Licensed Product
@@ -77,7 +105,8 @@ WC Licensed Product adds a new product type "Licensed Product" to WooCommerce, e
 
 1. Go to WooCommerce > Settings > Licensed Products
 2. Set default values for Max Activations, License Validity, and Version Binding
-3. Per-product settings override these defaults
+3. Enable Multi-Domain Licensing to allow multiple licenses per cart item
+4. Per-product settings override these defaults
 
 ### Customer Checkout
 
@@ -103,6 +132,52 @@ When a customer purchases a licensed product, they must enter the domain where t
 3. Upload a CSV file (supports exported format or simplified format)
 4. Choose options: skip header row, update existing licenses
 
+## Security
+
+The plugin implements several security best practices:
+
+- **Input Sanitization**: All user inputs are sanitized using WordPress functions
+- **Output Escaping**: All output is escaped to prevent XSS attacks
+- **CSRF Protection**: Nonce verification on all forms and AJAX requests
+- **SQL Injection Prevention**: All database queries use prepared statements
+- **Capability Checks**: Admin functions require `manage_woocommerce` capability
+- **Secure Downloads**: File downloads use hash-verified URLs with user authentication
+- **Response Signing**: Optional HMAC-SHA256 signatures for API tamper protection
+
+### Trusted Proxy Configuration
+
+If your server is behind a load balancer, reverse proxy, or CDN (like Cloudflare), you need to configure trusted proxies for accurate rate limiting. Without this, the rate limiter uses the direct connection IP which may be your proxy's IP.
+
+**Configuration (wp-config.php):**
+
+```php
+// For Cloudflare (includes all Cloudflare IP ranges)
+define('WC_LICENSE_TRUSTED_PROXIES', 'CLOUDFLARE');
+
+// For specific proxy IPs
+define('WC_LICENSE_TRUSTED_PROXIES', '10.0.0.1,10.0.0.2');
+
+// For CIDR ranges
+define('WC_LICENSE_TRUSTED_PROXIES', '10.0.0.0/8,192.168.1.0/24');
+
+// Combine multiple methods
+define('WC_LICENSE_TRUSTED_PROXIES', 'CLOUDFLARE,10.0.0.1');
+```
+
+**Note**: Only configure trusted proxies if you actually use them. Without this configuration, rate limiting is more secure against IP spoofing attacks.
+
+### Configurable Rate Limiting
+
+The default rate limit is 30 requests per 60 seconds. You can customize this:
+
+```php
+// Requests allowed per window (default: 30)
+define('WC_LICENSE_RATE_LIMIT', 60);
+
+// Window duration in seconds (default: 60)
+define('WC_LICENSE_RATE_WINDOW', 120);
+```
+
 ## REST API
 
 Full API documentation available in `openapi.json` (OpenAPI 3.1 specification).
@@ -117,6 +192,12 @@ When the server is configured with a shared secret, all API responses include cr
 define('WC_LICENSE_SERVER_SECRET', 'your-secure-random-string-min-32-chars');
 ```
 
+Generate a secure secret using:
+
+```bash
+openssl rand -hex 32
+```
+
 **Response Headers:**
 
 | Header | Description |
@@ -126,6 +207,8 @@ define('WC_LICENSE_SERVER_SECRET', 'your-secure-random-string-min-32-chars');
 
 The signature prevents man-in-the-middle attacks and ensures response integrity. Use the `magdev/wc-licensed-product-client` Composer package with the `SecureLicenseClient` class to automatically verify signatures.
 
+**Per-License Customer Secrets**: Each customer receives a unique verification secret derived from their license key. This secret is displayed in their account page under "API Verification Secret" and can be used with the client library instead of sharing the master server secret.
+
 ### Client Libraries & Examples
 
 **PHP (Recommended):** Install the official client library via Composer:
@@ -256,11 +339,12 @@ Content-Type: application/json
 
 ## Email Notifications
 
-The plugin sends automatic email notifications:
+The plugin sends automatic email notifications (configurable via WooCommerce > Settings > Emails):
 
 - **Order Completion**: License keys included in order confirmation emails
 - **Expiration Warning (7 days)**: Reminder sent 7 days before expiration
 - **Expiration Warning (1 day)**: Urgent reminder sent 1 day before expiration
+- **License Expired**: Notification when a license auto-expires
 
 ## Changelog
 

assets/css/admin.css

@@ -50,15 +50,21 @@ code.file-hash {
     color: #666;
 }
 
-/* License Product Tab */
-#woocommerce-product-data .show_if_licensed {
-    display: block !important;
+/* License Settings Tab - Hidden by default, shown via JS based on product type */
+/* WooCommerce creates tab with class: {tab_key}_options (licensed_product_options) */
+#woocommerce-product-data ul.wc-tabs li.licensed_product_options {
+    display: none;
 }
 
-#woocommerce-product-data .hide_if_licensed {
-    display: none !important;
+/* When shown, restore proper display for tab list items */
+#woocommerce-product-data ul.wc-tabs li.licensed_product_options.wclp-active {
+    display: block;
 }
 
+/* Variations tab visibility for licensed-variable is handled by WooCommerce */
+/* We add show_if_licensed-variable class to the variations tab via PHP filter */
+
+
 /* Action Buttons */
 .wp-list-table .button-link-delete {
     color: #a00;
@@ -201,7 +207,8 @@ code.file-hash {
 }
 
 .licenses-table .row-actions {
-    visibility: visible;
+    visibility: visible !important;
+    position: static !important;
     padding: 2px 0 0;
 }
 

assets/css/frontend.css

@@ -37,13 +37,196 @@
     color: #383d41;
 }
 
-/* License Cards */
+/* License Packages */
 .woocommerce-licenses {
     display: flex;
     flex-direction: column;
     gap: 1.5em;
 }
 
+.license-package {
+    border: 1px solid #e5e5e5;
+    border-radius: 8px;
+    overflow: hidden;
+    background: #fff;
+}
+
+.package-header {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    padding: 1em 1.5em;
+    background: #f8f9fa;
+    border-bottom: 1px solid #e5e5e5;
+}
+
+.package-title {
+    display: flex;
+    flex-direction: column;
+    gap: 0.25em;
+}
+
+.package-title h3 {
+    margin: 0;
+    font-size: 1.1em;
+}
+
+.package-title h3 a {
+    color: inherit;
+    text-decoration: none;
+}
+
+.package-title h3 a:hover {
+    text-decoration: underline;
+}
+
+.package-order {
+    font-size: 0.85em;
+    color: #666;
+}
+
+.package-order a {
+    color: #2271b1;
+    text-decoration: none;
+}
+
+.package-order a:hover {
+    text-decoration: underline;
+}
+
+.package-license-count {
+    font-size: 0.9em;
+    color: #666;
+    background: #e9ecef;
+    padding: 0.3em 0.8em;
+    border-radius: 12px;
+}
+
+/* Package Licenses - Two Row Layout */
+.package-licenses {
+    padding: 0;
+}
+
+.license-entry {
+    padding: 1em 1.5em;
+    border-bottom: 1px solid #e5e5e5;
+}
+
+.license-entry:last-child {
+    border-bottom: none;
+}
+
+.license-entry:hover {
+    background-color: #fafafa;
+}
+
+.license-row-primary {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 1em;
+    margin-bottom: 0.5em;
+}
+
+.license-key-group {
+    display: flex;
+    align-items: center;
+    gap: 0.75em;
+    flex-shrink: 1;
+    min-width: 0;
+}
+
+.license-entry code.license-key {
+    font-family: 'SF Mono', Monaco, Consolas, monospace;
+    background-color: #f5f5f5;
+    padding: 0.4em 0.75em;
+    border-radius: 4px;
+    font-size: 0.95em;
+    letter-spacing: 0.03em;
+    flex-shrink: 1;
+    min-width: 0;
+    overflow: hidden;
+    text-overflow: ellipsis;
+}
+
+.license-key-group .license-status {
+    flex-shrink: 0;
+}
+
+.license-actions {
+    display: flex;
+    align-items: center;
+    gap: 0.5em;
+    flex-shrink: 0;
+}
+
+.license-row-secondary {
+    display: flex;
+    align-items: center;
+    gap: 1.5em;
+    font-size: 0.9em;
+    color: #666;
+    flex-wrap: wrap;
+}
+
+.license-meta-item {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.35em;
+}
+
+.license-meta-item .dashicons {
+    font-size: 14px;
+    width: 14px;
+    height: 14px;
+    color: #999;
+}
+
+.license-domain {
+    color: #333;
+}
+
+.license-expiry .lifetime {
+    color: #28a745;
+    font-weight: 500;
+}
+
+/* Legacy table styles (kept for backwards compatibility) */
+.licenses-table {
+    width: 100%;
+    border-collapse: collapse;
+    font-size: 0.95em;
+}
+
+.licenses-table th,
+.licenses-table td {
+    padding: 0.75em 1em;
+    text-align: left;
+    border-bottom: 1px solid #e5e5e5;
+}
+
+.licenses-table th {
+    font-weight: 600;
+    background-color: #fafafa;
+    font-size: 0.9em;
+    color: #555;
+}
+
+.licenses-table code.license-key {
+    font-family: 'SF Mono', Monaco, Consolas, monospace;
+    background-color: #f5f5f5;
+    padding: 0.3em 0.6em;
+    border-radius: 4px;
+    font-size: 0.9em;
+    letter-spacing: 0.03em;
+}
+
+.licenses-table .lifetime {
+    color: #28a745;
+    font-weight: 500;
+}
+
+/* Legacy single card styles (kept for backwards compatibility) */
 .license-card {
     border: 1px solid #e5e5e5;
     border-radius: 8px;
@@ -184,12 +367,14 @@
 }
 
 /* Download Section */
+.package-downloads,
 .license-downloads {
     padding: 1em 1.5em;
     background: #f8f9fa;
     border-top: 1px solid #e5e5e5;
 }
 
+.package-downloads h4,
 .license-downloads h4 {
     margin: 0 0 0.75em 0;
     font-size: 0.95em;
@@ -202,18 +387,30 @@
     padding: 0;
 }
 
-.download-list li {
+.download-list li.download-item {
     display: flex;
-    align-items: center;
-    gap: 1em;
-    padding: 0.5em 0;
+    flex-direction: column;
+    gap: 0.35em;
+    padding: 0.75em 0;
     border-bottom: 1px solid #eee;
 }
 
-.download-list li:last-child {
+.download-list li.download-item:last-child {
     border-bottom: none;
 }
 
+.download-row-file {
+    display: flex;
+    align-items: center;
+}
+
+.download-row-meta {
+    display: flex;
+    align-items: center;
+    gap: 1em;
+    padding-left: 1.5em;
+}
+
 .download-link {
     display: inline-flex;
     align-items: center;
@@ -244,7 +441,6 @@
 .download-date {
     color: #999;
     font-size: 0.85em;
-    margin-left: auto;
 }
 
 .download-hash {
@@ -271,6 +467,71 @@
     color: #666;
 }
 
+/* Latest version badge */
+.download-version-badge {
+    display: inline-block;
+    padding: 0.15em 0.5em;
+    margin-left: 0.5em;
+    font-size: 0.75em;
+    font-weight: 600;
+    text-transform: uppercase;
+    background: #d4edda;
+    color: #155724;
+    border-radius: 3px;
+    vertical-align: middle;
+}
+
+/* Older versions collapsible */
+.older-versions-section {
+    margin-top: 0.75em;
+    padding-top: 0.75em;
+    border-top: 1px dashed #ddd;
+}
+
+.older-versions-toggle {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.35em;
+    padding: 0.4em 0.75em;
+    background: transparent;
+    border: 1px solid #ddd;
+    border-radius: 4px;
+    font-size: 0.85em;
+    color: #666;
+    cursor: pointer;
+    transition: all 0.2s ease;
+}
+
+.older-versions-toggle:hover {
+    background: #f5f5f5;
+    border-color: #ccc;
+    color: #333;
+}
+
+.older-versions-toggle .dashicons {
+    font-size: 16px;
+    width: 16px;
+    height: 16px;
+    transition: transform 0.2s ease;
+}
+
+.older-versions-toggle[aria-expanded="true"] .dashicons {
+    transform: rotate(180deg);
+}
+
+.older-versions-list {
+    margin-top: 0.75em;
+    padding-left: 0;
+}
+
+.older-versions-list .download-item {
+    opacity: 0.85;
+}
+
+.older-versions-list .download-item:hover {
+    opacity: 1;
+}
+
 /* Domain Field */
 #licensed-product-domain-field {
     margin-top: 2em;
@@ -322,6 +583,52 @@
 
 /* Responsive */
 @media screen and (max-width: 768px) {
+    /* Package header responsive */
+    .package-header {
+        flex-direction: column;
+        align-items: flex-start;
+        gap: 0.75em;
+    }
+
+    .package-license-count {
+        align-self: flex-start;
+    }
+
+    /* License entry responsive */
+    .license-entry {
+        padding: 1em;
+    }
+
+    .license-row-primary {
+        flex-direction: column;
+        align-items: flex-start;
+        gap: 0.75em;
+    }
+
+    .license-key-group {
+        flex-direction: column;
+        align-items: flex-start;
+        gap: 0.5em;
+        width: 100%;
+    }
+
+    .license-entry code.license-key {
+        font-size: 0.85em;
+        word-break: break-all;
+        white-space: normal;
+    }
+
+    .license-actions {
+        align-self: flex-start;
+    }
+
+    .license-row-secondary {
+        flex-direction: column;
+        align-items: flex-start;
+        gap: 0.5em;
+    }
+
+    /* Legacy card layout responsive */
     .license-header {
         flex-direction: column;
         align-items: flex-start;
@@ -338,42 +645,49 @@
         gap: 0.5em;
     }
 
-    .download-list li {
+    .download-row-meta {
+        padding-left: 0;
         flex-wrap: wrap;
     }
 
-    .download-date {
-        margin-left: 0;
-        width: 100%;
-    }
-
+    /* Legacy table responsive */
     .woocommerce-licenses-table,
     .woocommerce-licenses-table thead,
     .woocommerce-licenses-table tbody,
     .woocommerce-licenses-table th,
     .woocommerce-licenses-table td,
-    .woocommerce-licenses-table tr {
+    .woocommerce-licenses-table tr,
+    .licenses-table,
+    .licenses-table thead,
+    .licenses-table tbody,
+    .licenses-table th,
+    .licenses-table td,
+    .licenses-table tr {
         display: block;
     }
 
-    .woocommerce-licenses-table thead tr {
+    .woocommerce-licenses-table thead tr,
+    .licenses-table thead tr {
         position: absolute;
         top: -9999px;
         left: -9999px;
     }
 
-    .woocommerce-licenses-table tr {
+    .woocommerce-licenses-table tr,
+    .licenses-table tr {
         border: 1px solid #e5e5e5;
         margin-bottom: 1em;
     }
 
-    .woocommerce-licenses-table td {
+    .woocommerce-licenses-table td,
+    .licenses-table td {
         border: none;
         position: relative;
         padding-left: 50%;
     }
 
-    .woocommerce-licenses-table td:before {
+    .woocommerce-licenses-table td:before,
+    .licenses-table td:before {
         content: attr(data-title);
         position: absolute;
         left: 0.75em;
@@ -528,3 +842,139 @@
     color: #721c24;
     border: 1px solid #f5c6cb;
 }
+
+/* Product Version Display (Single Product Page) */
+.wclp-product-version {
+    margin: 0.5em 0 1em 0;
+    font-size: 0.95em;
+    color: #666;
+}
+
+.wclp-product-version .version-label {
+    font-weight: 500;
+    color: #555;
+}
+
+.wclp-product-version .version-number {
+    font-family: 'SF Mono', Monaco, Consolas, monospace;
+    background: #e7f3ff;
+    padding: 0.15em 0.5em;
+    border-radius: 3px;
+    color: #2271b1;
+    font-weight: 500;
+}
+
+/* Customer Secret Section */
+.license-row-secret {
+    margin-top: 0.75em;
+    padding-top: 0.75em;
+    border-top: 1px dashed #e5e5e5;
+}
+
+.secret-toggle {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.35em;
+    padding: 0.4em 0.75em;
+    background: transparent;
+    border: 1px solid #ddd;
+    border-radius: 4px;
+    font-size: 0.85em;
+    color: #666;
+    cursor: pointer;
+    transition: all 0.2s ease;
+}
+
+.secret-toggle:hover {
+    background: #f5f5f5;
+    border-color: #ccc;
+    color: #333;
+}
+
+.secret-toggle .dashicons {
+    font-size: 14px;
+    width: 14px;
+    height: 14px;
+}
+
+.secret-toggle .toggle-arrow {
+    transition: transform 0.2s ease;
+}
+
+.secret-toggle[aria-expanded="true"] .toggle-arrow {
+    transform: rotate(180deg);
+}
+
+.secret-content {
+    margin-top: 0.75em;
+    padding: 1em;
+    background: #f8f9fa;
+    border-radius: 4px;
+    border: 1px solid #e5e5e5;
+}
+
+.secret-description {
+    margin: 0 0 0.75em 0;
+    font-size: 0.85em;
+    color: #666;
+}
+
+.secret-value-wrapper {
+    display: flex;
+    align-items: center;
+    gap: 0.5em;
+}
+
+.secret-value {
+    font-family: 'SF Mono', Monaco, Consolas, monospace;
+    font-size: 0.75em;
+    background: #fff;
+    padding: 0.5em 0.75em;
+    border: 1px solid #ddd;
+    border-radius: 4px;
+    word-break: break-all;
+    flex: 1;
+    min-width: 0;
+    overflow-x: auto;
+}
+
+.copy-secret-btn {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    width: 32px;
+    height: 32px;
+    padding: 0;
+    background: #f0f0f0;
+    border: 1px solid #ddd;
+    border-radius: 4px;
+    cursor: pointer;
+    transition: all 0.2s ease;
+    flex-shrink: 0;
+}
+
+.copy-secret-btn:hover {
+    background: #e5e5e5;
+    border-color: #ccc;
+}
+
+.copy-secret-btn .dashicons {
+    font-size: 18px;
+    width: 18px;
+    height: 18px;
+}
+
+@media screen and (max-width: 768px) {
+    .secret-value-wrapper {
+        flex-direction: column;
+        align-items: stretch;
+    }
+
+    .secret-value {
+        font-size: 0.7em;
+    }
+
+    .copy-secret-btn {
+        align-self: flex-start;
+    }
+}

assets/js/checkout-blocks.js

@@ -1,7 +1,8 @@
 /**
  * WooCommerce Checkout Blocks Integration
  *
- * Adds a domain field to the checkout block for licensed products.
+ * Adds domain fields to the checkout block for licensed products.
+ * Supports single domain mode (legacy) and multi-domain mode (per quantity).
  *
  * @package WcLicensedProduct
  */
@@ -9,92 +10,492 @@
 (function () {
     'use strict';
 
-    const { registerCheckoutBlock } = wc.blocksCheckout;
-    const { createElement, useState, useEffect } = wp.element;
+    // Check dependencies
+    if (typeof wc === 'undefined' ||
+        typeof wc.blocksCheckout === 'undefined' ||
+        typeof wc.wcSettings === 'undefined') {
+        return;
+    }
+
+    const { getSetting } = wc.wcSettings;
+    const { createElement, useState, useEffect, useCallback } = wp.element;
     const { TextControl } = wp.components;
     const { __ } = wp.i18n;
-    const { extensionCartUpdate } = wc.blocksCheckout;
-    const { getSetting } = wc.wcSettings;
 
-    // Get settings passed from PHP
+    // Get available exports from blocksCheckout
+    const { ExperimentalOrderMeta, extensionCartUpdate } = wc.blocksCheckout;
+
+    // Debounce function for API updates
+    function debounce(func, wait) {
+        let timeout;
+        return function executedFunction(...args) {
+            const later = () => {
+                clearTimeout(timeout);
+                func(...args);
+            };
+            clearTimeout(timeout);
+            timeout = setTimeout(later, wait);
+        };
+    }
+
+    // Get settings from PHP
     const settings = getSetting('wc-licensed-product_data', {});
 
+    // Check if we have licensed products
+    if (!settings.hasLicensedProducts) {
+        return;
+    }
+
     /**
      * Validate domain format
      */
     function isValidDomain(domain) {
-        if (!domain || domain.length > 255) {
-            return false;
-        }
+        if (!domain || domain.length > 255) return false;
         const pattern = /^([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/;
         return pattern.test(domain);
     }
 
     /**
-     * Normalize domain (remove protocol and www)
+     * Normalize domain
      */
     function normalizeDomain(domain) {
-        let normalized = domain.toLowerCase().trim();
-        normalized = normalized.replace(/^https?:\/\//, '');
-        normalized = normalized.replace(/^www\./, '');
-        normalized = normalized.replace(/\/.*$/, '');
-        return normalized;
+        return domain.toLowerCase().trim()
+            .replace(/^https?:\/\//, '')
+            .replace(/^www\./, '')
+            .replace(/\/.*$/, '');
     }
 
     /**
-     * License Domain Block Component
+     * Single Domain Component
      */
-    const LicenseDomainBlock = ({ checkoutExtensionData, extensions }) => {
+    const SingleDomainField = () => {
         const [domain, setDomain] = useState('');
         const [error, setError] = useState('');
-        const { setExtensionData } = checkoutExtensionData;
 
-        // Only show if cart has licensed products
-        if (!settings.hasLicensedProducts) {
-            return null;
-        }
+        // Debounced API update function
+        const updateStoreApi = useCallback(
+            debounce((normalizedDomain) => {
+                if (extensionCartUpdate) {
+                    extensionCartUpdate({
+                        namespace: 'wc-licensed-product',
+                        data: {
+                            licensed_product_domain: normalizedDomain,
+                        },
+                    }).catch(err => {
+                        console.error('[WCLP] Store API update error:', err);
+                    });
+                }
+            }, 500),
+            []
+        );
 
         const handleChange = (value) => {
             const normalized = normalizeDomain(value);
             setDomain(normalized);
 
-            // Validate
             if (normalized && !isValidDomain(normalized)) {
                 setError(settings.validationError || __('Please enter a valid domain.', 'wc-licensed-product'));
             } else {
                 setError('');
+                // Update Store API when valid
+                updateStoreApi(normalized);
             }
 
-            // Update extension data for server-side processing
-            setExtensionData('wc-licensed-product', 'licensed_product_domain', normalized);
+            // Store in hidden input for form submission (fallback)
+            const hiddenInput = document.getElementById('wclp-domain-hidden');
+            if (hiddenInput) {
+                hiddenInput.value = normalized;
+            }
         };
 
         return createElement(
             'div',
-            { className: 'wc-block-components-licensed-product-domain' },
-            createElement(
-                'h3',
-                { className: 'wc-block-components-title' },
+            {
+                className: 'wc-block-components-licensed-product-domain',
+                style: {
+                    padding: '16px',
+                    backgroundColor: '#f0f0f0',
+                    borderRadius: '4px',
+                    marginBottom: '16px',
+                }
+            },
+            createElement('h4', { style: { marginTop: 0, marginBottom: '8px' } },
                 settings.sectionTitle || __('License Domain', 'wc-licensed-product')
             ),
+            createElement('p', { style: { marginBottom: '12px', color: '#666', fontSize: '0.9em' } },
+                settings.fieldDescription || __('Enter the domain where you will use the license.', 'wc-licensed-product')
+            ),
             createElement(TextControl, {
-                label: settings.fieldLabel || __('Domain for License Activation', 'wc-licensed-product'),
+                label: settings.singleDomainLabel || __('Domain', 'wc-licensed-product'),
                 value: domain,
                 onChange: handleChange,
                 placeholder: settings.fieldPlaceholder || 'example.com',
-                help: error || settings.fieldDescription || __('Enter the domain where you will use this license.', 'wc-licensed-product'),
+                help: error || '',
                 className: error ? 'has-error' : '',
-                required: true,
+            }),
+            createElement('input', {
+                type: 'hidden',
+                id: 'wclp-domain-hidden',
+                name: 'wclp_license_domain',
+                value: domain,
             })
         );
     };
 
-    // Register the checkout block
-    registerCheckoutBlock({
-        metadata: {
-            name: 'wc-licensed-product/domain-field',
-            parent: ['woocommerce/checkout-contact-information-block'],
-        },
-        component: LicenseDomainBlock,
-    });
+    /**
+     * Get unique key for product (handles variations)
+     */
+    function getProductKey(product) {
+        if (product.variation_id && product.variation_id > 0) {
+            return `${product.product_id}_${product.variation_id}`;
+        }
+        return String(product.product_id);
+    }
+
+    /**
+     * Multi-Domain Component
+     */
+    const MultiDomainFields = () => {
+        const products = settings.licensedProducts || [];
+        const [domains, setDomains] = useState(() => {
+            const init = {};
+            products.forEach(p => {
+                const key = getProductKey(p);
+                init[key] = Array(p.quantity).fill('');
+            });
+            return init;
+        });
+        const [errors, setErrors] = useState({});
+
+        // Debounced API update function
+        const updateStoreApi = useCallback(
+            debounce((domainsData) => {
+                if (extensionCartUpdate) {
+                    extensionCartUpdate({
+                        namespace: 'wc-licensed-product',
+                        data: {
+                            licensed_product_domains: domainsData,
+                        },
+                    }).catch(err => {
+                        console.error('[WCLP] Store API update error:', err);
+                    });
+                }
+            }, 500),
+            []
+        );
+
+        if (!products.length) {
+            return null;
+        }
+
+        const handleChange = (productKey, index, value) => {
+            const normalized = normalizeDomain(value);
+            const newDomains = { ...domains };
+            if (!newDomains[productKey]) newDomains[productKey] = [];
+            newDomains[productKey] = [...newDomains[productKey]];
+            newDomains[productKey][index] = normalized;
+            setDomains(newDomains);
+
+            // Validate
+            const key = `${productKey}_${index}`;
+            const newErrors = { ...errors };
+            if (normalized && !isValidDomain(normalized)) {
+                newErrors[key] = settings.validationError || __('Please enter a valid domain.', 'wc-licensed-product');
+            } else {
+                delete newErrors[key];
+            }
+
+            // Check for duplicates within same product/variation
+            const productDomains = newDomains[productKey].filter(d => d);
+            const uniqueDomains = new Set(productDomains.map(d => normalizeDomain(d)));
+            if (productDomains.length !== uniqueDomains.size) {
+                const seen = new Set();
+                newDomains[productKey].forEach((d, idx) => {
+                    const normalizedD = normalizeDomain(d);
+                    const dupKey = `${productKey}_${idx}`;
+                    if (normalizedD && seen.has(normalizedD)) {
+                        newErrors[dupKey] = settings.duplicateError || __('Each license requires a unique domain.', 'wc-licensed-product');
+                    } else if (normalizedD) {
+                        seen.add(normalizedD);
+                    }
+                });
+            }
+
+            setErrors(newErrors);
+
+            // Build domain data for Store API
+            const data = products.map(p => {
+                const pKey = getProductKey(p);
+                const doms = newDomains[pKey] || [];
+                const entry = {
+                    product_id: p.product_id,
+                    domains: doms.filter(d => d),
+                };
+                if (p.variation_id && p.variation_id > 0) {
+                    entry.variation_id = p.variation_id;
+                }
+                return entry;
+            }).filter(item => item.domains.length > 0);
+
+            // Update Store API
+            updateStoreApi(data);
+
+            // Update hidden field (fallback)
+            const hiddenInput = document.getElementById('wclp-domains-hidden');
+            if (hiddenInput) {
+                hiddenInput.value = JSON.stringify(data);
+            }
+        };
+
+        return createElement(
+            'div',
+            {
+                className: 'wc-block-components-licensed-product-domains',
+                style: {
+                    padding: '16px',
+                    backgroundColor: '#f0f0f0',
+                    borderRadius: '4px',
+                    marginBottom: '16px',
+                }
+            },
+            createElement('h4', { style: { marginTop: 0, marginBottom: '8px' } },
+                settings.sectionTitle || __('License Domains', 'wc-licensed-product')
+            ),
+            createElement('p', { style: { marginBottom: '12px', color: '#666', fontSize: '0.9em' } },
+                settings.fieldDescription || __('Enter a unique domain for each license.', 'wc-licensed-product')
+            ),
+            products.map(product => {
+                const productKey = getProductKey(product);
+                const durationLabel = product.duration_label || '';
+                const displayName = durationLabel
+                    ? `${product.name} (${durationLabel})`
+                    : product.name;
+
+                return createElement(
+                    'div',
+                    {
+                        key: productKey,
+                        style: {
+                            marginBottom: '16px',
+                            padding: '12px',
+                            backgroundColor: '#fff',
+                            borderRadius: '4px',
+                        }
+                    },
+                    createElement('strong', { style: { display: 'block', marginBottom: '8px' } },
+                        displayName + (product.quantity > 1 ? ` ×${product.quantity}` : '')
+                    ),
+                    Array.from({ length: product.quantity }, (_, i) => {
+                        const key = `${productKey}_${i}`;
+                        return createElement(
+                            'div',
+                            { key: i, style: { marginBottom: '8px' } },
+                            createElement(TextControl, {
+                                label: (settings.licenseLabel || __('License %d:', 'wc-licensed-product')).replace('%d', i + 1),
+                                value: domains[productKey]?.[i] || '',
+                                onChange: (val) => handleChange(productKey, i, val),
+                                placeholder: settings.fieldPlaceholder || 'example.com',
+                                help: errors[key] || '',
+                            })
+                        );
+                    })
+                );
+            }),
+            createElement('input', {
+                type: 'hidden',
+                id: 'wclp-domains-hidden',
+                name: 'wclp_license_domains',
+                value: '',
+            })
+        );
+    };
+
+    /**
+     * Main License Domains Block
+     */
+    const LicenseDomainsBlock = () => {
+        if (settings.isMultiDomainEnabled) {
+            return createElement(MultiDomainFields);
+        }
+        return createElement(SingleDomainField);
+    };
+
+    // Register using ExperimentalOrderMeta slot
+    if (ExperimentalOrderMeta) {
+        const { registerPlugin } = wp.plugins || {};
+
+        if (registerPlugin) {
+            registerPlugin('wc-licensed-product-domain-fields', {
+                render: () => {
+                    return createElement(
+                        ExperimentalOrderMeta,
+                        {},
+                        createElement(LicenseDomainsBlock)
+                    );
+                },
+                scope: 'woocommerce-checkout',
+            });
+        }
+    }
+
+    // Fallback: inject into DOM directly if React approach fails
+    setTimeout(function() {
+        const existingComponent = document.querySelector('.wc-block-components-licensed-product-domain, .wc-block-components-licensed-product-domains');
+        if (existingComponent) {
+            return;
+        }
+
+        const checkoutForm = document.querySelector('.wc-block-checkout, .wc-block-checkout__form, form.checkout');
+        if (!checkoutForm) {
+            return;
+        }
+
+        const contactInfo = document.querySelector('.wc-block-checkout__contact-fields, .wp-block-woocommerce-checkout-contact-information-block');
+        const paymentMethods = document.querySelector('.wc-block-checkout__payment-method, .wp-block-woocommerce-checkout-payment-block');
+
+        let insertionPoint = contactInfo || paymentMethods;
+        if (!insertionPoint) {
+            insertionPoint = checkoutForm.querySelector('.wc-block-components-form');
+        }
+
+        if (!insertionPoint) {
+            return;
+        }
+
+        const container = document.createElement('div');
+        container.id = 'wclp-domain-fields-container';
+        container.className = 'wc-block-components-licensed-product-wrapper';
+        container.style.cssText = 'margin: 20px 0; padding: 16px; background: #f0f0f0; border-radius: 4px;';
+
+        if (settings.isMultiDomainEnabled && settings.licensedProducts) {
+            container.innerHTML = `
+                <h4 style="margin: 0 0 8px 0;">${settings.sectionTitle || 'License Domains'}</h4>
+                <p style="margin-bottom: 12px; color: #666; font-size: 0.9em;">
+                    ${settings.fieldDescription || 'Enter a unique domain for each license.'}
+                </p>
+                ${settings.licensedProducts.map(product => {
+                    const productKey = product.variation_id && product.variation_id > 0
+                        ? `${product.product_id}_${product.variation_id}`
+                        : product.product_id;
+                    const durationLabel = product.duration_label || '';
+                    const displayName = durationLabel
+                        ? `${product.name} (${durationLabel})`
+                        : product.name;
+
+                    return `
+                    <div style="margin-bottom: 16px; padding: 12px; background: #fff; border-radius: 4px;">
+                        <strong style="display: block; margin-bottom: 8px;">
+                            ${displayName}${product.quantity > 1 ? ` ×${product.quantity}` : ''}
+                        </strong>
+                        ${Array.from({ length: product.quantity }, (_, i) => `
+                            <div style="margin-bottom: 8px;">
+                                <label style="display: block; margin-bottom: 4px;">
+                                    ${(settings.licenseLabel || 'License %d:').replace('%d', i + 1)}
+                                </label>
+                                <input type="text"
+                                    name="licensed_domains[${productKey}][${i}]"
+                                    placeholder="${settings.fieldPlaceholder || 'example.com'}"
+                                    style="width: 100%; padding: 8px; border: 1px solid #ccc; border-radius: 4px;"
+                                />
+                                ${product.variation_id && product.variation_id > 0 ? `
+                                    <input type="hidden"
+                                        name="licensed_variation_ids[${productKey}]"
+                                        value="${product.variation_id}"
+                                    />
+                                ` : ''}
+                            </div>
+                        `).join('')}
+                    </div>
+                `}).join('')}
+            `;
+        } else {
+            container.innerHTML = `
+                <h4 style="margin: 0 0 8px 0;">${settings.sectionTitle || 'License Domain'}</h4>
+                <p style="margin-bottom: 12px; color: #666; font-size: 0.9em;">
+                    ${settings.fieldDescription || 'Enter the domain where you will use the license.'}
+                </p>
+                <div style="margin-bottom: 8px;">
+                    <label style="display: block; margin-bottom: 4px;">
+                        ${settings.singleDomainLabel || 'Domain'}
+                    </label>
+                    <input type="text"
+                        name="licensed_product_domain"
+                        placeholder="${settings.fieldPlaceholder || 'example.com'}"
+                        style="width: 100%; padding: 8px; border: 1px solid #ccc; border-radius: 4px;"
+                    />
+                </div>
+            `;
+        }
+
+        if (contactInfo) {
+            contactInfo.parentNode.insertBefore(container, contactInfo.nextSibling);
+        } else if (paymentMethods) {
+            paymentMethods.parentNode.insertBefore(container, paymentMethods);
+        } else {
+            insertionPoint.appendChild(container);
+        }
+
+        // Add event listeners to sync with Store API
+        const debouncedUpdate = debounce(function() {
+            if (!extensionCartUpdate) {
+                return;
+            }
+
+            if (settings.isMultiDomainEnabled && settings.licensedProducts) {
+                // Collect multi-domain data
+                const domainsData = settings.licensedProducts.map(function(product) {
+                    const productKey = product.variation_id && product.variation_id > 0
+                        ? product.product_id + '_' + product.variation_id
+                        : String(product.product_id);
+
+                    const domains = [];
+                    for (let i = 0; i < product.quantity; i++) {
+                        const input = container.querySelector('input[name="licensed_domains[' + productKey + '][' + i + ']"]');
+                        if (input && input.value.trim()) {
+                            domains.push(normalizeDomain(input.value));
+                        }
+                    }
+
+                    const entry = {
+                        product_id: product.product_id,
+                        domains: domains,
+                    };
+                    if (product.variation_id && product.variation_id > 0) {
+                        entry.variation_id = product.variation_id;
+                    }
+                    return entry;
+                }).filter(function(item) { return item.domains.length > 0; });
+
+                extensionCartUpdate({
+                    namespace: 'wc-licensed-product',
+                    data: {
+                        licensed_product_domains: domainsData,
+                    },
+                }).catch(function(err) {
+                    console.error('[WCLP] Store API update error:', err);
+                });
+            } else {
+                // Single domain
+                const input = container.querySelector('input[name="licensed_product_domain"]');
+                if (input) {
+                    const domain = normalizeDomain(input.value);
+                    extensionCartUpdate({
+                        namespace: 'wc-licensed-product',
+                        data: {
+                            licensed_product_domain: domain,
+                        },
+                    }).catch(function(err) {
+                        console.error('[WCLP] Store API update error:', err);
+                    });
+                }
+            }
+        }, 500);
+
+        // Attach event listeners to all domain inputs
+        container.querySelectorAll('input[type="text"]').forEach(function(input) {
+            input.addEventListener('input', debouncedUpdate);
+            input.addEventListener('change', debouncedUpdate);
+        });
+    }, 2000);
+
 })();

assets/js/frontend.js

@@ -19,12 +19,19 @@
 
         bindEvents: function() {
             $(document).on('click', '.copy-license-btn', this.copyLicenseKey);
+            $(document).on('click', '.copy-secret-btn', this.copySecret);
 
             // Transfer modal events
             $(document).on('click', '.wclp-transfer-btn', this.openTransferModal.bind(this));
             $(document).on('click', '.wclp-modal-close, .wclp-modal-cancel, .wclp-modal-overlay', this.closeTransferModal.bind(this));
             $(document).on('submit', '#wclp-transfer-form', this.submitTransfer.bind(this));
 
+            // Older versions toggle
+            $(document).on('click', '.older-versions-toggle', this.toggleOlderVersions);
+
+            // Secret toggle
+            $(document).on('click', '.secret-toggle', this.toggleSecret);
+
             // Close modal on escape key
             $(document).on('keyup', function(e) {
                 if (e.key === 'Escape') {
@@ -33,6 +40,61 @@
             });
         },
 
+        /**
+         * Toggle older versions visibility
+         */
+        toggleOlderVersions: function(e) {
+            e.preventDefault();
+
+            var $btn = $(this);
+            var $list = $btn.siblings('.older-versions-list');
+            var isExpanded = $btn.attr('aria-expanded') === 'true';
+
+            $btn.attr('aria-expanded', !isExpanded);
+            $list.slideToggle(200);
+        },
+
+        /**
+         * Toggle secret visibility
+         */
+        toggleSecret: function(e) {
+            e.preventDefault();
+
+            var $btn = $(this);
+            var $content = $btn.siblings('.secret-content');
+            var isExpanded = $btn.attr('aria-expanded') === 'true';
+
+            $btn.attr('aria-expanded', !isExpanded);
+            $content.slideToggle(200);
+        },
+
+        /**
+         * Copy secret to clipboard
+         */
+        copySecret: function(e) {
+            e.preventDefault();
+
+            var $btn = $(this);
+            var secret = $btn.data('secret');
+
+            if (!secret) {
+                return;
+            }
+
+            // Use modern clipboard API if available
+            if (navigator.clipboard && navigator.clipboard.writeText) {
+                navigator.clipboard.writeText(secret)
+                    .then(function() {
+                        WCLicensedProductFrontend.showCopyFeedback($btn, true);
+                    })
+                    .catch(function() {
+                        WCLicensedProductFrontend.fallbackCopy(secret, $btn);
+                    });
+            } else {
+                WCLicensedProductFrontend.fallbackCopy(secret, $btn);
+            }
+        },
+
         /**
          * Copy license key to clipboard
          */

assets/js/order-licenses.js

@@ -16,6 +16,9 @@
             // Order domain save
             $('#wclp-save-order-domain').on('click', this.saveOrderDomain.bind(this));
 
+            // Generate licenses button
+            $(document).on('click', '#wclp-generate-licenses', this.generateLicenses.bind(this));
+
             // License domain edit/save/cancel
             $(document).on('click', '.wclp-edit-domain-btn', this.startEditDomain);
             $(document).on('click', '.wclp-save-domain-btn', this.saveLicenseDomain.bind(this));
@@ -135,6 +138,54 @@
             $editBtn.show();
         },
 
+        /**
+         * Generate licenses for order
+         */
+        generateLicenses: function(e) {
+            e.preventDefault();
+
+            var $btn = $(e.currentTarget);
+            var $spinner = $btn.siblings('.spinner');
+            var $status = $btn.siblings('.wclp-generate-status');
+
+            var orderId = $btn.data('order-id');
+
+            $btn.prop('disabled', true);
+            $spinner.addClass('is-active');
+            $status.text('').removeClass('success error');
+
+            $.ajax({
+                url: wclpOrderLicenses.ajaxUrl,
+                type: 'POST',
+                data: {
+                    action: 'wclp_generate_order_licenses',
+                    nonce: wclpOrderLicenses.nonce,
+                    order_id: orderId
+                },
+                success: function(response) {
+                    if (response.success) {
+                        $status.text(response.data.message).addClass('success');
+                        if (response.data.reload) {
+                            // Reload the page after a short delay to show the new licenses
+                            setTimeout(function() {
+                                window.location.reload();
+                            }, 1500);
+                        }
+                    } else {
+                        $status.text(response.data.message || wclpOrderLicenses.strings.error).addClass('error');
+                        $btn.prop('disabled', false);
+                    }
+                },
+                error: function() {
+                    $status.text(wclpOrderLicenses.strings.error).addClass('error');
+                    $btn.prop('disabled', false);
+                },
+                complete: function() {
+                    $spinner.removeClass('is-active');
+                }
+            });
+        },
+
         /**
          * Save license domain
          */

assets/js/versions.js

@@ -174,6 +174,24 @@
             });
         },
 
+        /**
+         * Compare two semantic version strings
+         * Returns: positive if a > b, negative if a < b, 0 if equal
+         */
+        compareVersions: function(a, b) {
+            var partsA = a.split('.').map(Number);
+            var partsB = b.split('.').map(Number);
+
+            for (var i = 0; i < 3; i++) {
+                var numA = partsA[i] || 0;
+                var numB = partsB[i] || 0;
+                if (numA !== numB) {
+                    return numA - numB;
+                }
+            }
+            return 0;
+        },
+
         /**
          * Extract version from filename
          * Supports patterns like: plugin-v1.2.3.zip, plugin-1.2.3.zip, v1.2.3.zip
@@ -244,8 +262,23 @@
                             // Remove "no versions" row if present
                             $('#versions-table tbody .no-versions').remove();
 
-                            // Add new row to table
-                            $('#versions-table tbody').prepend(response.data.html);
+                            // Add new row in sorted position (by version DESC)
+                            var $newRow = $(response.data.html);
+                            var newVersion = (response.data.version && response.data.version.version) || version;
+                            var inserted = false;
+
+                            $('#versions-table tbody tr').each(function() {
+                                var rowVersion = $(this).find('td:first strong').text();
+                                if (self.compareVersions(newVersion, rowVersion) > 0) {
+                                    $newRow.insertBefore($(this));
+                                    inserted = true;
+                                    return false; // break
+                                }
+                            });
+
+                            if (!inserted) {
+                                $('#versions-table tbody').append($newRow);
+                            }
 
                             // Clear form
                             $('#new_version').val('');

composer.lock

@@ -12,7 +12,7 @@
             "source": {
                 "type": "git",
                 "url": "https://src.bundespruefstelle.ch/magdev/wc-licensed-product-client.git",
-                "reference": "83037ea0c2d9e365cf9ec0ad50251d3ebc7e4782"
+                "reference": "5e4b5a970f75d0163c5496581d963a24ade4f276"
             },
             "require": {
                 "php": "^8.3",
@@ -52,7 +52,7 @@
                 "issues": "https://src.bundespruefstelle.ch/magdev/wc-licensed-product-client/issues",
                 "source": "https://src.bundespruefstelle.ch/magdev/wc-licensed-product-client"
             },
-            "time": "2026-01-22T15:24:57+00:00"
+            "time": "2026-01-26T15:54:37+00:00"
         },
         {
             "name": "psr/cache",
@@ -380,16 +380,16 @@
         },
         {
             "name": "symfony/http-client",
-            "version": "v7.4.3",
+            "version": "v7.4.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/http-client.git",
-                "reference": "d01dfac1e0dc99f18da48b18101c23ce57929616"
+                "reference": "d63c23357d74715a589454c141c843f0172bec6c"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/http-client/zipball/d01dfac1e0dc99f18da48b18101c23ce57929616",
-                "reference": "d01dfac1e0dc99f18da48b18101c23ce57929616",
+                "url": "https://api.github.com/repos/symfony/http-client/zipball/d63c23357d74715a589454c141c843f0172bec6c",
+                "reference": "d63c23357d74715a589454c141c843f0172bec6c",
                 "shasum": ""
             },
             "require": {
@@ -457,7 +457,7 @@
                 "http"
             ],
             "support": {
-                "source": "https://github.com/symfony/http-client/tree/v7.4.3"
+                "source": "https://github.com/symfony/http-client/tree/v7.4.4"
             },
             "funding": [
                 {
@@ -477,7 +477,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2025-12-23T14:50:43+00:00"
+            "time": "2026-01-23T16:34:22+00:00"
         },
         {
             "name": "symfony/http-client-contracts",
@@ -894,16 +894,16 @@
         },
         {
             "name": "twig/twig",
-            "version": "v3.22.2",
+            "version": "v3.23.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/twigphp/Twig.git",
-                "reference": "946ddeafa3c9f4ce279d1f34051af041db0e16f2"
+                "reference": "a64dc5d2cc7d6cafb9347f6cd802d0d06d0351c9"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/twigphp/Twig/zipball/946ddeafa3c9f4ce279d1f34051af041db0e16f2",
-                "reference": "946ddeafa3c9f4ce279d1f34051af041db0e16f2",
+                "url": "https://api.github.com/repos/twigphp/Twig/zipball/a64dc5d2cc7d6cafb9347f6cd802d0d06d0351c9",
+                "reference": "a64dc5d2cc7d6cafb9347f6cd802d0d06d0351c9",
                 "shasum": ""
             },
             "require": {
@@ -957,7 +957,7 @@
             ],
             "support": {
                 "issues": "https://github.com/twigphp/Twig/issues",
-                "source": "https://github.com/twigphp/Twig/tree/v3.22.2"
+                "source": "https://github.com/twigphp/Twig/tree/v3.23.0"
             },
             "funding": [
                 {
@@ -969,7 +969,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2025-12-14T11:28:47+00:00"
+            "time": "2026-01-23T21:00:41+00:00"
         }
     ],
     "packages-dev": [],

docs/server-implementation.md

@@ -8,14 +8,16 @@ The security model works as follows:
 
 1. Server generates a unique signature for each response using HMAC-SHA256
 2. Signature includes a timestamp to prevent replay attacks
-3. Client verifies the signature using a shared secret
-4. Invalid signatures cause the client to reject the response
+3. Each license key has a unique derived secret (not the master secret)
+4. Client verifies the signature using their per-license secret
+5. Invalid signatures cause the client to reject the response
 
 This prevents attackers from:
 
 - Faking valid license responses
 - Replaying old responses
 - Tampering with response data
+- Using one customer's secret to verify another customer's responses
 
 ## Requirements
 
@@ -323,13 +325,49 @@ Adjust if needed:
 $signature = new ResponseSignature($key, timestampTolerance: 600); // 10 minutes
 ```
 
+### Per-License Secrets
+
+Each customer receives a unique secret derived from their license key. This means:
+
+- Customers only know their own secret, not the master server secret
+- If one customer's secret is leaked, other customers are not affected
+- The server uses HKDF-like derivation to create unique secrets
+
+#### How Customers Get Their Secret
+
+Customers can find their per-license verification secret in their account:
+
+1. Log in to the store
+2. Go to My Account > Licenses
+3. Click "API Verification Secret" under any license
+4. Copy the 64-character hex string
+
+This secret is automatically derived from the customer's license key and the server's master secret.
+
+#### Using the Customer Secret
+
+```php
+use Magdev\WcLicensedProductClient\SecureLicenseClient;
+use Symfony\Component\HttpClient\HttpClient;
+
+// Customer uses their per-license secret (from account page)
+$client = new SecureLicenseClient(
+    httpClient: HttpClient::create(),
+    baseUrl: 'https://shop.example.com',
+    serverSecret: 'customer-secret-from-account-page', // 64 hex chars
+);
+
+$info = $client->validate('XXXX-XXXX-XXXX-XXXX', 'example.com');
+```
+
 ### Secret Key Rotation
 
 To rotate the server secret:
 
 1. Deploy new secret to server
-2. Update client configurations
-3. Old signatures become invalid immediately
+2. All per-license secrets change automatically (they're derived)
+3. Customers must copy their new secret from their account page
+4. Old signatures become invalid immediately
 
 For zero-downtime rotation, implement versioned secrets:
 

openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "WooCommerce Licensed Product API",
     "description": "REST API for validating and managing software licenses bound to domains. This API allows external applications to validate license keys, check license status, and activate licenses on specific domains.\n\n## Response Signing (Optional)\n\nWhen the server is configured with `WC_LICENSE_SERVER_SECRET`, all API responses include cryptographic signatures for tamper protection:\n\n- `X-License-Signature`: HMAC-SHA256 signature of the response\n- `X-License-Timestamp`: Unix timestamp when the response was generated\n\nSignature verification prevents man-in-the-middle attacks and ensures response integrity. Use the `magdev/wc-licensed-product-client` library's `SecureLicenseClient` class to automatically verify signatures.",
-    "version": "0.3.2",
+    "version": "0.6.0",
     "contact": {
       "name": "Marco Graetsch",
       "url": "https://src.bundespruefstelle.ch/magdev",
@@ -332,6 +332,148 @@
           }
         }
       }
+    },
+    "/update-check": {
+      "post": {
+        "operationId": "checkForUpdates",
+        "summary": "Check for plugin updates",
+        "description": "Checks if a newer version of the licensed product is available. Returns WordPress-compatible update information that can be used to integrate with WordPress's native plugin update system.",
+        "tags": ["Plugin Updates"],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/UpdateCheckRequest"
+              },
+              "example": {
+                "license_key": "ABCD-1234-EFGH-5678",
+                "domain": "example.com",
+                "plugin_slug": "my-licensed-plugin",
+                "current_version": "1.0.0"
+              }
+            },
+            "application/x-www-form-urlencoded": {
+              "schema": {
+                "$ref": "#/components/schemas/UpdateCheckRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Update check completed successfully",
+            "headers": {
+              "X-License-Signature": {
+                "$ref": "#/components/headers/X-License-Signature"
+              },
+              "X-License-Timestamp": {
+                "$ref": "#/components/headers/X-License-Timestamp"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/UpdateCheckResponse"
+                },
+                "examples": {
+                  "update_available": {
+                    "summary": "Update is available",
+                    "value": {
+                      "success": true,
+                      "update_available": true,
+                      "version": "1.2.0",
+                      "slug": "my-licensed-plugin",
+                      "plugin": "my-licensed-plugin/my-licensed-plugin.php",
+                      "download_url": "https://example.com/license-download/123-456-abc123",
+                      "package": "https://example.com/license-download/123-456-abc123",
+                      "last_updated": "2026-01-27",
+                      "tested": "6.7",
+                      "requires": "6.0",
+                      "requires_php": "8.3",
+                      "changelog": "## 1.2.0\n- New feature added\n- Bug fixes",
+                      "package_hash": "sha256:abc123def456...",
+                      "name": "My Licensed Plugin",
+                      "homepage": "https://example.com/product/my-plugin"
+                    }
+                  },
+                  "no_update": {
+                    "summary": "No update available",
+                    "value": {
+                      "success": true,
+                      "update_available": false,
+                      "version": "1.0.0"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "License validation failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                },
+                "examples": {
+                  "license_invalid": {
+                    "summary": "License is not valid",
+                    "value": {
+                      "success": false,
+                      "update_available": false,
+                      "error": "license_invalid",
+                      "message": "License validation failed."
+                    }
+                  },
+                  "domain_mismatch": {
+                    "summary": "Domain mismatch",
+                    "value": {
+                      "success": false,
+                      "update_available": false,
+                      "error": "domain_mismatch",
+                      "message": "This license is not valid for this domain."
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "License or product not found",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                },
+                "examples": {
+                  "license_not_found": {
+                    "summary": "License not found",
+                    "value": {
+                      "success": false,
+                      "update_available": false,
+                      "error": "license_not_found",
+                      "message": "License not found."
+                    }
+                  },
+                  "product_not_found": {
+                    "summary": "Product not found",
+                    "value": {
+                      "success": false,
+                      "update_available": false,
+                      "error": "product_not_found",
+                      "message": "Licensed product not found."
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "429": {
+            "$ref": "#/components/responses/RateLimitExceeded"
+          }
+        }
+      }
     }
   },
   "components": {
@@ -516,6 +658,130 @@
             "description": "Seconds until rate limit resets"
           }
         }
+      },
+      "UpdateCheckRequest": {
+        "type": "object",
+        "required": ["license_key", "domain"],
+        "properties": {
+          "license_key": {
+            "type": "string",
+            "description": "The license key to validate (format: XXXX-XXXX-XXXX-XXXX)",
+            "maxLength": 64,
+            "example": "ABCD-1234-EFGH-5678"
+          },
+          "domain": {
+            "type": "string",
+            "description": "The domain the plugin is installed on",
+            "maxLength": 255,
+            "example": "example.com"
+          },
+          "plugin_slug": {
+            "type": "string",
+            "description": "The plugin slug (optional, for identification)",
+            "example": "my-licensed-plugin"
+          },
+          "current_version": {
+            "type": "string",
+            "description": "Currently installed version for comparison",
+            "example": "1.0.0"
+          }
+        }
+      },
+      "UpdateCheckResponse": {
+        "type": "object",
+        "properties": {
+          "success": {
+            "type": "boolean",
+            "description": "Whether the request was successful"
+          },
+          "update_available": {
+            "type": "boolean",
+            "description": "Whether an update is available"
+          },
+          "version": {
+            "type": "string",
+            "description": "Latest available version"
+          },
+          "slug": {
+            "type": "string",
+            "description": "Plugin slug for WordPress"
+          },
+          "plugin": {
+            "type": "string",
+            "description": "Plugin basename (slug/slug.php)"
+          },
+          "download_url": {
+            "type": "string",
+            "format": "uri",
+            "description": "Secure download URL for the update package"
+          },
+          "package": {
+            "type": "string",
+            "format": "uri",
+            "description": "Alias for download_url (WordPress compatibility)"
+          },
+          "last_updated": {
+            "type": "string",
+            "format": "date",
+            "description": "Date of the latest release"
+          },
+          "tested": {
+            "type": "string",
+            "description": "Highest WordPress version tested with"
+          },
+          "requires": {
+            "type": "string",
+            "description": "Minimum required WordPress version"
+          },
+          "requires_php": {
+            "type": "string",
+            "description": "Minimum required PHP version"
+          },
+          "changelog": {
+            "type": "string",
+            "description": "Release notes/changelog for the update"
+          },
+          "package_hash": {
+            "type": "string",
+            "description": "SHA256 hash of the package for integrity verification",
+            "example": "sha256:abc123..."
+          },
+          "name": {
+            "type": "string",
+            "description": "Product name"
+          },
+          "homepage": {
+            "type": "string",
+            "format": "uri",
+            "description": "Product homepage URL"
+          },
+          "icons": {
+            "type": "object",
+            "description": "Plugin icons for WordPress admin",
+            "properties": {
+              "1x": {
+                "type": "string",
+                "format": "uri"
+              },
+              "2x": {
+                "type": "string",
+                "format": "uri"
+              }
+            }
+          },
+          "sections": {
+            "type": "object",
+            "description": "Content sections for plugin info modal",
+            "properties": {
+              "description": {
+                "type": "string"
+              },
+              "changelog": {
+                "type": "string"
+              }
+            }
+          }
+        }
       }
     },
     "responses": {
@@ -577,6 +843,10 @@
     {
       "name": "License Activation",
       "description": "Activate licenses on domains"
+    },
+    {
+      "name": "Plugin Updates",
+      "description": "Check for plugin updates via WordPress-compatible API"
     }
   ]
 }

releases/wc-licensed-product-0.3.3.sha256

@@ -0,0 +1 @@
+a06d29eabc2da08613ae13874ed152b8ea9363b8284a2e9bdda414e32777558c  wc-licensed-product-0.3.3.zip

releases/wc-licensed-product-0.3.4.sha256

@@ -0,0 +1 @@
+36a81c00eb03adf5dfa633891664d44b7e5225bf1ee594904f8acc9adec6bb47  releases/wc-licensed-product-0.3.4.zip

releases/wc-licensed-product-0.3.7.zip.sha256

@@ -0,0 +1 @@
+e93b2ab06f6d43c2179167090e07eda5db6809df6e391baece4ceba321cf33f6  wc-licensed-product-0.3.7.zip

releases/wc-licensed-product-0.3.9.zip.sha256

@@ -0,0 +1 @@
+fdb65200c368da380df0cabb3c6ac6419d5b4731cd528f630f9b432a3ba5c586  releases/wc-licensed-product-0.3.9.zip

releases/wc-licensed-product-0.4.0.zip.sha256

@@ -0,0 +1 @@
+cf8769c861d77c327f178049d5fac0d4e47679cc1a1d35c5b613e4cd3fb8674f  wc-licensed-product-0.4.0.zip

releases/wc-licensed-product-0.5.0.zip.sha256

@@ -0,0 +1 @@
+446804948e5f99d705b548061d5b78180856984c58458640a910ada8f27f5316  wc-licensed-product-0.5.0.zip

releases/wc-licensed-product-0.5.1.zip.sha256

@@ -0,0 +1 @@
+a489f0b8cfcd7d5d9b2021b7ff581b9f1a56468dfde87bbb06bb4555d11f7556  wc-licensed-product-0.5.1.zip

releases/wc-licensed-product-0.5.10.zip.sha256

@@ -0,0 +1 @@
+2bbc0655f724e201367247f0e40974ddce6d7c559987e661f2b06b43294fc99f  wc-licensed-product-0.5.10.zip

releases/wc-licensed-product-0.5.11.zip.sha256

@@ -0,0 +1 @@
+32571178bfa8f0d0a03ed05b498d5f9b3c860104393a96732e86a03b6de298d2  wc-licensed-product-0.5.11.zip

releases/wc-licensed-product-0.5.12.sha256

@@ -0,0 +1 @@
+20bb5cd453de9bca781864430ebd152c82f660b6f9fc3f09107ba03489a71d75  /home/magdev/workspaces/php/wordpress/wp-content/plugins/wc-licensed-product/releases/wc-licensed-product-0.5.12.zip

releases/wc-licensed-product-0.5.13.zip.sha256

@@ -0,0 +1 @@
+814710ad899529d0015494e4b332eace7d8e55aeda381fdf61f99274c0bf910c  wc-licensed-product-0.5.13.zip

releases/wc-licensed-product-0.5.15.sha256

@@ -0,0 +1 @@
+47407de49bae4c649644af64e87b44b32fb30eeb2d50890ff8c4bbb741059278  wc-licensed-product-0.5.15.zip

releases/wc-licensed-product-0.5.3.zip.sha256

@@ -0,0 +1 @@
+bbd0fa8888c6990a4ba00ccfb8b2189ee6ac529a34cc11a5d8d8d28518b1f6dd  wc-licensed-product-0.5.3.zip

releases/wc-licensed-product-0.5.5.zip.sha256

@@ -0,0 +1 @@
+8c37e1c68eb6031c37d35adc516a492abdbea8498bdc3e3fc7d93eda380a4fe0  wc-licensed-product-0.5.5.zip

releases/wc-licensed-product-0.5.6.zip.sha256

@@ -0,0 +1 @@
+4d35a319fe4cb4e7055bae17fc030487ca05e5e9ac905f76d0ac62002bde4336  releases/wc-licensed-product-0.5.6.zip

releases/wc-licensed-product-0.5.7.zip.sha256

@@ -0,0 +1 @@
+ceb4d57598f576f4f172153ff80df8c180ecd4dca873cf109327fc5ac718930f  wc-licensed-product-0.5.7.zip

releases/wc-licensed-product-0.5.8.zip.sha256

@@ -0,0 +1 @@
+670c2f5182ea7140ccf9533c2b4179daf7890019a244973f467f2a5c7622b9f4  wc-licensed-product-0.5.8.zip

releases/wc-licensed-product-0.5.9.zip.sha256

@@ -0,0 +1 @@
+fae77dab56cb8f46693cf44fe6a1dc38ad0526d881cab2cd1f0878b234afaa8b  wc-licensed-product-0.5.9.zip

src/Admin/AdminController.php

@@ -572,6 +572,11 @@ final class AdminController
      */
     private function handleCsvExport(): void
     {
+        // Verify nonce for CSRF protection
+        if (!wp_verify_nonce($_GET['_wpnonce'] ?? '', 'export_licenses_csv')) {
+            wp_die(__('Security check failed.', 'wc-licensed-product'));
+        }
+
         if (!current_user_can('manage_woocommerce')) {
             wp_die(__('You do not have permission to export licenses.', 'wc-licensed-product'));
         }
@@ -954,7 +959,7 @@ final class AdminController
                             <span class="dashicons dashicons-admin-network"></span>
                             <?php esc_html_e('Manage Licenses', 'wc-licensed-product'); ?>
                         </a>
-                        <a href="<?php echo esc_url(admin_url('admin.php?page=wc-licenses&action=export_csv')); ?>" class="button">
+                        <a href="<?php echo esc_url(wp_nonce_url(admin_url('admin.php?page=wc-licenses&action=export_csv'), 'export_licenses_csv')); ?>" class="button">
                             <span class="dashicons dashicons-download"></span>
                             <?php esc_html_e('Export to CSV', 'wc-licensed-product'); ?>
                         </a>
@@ -1048,6 +1053,12 @@ final class AdminController
         $this->twig->addFunction(new \Twig\TwigFunction('transfer_nonce', function (): string {
             return wp_create_nonce('transfer_license');
         }));
+        $this->twig->addFunction(new \Twig\TwigFunction('export_csv_url', function (): string {
+            return wp_nonce_url(
+                admin_url('admin.php?page=wc-licenses&action=export_csv'),
+                'export_licenses_csv'
+            );
+        }));
 
         try {
             echo $this->twig->render('admin/licenses.html.twig', [
@@ -1187,7 +1198,7 @@ final class AdminController
         ?>
         <div class="wrap">
             <h1 class="wp-heading-inline"><?php esc_html_e('Licenses', 'wc-licensed-product'); ?></h1>
-            <a href="<?php echo esc_url(admin_url('admin.php?page=wc-licenses&action=export_csv')); ?>" class="page-title-action">
+            <a href="<?php echo esc_url(wp_nonce_url(admin_url('admin.php?page=wc-licenses&action=export_csv'), 'export_licenses_csv')); ?>" class="page-title-action">
                 <span class="dashicons dashicons-download" style="vertical-align: middle;"></span>
                 <?php esc_html_e('Export CSV', 'wc-licensed-product'); ?>
             </a>

src/Admin/DashboardWidgetController.php

@@ -0,0 +1,147 @@
+<?php
+/**
+ * Dashboard Widget Controller
+ *
+ * @package Jeremias\WcLicensedProduct\Admin
+ */
+
+declare(strict_types=1);
+
+namespace Jeremias\WcLicensedProduct\Admin;
+
+use Jeremias\WcLicensedProduct\License\License;
+use Jeremias\WcLicensedProduct\License\LicenseManager;
+
+/**
+ * Handles the WordPress admin dashboard widget for license statistics
+ */
+final class DashboardWidgetController
+{
+    private LicenseManager $licenseManager;
+
+    public function __construct(LicenseManager $licenseManager)
+    {
+        $this->licenseManager = $licenseManager;
+        $this->registerHooks();
+    }
+
+    /**
+     * Register WordPress hooks
+     */
+    private function registerHooks(): void
+    {
+        add_action('wp_dashboard_setup', [$this, 'registerDashboardWidget']);
+    }
+
+    /**
+     * Register the dashboard widget
+     */
+    public function registerDashboardWidget(): void
+    {
+        if (!current_user_can('manage_woocommerce')) {
+            return;
+        }
+
+        wp_add_dashboard_widget(
+            'wclp_license_statistics',
+            __('License Statistics', 'wc-licensed-product'),
+            [$this, 'renderWidget']
+        );
+    }
+
+    /**
+     * Render the dashboard widget content
+     */
+    public function renderWidget(): void
+    {
+        $stats = $this->licenseManager->getStatistics();
+        $licensesUrl = admin_url('admin.php?page=wc-licenses');
+        ?>
+        <style>
+            .wclp-widget-stats {
+                display: grid;
+                grid-template-columns: repeat(2, 1fr);
+                gap: 12px;
+                margin-bottom: 16px;
+            }
+            .wclp-stat-card {
+                background: #f8f9fa;
+                border: 1px solid #e2e4e7;
+                border-radius: 4px;
+                padding: 12px;
+                text-align: center;
+            }
+            .wclp-stat-card.highlight {
+                border-left: 3px solid #7f54b3;
+            }
+            .wclp-stat-card.warning {
+                border-left: 3px solid #f0b849;
+            }
+            .wclp-stat-card.danger {
+                border-left: 3px solid #dc3232;
+            }
+            .wclp-stat-card.success {
+                border-left: 3px solid #46b450;
+            }
+            .wclp-stat-number {
+                font-size: 28px;
+                font-weight: 600;
+                color: #1d2327;
+                line-height: 1.2;
+            }
+            .wclp-stat-label {
+                font-size: 12px;
+                color: #646970;
+                text-transform: uppercase;
+                letter-spacing: 0.5px;
+                margin-top: 4px;
+            }
+            .wclp-widget-footer {
+                margin-top: 16px;
+                padding-top: 12px;
+                border-top: 1px solid #e2e4e7;
+                text-align: center;
+            }
+            .wclp-widget-footer a {
+                text-decoration: none;
+            }
+        </style>
+
+        <div class="wclp-widget-stats">
+            <div class="wclp-stat-card highlight">
+                <div class="wclp-stat-number"><?php echo esc_html(number_format_i18n($stats['total'])); ?></div>
+                <div class="wclp-stat-label"><?php esc_html_e('Total Licenses', 'wc-licensed-product'); ?></div>
+            </div>
+            <div class="wclp-stat-card success">
+                <div class="wclp-stat-number"><?php echo esc_html(number_format_i18n($stats['by_status'][License::STATUS_ACTIVE])); ?></div>
+                <div class="wclp-stat-label"><?php esc_html_e('Active', 'wc-licensed-product'); ?></div>
+            </div>
+            <div class="wclp-stat-card warning">
+                <div class="wclp-stat-number"><?php echo esc_html(number_format_i18n($stats['expiring_soon'])); ?></div>
+                <div class="wclp-stat-label"><?php esc_html_e('Expiring Soon', 'wc-licensed-product'); ?></div>
+            </div>
+            <div class="wclp-stat-card danger">
+                <div class="wclp-stat-number"><?php echo esc_html(number_format_i18n($stats['by_status'][License::STATUS_EXPIRED])); ?></div>
+                <div class="wclp-stat-label"><?php esc_html_e('Expired', 'wc-licensed-product'); ?></div>
+            </div>
+        </div>
+
+        <div class="wclp-widget-stats">
+            <div class="wclp-stat-card">
+                <div class="wclp-stat-number"><?php echo esc_html(number_format_i18n($stats['expiring'])); ?></div>
+                <div class="wclp-stat-label"><?php esc_html_e('Time-limited', 'wc-licensed-product'); ?></div>
+            </div>
+            <div class="wclp-stat-card">
+                <div class="wclp-stat-number"><?php echo esc_html(number_format_i18n($stats['lifetime'])); ?></div>
+                <div class="wclp-stat-label"><?php esc_html_e('Lifetime', 'wc-licensed-product'); ?></div>
+            </div>
+        </div>
+
+        <div class="wclp-widget-footer">
+            <a href="<?php echo esc_url($licensesUrl); ?>" class="button button-secondary">
+                <?php esc_html_e('View All Licenses', 'wc-licensed-product'); ?>
+            </a>
+        </div>
+        <?php
+    }
+}

src/Admin/DownloadWidgetController.php

@@ -0,0 +1,184 @@
+<?php
+/**
+ * Download Statistics Widget Controller
+ *
+ * @package Jeremias\WcLicensedProduct\Admin
+ */
+
+declare(strict_types=1);
+
+namespace Jeremias\WcLicensedProduct\Admin;
+
+use Jeremias\WcLicensedProduct\Product\VersionManager;
+
+/**
+ * Handles the WordPress admin dashboard widget for download statistics
+ */
+final class DownloadWidgetController
+{
+    private VersionManager $versionManager;
+
+    public function __construct(VersionManager $versionManager)
+    {
+        $this->versionManager = $versionManager;
+        $this->registerHooks();
+    }
+
+    /**
+     * Register WordPress hooks
+     */
+    private function registerHooks(): void
+    {
+        add_action('wp_dashboard_setup', [$this, 'registerDashboardWidget']);
+    }
+
+    /**
+     * Register the dashboard widget
+     */
+    public function registerDashboardWidget(): void
+    {
+        if (!current_user_can('manage_woocommerce')) {
+            return;
+        }
+
+        wp_add_dashboard_widget(
+            'wclp_download_statistics',
+            __('Download Statistics', 'wc-licensed-product'),
+            [$this, 'renderWidget']
+        );
+    }
+
+    /**
+     * Render the dashboard widget content
+     */
+    public function renderWidget(): void
+    {
+        $stats = $this->versionManager->getDownloadStatistics();
+        ?>
+        <style>
+            .wclp-download-widget-stats {
+                display: grid;
+                grid-template-columns: 1fr;
+                gap: 12px;
+                margin-bottom: 16px;
+            }
+            .wclp-download-stat-card {
+                background: #f8f9fa;
+                border: 1px solid #e2e4e7;
+                border-radius: 4px;
+                padding: 12px;
+                text-align: center;
+                border-left: 3px solid #2271b1;
+            }
+            .wclp-download-stat-number {
+                font-size: 32px;
+                font-weight: 600;
+                color: #1d2327;
+                line-height: 1.2;
+            }
+            .wclp-download-stat-label {
+                font-size: 12px;
+                color: #646970;
+                text-transform: uppercase;
+                letter-spacing: 0.5px;
+                margin-top: 4px;
+            }
+            .wclp-download-list {
+                margin: 0;
+                padding: 0;
+                list-style: none;
+            }
+            .wclp-download-list li {
+                display: flex;
+                justify-content: space-between;
+                align-items: center;
+                padding: 8px 0;
+                border-bottom: 1px solid #e2e4e7;
+            }
+            .wclp-download-list li:last-child {
+                border-bottom: none;
+            }
+            .wclp-download-list .product-name {
+                font-weight: 500;
+                color: #1d2327;
+                flex: 1;
+                overflow: hidden;
+                text-overflow: ellipsis;
+                white-space: nowrap;
+                margin-right: 12px;
+            }
+            .wclp-download-list .version-info {
+                font-size: 12px;
+                color: #646970;
+            }
+            .wclp-download-list .download-count {
+                background: #e7f5ff;
+                color: #0a4b78;
+                padding: 2px 8px;
+                border-radius: 10px;
+                font-size: 12px;
+                font-weight: 600;
+                white-space: nowrap;
+            }
+            .wclp-download-section-title {
+                margin: 16px 0 8px 0;
+                font-size: 13px;
+                color: #1d2327;
+                font-weight: 600;
+            }
+            .wclp-no-downloads {
+                color: #646970;
+                font-style: italic;
+                text-align: center;
+                padding: 12px 0;
+            }
+        </style>
+
+        <div class="wclp-download-widget-stats">
+            <div class="wclp-download-stat-card">
+                <div class="wclp-download-stat-number"><?php echo esc_html(number_format_i18n($stats['total'])); ?></div>
+                <div class="wclp-download-stat-label"><?php esc_html_e('Total Downloads', 'wc-licensed-product'); ?></div>
+            </div>
+        </div>
+
+        <h4 class="wclp-download-section-title">
+            <?php esc_html_e('Top Products', 'wc-licensed-product'); ?>
+        </h4>
+        <?php if (!empty($stats['by_product'])): ?>
+            <ul class="wclp-download-list">
+                <?php foreach (array_slice($stats['by_product'], 0, 5) as $product): ?>
+                    <li>
+                        <span class="product-name"><?php echo esc_html($product['product_name']); ?></span>
+                        <span class="download-count">
+                            <?php echo esc_html(number_format_i18n($product['downloads'])); ?>
+                        </span>
+                    </li>
+                <?php endforeach; ?>
+            </ul>
+        <?php else: ?>
+            <p class="wclp-no-downloads"><?php esc_html_e('No downloads yet', 'wc-licensed-product'); ?></p>
+        <?php endif; ?>
+
+        <h4 class="wclp-download-section-title">
+            <?php esc_html_e('Top Versions', 'wc-licensed-product'); ?>
+        </h4>
+        <?php if (!empty($stats['by_version'])): ?>
+            <ul class="wclp-download-list">
+                <?php foreach (array_slice($stats['by_version'], 0, 5) as $version): ?>
+                    <li>
+                        <span class="product-name">
+                            <?php echo esc_html($version['product_name']); ?>
+                            <span class="version-info">v<?php echo esc_html($version['version']); ?></span>
+                        </span>
+                        <span class="download-count">
+                            <?php echo esc_html(number_format_i18n($version['downloads'])); ?>
+                        </span>
+                    </li>
+                <?php endforeach; ?>
+            </ul>
+        <?php else: ?>
+            <p class="wclp-no-downloads"><?php esc_html_e('No downloads yet', 'wc-licensed-product'); ?></p>
+        <?php endif; ?>
+        <?php
+    }
+}

src/Admin/OrderLicenseController.php

@@ -36,6 +36,7 @@ final class OrderLicenseController
         // Handle AJAX actions
         add_action('wp_ajax_wclp_update_order_domain', [$this, 'ajaxUpdateOrderDomain']);
         add_action('wp_ajax_wclp_update_license_domain', [$this, 'ajaxUpdateLicenseDomain']);
+        add_action('wp_ajax_wclp_generate_order_licenses', [$this, 'ajaxGenerateOrderLicenses']);
 
         // Enqueue admin scripts
         add_action('admin_enqueue_scripts', [$this, 'enqueueScripts']);
@@ -82,7 +83,7 @@ final class OrderLicenseController
         $hasLicensedProduct = false;
         foreach ($order->get_items() as $item) {
             $product = $item->get_product();
-            if ($product && $product->is_type('licensed')) {
+            if ($product && $this->licenseManager->isLicensedProduct($product)) {
                 $hasLicensedProduct = true;
                 break;
             }
@@ -93,8 +94,10 @@ final class OrderLicenseController
             return;
         }
 
-        // Get order domain
-        $orderDomain = $order->get_meta('_licensed_product_domain');
+        // Check for multi-domain format first, then fall back to legacy single domain
+        $multiDomainData = $order->get_meta('_licensed_product_domains');
+        $legacyDomain = $order->get_meta('_licensed_product_domain');
+        $hasMultiDomain = !empty($multiDomainData) && is_array($multiDomainData);
 
         // Get licenses for this order
         $licenses = $this->licenseManager->getLicensesByOrder($order->get_id());
@@ -103,29 +106,71 @@ final class OrderLicenseController
         ?>
         <div class="wclp-order-licenses">
             <div class="wclp-order-domain-section">
-                <h4><?php esc_html_e('Order Domain', 'wc-licensed-product'); ?></h4>
-                <p class="description">
-                    <?php esc_html_e('The domain specified during checkout. Changing this will not automatically update existing license domains.', 'wc-licensed-product'); ?>
-                </p>
-                <div class="wclp-inline-edit">
-                    <input type="text"
-                           id="wclp-order-domain"
-                           class="regular-text"
-                           value="<?php echo esc_attr($orderDomain); ?>"
-                           data-order-id="<?php echo esc_attr($order->get_id()); ?>"
-                           placeholder="<?php esc_attr_e('example.com', 'wc-licensed-product'); ?>" />
-                    <button type="button" class="button" id="wclp-save-order-domain">
-                        <?php esc_html_e('Save', 'wc-licensed-product'); ?>
-                    </button>
-                    <span class="spinner"></span>
-                    <span class="wclp-status-message"></span>
-                </div>
+                <h4><?php esc_html_e('Order Domains', 'wc-licensed-product'); ?></h4>
+
+                <?php if ($hasMultiDomain): ?>
+                    <p class="description">
+                        <?php esc_html_e('Domains specified during checkout (multi-domain order).', 'wc-licensed-product'); ?>
+                    </p>
+                    <div class="wclp-multi-domain-display" style="margin-top: 10px;">
+                        <?php foreach ($multiDomainData as $item): ?>
+                            <?php
+                            $product = wc_get_product($item['product_id']);
+                            $productName = $product ? $product->get_name() : __('Unknown Product', 'wc-licensed-product');
+                            ?>
+                            <div class="wclp-product-domains-item" style="margin-bottom: 10px; padding: 10px; background: #f8f8f8; border-radius: 4px;">
+                                <strong><?php echo esc_html($productName); ?>:</strong><br>
+                                <code><?php echo esc_html(implode(', ', $item['domains'])); ?></code>
+                            </div>
+                        <?php endforeach; ?>
+                    </div>
+                <?php else: ?>
+                    <p class="description">
+                        <?php esc_html_e('The domain specified during checkout. Changing this will not automatically update existing license domains.', 'wc-licensed-product'); ?>
+                    </p>
+                    <div class="wclp-inline-edit">
+                        <input type="text"
+                               id="wclp-order-domain"
+                               class="regular-text"
+                               value="<?php echo esc_attr($legacyDomain); ?>"
+                               data-order-id="<?php echo esc_attr($order->get_id()); ?>"
+                               placeholder="<?php esc_attr_e('example.com', 'wc-licensed-product'); ?>" />
+                        <button type="button" class="button" id="wclp-save-order-domain">
+                            <?php esc_html_e('Save', 'wc-licensed-product'); ?>
+                        </button>
+                        <span class="spinner"></span>
+                        <span class="wclp-status-message"></span>
+                    </div>
+                <?php endif; ?>
             </div>
 
             <hr />
 
             <h4><?php esc_html_e('Licenses', 'wc-licensed-product'); ?></h4>
 
+            <?php
+            // Count expected licenses based on domain data
+            $expectedLicenses = 0;
+            if ($hasMultiDomain) {
+                // Multi-domain: count total domains across all products
+                foreach ($multiDomainData as $item) {
+                    if (isset($item['domains']) && is_array($item['domains'])) {
+                        $expectedLicenses += count($item['domains']);
+                    }
+                }
+            } else {
+                // Legacy: one license per licensed product
+                foreach ($order->get_items() as $item) {
+                    $product = $item->get_product();
+                    if ($product && $this->licenseManager->isLicensedProduct($product)) {
+                        $expectedLicenses++;
+                    }
+                }
+            }
+            $missingLicenses = $expectedLicenses - count($licenses);
+            $hasDomainData = $hasMultiDomain || !empty($legacyDomain);
+            ?>
+
             <?php if (empty($licenses)): ?>
                 <p class="description">
                     <?php esc_html_e('No licenses have been generated for this order yet.', 'wc-licensed-product'); ?>
@@ -137,6 +182,20 @@ final class OrderLicenseController
                         <em><?php esc_html_e('Licenses will be generated when the order is marked as paid/completed.', 'wc-licensed-product'); ?></em>
                     <?php endif; ?>
                 </p>
+                <?php if ($hasDomainData && $order->is_paid()): ?>
+                    <p style="margin-top: 10px;">
+                        <button type="button" class="button button-primary" id="wclp-generate-licenses" data-order-id="<?php echo esc_attr($order->get_id()); ?>">
+                            <?php esc_html_e('Generate Licenses', 'wc-licensed-product'); ?>
+                        </button>
+                        <span class="spinner" style="float: none; margin-top: 4px;"></span>
+                        <span class="wclp-generate-status"></span>
+                    </p>
+                <?php elseif (!$hasDomainData): ?>
+                    <p class="description" style="margin-top: 10px; color: #d63638;">
+                        <span class="dashicons dashicons-warning"></span>
+                        <?php esc_html_e('Please set the order domain above before generating licenses.', 'wc-licensed-product'); ?>
+                    </p>
+                <?php endif; ?>
             <?php else: ?>
                 <table class="widefat striped wclp-licenses-table">
                     <thead>
@@ -223,6 +282,29 @@ final class OrderLicenseController
                     );
                     ?>
                 </p>
+
+                <?php if ($missingLicenses > 0 && $hasDomainData && $order->is_paid()): ?>
+                    <p style="margin-top: 10px;">
+                        <span class="dashicons dashicons-warning" style="color: #dba617;"></span>
+                        <?php
+                        printf(
+                            /* translators: %d: Number of missing licenses */
+                            esc_html(_n(
+                                '%d licensed product is missing a license.',
+                                '%d licensed products are missing licenses.',
+                                $missingLicenses,
+                                'wc-licensed-product'
+                            )),
+                            $missingLicenses
+                        );
+                        ?>
+                        <button type="button" class="button" id="wclp-generate-licenses" data-order-id="<?php echo esc_attr($order->get_id()); ?>">
+                            <?php esc_html_e('Generate Missing Licenses', 'wc-licensed-product'); ?>
+                        </button>
+                        <span class="spinner" style="float: none; margin-top: 4px;"></span>
+                        <span class="wclp-generate-status"></span>
+                    </p>
+                <?php endif; ?>
             <?php endif; ?>
         </div>
 
@@ -248,6 +330,9 @@ final class OrderLicenseController
             .wclp-lifetime { color: #0073aa; font-weight: 500; }
             .wclp-edit-domain-btn { color: #0073aa; text-decoration: none; }
             .wclp-edit-domain-btn .dashicons { font-size: 16px; width: 16px; height: 16px; }
+            .wclp-generate-status { font-style: italic; margin-left: 8px; }
+            .wclp-generate-status.success { color: #46b450; }
+            .wclp-generate-status.error { color: #dc3232; }
         </style>
         <?php
     }
@@ -284,8 +369,9 @@ final class OrderLicenseController
             'strings' => [
                 'saving' => __('Saving...', 'wc-licensed-product'),
                 'saved' => __('Saved!', 'wc-licensed-product'),
-                'error' => __('Error saving. Please try again.', 'wc-licensed-product'),
+                'error' => __('Error. Please try again.', 'wc-licensed-product'),
                 'invalidDomain' => __('Please enter a valid domain.', 'wc-licensed-product'),
+                'generating' => __('Generating...', 'wc-licensed-product'),
             ],
         ]);
     }
@@ -392,4 +478,166 @@ final class OrderLicenseController
         $pattern = '/^([a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/';
         return (bool) preg_match($pattern, $domain);
     }
+
+    /**
+     * AJAX handler for generating order licenses
+     */
+    public function ajaxGenerateOrderLicenses(): void
+    {
+        check_ajax_referer('wclp_order_license_actions', 'nonce');
+
+        if (!current_user_can('manage_woocommerce')) {
+            wp_send_json_error(['message' => __('Permission denied.', 'wc-licensed-product')]);
+        }
+
+        $orderId = absint($_POST['order_id'] ?? 0);
+
+        if (!$orderId) {
+            wp_send_json_error(['message' => __('Invalid order ID.', 'wc-licensed-product')]);
+        }
+
+        $order = wc_get_order($orderId);
+        if (!$order) {
+            wp_send_json_error(['message' => __('Order not found.', 'wc-licensed-product')]);
+        }
+
+        // Check if order is paid
+        if (!$order->is_paid()) {
+            wp_send_json_error(['message' => __('Order must be paid before licenses can be generated.', 'wc-licensed-product')]);
+        }
+
+        // Check for multi-domain format first
+        $multiDomainData = $order->get_meta('_licensed_product_domains');
+        $legacyDomain = $order->get_meta('_licensed_product_domain');
+
+        if (!empty($multiDomainData) && is_array($multiDomainData)) {
+            // Multi-domain format
+            $result = $this->generateMultiDomainLicenses($order, $multiDomainData);
+        } elseif (!empty($legacyDomain)) {
+            // Legacy single domain format
+            $result = $this->generateLegacyLicenses($order, $legacyDomain);
+        } else {
+            wp_send_json_error(['message' => __('Please set the order domain before generating licenses.', 'wc-licensed-product')]);
+            return;
+        }
+
+        if ($result['generated'] > 0) {
+            wp_send_json_success([
+                'message' => sprintf(
+                    /* translators: %d: Number of licenses generated */
+                    _n(
+                        '%d license generated successfully.',
+                        '%d licenses generated successfully.',
+                        $result['generated'],
+                        'wc-licensed-product'
+                    ),
+                    $result['generated']
+                ),
+                'generated' => $result['generated'],
+                'skipped' => $result['skipped'],
+                'reload' => true,
+            ]);
+        } else {
+            wp_send_json_success([
+                'message' => __('All licenses already exist for this order.', 'wc-licensed-product'),
+                'generated' => 0,
+                'skipped' => $result['skipped'],
+                'reload' => false,
+            ]);
+        }
+    }
+
+    /**
+     * Generate licenses for multi-domain format
+     */
+    private function generateMultiDomainLicenses(\WC_Order $order, array $domainData): array
+    {
+        $generated = 0;
+        $skipped = 0;
+        $orderId = $order->get_id();
+        $customerId = $order->get_customer_id();
+
+        // Index domains by product ID
+        $domainsByProduct = [];
+        foreach ($domainData as $item) {
+            if (isset($item['product_id']) && isset($item['domains']) && is_array($item['domains'])) {
+                $domainsByProduct[(int) $item['product_id']] = $item['domains'];
+            }
+        }
+
+        foreach ($order->get_items() as $item) {
+            $product = $item->get_product();
+            if (!$product || !$this->licenseManager->isLicensedProduct($product)) {
+                continue;
+            }
+
+            $productId = $product->get_id();
+            $domains = $domainsByProduct[$productId] ?? [];
+
+            // Get existing licenses for this product
+            $existingLicenses = $this->licenseManager->getLicensesByOrderAndProduct($orderId, $productId);
+            $existingDomains = array_map(fn($l) => $l->getDomain(), $existingLicenses);
+
+            foreach ($domains as $domain) {
+                $normalizedDomain = $this->licenseManager->normalizeDomain($domain);
+
+                // Skip if license already exists for this domain
+                if (in_array($normalizedDomain, $existingDomains, true)) {
+                    $skipped++;
+                    continue;
+                }
+
+                $license = $this->licenseManager->generateLicense(
+                    $orderId,
+                    $productId,
+                    $customerId,
+                    $normalizedDomain
+                );
+
+                if ($license) {
+                    $generated++;
+                }
+            }
+        }
+
+        return ['generated' => $generated, 'skipped' => $skipped];
+    }
+
+    /**
+     * Generate licenses for legacy single domain format
+     */
+    private function generateLegacyLicenses(\WC_Order $order, string $domain): array
+    {
+        $generated = 0;
+        $skipped = 0;
+        $orderId = $order->get_id();
+        $customerId = $order->get_customer_id();
+
+        foreach ($order->get_items() as $item) {
+            $product = $item->get_product();
+            if (!$product || !$this->licenseManager->isLicensedProduct($product)) {
+                continue;
+            }
+
+            // Check if license already exists
+            $existing = $this->licenseManager->getLicenseByOrderAndProduct($orderId, $product->get_id());
+            if ($existing) {
+                $skipped++;
+                continue;
+            }
+
+            $license = $this->licenseManager->generateLicense(
+                $orderId,
+                $product->get_id(),
+                $customerId,
+                $domain
+            );
+
+            if ($license) {
+                $generated++;
+            }
+        }
+
+        return ['generated' => $generated, 'skipped' => $skipped];
+    }
 }

src/Admin/SettingsController.php

@@ -62,6 +62,7 @@ final class SettingsController
     {
         return [
             '' => __('Plugin License', 'wc-licensed-product'),
+            'auto-updates' => __('Auto-Updates', 'wc-licensed-product'),
             'defaults' => __('Default Settings', 'wc-licensed-product'),
             'notifications' => __('Notifications', 'wc-licensed-product'),
         ];
@@ -112,6 +113,7 @@ final class SettingsController
         $currentSection = $this->getCurrentSection();
 
         return match ($currentSection) {
+            'auto-updates' => $this->getAutoUpdatesSettings(),
             'defaults' => $this->getDefaultsSettings(),
             'notifications' => $this->getNotificationsSettings(),
             default => $this->getPluginLicenseSettings(),
@@ -160,6 +162,44 @@ final class SettingsController
         ];
     }
 
+    /**
+     * Get auto-updates settings
+     */
+    private function getAutoUpdatesSettings(): array
+    {
+        return [
+            'auto_update_section_title' => [
+                'name' => __('Auto-Updates', 'wc-licensed-product'),
+                'type' => 'title',
+                'desc' => __('Configure automatic plugin updates from the license server.', 'wc-licensed-product'),
+                'id' => 'wc_licensed_product_section_auto_update',
+            ],
+            'plugin_auto_update_enabled' => [
+                'name' => __('Enable Auto-Updates', 'wc-licensed-product'),
+                'type' => 'checkbox',
+                'desc' => __('Automatically check for and receive plugin updates from the license server.', 'wc-licensed-product'),
+                'id' => 'wc_licensed_product_plugin_auto_update_enabled',
+                'default' => 'yes',
+            ],
+            'update_check_frequency' => [
+                'name' => __('Check Frequency (Hours)', 'wc-licensed-product'),
+                'type' => 'number',
+                'desc' => __('How often to check for updates (in hours).', 'wc-licensed-product'),
+                'id' => 'wc_licensed_product_update_check_frequency',
+                'default' => '12',
+                'custom_attributes' => [
+                    'min' => '1',
+                    'max' => '168',
+                    'step' => '1',
+                ],
+            ],
+            'auto_update_section_end' => [
+                'type' => 'sectionend',
+                'id' => 'wc_licensed_product_section_auto_update_end',
+            ],
+        ];
+    }
+
     /**
      * Get default license settings
      */
@@ -173,7 +213,7 @@ final class SettingsController
                 'id' => 'wc_licensed_product_section_defaults',
             ],
             'default_max_activations' => [
-                'name' => __('Default Max Activations', 'wc-licensed-product'),
+                'name' => __('Max Activations', 'wc-licensed-product'),
                 'type' => 'number',
                 'desc' => __('Default maximum number of domain activations per license.', 'wc-licensed-product'),
                 'id' => 'wc_licensed_product_default_max_activations',
@@ -184,7 +224,7 @@ final class SettingsController
                 ],
             ],
             'default_validity_days' => [
-                'name' => __('Default License Validity (Days)', 'wc-licensed-product'),
+                'name' => __('License Validity (Days)', 'wc-licensed-product'),
                 'type' => 'number',
                 'desc' => __('Default number of days a license is valid. Leave empty or set to 0 for lifetime licenses.', 'wc-licensed-product'),
                 'id' => 'wc_licensed_product_default_validity_days',
@@ -196,12 +236,19 @@ final class SettingsController
                 ],
             ],
             'default_bind_to_version' => [
-                'name' => __('Default Bind to Major Version', 'wc-licensed-product'),
+                'name' => __('Bind to Major Version', 'wc-licensed-product'),
                 'type' => 'checkbox',
                 'desc' => __('If enabled, licenses are bound to the major version at purchase time by default.', 'wc-licensed-product'),
                 'id' => 'wc_licensed_product_default_bind_to_version',
                 'default' => 'no',
             ],
+            'enable_multi_domain' => [
+                'name' => __('Enable Multi-Domain Licensing', 'wc-licensed-product'),
+                'type' => 'checkbox',
+                'desc' => __('Allow customers to purchase multiple licenses for different domains at once. Each unit in cart quantity requires a unique domain.', 'wc-licensed-product'),
+                'id' => 'wc_licensed_product_enable_multi_domain',
+                'default' => 'no',
+            ],
             'section_end' => [
                 'type' => 'sectionend',
                 'id' => 'wc_licensed_product_section_defaults_end',
@@ -387,6 +434,14 @@ final class SettingsController
         return get_option('wc_licensed_product_default_bind_to_version', 'no') === 'yes';
     }
 
+    /**
+     * Check if multi-domain licensing is enabled
+     */
+    public static function isMultiDomainEnabled(): bool
+    {
+        return get_option('wc_licensed_product_enable_multi_domain', 'no') === 'yes';
+    }
+
     /**
      * Check if expiration warning emails are enabled
      * This checks both the WooCommerce email setting and the old setting for backwards compatibility
@@ -445,6 +500,23 @@ final class SettingsController
         return !empty($secret) ? (string) $secret : null;
     }
 
+    /**
+     * Check if auto-updates are enabled
+     */
+    public static function isAutoUpdateEnabled(): bool
+    {
+        return get_option('wc_licensed_product_plugin_auto_update_enabled', 'yes') === 'yes';
+    }
+
+    /**
+     * Get update check frequency in hours
+     */
+    public static function getUpdateCheckFrequency(): int
+    {
+        $value = get_option('wc_licensed_product_update_check_frequency', 12);
+        return max(1, min(168, (int) $value));
+    }
+
     /**
      * Handle AJAX verify license request
      */

src/Admin/VersionAdminController.php

@@ -43,25 +43,21 @@ final class VersionAdminController
 
     /**
      * Add versions meta box to product edit page
+     * Always adds the meta box - visibility is controlled via CSS/JavaScript based on product type
      */
     public function addVersionsMetaBox(): void
     {
         global $post;
 
-        // Only add meta box for licensed products or new products
         if ($post && $post->post_type === 'product') {
-            $product = wc_get_product($post->ID);
-            // Show for licensed products or new products (where type might be selected later)
-            if (!$product || $product->is_type('licensed') || $post->post_status === 'auto-draft') {
-                add_meta_box(
-                    'wc_licensed_product_versions',
-                    __('Product Versions', 'wc-licensed-product'),
-                    [$this, 'renderVersionsMetaBox'],
-                    'product',
-                    'normal',
-                    'high'
-                );
-            }
+            add_meta_box(
+                'wc_licensed_product_versions',
+                __('Product Versions', 'wc-licensed-product'),
+                [$this, 'renderVersionsMetaBox'],
+                'product',
+                'normal',
+                'high'
+            );
         }
     }
 
@@ -280,12 +276,13 @@ final class VersionAdminController
         }
 
         // Verify product exists and is of type licensed
-        $product = wc_get_product($productId);
-        if (!$product) {
+        // Use WC_Product_Factory::get_product_type() for reliable type detection
+        $productType = \WC_Product_Factory::get_product_type($productId);
+        if (!$productType) {
             wp_send_json_error(['message' => __('Product not found.', 'wc-licensed-product')]);
         }
 
-        if (!$product->is_type('licensed')) {
+        if (!in_array($productType, ['licensed', 'licensed-variable'], true)) {
             wp_send_json_error(['message' => __('This product is not a licensed product.', 'wc-licensed-product')]);
         }
 

src/Api/ResponseSigner.php

@@ -94,8 +94,8 @@ final class ResponseSigner
         $timestamp = time();
         $signingKey = $this->deriveKey($licenseKey);
 
-        // Sort keys for consistent ordering
-        ksort($data);
+        // Recursively sort keys for consistent ordering (required by client implementation)
+        $data = $this->recursiveKeySort($data);
 
         // Build signature payload
         $payload = $timestamp . ':' . json_encode(
@@ -109,6 +109,33 @@ final class ResponseSigner
         ];
     }
 
+    /**
+     * Recursively sort array keys alphabetically
+     *
+     * @param mixed $data The data to sort
+     * @return mixed The sorted data
+     */
+    private function recursiveKeySort(mixed $data): mixed
+    {
+        if (!is_array($data)) {
+            return $data;
+        }
+
+        // Check if array is associative (has string keys)
+        $isAssociative = array_keys($data) !== range(0, count($data) - 1);
+
+        if ($isAssociative) {
+            ksort($data);
+        }
+
+        // Recursively sort nested arrays
+        foreach ($data as $key => $value) {
+            $data[$key] = $this->recursiveKeySort($value);
+        }
+
+        return $data;
+    }
+
     /**
      * Derive a unique signing key for a license
      *
@@ -120,9 +147,59 @@ final class ResponseSigner
      */
     private function deriveKey(string $licenseKey): string
     {
-        // HKDF-like key derivation
-        $prk = hash_hmac('sha256', $licenseKey, $this->serverSecret, true);
+        return self::deriveCustomerSecret($licenseKey, $this->serverSecret);
+    }
 
-        return hash_hmac('sha256', $prk . "\x01", $this->serverSecret);
+    /**
+     * Derive a customer-specific secret from a license key
+     *
+     * This secret is unique per license and can be shared with the customer
+     * to verify signed API responses. Each customer gets their own secret
+     * derived from their license key.
+     *
+     * Uses RFC 5869 HKDF via PHP's native hash_hkdf() function.
+     * Parameters match the client library (SecureLicenseClient):
+     * - IKM (input keying material): server_secret
+     * - Length: 32 bytes (256 bits for SHA-256)
+     * - Info: license_key (context-specific info)
+     *
+     * @param string $licenseKey   The customer's license key
+     * @param string $serverSecret The server's master secret
+     * @return string The derived secret (64 hex characters)
+     */
+    public static function deriveCustomerSecret(string $licenseKey, string $serverSecret): string
+    {
+        // RFC 5869 HKDF using PHP's native implementation
+        // Must match client's ResponseSignature::deriveKey() exactly
+        $binaryKey = hash_hkdf('sha256', $serverSecret, 32, $licenseKey);
+
+        return bin2hex($binaryKey);
+    }
+
+    /**
+     * Get the customer secret for a license key using the configured server secret
+     *
+     * @param string $licenseKey The customer's license key
+     * @return string|null The derived secret, or null if server secret is not configured
+     */
+    public static function getCustomerSecretForLicense(string $licenseKey): ?string
+    {
+        $serverSecret = defined('WC_LICENSE_SERVER_SECRET') ? WC_LICENSE_SERVER_SECRET : '';
+
+        if (empty($serverSecret)) {
+            return null;
+        }
+
+        return self::deriveCustomerSecret($licenseKey, $serverSecret);
+    }
+
+    /**
+     * Check if response signing is enabled
+     *
+     * @return bool True if server secret is configured
+     */
+    public static function isSigningEnabled(): bool
+    {
+        return defined('WC_LICENSE_SERVER_SECRET') && !empty(WC_LICENSE_SERVER_SECRET);
     }
 }

src/Api/RestApiController.php

@@ -22,14 +22,34 @@ final class RestApiController
     private const NAMESPACE = 'wc-licensed-product/v1';
 
     /**
-     * Rate limit: requests per minute per IP
+     * Default rate limit: requests per window per IP
      */
-    private const RATE_LIMIT_REQUESTS = 30;
+    private const DEFAULT_RATE_LIMIT = 30;
 
     /**
-     * Rate limit window in seconds
+     * Default rate limit window in seconds
      */
-    private const RATE_LIMIT_WINDOW = 60;
+    private const DEFAULT_RATE_WINDOW = 60;
+
+    /**
+     * Get the configured rate limit (requests per window)
+     */
+    private function getRateLimit(): int
+    {
+        return defined('WC_LICENSE_RATE_LIMIT')
+            ? (int) WC_LICENSE_RATE_LIMIT
+            : self::DEFAULT_RATE_LIMIT;
+    }
+
+    /**
+     * Get the configured rate limit window in seconds
+     */
+    private function getRateWindow(): int
+    {
+        return defined('WC_LICENSE_RATE_WINDOW')
+            ? (int) WC_LICENSE_RATE_WINDOW
+            : self::DEFAULT_RATE_WINDOW;
+    }
 
     private LicenseManager $licenseManager;
 
@@ -56,12 +76,14 @@ final class RestApiController
     {
         $ip = $this->getClientIp();
         $transientKey = 'wclp_rate_' . md5($ip);
+        $rateLimit = $this->getRateLimit();
+        $rateWindow = $this->getRateWindow();
 
         $data = get_transient($transientKey);
 
         if ($data === false) {
             // First request, start counting
-            set_transient($transientKey, ['count' => 1, 'start' => time()], self::RATE_LIMIT_WINDOW);
+            set_transient($transientKey, ['count' => 1, 'start' => time()], $rateWindow);
             return null;
         }
 
@@ -69,15 +91,15 @@ final class RestApiController
         $start = (int) ($data['start'] ?? time());
 
         // Check if window has expired
-        if (time() - $start >= self::RATE_LIMIT_WINDOW) {
+        if (time() - $start >= $rateWindow) {
             // Reset counter
-            set_transient($transientKey, ['count' => 1, 'start' => time()], self::RATE_LIMIT_WINDOW);
+            set_transient($transientKey, ['count' => 1, 'start' => time()], $rateWindow);
             return null;
         }
 
         // Check if limit exceeded
-        if ($count >= self::RATE_LIMIT_REQUESTS) {
-            $retryAfter = self::RATE_LIMIT_WINDOW - (time() - $start);
+        if ($count >= $rateLimit) {
+            $retryAfter = $rateWindow - (time() - $start);
             $response = new WP_REST_Response([
                 'success' => false,
                 'error' => 'rate_limit_exceeded',
@@ -89,35 +111,158 @@ final class RestApiController
         }
 
         // Increment counter
-        set_transient($transientKey, ['count' => $count + 1, 'start' => $start], self::RATE_LIMIT_WINDOW);
+        set_transient($transientKey, ['count' => $count + 1, 'start' => $start], $rateWindow);
         return null;
     }
 
     /**
      * Get client IP address
+     *
+     * Security note: Only trust proxy headers when explicitly configured.
+     * Set WC_LICENSE_TRUSTED_PROXIES constant or configure trusted_proxies
+     * in wp-config.php to enable proxy header support.
+     *
+     * @return string Client IP address
      */
     private function getClientIp(): string
     {
-        $headers = [
-            'HTTP_CF_CONNECTING_IP', // Cloudflare
-            'HTTP_X_FORWARDED_FOR',
-            'HTTP_X_REAL_IP',
-            'REMOTE_ADDR',
-        ];
+        // Get the direct connection IP first
+        $remoteAddr = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
 
-        foreach ($headers as $header) {
-            if (!empty($_SERVER[$header])) {
-                $ips = explode(',', $_SERVER[$header]);
-                $ip = trim($ips[0]);
-                if (filter_var($ip, FILTER_VALIDATE_IP)) {
-                    return $ip;
+        // Only check proxy headers if we're behind a trusted proxy
+        if ($this->isTrustedProxy($remoteAddr)) {
+            // Check headers in order of trust preference
+            $headers = [
+                'HTTP_CF_CONNECTING_IP', // Cloudflare
+                'HTTP_X_FORWARDED_FOR',
+                'HTTP_X_REAL_IP',
+            ];
+
+            foreach ($headers as $header) {
+                if (!empty($_SERVER[$header])) {
+                    $ips = explode(',', $_SERVER[$header]);
+                    $ip = trim($ips[0]);
+                    if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
+                        return $ip;
+                    }
                 }
             }
         }
 
+        // Validate and return direct connection IP
+        if (filter_var($remoteAddr, FILTER_VALIDATE_IP)) {
+            return $remoteAddr;
+        }
+
         return '0.0.0.0';
     }
 
+    /**
+     * Check if the given IP is a trusted proxy
+     *
+     * @param string $ip The IP address to check
+     * @return bool Whether the IP is a trusted proxy
+     */
+    private function isTrustedProxy(string $ip): bool
+    {
+        // Check if trusted proxies are configured
+        if (!defined('WC_LICENSE_TRUSTED_PROXIES')) {
+            return false;
+        }
+
+        $trustedProxies = WC_LICENSE_TRUSTED_PROXIES;
+
+        // Handle string constant (comma-separated list)
+        if (is_string($trustedProxies)) {
+            $trustedProxies = array_map('trim', explode(',', $trustedProxies));
+        }
+
+        if (!is_array($trustedProxies)) {
+            return false;
+        }
+
+        // Check for special keywords
+        if (in_array('CLOUDFLARE', $trustedProxies, true)) {
+            // Cloudflare IP ranges (simplified - in production, fetch from Cloudflare API)
+            if ($this->isCloudflareIp($ip)) {
+                return true;
+            }
+        }
+
+        // Check direct IP match or CIDR notation
+        foreach ($trustedProxies as $proxy) {
+            if ($proxy === $ip) {
+                return true;
+            }
+
+            // Support CIDR notation
+            if (str_contains($proxy, '/') && $this->ipMatchesCidr($ip, $proxy)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * Check if IP is in Cloudflare range
+     *
+     * @param string $ip The IP to check
+     * @return bool Whether IP belongs to Cloudflare
+     */
+    private function isCloudflareIp(string $ip): bool
+    {
+        // Cloudflare IPv4 ranges (as of 2024)
+        $cloudflareRanges = [
+            '173.245.48.0/20',
+            '103.21.244.0/22',
+            '103.22.200.0/22',
+            '103.31.4.0/22',
+            '141.101.64.0/18',
+            '108.162.192.0/18',
+            '190.93.240.0/20',
+            '188.114.96.0/20',
+            '197.234.240.0/22',
+            '198.41.128.0/17',
+            '162.158.0.0/15',
+            '104.16.0.0/13',
+            '104.24.0.0/14',
+            '172.64.0.0/13',
+            '131.0.72.0/22',
+        ];
+
+        foreach ($cloudflareRanges as $range) {
+            if ($this->ipMatchesCidr($ip, $range)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * Check if an IP matches a CIDR range
+     *
+     * @param string $ip The IP to check
+     * @param string $cidr The CIDR range (e.g., "192.168.1.0/24")
+     * @return bool Whether the IP matches the CIDR range
+     */
+    private function ipMatchesCidr(string $ip, string $cidr): bool
+    {
+        [$subnet, $bits] = explode('/', $cidr);
+
+        if (!filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) ||
+            !filter_var($subnet, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
+            return false;
+        }
+
+        $ipLong = ip2long($ip);
+        $subnetLong = ip2long($subnet);
+        $mask = -1 << (32 - (int) $bits);
+
+        return ($ipLong & $mask) === ($subnetLong & $mask);
+    }
+
     /**
      * Register REST API routes
      */
@@ -134,7 +279,8 @@ final class RestApiController
                     'type' => 'string',
                     'sanitize_callback' => 'sanitize_text_field',
                     'validate_callback' => function ($value): bool {
-                        return !empty($value) && strlen($value) <= 64;
+                        $len = strlen($value);
+                        return !empty($value) && $len >= 8 && $len <= 64;
                     },
                 ],
                 'domain' => [
@@ -158,6 +304,10 @@ final class RestApiController
                     'required' => true,
                     'type' => 'string',
                     'sanitize_callback' => 'sanitize_text_field',
+                    'validate_callback' => function ($value): bool {
+                        $len = strlen($value);
+                        return !empty($value) && $len >= 8 && $len <= 64;
+                    },
                 ],
             ],
         ]);
@@ -172,11 +322,18 @@ final class RestApiController
                     'required' => true,
                     'type' => 'string',
                     'sanitize_callback' => 'sanitize_text_field',
+                    'validate_callback' => function ($value): bool {
+                        $len = strlen($value);
+                        return !empty($value) && $len >= 8 && $len <= 64;
+                    },
                 ],
                 'domain' => [
                     'required' => true,
                     'type' => 'string',
                     'sanitize_callback' => 'sanitize_text_field',
+                    'validate_callback' => function ($value): bool {
+                        return !empty($value) && strlen($value) <= 255;
+                    },
                 ],
             ],
         ]);
@@ -197,11 +354,32 @@ final class RestApiController
 
         $result = $this->licenseManager->validateLicense($licenseKey, $domain);
 
-        $statusCode = $result['valid'] ? 200 : 403;
+        $statusCode = $this->getStatusCodeForResult($result);
 
         return new WP_REST_Response($result, $statusCode);
     }
 
+    /**
+     * Get HTTP status code based on validation result
+     *
+     * @param array $result The validation result
+     * @return int HTTP status code
+     */
+    private function getStatusCodeForResult(array $result): int
+    {
+        if ($result['valid']) {
+            return 200;
+        }
+
+        $error = $result['error'] ?? '';
+
+        return match ($error) {
+            'license_not_found' => 404,
+            'activation_failed' => 500,
+            default => 403,
+        };
+    }
+
     /**
      * Check license status endpoint
      */

src/Api/UpdateController.php

@@ -0,0 +1,352 @@
+<?php
+/**
+ * Update Controller
+ *
+ * REST API endpoint for plugin update checks
+ *
+ * @package Jeremias\WcLicensedProduct\Api
+ */
+
+declare(strict_types=1);
+
+namespace Jeremias\WcLicensedProduct\Api;
+
+use Jeremias\WcLicensedProduct\License\LicenseManager;
+use Jeremias\WcLicensedProduct\Product\VersionManager;
+use Jeremias\WcLicensedProduct\Product\ProductVersion;
+use WP_REST_Request;
+use WP_REST_Response;
+use WP_REST_Server;
+
+/**
+ * Handles REST API endpoint for plugin update checks
+ *
+ * This endpoint allows licensed plugins to check for updates from this WooCommerce store.
+ * It validates the license and returns WordPress-compatible update information.
+ */
+final class UpdateController
+{
+    private const NAMESPACE = 'wc-licensed-product/v1';
+
+    /**
+     * Default rate limit: requests per window per IP
+     */
+    private const DEFAULT_RATE_LIMIT = 30;
+
+    /**
+     * Default rate limit window in seconds
+     */
+    private const DEFAULT_RATE_WINDOW = 60;
+
+    private LicenseManager $licenseManager;
+    private VersionManager $versionManager;
+
+    public function __construct(LicenseManager $licenseManager, VersionManager $versionManager)
+    {
+        $this->licenseManager = $licenseManager;
+        $this->versionManager = $versionManager;
+        $this->registerHooks();
+    }
+
+    /**
+     * Register WordPress hooks
+     */
+    private function registerHooks(): void
+    {
+        add_action('rest_api_init', [$this, 'registerRoutes']);
+    }
+
+    /**
+     * Get the configured rate limit (requests per window)
+     */
+    private function getRateLimit(): int
+    {
+        return defined('WC_LICENSE_RATE_LIMIT')
+            ? (int) WC_LICENSE_RATE_LIMIT
+            : self::DEFAULT_RATE_LIMIT;
+    }
+
+    /**
+     * Get the configured rate limit window in seconds
+     */
+    private function getRateWindow(): int
+    {
+        return defined('WC_LICENSE_RATE_WINDOW')
+            ? (int) WC_LICENSE_RATE_WINDOW
+            : self::DEFAULT_RATE_WINDOW;
+    }
+
+    /**
+     * Check rate limit for current IP
+     *
+     * @return WP_REST_Response|null Returns error response if rate limited, null if OK
+     */
+    private function checkRateLimit(): ?WP_REST_Response
+    {
+        $ip = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
+        $transientKey = 'wclp_update_rate_' . md5($ip);
+        $rateLimit = $this->getRateLimit();
+        $rateWindow = $this->getRateWindow();
+
+        $data = get_transient($transientKey);
+
+        if ($data === false) {
+            set_transient($transientKey, ['count' => 1, 'start' => time()], $rateWindow);
+            return null;
+        }
+
+        $count = (int) ($data['count'] ?? 0);
+        $start = (int) ($data['start'] ?? time());
+
+        if (time() - $start >= $rateWindow) {
+            set_transient($transientKey, ['count' => 1, 'start' => time()], $rateWindow);
+            return null;
+        }
+
+        if ($count >= $rateLimit) {
+            $retryAfter = $rateWindow - (time() - $start);
+            $response = new WP_REST_Response([
+                'success' => false,
+                'error' => 'rate_limit_exceeded',
+                'message' => __('Too many requests. Please try again later.', 'wc-licensed-product'),
+                'retry_after' => $retryAfter,
+            ], 429);
+            $response->header('Retry-After', (string) $retryAfter);
+            return $response;
+        }
+
+        set_transient($transientKey, ['count' => $count + 1, 'start' => $start], $rateWindow);
+        return null;
+    }
+
+    /**
+     * Register REST API routes
+     */
+    public function registerRoutes(): void
+    {
+        register_rest_route(self::NAMESPACE, '/update-check', [
+            'methods' => WP_REST_Server::CREATABLE,
+            'callback' => [$this, 'handleUpdateCheck'],
+            'permission_callback' => '__return_true',
+            'args' => [
+                'license_key' => [
+                    'required' => true,
+                    'type' => 'string',
+                    'sanitize_callback' => 'sanitize_text_field',
+                    'validate_callback' => function ($value): bool {
+                        $len = strlen($value);
+                        return !empty($value) && $len >= 8 && $len <= 64;
+                    },
+                ],
+                'domain' => [
+                    'required' => true,
+                    'type' => 'string',
+                    'sanitize_callback' => 'sanitize_text_field',
+                    'validate_callback' => function ($value): bool {
+                        return !empty($value) && strlen($value) <= 255;
+                    },
+                ],
+                'plugin_slug' => [
+                    'required' => false,
+                    'type' => 'string',
+                    'sanitize_callback' => 'sanitize_text_field',
+                ],
+                'current_version' => [
+                    'required' => false,
+                    'type' => 'string',
+                    'sanitize_callback' => 'sanitize_text_field',
+                ],
+            ],
+        ]);
+    }
+
+    /**
+     * Handle update check request
+     */
+    public function handleUpdateCheck(WP_REST_Request $request): WP_REST_Response
+    {
+        $rateLimitResponse = $this->checkRateLimit();
+        if ($rateLimitResponse !== null) {
+            return $rateLimitResponse;
+        }
+
+        $licenseKey = $request->get_param('license_key');
+        $domain = $request->get_param('domain');
+        $currentVersion = $request->get_param('current_version');
+
+        // Validate license
+        $validationResult = $this->licenseManager->validateLicense($licenseKey, $domain);
+
+        if (!$validationResult['valid']) {
+            return new WP_REST_Response([
+                'success' => false,
+                'update_available' => false,
+                'error' => $validationResult['error'] ?? 'license_invalid',
+                'message' => $validationResult['message'] ?? __('License validation failed.', 'wc-licensed-product'),
+            ], $validationResult['error'] === 'license_not_found' ? 404 : 403);
+        }
+
+        // Get license to access product ID
+        $license = $this->licenseManager->getLicenseByKey($licenseKey);
+        if (!$license) {
+            return new WP_REST_Response([
+                'success' => false,
+                'update_available' => false,
+                'error' => 'license_not_found',
+                'message' => __('License not found.', 'wc-licensed-product'),
+            ], 404);
+        }
+
+        $productId = $license->getProductId();
+        $product = wc_get_product($productId);
+
+        if (!$product) {
+            return new WP_REST_Response([
+                'success' => false,
+                'update_available' => false,
+                'error' => 'product_not_found',
+                'message' => __('Licensed product not found.', 'wc-licensed-product'),
+            ], 404);
+        }
+
+        // Get latest version based on major version binding
+        $latestVersion = $this->getLatestVersionForLicense($license);
+
+        if (!$latestVersion) {
+            return new WP_REST_Response([
+                'success' => true,
+                'update_available' => false,
+                'version' => $currentVersion ?? '0.0.0',
+                'message' => __('No versions available for this product.', 'wc-licensed-product'),
+            ]);
+        }
+
+        // Check if update is available
+        $updateAvailable = $currentVersion
+            ? version_compare($latestVersion->getVersion(), $currentVersion, '>')
+            : true;
+
+        // Build response
+        $response = $this->buildUpdateResponse($product, $latestVersion, $license, $updateAvailable);
+
+        return new WP_REST_Response($response);
+    }
+
+    /**
+     * Get latest version for a license, respecting major version binding
+     */
+    private function getLatestVersionForLicense($license): ?ProductVersion
+    {
+        $productId = $license->getProductId();
+
+        // Check if license is bound to a specific version
+        $versionId = $license->getVersionId();
+        if ($versionId) {
+            $boundVersion = $this->versionManager->getVersionById($versionId);
+            if ($boundVersion) {
+                // Get latest version for this major version
+                return $this->versionManager->getLatestVersionForMajor(
+                    $productId,
+                    $boundVersion->getMajorVersion()
+                );
+            }
+        }
+
+        // No version binding, return latest overall
+        return $this->versionManager->getLatestVersion($productId);
+    }
+
+    /**
+     * Build WordPress-compatible update response
+     */
+    private function buildUpdateResponse($product, ProductVersion $version, $license, bool $updateAvailable): array
+    {
+        $productSlug = $product->get_slug();
+
+        // Generate secure download URL
+        $downloadUrl = $this->generateUpdateDownloadUrl($license->getId(), $version->getId());
+
+        $response = [
+            'success' => true,
+            'update_available' => $updateAvailable,
+            'version' => $version->getVersion(),
+            'slug' => $productSlug,
+            'plugin' => $productSlug . '/' . $productSlug . '.php',
+            'download_url' => $downloadUrl,
+            'package' => $downloadUrl,
+            'last_updated' => $version->getReleasedAt()->format('Y-m-d'),
+            'tested' => $this->getTestedWpVersion(),
+            'requires' => $this->getRequiredWpVersion(),
+            'requires_php' => $this->getRequiredPhpVersion(),
+        ];
+
+        // Add changelog if available
+        if ($version->getReleaseNotes()) {
+            $response['changelog'] = $version->getReleaseNotes();
+            $response['sections'] = [
+                'description' => $product->get_short_description() ?: $product->get_description(),
+                'changelog' => $version->getReleaseNotes(),
+            ];
+        }
+
+        // Add package hash for integrity verification
+        if ($version->getFileHash()) {
+            $response['package_hash'] = 'sha256:' . $version->getFileHash();
+        }
+
+        // Add product name and homepage
+        $response['name'] = $product->get_name();
+        $response['homepage'] = get_permalink($product->get_id());
+
+        // Add icons if product has featured image
+        $imageId = $product->get_image_id();
+        if ($imageId) {
+            $iconUrl = wp_get_attachment_image_url($imageId, 'thumbnail');
+            $iconUrl2x = wp_get_attachment_image_url($imageId, 'medium');
+            if ($iconUrl) {
+                $response['icons'] = [
+                    '1x' => $iconUrl,
+                    '2x' => $iconUrl2x ?: $iconUrl,
+                ];
+            }
+        }
+
+        return $response;
+    }
+
+    /**
+     * Generate secure download URL for updates
+     */
+    private function generateUpdateDownloadUrl(int $licenseId, int $versionId): string
+    {
+        $data = $licenseId . '-' . $versionId . '-' . wp_salt('auth');
+        $hash = substr(hash('sha256', $data), 0, 16);
+        $downloadKey = $licenseId . '-' . $versionId . '-' . $hash;
+
+        return home_url('license-download/' . $downloadKey);
+    }
+
+    /**
+     * Get tested WordPress version from plugin headers
+     */
+    private function getTestedWpVersion(): string
+    {
+        return get_option('wc_licensed_product_tested_wp', '6.7');
+    }
+
+    /**
+     * Get required WordPress version from plugin headers
+     */
+    private function getRequiredWpVersion(): string
+    {
+        return get_option('wc_licensed_product_requires_wp', '6.0');
+    }
+
+    /**
+     * Get required PHP version
+     */
+    private function getRequiredPhpVersion(): string
+    {
+        return get_option('wc_licensed_product_requires_php', '8.3');
+    }
+}

src/Checkout/CheckoutBlocksIntegration.php

@@ -10,6 +10,8 @@ declare(strict_types=1);
 namespace Jeremias\WcLicensedProduct\Checkout;
 
 use Automattic\WooCommerce\Blocks\Integrations\IntegrationInterface;
+use Jeremias\WcLicensedProduct\Admin\SettingsController;
+use Jeremias\WcLicensedProduct\Product\LicensedProductVariation;
 
 /**
  * Integration with WooCommerce Checkout Blocks
@@ -30,7 +32,7 @@ final class CheckoutBlocksIntegration implements IntegrationInterface
     public function initialize(): void
     {
         $this->registerScripts();
-        $this->registerBlockExtensionData();
+        $this->registerAdditionalCheckoutFields();
     }
 
     /**
@@ -45,7 +47,7 @@ final class CheckoutBlocksIntegration implements IntegrationInterface
             wp_register_script(
                 'wc-licensed-product-checkout-blocks',
                 $scriptUrl,
-                ['wc-blocks-checkout', 'wp-element', 'wp-components', 'wp-i18n'],
+                ['wc-blocks-checkout', 'wp-element', 'wp-components', 'wp-i18n', 'wp-plugins', 'wp-data'],
                 WC_LICENSED_PRODUCT_VERSION,
                 true
             );
@@ -59,20 +61,33 @@ final class CheckoutBlocksIntegration implements IntegrationInterface
     }
 
     /**
-     * Register block extension data
+     * Register additional checkout fields using WooCommerce Blocks API
      */
-    private function registerBlockExtensionData(): void
+    private function registerAdditionalCheckoutFields(): void
     {
-        // Pass data to the checkout block script
-        add_filter(
-            'woocommerce_blocks_checkout_block_registration_data',
-            function (array $data): array {
-                $data['wc-licensed-product'] = [
-                    'hasLicensedProducts' => $this->cartHasLicensedProducts(),
-                ];
-                return $data;
+        add_action('woocommerce_blocks_loaded', function (): void {
+            // Check if the function exists (WooCommerce 8.9+)
+            if (!function_exists('woocommerce_register_additional_checkout_field')) {
+                return;
             }
-        );
+
+            // Register the domain field using WooCommerce's checkout fields API
+            // For single domain mode only (multi-domain uses custom JS component)
+            if (!SettingsController::isMultiDomainEnabled()) {
+                woocommerce_register_additional_checkout_field([
+                    'id' => 'wc-licensed-product/domain',
+                    'label' => __('License Domain', 'wc-licensed-product'),
+                    'location' => 'order',
+                    'type' => 'text',
+                    'required' => false,
+                    'attributes' => [
+                        'placeholder' => __('example.com', 'wc-licensed-product'),
+                        'pattern' => '^([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$',
+                        'title' => __('Enter a valid domain (without http:// or www)', 'wc-licensed-product'),
+                    ],
+                ]);
+            }
+        });
     }
 
     /**
@@ -96,13 +111,25 @@ final class CheckoutBlocksIntegration implements IntegrationInterface
      */
     public function get_script_data(): array
     {
+        $isMultiDomain = SettingsController::isMultiDomainEnabled();
+        $licensedProducts = $this->getLicensedProductsFromCart();
+        $hasLicensedProducts = !empty($licensedProducts);
+
         return [
-            'hasLicensedProducts' => $this->cartHasLicensedProducts(),
-            'fieldLabel' => __('Domain for License Activation', 'wc-licensed-product'),
+            'hasLicensedProducts' => $hasLicensedProducts,
+            'licensedProducts' => $licensedProducts,
+            'isMultiDomainEnabled' => $isMultiDomain,
             'fieldPlaceholder' => __('example.com', 'wc-licensed-product'),
-            'fieldDescription' => __('Enter the domain where you will use this license (without http:// or www).', 'wc-licensed-product'),
-            'sectionTitle' => __('License Domain', 'wc-licensed-product'),
-            'validationError' => __('Please enter a valid domain for your license activation.', 'wc-licensed-product'),
+            'fieldDescription' => $isMultiDomain
+                ? __('Enter a unique domain for each license (without http:// or www).', 'wc-licensed-product')
+                : __('Enter the domain where you will use the license (without http:// or www).', 'wc-licensed-product'),
+            'sectionTitle' => $isMultiDomain
+                ? __('License Domains', 'wc-licensed-product')
+                : __('License Domain', 'wc-licensed-product'),
+            'validationError' => __('Please enter a valid domain.', 'wc-licensed-product'),
+            'duplicateError' => __('Each license requires a unique domain.', 'wc-licensed-product'),
+            'licenseLabel' => __('License %d:', 'wc-licensed-product'),
+            'singleDomainLabel' => __('Domain', 'wc-licensed-product'),
         ];
     }
 
@@ -110,18 +137,74 @@ final class CheckoutBlocksIntegration implements IntegrationInterface
      * Check if cart contains licensed products
      */
     private function cartHasLicensedProducts(): bool
+    {
+        return !empty($this->getLicensedProductsFromCart());
+    }
+
+    /**
+     * Get licensed products from cart with quantities
+     *
+     * @return array<string, array{product_id: int, variation_id: int, name: string, quantity: int, duration_label: string}>
+     */
+    private function getLicensedProductsFromCart(): array
     {
         if (!WC()->cart) {
-            return false;
+            return [];
         }
 
-        foreach (WC()->cart->get_cart() as $cartItem) {
+        $licensedProducts = [];
+        $cartContents = WC()->cart->get_cart();
+
+        foreach ($cartContents as $cartKey => $cartItem) {
             $product = $cartItem['data'];
-            if ($product && $product->is_type('licensed')) {
-                return true;
+
+            if (!$product) {
+                continue;
+            }
+
+            // Check for simple licensed products
+            if ($product->is_type('licensed')) {
+                $productId = $product->get_id();
+                $licensedProducts[] = [
+                    'product_id' => $productId,
+                    'variation_id' => 0,
+                    'name' => $product->get_name(),
+                    'quantity' => (int) $cartItem['quantity'],
+                    'duration_label' => '',
+                ];
+                continue;
+            }
+
+            // Check for variations of licensed-variable products
+            // Use WC_Product_Factory::get_product_type() for reliable parent type check
+            $parentId = $product->get_parent_id();
+            if ($parentId) {
+                $parentType = \WC_Product_Factory::get_product_type($parentId);
+
+                if ($parentType === 'licensed-variable') {
+                    $variationId = $product->get_id();
+
+                    // Get duration label if it's a LicensedProductVariation
+                    $durationLabel = '';
+                    if ($product instanceof LicensedProductVariation) {
+                        $durationLabel = $product->get_license_duration_label();
+                    } else {
+                        // Try to instantiate as LicensedProductVariation
+                        $variation = new LicensedProductVariation($variationId);
+                        $durationLabel = $variation->get_license_duration_label();
+                    }
+
+                    $licensedProducts[] = [
+                        'product_id' => $parentId,
+                        'variation_id' => $variationId,
+                        'name' => $product->get_name(),
+                        'quantity' => (int) $cartItem['quantity'],
+                        'duration_label' => $durationLabel,
+                    ];
+                }
             }
         }
 
-        return false;
+        return $licensedProducts;
     }
 }

src/Checkout/CheckoutController.php

@@ -10,6 +10,8 @@ declare(strict_types=1);
 namespace Jeremias\WcLicensedProduct\Checkout;
 
 use Jeremias\WcLicensedProduct\License\LicenseManager;
+use Jeremias\WcLicensedProduct\Admin\SettingsController;
+use Jeremias\WcLicensedProduct\Product\LicensedProductVariation;
 
 /**
  * Handles checkout modifications for licensed products
@@ -50,35 +52,116 @@ final class CheckoutController
      */
     private function cartHasLicensedProducts(): bool
     {
-        if (!WC()->cart) {
-            return false;
-        }
-
-        foreach (WC()->cart->get_cart() as $cartItem) {
-            $product = $cartItem['data'];
-            if ($product && $product->is_type('licensed')) {
-                return true;
-            }
-        }
-
-        return false;
+        return !empty($this->getLicensedProductsFromCart());
     }
 
     /**
-     * Add domain field to checkout form
+     * Get licensed products from cart with quantities
+     *
+     * @return array<string, array{product_id: int, variation_id: int, name: string, quantity: int, duration_label: string}>
+     */
+    private function getLicensedProductsFromCart(): array
+    {
+        if (!WC()->cart) {
+            return [];
+        }
+
+        $licensedProducts = [];
+        foreach (WC()->cart->get_cart() as $cartItemKey => $cartItem) {
+            $product = $cartItem['data'];
+
+            if (!$product) {
+                continue;
+            }
+
+            // Check for simple licensed products
+            if ($product->is_type('licensed')) {
+                $productId = $product->get_id();
+                $licensedProducts[$productId] = [
+                    'product_id' => $productId,
+                    'variation_id' => 0,
+                    'name' => $product->get_name(),
+                    'quantity' => (int) $cartItem['quantity'],
+                    'duration_label' => '',
+                ];
+                continue;
+            }
+
+            // Check for variations of licensed-variable products
+            // Use WC_Product_Factory::get_product_type() for reliable parent type check
+            $parentId = $product->get_parent_id();
+            if ($parentId) {
+                $parentType = \WC_Product_Factory::get_product_type($parentId);
+
+                if ($parentType === 'licensed-variable') {
+                    $variationId = $product->get_id();
+                    // Use combination key to allow same product with different variations
+                    $key = "{$parentId}_{$variationId}";
+
+                    // Get duration label if it's a LicensedProductVariation
+                    $durationLabel = '';
+                    if ($product instanceof LicensedProductVariation) {
+                        $durationLabel = $product->get_license_duration_label();
+                    } else {
+                        // Try to instantiate as LicensedProductVariation
+                        $variation = new LicensedProductVariation($variationId);
+                        $durationLabel = $variation->get_license_duration_label();
+                    }
+
+                    $licensedProducts[$key] = [
+                        'product_id' => $parentId,
+                        'variation_id' => $variationId,
+                        'name' => $product->get_name(),
+                        'quantity' => (int) $cartItem['quantity'],
+                        'duration_label' => $durationLabel,
+                    ];
+                }
+            }
+        }
+
+        return $licensedProducts;
+    }
+
+    /**
+     * Add domain fields to checkout form
+     * Shows multiple domain fields if multi-domain is enabled, otherwise single field
      */
     public function addDomainField(): void
     {
-        if (!$this->cartHasLicensedProducts()) {
+        $licensedProducts = $this->getLicensedProductsFromCart();
+
+        if (empty($licensedProducts)) {
             return;
         }
 
+        // Check if multi-domain licensing is enabled
+        if (SettingsController::isMultiDomainEnabled()) {
+            $this->renderMultiDomainFields($licensedProducts);
+        } else {
+            $this->renderSingleDomainField();
+        }
+    }
+
+    /**
+     * Render single domain field (legacy mode)
+     */
+    private function renderSingleDomainField(): void
+    {
+        $savedValue = '';
+
+        // Check POST data first (validation failure case)
+        if (isset($_POST['licensed_product_domain'])) {
+            $savedValue = sanitize_text_field($_POST['licensed_product_domain']);
+        } elseif (WC()->session) {
+            $savedValue = WC()->session->get('licensed_product_domain', '');
+        }
+
         ?>
         <div id="licensed-product-domain-field">
             <h3><?php esc_html_e('License Domain', 'wc-licensed-product'); ?></h3>
             <p class="form-row form-row-wide">
                 <label for="licensed_product_domain">
-                    <?php esc_html_e('Domain for License Activation', 'wc-licensed-product'); ?>
+                    <?php esc_html_e('Domain', 'wc-licensed-product'); ?>
                     <abbr class="required" title="<?php esc_attr_e('required', 'wc-licensed-product'); ?>">*</abbr>
                 </label>
                 <input
@@ -87,10 +170,10 @@ final class CheckoutController
                     name="licensed_product_domain"
                     id="licensed_product_domain"
                     placeholder="<?php esc_attr_e('example.com', 'wc-licensed-product'); ?>"
-                    value="<?php echo esc_attr(WC()->checkout->get_value('licensed_product_domain')); ?>"
+                    value="<?php echo esc_attr($savedValue); ?>"
                 />
                 <span class="description">
-                    <?php esc_html_e('Enter the domain where you will use this license (without http:// or www).', 'wc-licensed-product'); ?>
+                    <?php esc_html_e('Enter the domain where you will use the license (without http:// or www).', 'wc-licensed-product'); ?>
                 </span>
             </p>
         </div>
@@ -98,62 +181,319 @@ final class CheckoutController
     }
 
     /**
-     * Validate domain field during checkout
+     * Render multi-domain fields (one per quantity)
+     */
+    private function renderMultiDomainFields(array $licensedProducts): void
+    {
+        ?>
+        <div id="licensed-product-domain-fields">
+            <h3><?php esc_html_e('License Domains', 'wc-licensed-product'); ?></h3>
+            <p class="wclp-domain-description">
+                <?php esc_html_e('Enter a unique domain for each license (without http:// or www).', 'wc-licensed-product'); ?>
+            </p>
+
+            <?php foreach ($licensedProducts as $key => $productData): ?>
+                <?php
+                $productId = $productData['product_id'];
+                $variationId = $productData['variation_id'] ?? 0;
+                $durationLabel = $productData['duration_label'] ?? '';
+                // Use key for field names to handle variations
+                $fieldKey = $variationId > 0 ? "{$productId}_{$variationId}" : $productId;
+                ?>
+                <div class="wclp-product-domains" data-product-id="<?php echo esc_attr($productId); ?>" data-variation-id="<?php echo esc_attr($variationId); ?>">
+                    <h4>
+                        <?php
+                        echo esc_html($productData['name']);
+                        if (!empty($durationLabel)) {
+                            echo ' <span class="wclp-duration-badge">(' . esc_html($durationLabel) . ')</span>';
+                        }
+                        if ($productData['quantity'] > 1) {
+                            printf(' ×%d', $productData['quantity']);
+                        }
+                        ?>
+                    </h4>
+
+                    <?php for ($i = 0; $i < $productData['quantity']; $i++): ?>
+                        <?php
+                        $fieldName = sprintf('licensed_domains[%s][%d]', $fieldKey, $i);
+                        $fieldId = sprintf('licensed_domain_%s_%d', str_replace('_', '-', $fieldKey), $i);
+                        $savedValue = $this->getSavedDomainValue($productId, $i, $variationId);
+                        ?>
+                        <p class="form-row form-row-wide wclp-domain-row">
+                            <label for="<?php echo esc_attr($fieldId); ?>">
+                                <?php
+                                printf(
+                                    /* translators: %d: license number */
+                                    esc_html__('License %d:', 'wc-licensed-product'),
+                                    $i + 1
+                                );
+                                ?>
+                                <abbr class="required" title="<?php esc_attr_e('required', 'wc-licensed-product'); ?>">*</abbr>
+                            </label>
+                            <input
+                                type="text"
+                                class="input-text wclp-domain-input"
+                                name="<?php echo esc_attr($fieldName); ?>"
+                                id="<?php echo esc_attr($fieldId); ?>"
+                                placeholder="<?php esc_attr_e('example.com', 'wc-licensed-product'); ?>"
+                                value="<?php echo esc_attr($savedValue); ?>"
+                            />
+                            <?php if ($variationId > 0): ?>
+                                <input type="hidden" name="licensed_variation_ids[<?php echo esc_attr($fieldKey); ?>]" value="<?php echo esc_attr($variationId); ?>" />
+                            <?php endif; ?>
+                        </p>
+                    <?php endfor; ?>
+                </div>
+            <?php endforeach; ?>
+        </div>
+        <style>
+            #licensed-product-domain-fields { margin-bottom: 20px; }
+            #licensed-product-domain-fields h3 { margin-bottom: 10px; }
+            .wclp-domain-description { margin-bottom: 15px; color: #666; }
+            .wclp-product-domains { margin-bottom: 20px; padding: 15px; background: #f8f8f8; border-radius: 4px; }
+            .wclp-product-domains h4 { margin: 0 0 10px 0; font-size: 1em; }
+            .wclp-duration-badge { color: #0073aa; font-weight: normal; }
+            .wclp-domain-row { margin-bottom: 10px; }
+            .wclp-domain-row:last-child { margin-bottom: 0; }
+            .wclp-domain-row label { display: block; margin-bottom: 5px; }
+        </style>
+        <?php
+    }
+
+    /**
+     * Get saved domain value from session/POST
+     */
+    private function getSavedDomainValue(int $productId, int $index, int $variationId = 0): string
+    {
+        // Build the field key (with or without variation)
+        $fieldKey = $variationId > 0 ? "{$productId}_{$variationId}" : (string) $productId;
+
+        // Check POST data first (validation failure case)
+        if (isset($_POST['licensed_domains'][$fieldKey][$index])) {
+            return sanitize_text_field($_POST['licensed_domains'][$fieldKey][$index]);
+        }
+
+        // Also try numeric key for backward compatibility
+        if (isset($_POST['licensed_domains'][$productId][$index])) {
+            return sanitize_text_field($_POST['licensed_domains'][$productId][$index]);
+        }
+
+        // Check session for blocks checkout
+        if (WC()->session) {
+            $sessionDomains = WC()->session->get('licensed_product_domains', []);
+            foreach ($sessionDomains as $item) {
+                $itemProductId = (int) ($item['product_id'] ?? 0);
+                $itemVariationId = (int) ($item['variation_id'] ?? 0);
+
+                // Match by product and variation
+                if ($itemProductId === $productId && $itemVariationId === $variationId) {
+                    if (isset($item['domains'][$index])) {
+                        return $item['domains'][$index];
+                    }
+                }
+            }
+        }
+
+        return '';
+    }
+
+    /**
+     * Validate domain fields during checkout
      */
     public function validateDomainField(): void
     {
-        if (!$this->cartHasLicensedProducts()) {
+        $licensedProducts = $this->getLicensedProductsFromCart();
+        if (empty($licensedProducts)) {
             return;
         }
 
-        $domain = isset($_POST['licensed_product_domain'])
-            ? sanitize_text_field($_POST['licensed_product_domain'])
-            : '';
-
-        if (empty($domain)) {
-            wc_add_notice(
-                __('Please enter a domain for your license activation.', 'wc-licensed-product'),
-                'error'
-            );
-            return;
-        }
-
-        // Validate domain format
-        $normalizedDomain = $this->licenseManager->normalizeDomain($domain);
-        if (!$this->isValidDomain($normalizedDomain)) {
-            wc_add_notice(
-                __('Please enter a valid domain name.', 'wc-licensed-product'),
-                'error'
-            );
+        // Check if multi-domain licensing is enabled
+        if (SettingsController::isMultiDomainEnabled()) {
+            $this->validateMultiDomainFields($licensedProducts);
+        } else {
+            $this->validateSingleDomainField();
         }
     }
 
     /**
-     * Save domain field to order meta
+     * Validate single domain field
      */
-    public function saveDomainField(int $orderId): void
+    private function validateSingleDomainField(): void
     {
-        if (!$this->cartHasLicensedProducts()) {
+        $domain = isset($_POST['licensed_product_domain']) ? sanitize_text_field($_POST['licensed_product_domain']) : '';
+
+        if (empty($domain)) {
+            wc_add_notice(__('Please enter a domain for your license.', 'wc-licensed-product'), 'error');
             return;
         }
 
-        if (isset($_POST['licensed_product_domain']) && !empty($_POST['licensed_product_domain'])) {
-            $domain = sanitize_text_field($_POST['licensed_product_domain']);
-            $normalizedDomain = $this->licenseManager->normalizeDomain($domain);
+        $normalizedDomain = $this->licenseManager->normalizeDomain($domain);
+        if (!$this->isValidDomain($normalizedDomain)) {
+            wc_add_notice(__('Please enter a valid domain for your license.', 'wc-licensed-product'), 'error');
+        }
+    }
 
-            $order = wc_get_order($orderId);
-            if ($order) {
-                $order->update_meta_data('_licensed_product_domain', $normalizedDomain);
-                $order->save();
+    /**
+     * Validate multi-domain fields
+     */
+    private function validateMultiDomainFields(array $licensedProducts): void
+    {
+        $licensedDomains = $_POST['licensed_domains'] ?? [];
+
+        foreach ($licensedProducts as $key => $productData) {
+            $productId = $productData['product_id'];
+            $variationId = $productData['variation_id'] ?? 0;
+            $fieldKey = $variationId > 0 ? "{$productId}_{$variationId}" : (string) $productId;
+
+            $productDomains = $licensedDomains[$fieldKey] ?? $licensedDomains[$productId] ?? [];
+            $normalizedDomains = [];
+
+            for ($i = 0; $i < $productData['quantity']; $i++) {
+                $domain = isset($productDomains[$i]) ? sanitize_text_field($productDomains[$i]) : '';
+
+                // Check if domain is empty
+                if (empty($domain)) {
+                    wc_add_notice(
+                        sprintf(
+                            /* translators: 1: product name, 2: license number */
+                            __('Please enter a domain for %1$s (License %2$d).', 'wc-licensed-product'),
+                            $productData['name'],
+                            $i + 1
+                        ),
+                        'error'
+                    );
+                    continue;
+                }
+
+                // Validate domain format
+                $normalizedDomain = $this->licenseManager->normalizeDomain($domain);
+                if (!$this->isValidDomain($normalizedDomain)) {
+                    wc_add_notice(
+                        sprintf(
+                            /* translators: 1: product name, 2: license number */
+                            __('Please enter a valid domain for %1$s (License %2$d).', 'wc-licensed-product'),
+                            $productData['name'],
+                            $i + 1
+                        ),
+                        'error'
+                    );
+                    continue;
+                }
+
+                // Check for duplicate domains within same product/variation
+                if (in_array($normalizedDomain, $normalizedDomains, true)) {
+                    wc_add_notice(
+                        sprintf(
+                            /* translators: 1: domain name, 2: product name */
+                            __('The domain "%1$s" is used multiple times for %2$s. Each license requires a unique domain.', 'wc-licensed-product'),
+                            $normalizedDomain,
+                            $productData['name']
+                        ),
+                        'error'
+                    );
+                } else {
+                    $normalizedDomains[] = $normalizedDomain;
+                }
             }
         }
     }
 
     /**
-     * Display domain in admin order view
+     * Save domain fields to order meta
+     */
+    public function saveDomainField(int $orderId): void
+    {
+        $licensedProducts = $this->getLicensedProductsFromCart();
+
+        if (empty($licensedProducts)) {
+            return;
+        }
+
+        $order = wc_get_order($orderId);
+        if (!$order) {
+            return;
+        }
+
+        // Check if multi-domain licensing is enabled
+        if (SettingsController::isMultiDomainEnabled()) {
+            $this->saveMultiDomainFields($order, $licensedProducts);
+        } else {
+            $this->saveSingleDomainField($order);
+        }
+    }
+
+    /**
+     * Save single domain field to order meta (legacy format)
+     */
+    private function saveSingleDomainField(\WC_Order $order): void
+    {
+        $domain = isset($_POST['licensed_product_domain']) ? sanitize_text_field($_POST['licensed_product_domain']) : '';
+
+        if (!empty($domain)) {
+            $normalizedDomain = $this->licenseManager->normalizeDomain($domain);
+            $order->update_meta_data('_licensed_product_domain', $normalizedDomain);
+            $order->save();
+        }
+    }
+
+    /**
+     * Save multi-domain fields to order meta
+     */
+    private function saveMultiDomainFields(\WC_Order $order, array $licensedProducts): void
+    {
+        $licensedDomains = $_POST['licensed_domains'] ?? [];
+        $licensedVariationIds = $_POST['licensed_variation_ids'] ?? [];
+        $domainData = [];
+
+        foreach ($licensedProducts as $key => $productData) {
+            $productId = $productData['product_id'];
+            $variationId = $productData['variation_id'] ?? 0;
+            $fieldKey = $variationId > 0 ? "{$productId}_{$variationId}" : (string) $productId;
+
+            $productDomains = $licensedDomains[$fieldKey] ?? $licensedDomains[$productId] ?? [];
+            $normalizedDomains = [];
+
+            for ($i = 0; $i < $productData['quantity']; $i++) {
+                $domain = isset($productDomains[$i]) ? sanitize_text_field($productDomains[$i]) : '';
+                if (!empty($domain)) {
+                    $normalizedDomains[] = $this->licenseManager->normalizeDomain($domain);
+                }
+            }
+
+            if (!empty($normalizedDomains)) {
+                $entry = [
+                    'product_id' => $productId,
+                    'domains' => $normalizedDomains,
+                ];
+
+                // Include variation_id if present
+                if ($variationId > 0) {
+                    $entry['variation_id'] = $variationId;
+                }
+
+                $domainData[] = $entry;
+            }
+        }
+
+        if (!empty($domainData)) {
+            $order->update_meta_data('_licensed_product_domains', $domainData);
+            $order->save();
+        }
+    }
+
+    /**
+     * Display domains in admin order view
      */
     public function displayDomainInAdmin(\WC_Order $order): void
     {
+        // Try new multi-domain format first
+        $domainData = $order->get_meta('_licensed_product_domains');
+        if (!empty($domainData) && is_array($domainData)) {
+            $this->displayMultiDomainsInAdmin($domainData);
+            return;
+        }
+
+        // Fall back to legacy single domain
         $domain = $order->get_meta('_licensed_product_domain');
         if (!$domain) {
             return;
@@ -168,10 +508,54 @@ final class CheckoutController
     }
 
     /**
-     * Display domain in order emails
+     * Display multi-domain data in admin
+     */
+    private function displayMultiDomainsInAdmin(array $domainData): void
+    {
+        ?>
+        <div class="wclp-order-domains">
+            <strong><?php esc_html_e('License Domains:', 'wc-licensed-product'); ?></strong>
+            <?php foreach ($domainData as $item): ?>
+                <?php
+                $productId = $item['product_id'];
+                $variationId = $item['variation_id'] ?? 0;
+
+                // Get product name
+                if ($variationId > 0) {
+                    $variation = wc_get_product($variationId);
+                    $productName = $variation ? $variation->get_name() : __('Unknown Variation', 'wc-licensed-product');
+
+                    // Add duration label if available
+                    if ($variation instanceof LicensedProductVariation) {
+                        $productName .= ' (' . $variation->get_license_duration_label() . ')';
+                    }
+                } else {
+                    $product = wc_get_product($productId);
+                    $productName = $product ? $product->get_name() : __('Unknown Product', 'wc-licensed-product');
+                }
+                ?>
+                <p style="margin: 5px 0 5px 15px;">
+                    <em><?php echo esc_html($productName); ?>:</em><br>
+                    <?php echo esc_html(implode(', ', $item['domains'])); ?>
+                </p>
+            <?php endforeach; ?>
+        </div>
+        <?php
+    }
+
+    /**
+     * Display domains in order emails
      */
     public function displayDomainInEmail(\WC_Order $order, bool $sentToAdmin, bool $plainText): void
     {
+        // Try new multi-domain format first
+        $domainData = $order->get_meta('_licensed_product_domains');
+        if (!empty($domainData) && is_array($domainData)) {
+            $this->displayMultiDomainsInEmail($domainData, $plainText);
+            return;
+        }
+
+        // Fall back to legacy single domain
         $domain = $order->get_meta('_licensed_product_domain');
         if (!$domain) {
             return;
@@ -189,6 +573,60 @@ final class CheckoutController
         }
     }
 
+    /**
+     * Display multi-domain data in email
+     */
+    private function displayMultiDomainsInEmail(array $domainData, bool $plainText): void
+    {
+        if ($plainText) {
+            echo "\n" . esc_html__('License Domains:', 'wc-licensed-product') . "\n";
+            foreach ($domainData as $item) {
+                $productId = $item['product_id'];
+                $variationId = $item['variation_id'] ?? 0;
+
+                if ($variationId > 0) {
+                    $variation = wc_get_product($variationId);
+                    $productName = $variation ? $variation->get_name() : __('Unknown Variation', 'wc-licensed-product');
+                    if ($variation instanceof LicensedProductVariation) {
+                        $productName .= ' (' . $variation->get_license_duration_label() . ')';
+                    }
+                } else {
+                    $product = wc_get_product($productId);
+                    $productName = $product ? $product->get_name() : __('Unknown Product', 'wc-licensed-product');
+                }
+
+                echo '  ' . esc_html($productName) . ': ' . esc_html(implode(', ', $item['domains'])) . "\n";
+            }
+        } else {
+            ?>
+            <div style="margin-bottom: 15px;">
+                <strong><?php esc_html_e('License Domains:', 'wc-licensed-product'); ?></strong>
+                <?php foreach ($domainData as $item): ?>
+                    <?php
+                    $productId = $item['product_id'];
+                    $variationId = $item['variation_id'] ?? 0;
+
+                    if ($variationId > 0) {
+                        $variation = wc_get_product($variationId);
+                        $productName = $variation ? $variation->get_name() : __('Unknown Variation', 'wc-licensed-product');
+                        if ($variation instanceof LicensedProductVariation) {
+                            $productName .= ' (' . $variation->get_license_duration_label() . ')';
+                        }
+                    } else {
+                        $product = wc_get_product($productId);
+                        $productName = $product ? $product->get_name() : __('Unknown Product', 'wc-licensed-product');
+                    }
+                    ?>
+                    <p style="margin: 5px 0 5px 15px;">
+                        <em><?php echo esc_html($productName); ?>:</em><br>
+                        <?php echo esc_html(implode(', ', $item['domains'])); ?>
+                    </p>
+                <?php endforeach; ?>
+            </div>
+            <?php
+        }
+    }
+
     /**
      * Validate domain format
      */

src/Checkout/StoreApiExtension.php

@@ -12,6 +12,7 @@ namespace Jeremias\WcLicensedProduct\Checkout;
 use Automattic\WooCommerce\StoreApi\Schemas\V1\CheckoutSchema;
 use Automattic\WooCommerce\StoreApi\StoreApi;
 use Automattic\WooCommerce\StoreApi\Schemas\ExtendSchema;
+use Jeremias\WcLicensedProduct\Admin\SettingsController;
 use Jeremias\WcLicensedProduct\License\LicenseManager;
 
 /**
@@ -70,6 +71,12 @@ final class StoreApiExtension
      */
     public function getExtensionData(): array
     {
+        if (SettingsController::isMultiDomainEnabled()) {
+            return [
+                'licensed_product_domains' => WC()->session ? WC()->session->get('licensed_product_domains', []) : [],
+            ];
+        }
+
         return [
             'licensed_product_domain' => WC()->session ? WC()->session->get('licensed_product_domain', '') : '',
         ];
@@ -80,6 +87,34 @@ final class StoreApiExtension
      */
     public function getExtensionSchema(): array
     {
+        if (SettingsController::isMultiDomainEnabled()) {
+            return [
+                'licensed_product_domains' => [
+                    'description' => __('Domains for license activation by product', 'wc-licensed-product'),
+                    'type' => 'array',
+                    'context' => ['view', 'edit'],
+                    'readonly' => false,
+                    'items' => [
+                        'type' => 'object',
+                        'properties' => [
+                            'product_id' => [
+                                'type' => 'integer',
+                            ],
+                            'variation_id' => [
+                                'type' => 'integer',
+                            ],
+                            'domains' => [
+                                'type' => 'array',
+                                'items' => [
+                                    'type' => 'string',
+                                ],
+                            ],
+                        ],
+                    ],
+                ],
+            ];
+        }
+
         return [
             'licensed_product_domain' => [
                 'description' => __('Domain for license activation', 'wc-licensed-product'),
@@ -95,30 +130,111 @@ final class StoreApiExtension
      */
     public function handleExtensionUpdate(array $data): void
     {
-        if (isset($data['licensed_product_domain'])) {
-            $domain = sanitize_text_field($data['licensed_product_domain']);
-            $normalizedDomain = $this->licenseManager->normalizeDomain($domain);
+        if (SettingsController::isMultiDomainEnabled()) {
+            // Multi-domain mode
+            if (isset($data['licensed_product_domains']) && is_array($data['licensed_product_domains'])) {
+                $normalizedData = $this->normalizeDomainsData($data['licensed_product_domains']);
 
-            if (WC()->session) {
-                WC()->session->set('licensed_product_domain', $normalizedDomain);
+                if (WC()->session) {
+                    WC()->session->set('licensed_product_domains', $normalizedData);
+                }
+            }
+        } else {
+            // Single domain mode
+            if (isset($data['licensed_product_domain'])) {
+                $sanitized = sanitize_text_field($data['licensed_product_domain']);
+                $normalized = $this->licenseManager->normalizeDomain($sanitized);
+
+                if (WC()->session) {
+                    WC()->session->set('licensed_product_domain', $normalized);
+                }
             }
         }
     }
 
     /**
-     * Process the checkout order - save domain to order meta
+     * Normalize domains data from frontend
+     */
+    private function normalizeDomainsData(array $domainsData): array
+    {
+        $normalized = [];
+
+        foreach ($domainsData as $item) {
+            if (!isset($item['product_id']) || !isset($item['domains']) || !is_array($item['domains'])) {
+                continue;
+            }
+
+            $productId = (int) $item['product_id'];
+            $variationId = isset($item['variation_id']) ? (int) $item['variation_id'] : 0;
+            $domains = [];
+
+            foreach ($item['domains'] as $domain) {
+                $sanitized = sanitize_text_field($domain);
+                if (!empty($sanitized)) {
+                    $domains[] = $this->licenseManager->normalizeDomain($sanitized);
+                }
+            }
+
+            if (!empty($domains)) {
+                $entry = [
+                    'product_id' => $productId,
+                    'domains' => $domains,
+                ];
+
+                // Include variation_id if present
+                if ($variationId > 0) {
+                    $entry['variation_id'] = $variationId;
+                }
+
+                $normalized[] = $entry;
+            }
+        }
+
+        return $normalized;
+    }
+
+    /**
+     * Process the checkout order - save domains to order meta
      */
     public function processCheckoutOrder(\WC_Order $order): void
     {
-        $domain = WC()->session ? WC()->session->get('licensed_product_domain', '') : '';
+        $requestData = json_decode(file_get_contents('php://input'), true);
 
-        // Also check in the request data for block checkout
-        if (empty($domain)) {
-            $requestData = json_decode(file_get_contents('php://input'), true);
-            if (isset($requestData['extensions'][self::IDENTIFIER]['licensed_product_domain'])) {
-                $domain = sanitize_text_field($requestData['extensions'][self::IDENTIFIER]['licensed_product_domain']);
-                $domain = $this->licenseManager->normalizeDomain($domain);
-            }
+        if (SettingsController::isMultiDomainEnabled()) {
+            $this->processMultiDomainOrder($order, $requestData);
+        } else {
+            $this->processSingleDomainOrder($order, $requestData);
+        }
+    }
+
+    /**
+     * Process order in single domain mode (legacy)
+     */
+    private function processSingleDomainOrder(\WC_Order $order, ?array $requestData): void
+    {
+        $domain = '';
+
+        // Check session first
+        if (WC()->session) {
+            $domain = WC()->session->get('licensed_product_domain', '');
+        }
+
+        // Check in the request data for block checkout (extension data)
+        if (empty($domain) && isset($requestData['extensions'][self::IDENTIFIER]['licensed_product_domain'])) {
+            $sanitized = sanitize_text_field($requestData['extensions'][self::IDENTIFIER]['licensed_product_domain']);
+            $domain = $this->licenseManager->normalizeDomain($sanitized);
+        }
+
+        // Check for wclp_license_domain (from our hidden input)
+        if (empty($domain) && isset($requestData['wclp_license_domain'])) {
+            $sanitized = sanitize_text_field($requestData['wclp_license_domain']);
+            $domain = $this->licenseManager->normalizeDomain($sanitized);
+        }
+
+        // Check for additional_fields (WC Blocks API)
+        if (empty($domain) && isset($requestData['additional_fields']['wc-licensed-product/domain'])) {
+            $sanitized = sanitize_text_field($requestData['additional_fields']['wc-licensed-product/domain']);
+            $domain = $this->licenseManager->normalizeDomain($sanitized);
         }
 
         if (!empty($domain)) {
@@ -131,4 +247,84 @@ final class StoreApiExtension
             }
         }
     }
+
+    /**
+     * Process order in multi-domain mode
+     */
+    private function processMultiDomainOrder(\WC_Order $order, ?array $requestData): void
+    {
+        $domainData = [];
+
+        // Check session first
+        if (WC()->session) {
+            $domainData = WC()->session->get('licensed_product_domains', []);
+        }
+
+        // Check in the request data for block checkout (extension data)
+        if (empty($domainData) && isset($requestData['extensions'][self::IDENTIFIER]['licensed_product_domains'])) {
+            $domainData = $this->normalizeDomainsData(
+                $requestData['extensions'][self::IDENTIFIER]['licensed_product_domains']
+            );
+        }
+
+        // Check for wclp_license_domains (from our hidden input - JSON string)
+        if (empty($domainData) && isset($requestData['wclp_license_domains'])) {
+            $parsed = json_decode($requestData['wclp_license_domains'], true);
+            if (is_array($parsed)) {
+                $domainData = $this->normalizeDomainsData($parsed);
+            }
+        }
+
+        // Check for licensed_domains in classic format (from DOM injection)
+        if (empty($domainData) && isset($requestData['licensed_domains']) && is_array($requestData['licensed_domains'])) {
+            $domainData = [];
+            $variationIds = $requestData['licensed_variation_ids'] ?? [];
+
+            foreach ($requestData['licensed_domains'] as $key => $domains) {
+                if (!is_array($domains)) {
+                    continue;
+                }
+
+                // Parse key - could be "productId" or "productId_variationId"
+                $parts = explode('_', (string) $key);
+                $productId = (int) $parts[0];
+                $variationId = isset($parts[1]) ? (int) $parts[1] : 0;
+
+                // Also check for hidden variation ID field
+                if ($variationId === 0 && isset($variationIds[$key])) {
+                    $variationId = (int) $variationIds[$key];
+                }
+
+                $normalizedDomains = [];
+                foreach ($domains as $domain) {
+                    $sanitized = sanitize_text_field($domain);
+                    if (!empty($sanitized)) {
+                        $normalizedDomains[] = $this->licenseManager->normalizeDomain($sanitized);
+                    }
+                }
+                if (!empty($normalizedDomains)) {
+                    $entry = [
+                        'product_id' => $productId,
+                        'domains' => $normalizedDomains,
+                    ];
+
+                    if ($variationId > 0) {
+                        $entry['variation_id'] = $variationId;
+                    }
+
+                    $domainData[] = $entry;
+                }
+            }
+        }
+
+        if (!empty($domainData)) {
+            $order->update_meta_data('_licensed_product_domains', $domainData);
+            $order->save();
+
+            // Clear session data
+            if (WC()->session) {
+                WC()->session->set('licensed_product_domains', []);
+            }
+        }
+    }
 }

src/Email/LicenseEmailController.php

@@ -55,6 +55,7 @@ final class LicenseEmailController
     public function registerEmailClasses(array $email_classes): array
     {
         $email_classes['WCLP_License_Expiration'] = new LicenseExpirationEmail();
+        $email_classes['WCLP_License_Expired'] = new LicenseExpiredEmail();
         return $email_classes;
     }
 
@@ -69,10 +70,13 @@ final class LicenseEmailController
     }
 
     /**
-     * Send expiration warning emails
+     * Send expiration warning emails and auto-expire licenses
      */
     public function sendExpirationWarnings(): void
     {
+        // First, auto-expire licenses that have passed their expiration date
+        $this->autoExpireAndNotify();
+
         // Check if expiration emails are enabled in settings
         if (!SettingsController::isExpirationEmailsEnabled()) {
             return;
@@ -107,6 +111,41 @@ final class LicenseEmailController
         }
     }
 
+    /**
+     * Auto-expire licenses and send expired notifications
+     */
+    private function autoExpireAndNotify(): void
+    {
+        // Get licenses that should be auto-expired
+        $expiredActiveLicenses = $this->licenseManager->getExpiredActiveLicenses();
+
+        if (empty($expiredActiveLicenses)) {
+            return;
+        }
+
+        // Get the WooCommerce email instance for expired notifications
+        $mailer = WC()->mailer();
+        $emails = $mailer->get_emails();
+
+        /** @var LicenseExpiredEmail|null $expiredEmail */
+        $expiredEmail = $emails['WCLP_License_Expired'] ?? null;
+
+        foreach ($expiredActiveLicenses as $license) {
+            // Auto-expire the license
+            $wasExpired = $this->licenseManager->autoExpireLicense($license->getId());
+
+            if ($wasExpired && $expiredEmail && $expiredEmail->is_enabled()) {
+                // Check if we haven't already sent an expired notification
+                if (!$this->licenseManager->wasExpirationNotified($license->getId(), 'license_expired')) {
+                    // Send expired notification email
+                    if ($expiredEmail->trigger($license)) {
+                        $this->licenseManager->markExpirationNotified($license->getId(), 'license_expired');
+                    }
+                }
+            }
+        }
+    }
+
     /**
      * Process and send expiration warnings for a specific time frame
      *
@@ -155,7 +194,7 @@ final class LicenseEmailController
     }
 
     /**
-     * Add license key to order item in email
+     * Add license key(s) to order item in email
      */
     public function addLicenseToOrderItem(int $itemId, \WC_Order_Item $item, \WC_Order $order, bool $plainText): void
     {
@@ -164,94 +203,117 @@ final class LicenseEmailController
             return;
         }
 
-        $license = $this->licenseManager->getLicenseByOrderAndProduct($order->get_id(), $product->get_id());
-        if (!$license) {
+        $licenses = $this->licenseManager->getLicensesByOrderAndProduct($order->get_id(), $product->get_id());
+        if (empty($licenses)) {
             return;
         }
 
         if ($plainText) {
-            echo "\n" . esc_html__('License Key:', 'wc-licensed-product') . ' ' . esc_html($license->getLicenseKey()) . "\n";
+            echo "\n" . esc_html__('License Keys:', 'wc-licensed-product') . "\n";
+            foreach ($licenses as $license) {
+                echo '  - ' . esc_html($license->getLicenseKey());
+                echo ' (' . esc_html($license->getDomain()) . ')' . "\n";
+            }
         } else {
             ?>
             <div style="margin-top: 10px; padding: 10px; background-color: #f8f9fa; border-left: 3px solid #7f54b3;">
-                <strong><?php esc_html_e('License Key:', 'wc-licensed-product'); ?></strong>
-                <code style="display: block; margin-top: 5px; padding: 5px; background: #fff; font-family: monospace;">
-                    <?php echo esc_html($license->getLicenseKey()); ?>
-                </code>
+                <strong><?php esc_html_e('License Keys:', 'wc-licensed-product'); ?></strong>
+                <?php foreach ($licenses as $license) : ?>
+                    <div style="margin-top: 5px; padding: 5px; background: #fff;">
+                        <code style="font-family: monospace;">
+                            <?php echo esc_html($license->getLicenseKey()); ?>
+                        </code>
+                        <span style="color: #666; margin-left: 10px;">
+                            <?php echo esc_html($license->getDomain()); ?>
+                        </span>
+                    </div>
+                <?php endforeach; ?>
             </div>
             <?php
         }
     }
 
     /**
-     * Get all licenses for an order
+     * Get all licenses for an order grouped by product
+     *
+     * @return array Array of products with their licenses
      */
     private function getLicensesForOrder(\WC_Order $order): array
     {
-        $licenses = [];
+        $products = [];
 
         foreach ($order->get_items() as $item) {
             $product = $item->get_product();
             if ($product && $product->is_type('licensed')) {
-                $license = $this->licenseManager->getLicenseByOrderAndProduct($order->get_id(), $product->get_id());
-                if ($license) {
-                    $licenses[] = [
-                        'license' => $license,
+                $licenses = $this->licenseManager->getLicensesByOrderAndProduct($order->get_id(), $product->get_id());
+                if (!empty($licenses)) {
+                    $products[] = [
                         'product_name' => $product->get_name(),
+                        'licenses' => $licenses,
                     ];
                 }
             }
         }
 
-        return $licenses;
+        return $products;
     }
 
     /**
      * Render license info in HTML format
      */
-    private function renderHtmlLicenseInfo(array $licenses, \WC_Order $order): void
+    private function renderHtmlLicenseInfo(array $products, \WC_Order $order): void
     {
-        $domain = $order->get_meta('_licensed_product_domain');
         ?>
         <div style="margin: 20px 0; padding: 20px; background-color: #f8f9fa; border: 1px solid #e5e5e5; border-radius: 4px;">
             <h2 style="margin-top: 0; color: #333;"><?php esc_html_e('Your License Keys', 'wc-licensed-product'); ?></h2>
 
-            <?php if ($domain) : ?>
-                <p style="margin-bottom: 15px;">
-                    <strong><?php esc_html_e('Licensed Domain:', 'wc-licensed-product'); ?></strong>
-                    <?php echo esc_html($domain); ?>
-                </p>
-            <?php endif; ?>
+            <?php foreach ($products as $product) : ?>
+                <div style="margin-bottom: 20px;">
+                    <h3 style="margin: 0 0 10px 0; font-size: 1.1em; color: #333;">
+                        <?php echo esc_html($product['product_name']); ?>
+                        <span style="font-weight: normal; color: #666; font-size: 0.9em;">
+                            (<?php
+                            printf(
+                                esc_html(_n('%d license', '%d licenses', count($product['licenses']), 'wc-licensed-product')),
+                                count($product['licenses'])
+                            );
+                            ?>)
+                        </span>
+                    </h3>
 
-            <table style="width: 100%; border-collapse: collapse;">
-                <thead>
-                    <tr>
-                        <th style="text-align: left; padding: 10px; border-bottom: 2px solid #ddd;"><?php esc_html_e('Product', 'wc-licensed-product'); ?></th>
-                        <th style="text-align: left; padding: 10px; border-bottom: 2px solid #ddd;"><?php esc_html_e('License Key', 'wc-licensed-product'); ?></th>
-                        <th style="text-align: left; padding: 10px; border-bottom: 2px solid #ddd;"><?php esc_html_e('Expires', 'wc-licensed-product'); ?></th>
-                    </tr>
-                </thead>
-                <tbody>
-                    <?php foreach ($licenses as $item) : ?>
-                        <tr>
-                            <td style="padding: 10px; border-bottom: 1px solid #eee;"><?php echo esc_html($item['product_name']); ?></td>
-                            <td style="padding: 10px; border-bottom: 1px solid #eee;">
-                                <code style="background: #fff; padding: 3px 6px; font-family: monospace;">
-                                    <?php echo esc_html($item['license']->getLicenseKey()); ?>
-                                </code>
-                            </td>
-                            <td style="padding: 10px; border-bottom: 1px solid #eee;">
-                                <?php
-                                $expiresAt = $item['license']->getExpiresAt();
-                                echo $expiresAt
-                                    ? esc_html($expiresAt->format(get_option('date_format')))
-                                    : esc_html__('Never', 'wc-licensed-product');
-                                ?>
-                            </td>
-                        </tr>
-                    <?php endforeach; ?>
-                </tbody>
-            </table>
+                    <table style="width: 100%; border-collapse: collapse; background: #fff;">
+                        <thead>
+                            <tr>
+                                <th style="text-align: left; padding: 8px 10px; border-bottom: 2px solid #ddd; font-size: 0.9em;"><?php esc_html_e('License Key', 'wc-licensed-product'); ?></th>
+                                <th style="text-align: left; padding: 8px 10px; border-bottom: 2px solid #ddd; font-size: 0.9em;"><?php esc_html_e('Domain', 'wc-licensed-product'); ?></th>
+                                <th style="text-align: left; padding: 8px 10px; border-bottom: 2px solid #ddd; font-size: 0.9em;"><?php esc_html_e('Expires', 'wc-licensed-product'); ?></th>
+                            </tr>
+                        </thead>
+                        <tbody>
+                            <?php foreach ($product['licenses'] as $license) : ?>
+                                <tr>
+                                    <td style="padding: 8px 10px; border-bottom: 1px solid #eee;">
+                                        <code style="background: #f5f5f5; padding: 3px 6px; font-family: monospace; font-size: 0.9em;">
+                                            <?php echo esc_html($license->getLicenseKey()); ?>
+                                        </code>
+                                    </td>
+                                    <td style="padding: 8px 10px; border-bottom: 1px solid #eee;">
+                                        <?php echo esc_html($license->getDomain()); ?>
+                                    </td>
+                                    <td style="padding: 8px 10px; border-bottom: 1px solid #eee;">
+                                        <?php
+                                        $expiresAt = $license->getExpiresAt();
+                                        echo $expiresAt
+                                            ? esc_html($expiresAt->format(get_option('date_format')))
+                                            : esc_html__('Never', 'wc-licensed-product');
+                                        ?>
+                                    </td>
+                                </tr>
+                            <?php endforeach; ?>
+                        </tbody>
+                    </table>
+                </div>
+            <?php endforeach; ?>
 
             <p style="margin-top: 15px; margin-bottom: 0; font-size: 0.9em; color: #666;">
                 <?php esc_html_e('You can also view your licenses in your account under "Licenses".', 'wc-licensed-product'); ?>
@@ -263,29 +325,33 @@ final class LicenseEmailController
     /**
      * Render license info in plain text format
      */
-    private function renderPlainTextLicenseInfo(array $licenses, \WC_Order $order): void
+    private function renderPlainTextLicenseInfo(array $products, \WC_Order $order): void
     {
-        $domain = $order->get_meta('_licensed_product_domain');
-
         echo "\n\n";
         echo "==========================================================\n";
         echo esc_html__('YOUR LICENSE KEYS', 'wc-licensed-product') . "\n";
         echo "==========================================================\n\n";
 
-        if ($domain) {
-            echo esc_html__('Licensed Domain:', 'wc-licensed-product') . ' ' . esc_html($domain) . "\n\n";
-        }
+        foreach ($products as $product) {
+            echo esc_html($product['product_name']);
+            echo ' (' . count($product['licenses']) . ' ' .
+                _n('license', 'licenses', count($product['licenses']), 'wc-licensed-product') . ')';
+            echo "\n";
+            echo "-----------------------------------------------------------\n";
 
-        foreach ($licenses as $item) {
-            echo esc_html($item['product_name']) . "\n";
-            echo esc_html__('License Key:', 'wc-licensed-product') . ' ' . esc_html($item['license']->getLicenseKey()) . "\n";
+            foreach ($product['licenses'] as $license) {
+                echo esc_html__('License Key:', 'wc-licensed-product') . ' ';
+                echo esc_html($license->getLicenseKey()) . "\n";
+                echo esc_html__('Domain:', 'wc-licensed-product') . ' ';
+                echo esc_html($license->getDomain()) . "\n";
+                echo esc_html__('Expires:', 'wc-licensed-product') . ' ';
 
-            $expiresAt = $item['license']->getExpiresAt();
-            echo esc_html__('Expires:', 'wc-licensed-product') . ' ';
-            echo $expiresAt
-                ? esc_html($expiresAt->format(get_option('date_format')))
-                : esc_html__('Never', 'wc-licensed-product');
-            echo "\n\n";
+                $expiresAt = $license->getExpiresAt();
+                echo $expiresAt
+                    ? esc_html($expiresAt->format(get_option('date_format')))
+                    : esc_html__('Never', 'wc-licensed-product');
+                echo "\n\n";
+            }
         }
 
         echo esc_html__('You can also view your licenses in your account under "Licenses".', 'wc-licensed-product') . "\n";

src/Email/LicenseExpiredEmail.php

@@ -0,0 +1,335 @@
+<?php
+/**
+ * License Expired Email
+ *
+ * @package Jeremias\WcLicensedProduct\Email
+ */
+
+declare(strict_types=1);
+
+namespace Jeremias\WcLicensedProduct\Email;
+
+use Jeremias\WcLicensedProduct\License\License;
+use WC_Email;
+
+/**
+ * License Expired Email class
+ *
+ * Sends email notifications to customers when their licenses have expired.
+ * Uses WooCommerce's transactional email system for consistent styling and customization.
+ */
+class LicenseExpiredEmail extends WC_Email
+{
+    /**
+     * License object
+     */
+    public ?License $license = null;
+
+    /**
+     * Product name
+     */
+    public string $product_name = '';
+
+    /**
+     * Expiration date formatted
+     */
+    public string $expiration_date = '';
+
+    /**
+     * Customer display name
+     */
+    public string $customer_name = '';
+
+    /**
+     * Constructor
+     */
+    public function __construct()
+    {
+        $this->id = 'wclp_license_expired';
+        $this->customer_email = true;
+        $this->title = __('License Expired', 'wc-licensed-product');
+        $this->description = __('License expired emails are sent to customers when their licenses have expired.', 'wc-licensed-product');
+
+        $this->placeholders = [
+            '{site_title}' => $this->get_blogname(),
+            '{product_name}' => '',
+            '{expiration_date}' => '',
+        ];
+
+        // Call parent constructor
+        parent::__construct();
+    }
+
+    /**
+     * Get email subject
+     */
+    public function get_default_subject(): string
+    {
+        return __('[{site_title}] Your license for {product_name} has expired', 'wc-licensed-product');
+    }
+
+    /**
+     * Get email heading
+     */
+    public function get_default_heading(): string
+    {
+        return __('License Expired', 'wc-licensed-product');
+    }
+
+    /**
+     * Trigger the email
+     *
+     * @param License $license License object
+     */
+    public function trigger(License $license): bool
+    {
+        $this->setup_locale();
+
+        $customer = get_userdata($license->getCustomerId());
+        if (!$customer || !$customer->user_email) {
+            $this->restore_locale();
+            return false;
+        }
+
+        $this->license = $license;
+        $this->recipient = $customer->user_email;
+        $this->customer_name = $customer->display_name ?: __('Customer', 'wc-licensed-product');
+
+        $product = wc_get_product($license->getProductId());
+        $this->product_name = $product ? $product->get_name() : __('Unknown Product', 'wc-licensed-product');
+
+        $expiresAt = $license->getExpiresAt();
+        $this->expiration_date = $expiresAt ? $expiresAt->format(get_option('date_format')) : '';
+
+        // Update placeholders
+        $this->placeholders['{product_name}'] = $this->product_name;
+        $this->placeholders['{expiration_date}'] = $this->expiration_date;
+
+        if (!$this->is_enabled() || !$this->get_recipient()) {
+            $this->restore_locale();
+            return false;
+        }
+
+        $result = $this->send(
+            $this->get_recipient(),
+            $this->get_subject(),
+            $this->get_content(),
+            $this->get_headers(),
+            $this->get_attachments()
+        );
+
+        $this->restore_locale();
+
+        return $result;
+    }
+
+    /**
+     * Get content HTML
+     */
+    public function get_content_html(): string
+    {
+        ob_start();
+
+        // Use WooCommerce's email header
+        wc_get_template('emails/email-header.php', ['email_heading' => $this->get_heading()]);
+
+        $this->render_email_body_html();
+
+        // Use WooCommerce's email footer
+        wc_get_template('emails/email-footer.php', ['email' => $this]);
+
+        return ob_get_clean();
+    }
+
+    /**
+     * Get content plain text
+     */
+    public function get_content_plain(): string
+    {
+        ob_start();
+
+        echo "=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n";
+        echo esc_html(wp_strip_all_tags($this->get_heading()));
+        echo "\n=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n\n";
+
+        $this->render_email_body_plain();
+
+        return ob_get_clean();
+    }
+
+    /**
+     * Render HTML email body content
+     */
+    private function render_email_body_html(): void
+    {
+        $account_url = wc_get_account_endpoint_url('licenses');
+        ?>
+        <p><?php printf(esc_html__('Hello %s,', 'wc-licensed-product'), esc_html($this->customer_name)); ?></p>
+
+        <p style="color: #dc3232; font-weight: 600;">
+            <?php printf(
+                esc_html__('Your license for %1$s has expired on %2$s.', 'wc-licensed-product'),
+                '<strong>' . esc_html($this->product_name) . '</strong>',
+                esc_html($this->expiration_date)
+            ); ?>
+        </p>
+
+        <p>
+            <?php esc_html_e('Your license is no longer valid and the product will stop working until you renew.', 'wc-licensed-product'); ?>
+        </p>
+
+        <h2><?php esc_html_e('Expired License Details', 'wc-licensed-product'); ?></h2>
+
+        <div style="margin-bottom: 40px;">
+            <table class="td" cellspacing="0" cellpadding="6" style="width: 100%; font-family: 'Helvetica Neue', Helvetica, Roboto, Arial, sans-serif;" border="1">
+                <tbody>
+                    <tr>
+                        <th class="td" scope="row" style="text-align:<?php echo is_rtl() ? 'right' : 'left'; ?>;"><?php esc_html_e('Product:', 'wc-licensed-product'); ?></th>
+                        <td class="td" style="text-align:<?php echo is_rtl() ? 'right' : 'left'; ?>;"><?php echo esc_html($this->product_name); ?></td>
+                    </tr>
+                    <tr>
+                        <th class="td" scope="row" style="text-align:<?php echo is_rtl() ? 'right' : 'left'; ?>;"><?php esc_html_e('License Key:', 'wc-licensed-product'); ?></th>
+                        <td class="td" style="text-align:<?php echo is_rtl() ? 'right' : 'left'; ?>;">
+                            <code style="background: #f5f5f5; padding: 3px 8px; border-radius: 3px; font-family: monospace;">
+                                <?php echo esc_html($this->license->getLicenseKey()); ?>
+                            </code>
+                        </td>
+                    </tr>
+                    <tr>
+                        <th class="td" scope="row" style="text-align:<?php echo is_rtl() ? 'right' : 'left'; ?>;"><?php esc_html_e('Domain:', 'wc-licensed-product'); ?></th>
+                        <td class="td" style="text-align:<?php echo is_rtl() ? 'right' : 'left'; ?>;"><?php echo esc_html($this->license->getDomain()); ?></td>
+                    </tr>
+                    <tr>
+                        <th class="td" scope="row" style="text-align:<?php echo is_rtl() ? 'right' : 'left'; ?>;"><?php esc_html_e('Expired on:', 'wc-licensed-product'); ?></th>
+                        <td class="td" style="text-align:<?php echo is_rtl() ? 'right' : 'left'; ?>; color: #dc3232; font-weight: 600;"><?php echo esc_html($this->expiration_date); ?></td>
+                    </tr>
+                    <tr>
+                        <th class="td" scope="row" style="text-align:<?php echo is_rtl() ? 'right' : 'left'; ?>;"><?php esc_html_e('Status:', 'wc-licensed-product'); ?></th>
+                        <td class="td" style="text-align:<?php echo is_rtl() ? 'right' : 'left'; ?>;">
+                            <span style="background: #f8d7da; color: #721c24; padding: 3px 10px; border-radius: 12px; font-size: 12px; font-weight: 500;">
+                                <?php esc_html_e('Expired', 'wc-licensed-product'); ?>
+                            </span>
+                        </td>
+                    </tr>
+                </tbody>
+            </table>
+        </div>
+
+        <?php
+        $additional_content = $this->get_additional_content();
+        if ($additional_content) :
+            ?>
+            <p><?php echo wp_kses_post($additional_content); ?></p>
+        <?php endif; ?>
+
+        <p style="margin-top: 25px;">
+            <a href="<?php echo esc_url($account_url); ?>" class="button" style="display: inline-block; background-color: #7f54b3; color: #ffffff; padding: 12px 24px; text-decoration: none; border-radius: 4px; font-weight: 600;">
+                <?php esc_html_e('View My Licenses', 'wc-licensed-product'); ?>
+            </a>
+        </p>
+        <?php
+    }
+
+    /**
+     * Render plain text email body content
+     */
+    private function render_email_body_plain(): void
+    {
+        printf(esc_html__('Hello %s,', 'wc-licensed-product'), esc_html($this->customer_name));
+        echo "\n\n";
+
+        printf(
+            esc_html__('Your license for %1$s has expired on %2$s.', 'wc-licensed-product'),
+            esc_html($this->product_name),
+            esc_html($this->expiration_date)
+        );
+        echo "\n\n";
+
+        echo esc_html__('Your license is no longer valid and the product will stop working until you renew.', 'wc-licensed-product');
+        echo "\n\n";
+
+        echo "----------\n";
+        echo esc_html__('Expired License Details', 'wc-licensed-product') . "\n";
+        echo "----------\n\n";
+
+        echo esc_html__('Product:', 'wc-licensed-product') . ' ' . esc_html($this->product_name) . "\n";
+        echo esc_html__('License Key:', 'wc-licensed-product') . ' ' . esc_html($this->license->getLicenseKey()) . "\n";
+        echo esc_html__('Domain:', 'wc-licensed-product') . ' ' . esc_html($this->license->getDomain()) . "\n";
+        echo esc_html__('Expired on:', 'wc-licensed-product') . ' ' . esc_html($this->expiration_date) . "\n";
+        echo esc_html__('Status:', 'wc-licensed-product') . ' ' . esc_html__('Expired', 'wc-licensed-product') . "\n\n";
+
+        $additional_content = $this->get_additional_content();
+        if ($additional_content) {
+            echo "----------\n\n";
+            echo esc_html(wp_strip_all_tags(wptexturize($additional_content)));
+            echo "\n\n";
+        }
+
+        echo esc_html__('View My Licenses', 'wc-licensed-product') . ': ' . esc_url(wc_get_account_endpoint_url('licenses')) . "\n\n";
+
+        echo "=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n";
+    }
+
+    /**
+     * Default content to show below main email content
+     */
+    public function get_default_additional_content(): string
+    {
+        return __('To continue using this product, please renew your license.', 'wc-licensed-product');
+    }
+
+    /**
+     * Initialize settings form fields
+     */
+    public function init_form_fields(): void
+    {
+        $placeholder_text = sprintf(
+            /* translators: %s: list of placeholders */
+            __('Available placeholders: %s', 'wc-licensed-product'),
+            '<code>{site_title}, {product_name}, {expiration_date}</code>'
+        );
+
+        $this->form_fields = [
+            'enabled' => [
+                'title' => __('Enable/Disable', 'wc-licensed-product'),
+                'type' => 'checkbox',
+                'label' => __('Enable this email notification', 'wc-licensed-product'),
+                'default' => 'yes',
+            ],
+            'subject' => [
+                'title' => __('Subject', 'wc-licensed-product'),
+                'type' => 'text',
+                'desc_tip' => true,
+                'description' => $placeholder_text,
+                'placeholder' => $this->get_default_subject(),
+                'default' => '',
+            ],
+            'heading' => [
+                'title' => __('Email heading', 'wc-licensed-product'),
+                'type' => 'text',
+                'desc_tip' => true,
+                'description' => $placeholder_text,
+                'placeholder' => $this->get_default_heading(),
+                'default' => '',
+            ],
+            'additional_content' => [
+                'title' => __('Additional content', 'wc-licensed-product'),
+                'description' => __('Text to appear below the main email content.', 'wc-licensed-product') . ' ' . $placeholder_text,
+                'css' => 'width:400px; height: 75px;',
+                'placeholder' => $this->get_default_additional_content(),
+                'type' => 'textarea',
+                'default' => '',
+                'desc_tip' => true,
+            ],
+            'email_type' => [
+                'title' => __('Email type', 'wc-licensed-product'),
+                'type' => 'select',
+                'description' => __('Choose which format of email to send.', 'wc-licensed-product'),
+                'default' => 'html',
+                'class' => 'email_type wc-enhanced-select',
+                'options' => $this->get_email_type_options(),
+                'desc_tip' => true,
+            ],
+        ];
+    }
+}

src/Frontend/AccountController.php

@@ -9,6 +9,7 @@ declare(strict_types=1);
 
 namespace Jeremias\WcLicensedProduct\Frontend;
 
+use Jeremias\WcLicensedProduct\Api\ResponseSigner;
 use Jeremias\WcLicensedProduct\License\LicenseManager;
 use Jeremias\WcLicensedProduct\Product\VersionManager;
 use Twig\Environment;
@@ -107,135 +108,250 @@ final class AccountController
 
         $licenses = $this->licenseManager->getLicensesByCustomer($customerId);
 
-        // Enrich licenses with product data and downloads
-        $enrichedLicenses = [];
-        foreach ($licenses as $license) {
-            $product = wc_get_product($license->getProductId());
-            $order = wc_get_order($license->getOrderId());
-
-            // Get available downloads for this license
-            $downloads = [];
-            if ($license->getStatus() === 'active') {
-                $versions = $this->versionManager->getVersionsByProduct($license->getProductId());
-                foreach ($versions as $version) {
-                    if ($version->isActive() && ($version->getAttachmentId() || $version->getDownloadUrl())) {
-                        $downloads[] = [
-                            'version' => $version->getVersion(),
-                            'version_id' => $version->getId(),
-                            'filename' => $version->getDownloadFilename(),
-                            'download_url' => $this->downloadController->generateDownloadUrl(
-                                $license->getId(),
-                                $version->getId()
-                            ),
-                            'release_notes' => $version->getReleaseNotes(),
-                            'released_at' => $version->getReleasedAt()->format(get_option('date_format')),
-                            'file_hash' => $version->getFileHash(),
-                        ];
-                    }
-                }
-            }
-
-            $enrichedLicenses[] = [
-                'license' => $license,
-                'product_name' => $product ? $product->get_name() : __('Unknown Product', 'wc-licensed-product'),
-                'product_url' => $product ? $product->get_permalink() : '',
-                'order_number' => $order ? $order->get_order_number() : '',
-                'order_url' => $order ? $order->get_view_order_url() : '',
-                'downloads' => $downloads,
-            ];
-        }
+        // Group licenses by product+order into "packages"
+        $packages = $this->groupLicensesIntoPackages($licenses);
 
         try {
             echo $this->twig->render('frontend/licenses.html.twig', [
-                'licenses' => $enrichedLicenses,
-                'has_licenses' => !empty($enrichedLicenses),
+                'packages' => $packages,
+                'has_packages' => !empty($packages),
+                'signing_enabled' => ResponseSigner::isSigningEnabled(),
             ]);
         } catch (\Exception $e) {
             // Fallback to PHP template if Twig fails
-            $this->displayLicensesFallback($enrichedLicenses);
+            $this->displayLicensesFallback($packages);
         }
     }
 
+    /**
+     * Group licenses into packages by product+order
+     *
+     * @param array $licenses Array of License objects
+     * @return array Array of package data
+     */
+    private function groupLicensesIntoPackages(array $licenses): array
+    {
+        $grouped = [];
+
+        foreach ($licenses as $license) {
+            $productId = $license->getProductId();
+            $orderId = $license->getOrderId();
+            $key = $productId . '_' . $orderId;
+
+            if (!isset($grouped[$key])) {
+                $product = wc_get_product($productId);
+                $order = wc_get_order($orderId);
+
+                $grouped[$key] = [
+                    'product_id' => $productId,
+                    'order_id' => $orderId,
+                    'product_name' => $product ? $product->get_name() : __('Unknown Product', 'wc-licensed-product'),
+                    'product_url' => $product ? $product->get_permalink() : '',
+                    'order_number' => $order ? $order->get_order_number() : '',
+                    'order_url' => $order ? $order->get_view_order_url() : '',
+                    'licenses' => [],
+                    'downloads' => [],
+                    'has_active_license' => false,
+                ];
+            }
+
+            // Add license to package
+            $grouped[$key]['licenses'][] = [
+                'id' => $license->getId(),
+                'license_key' => $license->getLicenseKey(),
+                'domain' => $license->getDomain(),
+                'status' => $license->getStatus(),
+                'expires_at' => $license->getExpiresAt(),
+                'is_transferable' => in_array($license->getStatus(), ['active', 'inactive'], true),
+                'customer_secret' => ResponseSigner::getCustomerSecretForLicense($license->getLicenseKey()),
+            ];
+
+            // Track if package has at least one active license
+            if ($license->getStatus() === 'active') {
+                $grouped[$key]['has_active_license'] = true;
+            }
+        }
+
+        // Add downloads for packages with active licenses
+        foreach ($grouped as $key => &$package) {
+            if ($package['has_active_license']) {
+                $package['downloads'] = $this->getDownloadsForProduct(
+                    $package['product_id'],
+                    $package['licenses'][0]['id'] // Use first license for download URL
+                );
+            }
+        }
+
+        // Sort by order date (newest first) - re-index array
+        return array_values($grouped);
+    }
+
+    /**
+     * Get downloads for a product
+     */
+    private function getDownloadsForProduct(int $productId, int $licenseId): array
+    {
+        $downloads = [];
+        $versions = $this->versionManager->getVersionsByProduct($productId);
+
+        foreach ($versions as $version) {
+            if ($version->isActive() && ($version->getAttachmentId() || $version->getDownloadUrl())) {
+                $downloads[] = [
+                    'version' => $version->getVersion(),
+                    'version_id' => $version->getId(),
+                    'filename' => $version->getDownloadFilename(),
+                    'download_url' => $this->downloadController->generateDownloadUrl(
+                        $licenseId,
+                        $version->getId()
+                    ),
+                    'release_notes' => $version->getReleaseNotes(),
+                    'released_at' => $version->getReleasedAt()->format(get_option('date_format')),
+                    'file_hash' => $version->getFileHash(),
+                ];
+            }
+        }
+
+        return $downloads;
+    }
+
     /**
      * Fallback display method if Twig is unavailable
      */
-    private function displayLicensesFallback(array $enrichedLicenses): void
+    private function displayLicensesFallback(array $packages): void
     {
-        if (empty($enrichedLicenses)) {
+        if (empty($packages)) {
             echo '<p>' . esc_html__('You have no licenses yet.', 'wc-licensed-product') . '</p>';
             return;
         }
 
         ?>
         <div class="woocommerce-licenses">
-            <?php foreach ($enrichedLicenses as $item): ?>
-                <div class="license-card">
-                    <div class="license-header">
+            <?php foreach ($packages as $package): ?>
+                <div class="license-package">
+                    <div class="package-header">
                         <h3>
-                            <?php if ($item['product_url']): ?>
-                                <a href="<?php echo esc_url($item['product_url']); ?>">
-                                    <?php echo esc_html($item['product_name']); ?>
+                            <?php if ($package['product_url']): ?>
+                                <a href="<?php echo esc_url($package['product_url']); ?>">
+                                    <?php echo esc_html($package['product_name']); ?>
                                 </a>
                             <?php else: ?>
-                                <?php echo esc_html($item['product_name']); ?>
+                                <?php echo esc_html($package['product_name']); ?>
                             <?php endif; ?>
                         </h3>
-                        <span class="license-status license-status-<?php echo esc_attr($item['license']->getStatus()); ?>">
-                            <?php echo esc_html(ucfirst($item['license']->getStatus())); ?>
+                        <span class="package-order">
+                            <?php
+                            printf(
+                                /* translators: %s: order number */
+                                esc_html__('Order #%s', 'wc-licensed-product'),
+                                esc_html($package['order_number'])
+                            );
+                            ?>
                         </span>
                     </div>
 
-                    <div class="license-details">
-                        <div class="license-key-row">
-                            <label><?php esc_html_e('License Key:', 'wc-licensed-product'); ?></label>
-                            <code class="license-key" data-license-key="<?php echo esc_attr($item['license']->getLicenseKey()); ?>">
-                                <?php echo esc_html($item['license']->getLicenseKey()); ?>
-                            </code>
-                            <button type="button" class="copy-license-btn" data-license-key="<?php echo esc_attr($item['license']->getLicenseKey()); ?>" title="<?php esc_attr_e('Copy to clipboard', 'wc-licensed-product'); ?>">
-                                <span class="dashicons dashicons-clipboard"></span>
-                            </button>
-                        </div>
-
-                        <div class="license-info-row">
-                            <span class="license-domain-display" data-license-id="<?php echo esc_attr($item['license']->getId()); ?>">
-                                <strong><?php esc_html_e('Domain:', 'wc-licensed-product'); ?></strong>
-                                <span class="domain-value"><?php echo esc_html($item['license']->getDomain()); ?></span>
-                                <?php if (in_array($item['license']->getStatus(), ['active', 'inactive'], true)): ?>
-                                    <button type="button" class="wclp-transfer-btn"
-                                            data-license-id="<?php echo esc_attr($item['license']->getId()); ?>"
-                                            data-current-domain="<?php echo esc_attr($item['license']->getDomain()); ?>"
-                                            title="<?php esc_attr_e('Transfer to new domain', 'wc-licensed-product'); ?>">
-                                        <span class="dashicons dashicons-randomize"></span>
-                                        <?php esc_html_e('Transfer', 'wc-licensed-product'); ?>
-                                    </button>
-                                <?php endif; ?>
-                            </span>
-                            <span><strong><?php esc_html_e('Expires:', 'wc-licensed-product'); ?></strong>
-                                <?php
-                                $expiresAt = $item['license']->getExpiresAt();
-                                echo $expiresAt
-                                    ? esc_html($expiresAt->format(get_option('date_format')))
-                                    : esc_html__('Never', 'wc-licensed-product');
-                                ?>
-                            </span>
-                        </div>
+                    <div class="package-licenses">
+                        <?php foreach ($package['licenses'] as $license): ?>
+                            <div class="license-entry license-entry-<?php echo esc_attr($license['status']); ?>">
+                                <div class="license-row-primary">
+                                    <div class="license-key-group">
+                                        <code class="license-key"><?php echo esc_html($license['license_key']); ?></code>
+                                        <span class="license-status license-status-<?php echo esc_attr($license['status']); ?>">
+                                            <?php echo esc_html(ucfirst($license['status'])); ?>
+                                        </span>
+                                    </div>
+                                    <div class="license-actions">
+                                        <button type="button" class="copy-license-btn" data-license-key="<?php echo esc_attr($license['license_key']); ?>" title="<?php esc_attr_e('Copy to clipboard', 'wc-licensed-product'); ?>">
+                                            <span class="dashicons dashicons-clipboard"></span>
+                                        </button>
+                                        <?php if ($license['is_transferable']): ?>
+                                            <button type="button" class="wclp-transfer-btn"
+                                                    data-license-id="<?php echo esc_attr($license['id']); ?>"
+                                                    data-current-domain="<?php echo esc_attr($license['domain']); ?>"
+                                                    title="<?php esc_attr_e('Transfer to new domain', 'wc-licensed-product'); ?>">
+                                                <span class="dashicons dashicons-randomize"></span>
+                                            </button>
+                                        <?php endif; ?>
+                                    </div>
+                                </div>
+                                <div class="license-row-secondary">
+                                    <span class="license-meta-item license-domain">
+                                        <span class="dashicons dashicons-admin-site-alt3"></span>
+                                        <?php echo esc_html($license['domain']); ?>
+                                    </span>
+                                    <span class="license-meta-item license-expiry">
+                                        <span class="dashicons dashicons-calendar-alt"></span>
+                                        <?php
+                                        echo $license['expires_at']
+                                            ? esc_html($license['expires_at']->format('Y-m-d'))
+                                            : '<span class="lifetime">' . esc_html__('Lifetime', 'wc-licensed-product') . '</span>';
+                                        ?>
+                                    </span>
+                                </div>
+                            </div>
+                        <?php endforeach; ?>
                     </div>
 
-                    <?php if (!empty($item['downloads'])): ?>
-                        <div class="license-downloads">
+                    <?php if (!empty($package['downloads'])): ?>
+                        <div class="package-downloads">
                             <h4><?php esc_html_e('Available Downloads', 'wc-licensed-product'); ?></h4>
                             <ul class="download-list">
-                                <?php foreach ($item['downloads'] as $download): ?>
-                                    <li>
-                                        <a href="<?php echo esc_url($download['download_url']); ?>" class="download-link">
+                                <?php
+                                $latest = $package['downloads'][0];
+                                ?>
+                                <li class="download-item download-item-latest">
+                                    <div class="download-row-file">
+                                        <a href="<?php echo esc_url($latest['download_url']); ?>" class="download-link">
                                             <span class="dashicons dashicons-download"></span>
-                                            <?php echo esc_html($download['filename'] ?: sprintf(__('Version %s', 'wc-licensed-product'), $download['version'])); ?>
+                                            <?php echo esc_html($latest['filename'] ?: sprintf(__('Version %s', 'wc-licensed-product'), $latest['version'])); ?>
                                         </a>
-                                        <span class="download-version">v<?php echo esc_html($download['version']); ?></span>
-                                        <span class="download-date"><?php echo esc_html($download['released_at']); ?></span>
-                                    </li>
-                                <?php endforeach; ?>
+                                        <span class="download-version-badge"><?php esc_html_e('Latest', 'wc-licensed-product'); ?></span>
+                                    </div>
+                                    <div class="download-row-meta">
+                                        <span class="download-date"><?php echo esc_html($latest['released_at']); ?></span>
+                                        <?php if (!empty($latest['file_hash'])): ?>
+                                            <span class="download-hash" title="<?php echo esc_attr($latest['file_hash']); ?>">
+                                                <span class="dashicons dashicons-shield"></span>
+                                                <code><?php echo esc_html(substr($latest['file_hash'], 0, 12)); ?>...</code>
+                                            </span>
+                                        <?php endif; ?>
+                                    </div>
+                                </li>
                             </ul>
+
+                            <?php if (count($package['downloads']) > 1): ?>
+                                <div class="older-versions-section">
+                                    <button type="button" class="older-versions-toggle" aria-expanded="false">
+                                        <span class="dashicons dashicons-arrow-down-alt2"></span>
+                                        <?php
+                                        printf(
+                                            esc_html__('Older versions (%d)', 'wc-licensed-product'),
+                                            count($package['downloads']) - 1
+                                        );
+                                        ?>
+                                    </button>
+                                    <ul class="download-list older-versions-list" style="display: none;">
+                                        <?php foreach (array_slice($package['downloads'], 1) as $download): ?>
+                                            <li class="download-item">
+                                                <div class="download-row-file">
+                                                    <a href="<?php echo esc_url($download['download_url']); ?>" class="download-link">
+                                                        <span class="dashicons dashicons-download"></span>
+                                                        <?php echo esc_html($download['filename'] ?: sprintf(__('Version %s', 'wc-licensed-product'), $download['version'])); ?>
+                                                    </a>
+                                                </div>
+                                                <div class="download-row-meta">
+                                                    <span class="download-date"><?php echo esc_html($download['released_at']); ?></span>
+                                                    <?php if (!empty($download['file_hash'])): ?>
+                                                        <span class="download-hash" title="<?php echo esc_attr($download['file_hash']); ?>">
+                                                            <span class="dashicons dashicons-shield"></span>
+                                                            <code><?php echo esc_html(substr($download['file_hash'], 0, 12)); ?>...</code>
+                                                        </span>
+                                                    <?php endif; ?>
+                                                </div>
+                                            </li>
+                                        <?php endforeach; ?>
+                                    </ul>
+                                </div>
+                            <?php endif; ?>
                         </div>
                     <?php endif; ?>
                 </div>

src/Frontend/DownloadController.php

@@ -35,6 +35,9 @@ final class DownloadController
         // Add download endpoint
         add_action('init', [$this, 'addDownloadEndpoint']);
 
+        // Register query var for the endpoint
+        add_filter('query_vars', [$this, 'addDownloadQueryVar']);
+
         // Handle download requests
         add_action('template_redirect', [$this, 'handleDownloadRequest']);
     }
@@ -47,6 +50,15 @@ final class DownloadController
         add_rewrite_endpoint('license-download', EP_ROOT | EP_PAGES);
     }
 
+    /**
+     * Register the download query var
+     */
+    public function addDownloadQueryVar(array $vars): array
+    {
+        $vars[] = 'license-download';
+        return $vars;
+    }
+
     /**
      * Handle download request
      */
@@ -160,8 +172,12 @@ final class DownloadController
         $downloadUrl = $version->getDownloadUrl();
 
         if ($attachmentId) {
+            // Increment download count before serving
+            $this->versionManager->incrementDownloadCount($versionId);
             $this->serveAttachment($attachmentId, $version->getVersion());
         } elseif ($downloadUrl) {
+            // Increment download count before redirect
+            $this->versionManager->incrementDownloadCount($versionId);
             // Redirect to external URL
             wp_redirect($downloadUrl);
             exit;

src/Installer.php

@@ -31,17 +31,41 @@ final class Installer
     {
         self::createTables();
         self::createCacheDir();
+        self::registerProductTypes();
 
         // Set version in options
         update_option('wc_licensed_product_version', WC_LICENSED_PRODUCT_VERSION);
 
-        // Register the licenses endpoint before flushing rewrite rules
+        // Register endpoints before flushing rewrite rules
         add_rewrite_endpoint('licenses', EP_ROOT | EP_PAGES);
+        add_rewrite_endpoint('license-download', EP_ROOT | EP_PAGES);
 
         // Flush rewrite rules for REST API and My Account endpoints
         flush_rewrite_rules();
     }
 
+    /**
+     * Register custom product type terms in the product_type taxonomy
+     * This is required for WC_Product_Factory::get_product_type() to work correctly
+     */
+    public static function registerProductTypes(): void
+    {
+        // Ensure WooCommerce taxonomies are registered
+        if (!taxonomy_exists('product_type')) {
+            return;
+        }
+
+        // Register 'licensed' product type term if it doesn't exist
+        if (!term_exists('licensed', 'product_type')) {
+            wp_insert_term('licensed', 'product_type');
+        }
+
+        // Register 'licensed-variable' product type term if it doesn't exist
+        if (!term_exists('licensed-variable', 'product_type')) {
+            wp_insert_term('licensed-variable', 'product_type');
+        }
+    }
+
     /**
      * Run on plugin deactivation
      */
@@ -103,6 +127,7 @@ final class Installer
             download_url VARCHAR(512) DEFAULT NULL,
             attachment_id BIGINT UNSIGNED DEFAULT NULL,
             file_hash VARCHAR(64) DEFAULT NULL,
+            download_count BIGINT UNSIGNED NOT NULL DEFAULT 0,
             is_active TINYINT(1) NOT NULL DEFAULT 1,
             released_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
             created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,

src/License/LicenseManager.php

@@ -11,12 +11,51 @@ namespace Jeremias\WcLicensedProduct\License;
 
 use Jeremias\WcLicensedProduct\Installer;
 use Jeremias\WcLicensedProduct\Product\LicensedProduct;
+use Jeremias\WcLicensedProduct\Product\LicensedProductVariation;
+use Jeremias\WcLicensedProduct\Product\LicensedVariableProduct;
 
 /**
  * Manages license operations (CRUD, validation, generation)
  */
 class LicenseManager
 {
+    /**
+     * Check if a product is any type of licensed product
+     *
+     * @param \WC_Product $product Product to check
+     * @return bool True if product is licensed (simple or variable or variation)
+     */
+    public function isLicensedProduct(\WC_Product $product): bool
+    {
+        // Simple licensed product
+        if ($product->is_type('licensed')) {
+            return true;
+        }
+
+        // Variable licensed product
+        if ($product->is_type('licensed-variable')) {
+            return true;
+        }
+
+        // Check for our custom variation class
+        if ($product instanceof LicensedProductVariation) {
+            return true;
+        }
+
+        // Variation of a licensed-variable product
+        // Use WC_Product_Factory::get_product_type() for reliable parent type check
+        // This queries the database directly and doesn't depend on product class loading
+        $parentId = $product->get_parent_id();
+        if ($parentId) {
+            $parentType = \WC_Product_Factory::get_product_type($parentId);
+            if ($parentType === 'licensed-variable') {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
     /**
      * Generate a unique license key
      */
@@ -40,29 +79,63 @@ class LicenseManager
 
     /**
      * Generate a license for a completed order
+     *
+     * @param int $orderId Order ID
+     * @param int $productId Product ID (parent product for variations)
+     * @param int $customerId Customer ID
+     * @param string $domain Domain to bind the license to
+     * @param int|null $variationId Optional variation ID for variable licensed products
+     * @return License|null Generated license or null on failure
      */
     public function generateLicense(
         int $orderId,
         int $productId,
         int $customerId,
-        string $domain
+        string $domain,
+        ?int $variationId = null
     ): ?License {
         global $wpdb;
 
-        // Check if license already exists for this order and product
-        $existing = $this->getLicenseByOrderAndProduct($orderId, $productId);
+        // Normalize domain first for duplicate detection
+        $normalizedDomain = $this->normalizeDomain($domain);
+
+        // Check if license already exists for this order, product, domain, and variation
+        $existing = $this->getLicenseByOrderProductDomainAndVariation($orderId, $productId, $normalizedDomain, $variationId);
         if ($existing) {
             return $existing;
         }
 
-        $product = wc_get_product($productId);
-        if (!$product || !$product->is_type('licensed')) {
-            return null;
+        // Load the product that has the license settings
+        // For variations, load the variation; otherwise load the parent product
+        if ($variationId) {
+            $settingsProduct = wc_get_product($variationId);
+
+            // Verify parent is licensed-variable using DB-level type check
+            $parentType = \WC_Product_Factory::get_product_type($productId);
+            if ($parentType !== 'licensed-variable') {
+                return null;
+            }
+
+            // Ensure we have the proper variation class
+            if ($settingsProduct && !$settingsProduct instanceof LicensedProductVariation) {
+                $settingsProduct = new LicensedProductVariation($variationId);
+            }
+        } else {
+            $settingsProduct = wc_get_product($productId);
+
+            // Check if this is a licensed product (simple)
+            if (!$settingsProduct || !$settingsProduct->is_type('licensed')) {
+                return null;
+            }
+
+            // Ensure we have the LicensedProduct instance for type hints
+            if (!$settingsProduct instanceof LicensedProduct) {
+                $settingsProduct = new LicensedProduct($productId);
+            }
         }
 
-        // Ensure we have the LicensedProduct instance for type hints
-        if (!$product instanceof LicensedProduct) {
-            $product = new LicensedProduct($productId);
+        if (!$settingsProduct) {
+            return null;
         }
 
         // Generate unique license key
@@ -71,16 +144,16 @@ class LicenseManager
             $licenseKey = $this->generateLicenseKey();
         }
 
-        // Calculate expiration date
+        // Calculate expiration date from the settings product (variation or parent)
         $expiresAt = null;
-        $validityDays = $product->get_validity_days();
+        $validityDays = $settingsProduct->get_validity_days();
         if ($validityDays !== null && $validityDays > 0) {
             $expiresAt = (new \DateTimeImmutable())->modify("+{$validityDays} days")->format('Y-m-d H:i:s');
         }
 
-        // Determine version ID if bound to version
+        // Determine version ID if bound to version (always use parent product ID for versions)
         $versionId = null;
-        if ($product->is_bound_to_version()) {
+        if ($settingsProduct->is_bound_to_version()) {
             $versionId = $this->getCurrentVersionId($productId);
         }
 
@@ -96,7 +169,7 @@ class LicenseManager
                 'version_id' => $versionId,
                 'status' => License::STATUS_ACTIVE,
                 'activations_count' => 1,
-                'max_activations' => $product->get_max_activations(),
+                'max_activations' => $settingsProduct->get_max_activations(),
                 'expires_at' => $expiresAt,
             ],
             ['%s', '%d', '%d', '%d', '%s', '%d', '%s', '%d', '%d', '%s']
@@ -109,6 +182,16 @@ class LicenseManager
         return $this->getLicenseById((int) $wpdb->insert_id);
     }
 
+    /**
+     * Get license by order, product, domain, and optional variation
+     */
+    public function getLicenseByOrderProductDomainAndVariation(int $orderId, int $productId, string $domain, ?int $variationId = null): ?License
+    {
+        // For now, just use the existing method since we don't store variation_id in licenses table yet
+        // In the future, we could add a variation_id column to the licenses table
+        return $this->getLicenseByOrderProductAndDomain($orderId, $productId, $domain);
+    }
+
     /**
      * Get license by ID
      */
@@ -161,6 +244,49 @@ class LicenseManager
         return $row ? License::fromArray($row) : null;
     }
 
+    /**
+     * Get all licenses for an order and product
+     *
+     * @return License[]
+     */
+    public function getLicensesByOrderAndProduct(int $orderId, int $productId): array
+    {
+        global $wpdb;
+
+        $tableName = Installer::getLicensesTable();
+        $rows = $wpdb->get_results(
+            $wpdb->prepare(
+                "SELECT * FROM {$tableName} WHERE order_id = %d AND product_id = %d ORDER BY created_at ASC",
+                $orderId,
+                $productId
+            ),
+            ARRAY_A
+        );
+
+        return array_map(fn(array $row) => License::fromArray($row), $rows ?: []);
+    }
+
+    /**
+     * Get license by order, product, and domain
+     */
+    public function getLicenseByOrderProductAndDomain(int $orderId, int $productId, string $domain): ?License
+    {
+        global $wpdb;
+
+        $tableName = Installer::getLicensesTable();
+        $row = $wpdb->get_row(
+            $wpdb->prepare(
+                "SELECT * FROM {$tableName} WHERE order_id = %d AND product_id = %d AND domain = %s",
+                $orderId,
+                $productId,
+                $domain
+            ),
+            ARRAY_A
+        );
+
+        return $row ? License::fromArray($row) : null;
+    }
+
     /**
      * Get all licenses for an order
      */
@@ -862,6 +988,56 @@ class LicenseManager
         return (bool) get_user_meta($license->getCustomerId(), $metaKey, true);
     }
 
+    /**
+     * Get licenses that have passed their expiration date but are still marked as active
+     *
+     * @return array Array of License objects that need to be auto-expired
+     */
+    public function getExpiredActiveLicenses(): array
+    {
+        global $wpdb;
+
+        $tableName = Installer::getLicensesTable();
+        $now = new \DateTimeImmutable();
+
+        $sql = "SELECT * FROM {$tableName}
+                WHERE expires_at IS NOT NULL
+                AND expires_at < %s
+                AND status = %s";
+
+        $rows = $wpdb->get_results(
+            $wpdb->prepare($sql, $now->format('Y-m-d H:i:s'), License::STATUS_ACTIVE),
+            ARRAY_A
+        );
+
+        return array_map(fn(array $row) => License::fromArray($row), $rows ?: []);
+    }
+
+    /**
+     * Auto-expire a license and return true if status was changed
+     *
+     * @param int $licenseId License ID
+     * @return bool True if license was expired, false if already expired or error
+     */
+    public function autoExpireLicense(int $licenseId): bool
+    {
+        $license = $this->getLicenseById($licenseId);
+        if (!$license) {
+            return false;
+        }
+
+        // Only expire if currently active and past expiration date
+        if ($license->getStatus() !== License::STATUS_ACTIVE) {
+            return false;
+        }
+
+        if (!$license->isExpired()) {
+            return false;
+        }
+
+        return $this->updateLicenseStatus($licenseId, License::STATUS_EXPIRED);
+    }
+
     /**
      * Import a license from CSV data
      *

src/License/PluginLicenseChecker.php

@@ -52,6 +52,11 @@ final class PluginLicenseChecker
      */
     private ?bool $isLocalhostCached = null;
 
+    /**
+     * Cached self-licensing check result
+     */
+    private ?bool $isSelfLicensingCached = null;
+
     /**
      * Get singleton instance
      */
@@ -84,6 +89,11 @@ final class PluginLicenseChecker
             return true;
         }
 
+        // Always valid when self-licensing (server URL points to this installation)
+        if ($this->isSelfLicensing()) {
+            return true;
+        }
+
         // Check cache first
         $cached = get_transient(self::CACHE_KEY);
         if ($cached !== false) {
@@ -107,6 +117,11 @@ final class PluginLicenseChecker
             return true;
         }
 
+        // Always valid when self-licensing (server URL points to this installation)
+        if ($this->isSelfLicensing()) {
+            return true;
+        }
+
         // Check settings are configured
         $serverUrl = $this->getLicenseServerUrl();
         $licenseKey = $this->getLicenseKey();
@@ -176,6 +191,7 @@ final class PluginLicenseChecker
         delete_transient(self::CACHE_KEY);
         delete_transient(self::ERROR_CACHE_KEY);
         $this->isLocalhostCached = null;
+        $this->isSelfLicensingCached = null;
     }
 
     /**
@@ -215,6 +231,60 @@ final class PluginLicenseChecker
         return false;
     }
 
+    /**
+     * Check if self-licensing (license server URL points to this installation)
+     *
+     * Prevents circular dependency where plugin tries to validate against itself.
+     * Plugins can only be validated against the original store from which they were obtained.
+     */
+    public function isSelfLicensing(): bool
+    {
+        if ($this->isSelfLicensingCached !== null) {
+            return $this->isSelfLicensingCached;
+        }
+
+        $serverUrl = $this->getLicenseServerUrl();
+
+        // No server URL configured - not self-licensing
+        if (empty($serverUrl)) {
+            $this->isSelfLicensingCached = false;
+            return false;
+        }
+
+        // Parse both URLs to compare domains
+        $serverParsed = parse_url($serverUrl);
+        $siteUrl = get_site_url();
+        $siteParsed = parse_url($siteUrl);
+
+        // Get normalized domains (lowercase, no www prefix)
+        $serverDomain = $this->normalizeDomain($serverParsed['host'] ?? '');
+        $siteDomain = $this->normalizeDomain($siteParsed['host'] ?? '');
+
+        // If domains match, this is self-licensing
+        if ($serverDomain === $siteDomain) {
+            $this->isSelfLicensingCached = true;
+            return true;
+        }
+
+        $this->isSelfLicensingCached = false;
+        return false;
+    }
+
+    /**
+     * Normalize a domain for comparison (lowercase, strip www)
+     */
+    private function normalizeDomain(string $domain): string
+    {
+        $domain = strtolower(trim($domain));
+
+        // Strip www. prefix
+        if (str_starts_with($domain, 'www.')) {
+            $domain = substr($domain, 4);
+        }
+
+        return $domain;
+    }
+
     /**
      * Get the current domain from the site URL
      */

src/Plugin.php

@@ -10,11 +10,14 @@ declare(strict_types=1);
 namespace Jeremias\WcLicensedProduct;
 
 use Jeremias\WcLicensedProduct\Admin\AdminController;
+use Jeremias\WcLicensedProduct\Admin\DashboardWidgetController;
+use Jeremias\WcLicensedProduct\Admin\DownloadWidgetController;
 use Jeremias\WcLicensedProduct\Admin\OrderLicenseController;
 use Jeremias\WcLicensedProduct\Admin\SettingsController;
 use Jeremias\WcLicensedProduct\Admin\VersionAdminController;
 use Jeremias\WcLicensedProduct\Api\ResponseSigner;
 use Jeremias\WcLicensedProduct\Api\RestApiController;
+use Jeremias\WcLicensedProduct\Api\UpdateController;
 use Jeremias\WcLicensedProduct\Checkout\CheckoutBlocksIntegration;
 use Jeremias\WcLicensedProduct\Checkout\CheckoutController;
 use Jeremias\WcLicensedProduct\Checkout\StoreApiExtension;
@@ -25,6 +28,7 @@ use Jeremias\WcLicensedProduct\License\LicenseManager;
 use Jeremias\WcLicensedProduct\License\PluginLicenseChecker;
 use Jeremias\WcLicensedProduct\Product\LicensedProductType;
 use Jeremias\WcLicensedProduct\Product\VersionManager;
+use Jeremias\WcLicensedProduct\Update\PluginUpdateChecker;
 use Twig\Environment;
 use Twig\Loader\FilesystemLoader;
 
@@ -97,6 +101,7 @@ final class Plugin
         $this->twig = new Environment($loader, [
             'cache' => WP_CONTENT_DIR . '/cache/wc-licensed-product/twig',
             'auto_reload' => true, // Always check for template changes
+            'autoescape' => 'html', // Explicitly enable HTML autoescape for XSS protection
         ]);
 
         // Add WordPress functions as Twig functions
@@ -136,8 +141,9 @@ final class Plugin
             new AccountController($this->twig, $this->licenseManager, $this->versionManager, $this->downloadController);
         }
 
-        // Always initialize REST API and email controller
+        // Always initialize REST API, update API, and email controller
         new RestApiController($this->licenseManager);
+        new UpdateController($this->licenseManager, $this->versionManager);
         new LicenseEmailController($this->licenseManager);
 
         // Initialize response signing if server secret is configured
@@ -151,12 +157,20 @@ final class Plugin
             new VersionAdminController($this->versionManager);
             new OrderLicenseController($this->licenseManager);
             new SettingsController();
+            new DashboardWidgetController($this->licenseManager);
+            new DownloadWidgetController($this->versionManager);
 
             // Show admin notice if unlicensed and not on localhost
             if (!$isLicensed && !$licenseChecker->isLocalhost()) {
                 add_action('admin_notices', [$this, 'showUnlicensedNotice']);
             }
         }
+
+        // Initialize update checker if license server is configured (client-side updates)
+        $serverUrl = SettingsController::getPluginLicenseServerUrl();
+        if (!empty($serverUrl) && !$licenseChecker->isSelfLicensing()) {
+            PluginUpdateChecker::getInstance()->register();
+        }
     }
 
     /**
@@ -203,22 +217,106 @@ final class Plugin
             return;
         }
 
+        // Try new multi-domain format first
+        $domainData = $order->get_meta('_licensed_product_domains');
+
+        if (!empty($domainData) && is_array($domainData)) {
+            $this->generateLicensesMultiDomain($order, $domainData);
+            return;
+        }
+
+        // Fall back to legacy single domain format
+        $this->generateLicensesSingleDomain($order);
+    }
+
+    /**
+     * Generate licenses for new multi-domain format
+     */
+    private function generateLicensesMultiDomain(\WC_Order $order, array $domainData): void
+    {
+        $orderId = $order->get_id();
+        $customerId = $order->get_customer_id();
+
+        // Index domains by product ID (and variation ID for variable products)
+        $domainsByProduct = [];
+        foreach ($domainData as $item) {
+            if (isset($item['product_id']) && isset($item['domains']) && is_array($item['domains'])) {
+                $productId = (int) $item['product_id'];
+                $variationId = isset($item['variation_id']) ? (int) $item['variation_id'] : 0;
+                $key = $variationId > 0 ? "{$productId}_{$variationId}" : (string) $productId;
+                $domainsByProduct[$key] = [
+                    'domains' => $item['domains'],
+                    'variation_id' => $variationId,
+                ];
+            }
+        }
+
+        // Generate licenses for each licensed product
         foreach ($order->get_items() as $item) {
             $product = $item->get_product();
-            if ($product && $product->is_type('licensed')) {
-                $domain = $order->get_meta('_licensed_product_domain');
-                if ($domain) {
+
+            if (!$product) {
+                continue;
+            }
+
+            if (!$this->licenseManager->isLicensedProduct($product)) {
+                continue;
+            }
+
+            // Get the parent product ID (for variations, this is the main product)
+            $productId = $product->is_type('variation') ? $product->get_parent_id() : $product->get_id();
+            $variationId = $item->get_variation_id();
+
+            // Look up domains - first try with variation, then without
+            $key = $variationId > 0 ? "{$productId}_{$variationId}" : (string) $productId;
+            $domainInfo = $domainsByProduct[$key] ?? $domainsByProduct[(string) $productId] ?? null;
+            $domains = $domainInfo['domains'] ?? [];
+
+            // Generate a license for each domain
+            foreach ($domains as $domain) {
+                if (!empty($domain)) {
                     $this->licenseManager->generateLicense(
                         $orderId,
-                        $product->get_id(),
-                        $order->get_customer_id(),
-                        $domain
+                        $productId,
+                        $customerId,
+                        $domain,
+                        $variationId > 0 ? $variationId : null
                     );
                 }
             }
         }
     }
 
+    /**
+     * Generate licenses for legacy single domain format
+     */
+    private function generateLicensesSingleDomain(\WC_Order $order): void
+    {
+        $domain = $order->get_meta('_licensed_product_domain');
+
+        if (empty($domain)) {
+            return;
+        }
+
+        foreach ($order->get_items() as $item) {
+            $product = $item->get_product();
+
+            if ($product && $this->licenseManager->isLicensedProduct($product)) {
+                // Get the parent product ID (for variations, this is the main product)
+                $productId = $product->is_type('variation') ? $product->get_parent_id() : $product->get_id();
+                $variationId = $item->get_variation_id();
+
+                $this->licenseManager->generateLicense(
+                    $order->get_id(),
+                    $productId,
+                    $order->get_customer_id(),
+                    $domain,
+                    $variationId > 0 ? $variationId : null
+                );
+            }
+        }
+    }
+
     /**
      * Get Twig environment
      */

src/Product/LicensedProduct.php

@@ -55,6 +55,14 @@ class LicensedProduct extends WC_Product
         return $this->exists() && $this->get_price() !== '';
     }
 
+    /**
+     * Licensed products are always in stock (virtual, no inventory)
+     */
+    public function is_in_stock(): bool
+    {
+        return true;
+    }
+
     /**
      * Get max activations for this product
      * Falls back to default settings if not set on product

src/Product/LicensedProductType.php

@@ -12,7 +12,8 @@ namespace Jeremias\WcLicensedProduct\Product;
 use Jeremias\WcLicensedProduct\Admin\SettingsController;
 
 /**
- * Registers and handles the Licensed product type for WooCommerce
+ * Registers and handles the Licensed product types for WooCommerce
+ * Supports both simple licensed products and variable licensed products
  */
 final class LicensedProductType
 {
@@ -29,9 +30,12 @@ final class LicensedProductType
      */
     private function registerHooks(): void
     {
-        // Register product type
+        // Ensure product type terms exist in taxonomy (for WC_Product_Factory::get_product_type())
+        add_action('woocommerce_init', [$this, 'ensureProductTypeTermsExist']);
+
+        // Register product types
         add_filter('product_type_selector', [$this, 'addProductType']);
-        add_filter('woocommerce_product_class', [$this, 'getProductClass'], 10, 2);
+        add_filter('woocommerce_product_class', [$this, 'getProductClass'], 10, 4);
 
         // Add product data tabs
         add_filter('woocommerce_product_data_tabs', [$this, 'addProductDataTab']);
@@ -39,45 +43,121 @@ final class LicensedProductType
 
         // Save product meta
         add_action('woocommerce_process_product_meta_licensed', [$this, 'saveProductMeta']);
+        add_action('woocommerce_process_product_meta_licensed-variable', [$this, 'saveProductMeta']);
 
         // Show price and add to cart for licensed products
         add_action('woocommerce_licensed_add_to_cart', [$this, 'addToCartTemplate']);
+        add_action('woocommerce_licensed-variable_add_to_cart', [$this, 'variableAddToCartTemplate']);
+
+        // Use variable product add-to-cart handler for licensed-variable products
+        add_filter('woocommerce_add_to_cart_handler', [$this, 'addToCartHandler'], 10, 2);
 
         // Make product virtual by default
         add_filter('woocommerce_product_is_virtual', [$this, 'isVirtual'], 10, 2);
+
+        // Hide stock HTML for licensed products
+        add_filter('woocommerce_get_stock_html', [$this, 'hideStockHtml'], 10, 2);
+        add_filter('woocommerce_get_availability', [$this, 'hideAvailability'], 10, 2);
+        add_filter('woocommerce_get_availability_text', [$this, 'hideAvailabilityText'], 10, 2);
+        add_filter('woocommerce_product_get_stock_quantity', [$this, 'hideStockQuantity'], 10, 2);
+        add_filter('woocommerce_product_variation_get_stock_quantity', [$this, 'hideStockQuantity'], 10, 2);
+
+        // Display current version under product title on single product page
+        add_action('woocommerce_single_product_summary', [$this, 'displayCurrentVersion'], 6);
+
+        // Enqueue frontend CSS for licensed products on single product pages
+        add_action('wp_enqueue_scripts', [$this, 'enqueueFrontendStyles']);
+
+        // Variable product support - variation settings
+        add_action('woocommerce_variation_options', [$this, 'addVariationOptions'], 10, 3);
+        add_action('woocommerce_product_after_variable_attributes', [$this, 'addVariationFields'], 10, 3);
+        add_action('woocommerce_save_product_variation', [$this, 'saveVariationFields'], 10, 2);
+
+        // Admin scripts for licensed-variable type
+        add_action('admin_footer', [$this, 'addVariableProductScripts']);
     }
 
     /**
-     * Add product type to selector
+     * Ensure product type terms exist in the product_type taxonomy
+     * This is required for WC_Product_Factory::get_product_type() to work correctly
+     */
+    public function ensureProductTypeTermsExist(): void
+    {
+        \Jeremias\WcLicensedProduct\Installer::registerProductTypes();
+    }
+
+    /**
+     * Add product types to selector
      */
     public function addProductType(array $types): array
     {
         $types['licensed'] = __('Licensed Product', 'wc-licensed-product');
+        $types['licensed-variable'] = __('Licensed Variable Product', 'wc-licensed-product');
         return $types;
     }
 
     /**
-     * Get product class for licensed type
+     * Get product class for licensed types
+     *
+     * @param string $className Default class name
+     * @param string $productType Product type
+     * @param string $postType Post type (usually 'product' or 'product_variation')
+     * @param mixed  $productId Product ID (can be int or string)
      */
-    public function getProductClass(string $className, string $productType): string
+    public function getProductClass(string $className, string $productType, string $postType = '', $productId = 0): string
     {
         if ($productType === 'licensed') {
             return LicensedProduct::class;
         }
+        if ($productType === 'licensed-variable') {
+            return LicensedVariableProduct::class;
+        }
+        // Handle variations of licensed-variable products
+        // Check both by product type and by post type for variations
+        if ($productType === 'variation' || $postType === 'product_variation') {
+            // Get parent ID from the product post
+            $parentId = 0;
+            $productIdInt = (int) $productId;
+            if ($productIdInt > 0) {
+                $parentId = wp_get_post_parent_id($productIdInt);
+            }
+            // Fallback to global $post if product ID not available
+            if (!$parentId) {
+                global $post;
+                if ($post && $post->post_parent) {
+                    $parentId = (int) $post->post_parent;
+                }
+            }
+
+            if ($parentId) {
+                $parentType = \WC_Product_Factory::get_product_type($parentId);
+                if ($parentType === 'licensed-variable') {
+                    return LicensedProductVariation::class;
+                }
+            }
+        }
         return $className;
     }
 
     /**
      * Add product data tab for license settings
+     * Also modify variations tab to show for licensed-variable products
      */
     public function addProductDataTab(array $tabs): array
     {
+        // Add our License Settings tab
         $tabs['licensed_product'] = [
             'label' => __('License Settings', 'wc-licensed-product'),
             'target' => 'licensed_product_data',
-            'class' => ['show_if_licensed'],
+            'class' => ['show_if_licensed', 'show_if_licensed-variable'],
             'priority' => 21,
         ];
+
+        // Make Variations tab also show for licensed-variable products
+        if (isset($tabs['variations'])) {
+            $tabs['variations']['class'][] = 'show_if_licensed-variable';
+        }
+
         return $tabs;
     }
 
@@ -167,27 +247,6 @@ final class LicensedProductType
                 ?>
             </div>
         </div>
-        <script type="text/javascript">
-            jQuery(document).ready(function($) {
-                // Show/hide panels based on product type
-                $('select#product-type').change(function() {
-                    if ($(this).val() === 'licensed') {
-                        $('.show_if_licensed').show();
-                        $('.general_options').show();
-                        $('.pricing').show();
-                    } else {
-                        $('.show_if_licensed').hide();
-                    }
-                }).change();
-
-                // Show general tab for licensed products
-                $('#product-type').on('change', function() {
-                    if ($(this).val() === 'licensed') {
-                        $('.general_tab').show();
-                    }
-                });
-            });
-        </script>
         <?php
     }
 
@@ -225,14 +284,432 @@ final class LicensedProductType
         wc_get_template('single-product/add-to-cart/simple.php');
     }
 
+    /**
+     * Use the variable product add-to-cart handler for licensed-variable products
+     * WooCommerce uses product type to determine which handler to use
+     */
+    public function addToCartHandler(string $handler, \WC_Product $product): string
+    {
+        if ($product->is_type('licensed-variable')) {
+            return 'variable';
+        }
+        return $handler;
+    }
+
+    /**
+     * Hide stock HTML for licensed products (they're always virtual/in-stock)
+     */
+    public function hideStockHtml(string $html, \WC_Product $product): string
+    {
+        if ($this->isLicensedProductOrVariation($product)) {
+            return '';
+        }
+        return $html;
+    }
+
+    /**
+     * Hide availability data for licensed products (they're always virtual/in-stock)
+     */
+    public function hideAvailability(array $availability, \WC_Product $product): array
+    {
+        if ($this->isLicensedProductOrVariation($product)) {
+            return [
+                'availability' => '',
+                'class'        => '',
+            ];
+        }
+        return $availability;
+    }
+
+    /**
+     * Hide availability text for licensed products
+     */
+    public function hideAvailabilityText(string $availability, \WC_Product $product): string
+    {
+        if ($this->isLicensedProductOrVariation($product)) {
+            return '';
+        }
+        return $availability;
+    }
+
+    /**
+     * Hide stock quantity for licensed products (return null = no stock display)
+     *
+     * @param int|null $quantity
+     * @param \WC_Product $product
+     * @return int|null
+     */
+    public function hideStockQuantity($quantity, \WC_Product $product)
+    {
+        if ($this->isLicensedProductOrVariation($product)) {
+            return null;
+        }
+        return $quantity;
+    }
+
+    /**
+     * Check if product is a licensed product or variation of one
+     */
+    private function isLicensedProductOrVariation(\WC_Product $product): bool
+    {
+        // Direct licensed products
+        if ($product->is_type('licensed') || $product->is_type('licensed-variable')) {
+            return true;
+        }
+
+        // Check by class name for our custom variation class
+        if ($product instanceof LicensedProductVariation) {
+            return true;
+        }
+
+        // Check if this is a variation with a licensed-variable parent
+        // Use WC_Product_Factory::get_product_type() to get parent type directly from DB
+        // This is more reliable than loading the full product object
+        $parentId = $product->get_parent_id();
+        if ($parentId) {
+            $parentType = \WC_Product_Factory::get_product_type($parentId);
+            if ($parentType === 'licensed-variable') {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
     /**
      * Make licensed products virtual by default
      */
     public function isVirtual(bool $isVirtual, \WC_Product $product): bool
     {
-        if ($product->is_type('licensed')) {
+        if ($this->isLicensedProductOrVariation($product)) {
             return true;
         }
         return $isVirtual;
     }
+
+    /**
+     * Enqueue frontend styles and scripts for licensed products on single product pages
+     */
+    public function enqueueFrontendStyles(): void
+    {
+        if (!is_product()) {
+            return;
+        }
+
+        global $product;
+
+        if (!$product || (!$product->is_type('licensed') && !$product->is_type('licensed-variable'))) {
+            return;
+        }
+
+        wp_enqueue_style(
+            'wc-licensed-product-frontend',
+            WC_LICENSED_PRODUCT_PLUGIN_URL . 'assets/css/frontend.css',
+            [],
+            WC_LICENSED_PRODUCT_VERSION
+        );
+
+        // For licensed-variable products, enqueue WooCommerce variation scripts
+        if ($product->is_type('licensed-variable')) {
+            wp_enqueue_script('wc-add-to-cart-variation');
+        }
+    }
+
+    /**
+     * Display current version under product title on single product page
+     */
+    public function displayCurrentVersion(): void
+    {
+        global $product;
+
+        if (!$product || (!$product->is_type('licensed') && !$product->is_type('licensed-variable'))) {
+            return;
+        }
+
+        /** @var LicensedProduct|LicensedVariableProduct $product */
+        $version = $product->get_current_version();
+
+        if (empty($version)) {
+            return;
+        }
+
+        printf(
+            '<p class="wclp-product-version"><span class="version-label">%s</span> <span class="version-number">%s</span></p>',
+            esc_html__('Version:', 'wc-licensed-product'),
+            esc_html($version)
+        );
+    }
+
+    /**
+     * Add to cart template for variable licensed products
+     * This mirrors WooCommerce's woocommerce_variable_add_to_cart() function
+     */
+    public function variableAddToCartTemplate(): void
+    {
+        global $product;
+
+        // The hook woocommerce_licensed-variable_add_to_cart only fires for this product type
+        // so we just need to verify the product exists
+        if (!$product) {
+            return;
+        }
+
+        // Ensure we're working with a product that has variable product methods
+        // Re-load the product to ensure we get the correct class instance
+        $productId = $product->get_id();
+        $variableProduct = wc_get_product($productId);
+
+        if (!$variableProduct || !method_exists($variableProduct, 'get_variation_attributes')) {
+            // Fallback to simple add to cart if not a variable product
+            wc_get_template('single-product/add-to-cart/simple.php');
+            return;
+        }
+
+        // Update global $product to use the correctly loaded instance
+        // This ensures the template has the right product type
+        $product = $variableProduct;
+
+        // Get variations count to determine if we should load them via AJAX
+        $children = $variableProduct->get_children();
+        $getVariations = count($children) <= apply_filters('woocommerce_ajax_variation_threshold', 30, $variableProduct);
+
+        // Get template variables - WooCommerce expects these to be set
+        $availableVariations = $getVariations ? $variableProduct->get_available_variations() : false;
+        $attributes = $variableProduct->get_variation_attributes();
+        $selectedAttributes = $variableProduct->get_default_attributes();
+
+        // Ensure arrays (WooCommerce template expects arrays, not null)
+        if (!is_array($attributes)) {
+            $attributes = [];
+        }
+        if (!is_array($selectedAttributes)) {
+            $selectedAttributes = [];
+        }
+
+        wc_get_template(
+            'single-product/add-to-cart/variable.php',
+            [
+                'available_variations' => $availableVariations,
+                'attributes'           => $attributes,
+                'selected_attributes'  => $selectedAttributes,
+            ]
+        );
+    }
+
+    /**
+     * Add variation options (checkboxes next to variation header)
+     */
+    public function addVariationOptions(int $loop, array $variationData, \WP_Post $variation): void
+    {
+        // Check if parent is licensed-variable
+        $parentId = $variation->post_parent;
+        $parentProduct = wc_get_product($parentId);
+
+        if (!$parentProduct || !$parentProduct->is_type('licensed-variable')) {
+            return;
+        }
+
+        $isVirtual = get_post_meta($variation->ID, '_virtual', true);
+        ?>
+        <label class="tips" data-tip="<?php esc_attr_e('Licensed products are always virtual', 'wc-licensed-product'); ?>">
+            <input type="checkbox" class="checkbox" disabled checked />
+            <?php esc_html_e('Virtual', 'wc-licensed-product'); ?>
+        </label>
+        <?php
+    }
+
+    /**
+     * Add variation fields for license settings
+     */
+    public function addVariationFields(int $loop, array $variationData, \WP_Post $variation): void
+    {
+        // Check if parent is licensed-variable
+        $parentId = $variation->post_parent;
+        $parentProduct = wc_get_product($parentId);
+
+        if (!$parentProduct || !$parentProduct->is_type('licensed-variable')) {
+            return;
+        }
+
+        // Get variation values
+        $validityDays = get_post_meta($variation->ID, '_licensed_validity_days', true);
+        $maxActivations = get_post_meta($variation->ID, '_licensed_max_activations', true);
+
+        // Get parent defaults for placeholder
+        $parentValidityDays = $parentProduct->get_validity_days();
+        $parentMaxActivations = $parentProduct->get_max_activations();
+
+        $parentValidityDisplay = $parentValidityDays !== null
+            ? sprintf(__('%d days', 'wc-licensed-product'), $parentValidityDays)
+            : __('Lifetime', 'wc-licensed-product');
+
+        ?>
+        <div class="wclp-variation-license-settings">
+            <p class="form-row form-row-first">
+                <label><?php esc_html_e('License Duration (Days)', 'wc-licensed-product'); ?></label>
+                <input type="number"
+                       name="wclp_validity_days[<?php echo esc_attr($loop); ?>]"
+                       class="short"
+                       min="0"
+                       step="1"
+                       placeholder="<?php echo esc_attr($parentValidityDisplay); ?>"
+                       value="<?php echo esc_attr($validityDays); ?>"
+                />
+                <span class="description"><?php esc_html_e('Leave empty for parent default. 0 = Lifetime.', 'wc-licensed-product'); ?></span>
+            </p>
+            <p class="form-row form-row-last">
+                <label><?php esc_html_e('Max Activations', 'wc-licensed-product'); ?></label>
+                <input type="number"
+                       name="wclp_max_activations[<?php echo esc_attr($loop); ?>]"
+                       class="short"
+                       min="1"
+                       step="1"
+                       placeholder="<?php echo esc_attr($parentMaxActivations); ?>"
+                       value="<?php echo esc_attr($maxActivations); ?>"
+                />
+                <span class="description"><?php esc_html_e('Leave empty for parent default.', 'wc-licensed-product'); ?></span>
+            </p>
+        </div>
+        <style>
+            .wclp-variation-license-settings {
+                background: #f8f8f8;
+                border: 1px solid #e5e5e5;
+                padding: 10px;
+                margin: 10px 0;
+                border-radius: 4px;
+            }
+            .wclp-variation-license-settings .description {
+                display: block;
+                font-style: italic;
+                color: #666;
+                margin-top: 4px;
+            }
+        </style>
+        <?php
+    }
+
+    /**
+     * Save variation fields
+     */
+    public function saveVariationFields(int $variationId, int $loop): void
+    {
+        // Check if parent is licensed-variable
+        $variation = wc_get_product($variationId);
+        if (!$variation) {
+            return;
+        }
+
+        $parentProduct = wc_get_product($variation->get_parent_id());
+        if (!$parentProduct || !$parentProduct->is_type('licensed-variable')) {
+            return;
+        }
+
+        // Save validity days
+        // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce is verified by WooCommerce
+        if (isset($_POST['wclp_validity_days'][$loop])) {
+            // phpcs:ignore WordPress.Security.NonceVerification.Missing
+            $validityDays = sanitize_text_field($_POST['wclp_validity_days'][$loop]);
+            if ($validityDays !== '') {
+                update_post_meta($variationId, '_licensed_validity_days', absint($validityDays));
+            } else {
+                delete_post_meta($variationId, '_licensed_validity_days');
+            }
+        }
+
+        // Save max activations
+        // phpcs:ignore WordPress.Security.NonceVerification.Missing
+        if (isset($_POST['wclp_max_activations'][$loop])) {
+            // phpcs:ignore WordPress.Security.NonceVerification.Missing
+            $maxActivations = sanitize_text_field($_POST['wclp_max_activations'][$loop]);
+            if ($maxActivations !== '') {
+                update_post_meta($variationId, '_licensed_max_activations', absint($maxActivations));
+            } else {
+                delete_post_meta($variationId, '_licensed_max_activations');
+            }
+        }
+
+        // Set variation as virtual (licensed products are always virtual)
+        update_post_meta($variationId, '_virtual', 'yes');
+    }
+
+    /**
+     * Add JavaScript for licensed product types in admin
+     * Handles visibility of License Settings tab and Product Versions meta box
+     */
+    public function addVariableProductScripts(): void
+    {
+        global $post, $pagenow;
+
+        if ($pagenow !== 'post.php' && $pagenow !== 'post-new.php') {
+            return;
+        }
+
+        if (!$post || get_post_type($post) !== 'product') {
+            return;
+        }
+
+        ?>
+        <script type="text/javascript">
+            jQuery(document).ready(function($) {
+                // Handle our custom License Settings tab, Product Versions meta box,
+                // and show_if_licensed-variable elements
+                function toggleOurElements() {
+                    var productType = $('#product-type').val();
+                    var isLicensed = productType === 'licensed';
+                    var isLicensedVariable = productType === 'licensed-variable';
+
+                    // License Settings tab - use CSS class for visibility
+                    var $licenseTab = $('li.licensed_product_options');
+                    if (isLicensed || isLicensedVariable) {
+                        $licenseTab.addClass('wclp-active');
+                    } else {
+                        $licenseTab.removeClass('wclp-active');
+                        // If License Settings panel is active, switch to General tab
+                        if ($('#licensed_product_data').is(':visible')) {
+                            $('li.general_options a').trigger('click');
+                        }
+                    }
+
+                    // Product Versions meta box
+                    var $metaBox = $('#wc_licensed_product_versions');
+                    if (isLicensed || isLicensedVariable) {
+                        $metaBox.css('display', '');
+                    } else {
+                        $metaBox.css('display', 'none');
+                    }
+
+                    // Handle show_if_licensed-variable elements (like Variations tab)
+                    // WooCommerce doesn't know about our custom product types
+                    if (isLicensedVariable) {
+                        $('.show_if_licensed-variable').show();
+                        // Also show elements that should be visible for variable products
+                        // since licensed-variable is a variable product type
+                        $('.show_if_variable').show();
+                        $('.hide_if_variable').hide();
+                    } else {
+                        // Let WooCommerce handle show_if_variable elements
+                        // We only need to hide our custom class when not licensed-variable
+                        // Don't hide show_if_licensed-variable when it's licensed (simple)
+                        if (!isLicensed) {
+                            $('.show_if_licensed-variable').not('.show_if_licensed').hide();
+                        }
+                    }
+                }
+
+                // Initial setup - run after WooCommerce has initialized
+                setTimeout(toggleOurElements, 10);
+
+                // On product type change - run after WooCommerce has processed
+                $('#product-type').on('change', function() {
+                    setTimeout(toggleOurElements, 100);
+                });
+
+                // Re-apply after WooCommerce AJAX operations
+                $(document).on('woocommerce_variations_loaded woocommerce_variations_added woocommerce_variations_saved', function() {
+                    setTimeout(toggleOurElements, 10);
+                });
+            });
+        </script>
+        <?php
+    }
 }

src/Product/LicensedProductVariation.php

@@ -0,0 +1,251 @@
+<?php
+/**
+ * Licensed Product Variation Class
+ *
+ * @package Jeremias\WcLicensedProduct\Product
+ */
+
+declare(strict_types=1);
+
+namespace Jeremias\WcLicensedProduct\Product;
+
+use Jeremias\WcLicensedProduct\Admin\SettingsController;
+use WC_Product_Variation;
+
+/**
+ * Licensed Product Variation type extending WooCommerce Product Variation
+ *
+ * Each variation can have its own license duration settings.
+ */
+class LicensedProductVariation extends WC_Product_Variation
+{
+    /**
+     * Constructor
+     */
+    public function __construct($product = 0)
+    {
+        parent::__construct($product);
+    }
+
+    /**
+     * Licensed products are always virtual
+     */
+    public function is_virtual(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Licensed products are always in stock (virtual, no inventory)
+     */
+    public function is_in_stock(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get availability - empty for licensed products (no stock indicator)
+     */
+    public function get_availability(): array
+    {
+        return [
+            'availability' => '',
+            'class'        => '',
+        ];
+    }
+
+    /**
+     * Don't manage stock for licensed products
+     */
+    public function managing_stock(): bool
+    {
+        return false;
+    }
+
+    /**
+     * Check if variation is purchasable
+     * Override to handle custom parent product type
+     */
+    public function is_purchasable(): bool
+    {
+        // Check if variation exists
+        if (!$this->exists()) {
+            return false;
+        }
+
+        // Check parent product status
+        $parentId = $this->get_parent_id();
+        $parentStatus = get_post_status($parentId);
+
+        if ($parentStatus !== 'publish' && !current_user_can('edit_post', $parentId)) {
+            return false;
+        }
+
+        // Check if variation has a price
+        $price = $this->get_price();
+        if ($price === '' || $price === null) {
+            return false;
+        }
+
+        return apply_filters('woocommerce_variation_is_purchasable', true, $this);
+    }
+
+    /**
+     * Get max activations for this variation
+     * Falls back to parent product, then to default settings
+     */
+    public function get_max_activations(): int
+    {
+        // Check variation-specific setting first
+        $value = $this->get_meta('_licensed_max_activations', true);
+        if ($value !== '' && $value !== null) {
+            return max(1, (int) $value);
+        }
+
+        // Fall back to parent product
+        $parent = wc_get_product($this->get_parent_id());
+        if ($parent && method_exists($parent, 'get_max_activations')) {
+            return $parent->get_max_activations();
+        }
+
+        return SettingsController::getDefaultMaxActivations();
+    }
+
+    /**
+     * Check if variation has custom max activations set
+     */
+    public function has_custom_max_activations(): bool
+    {
+        $value = $this->get_meta('_licensed_max_activations', true);
+        return $value !== '' && $value !== null;
+    }
+
+    /**
+     * Get validity days for this variation
+     * This is the primary license setting that varies per variation
+     * Falls back to parent product, then to default settings
+     */
+    public function get_validity_days(): ?int
+    {
+        // Check variation-specific setting first
+        $value = $this->get_meta('_licensed_validity_days', true);
+        if ($value !== '' && $value !== null) {
+            $days = (int) $value;
+            // 0 means lifetime
+            return $days > 0 ? $days : null;
+        }
+
+        // Fall back to parent product
+        $parent = wc_get_product($this->get_parent_id());
+        if ($parent && method_exists($parent, 'get_validity_days')) {
+            return $parent->get_validity_days();
+        }
+
+        return SettingsController::getDefaultValidityDays();
+    }
+
+    /**
+     * Check if variation has custom validity days set
+     */
+    public function has_custom_validity_days(): bool
+    {
+        $value = $this->get_meta('_licensed_validity_days', true);
+        return $value !== '' && $value !== null;
+    }
+
+    /**
+     * Check if license should be bound to major version
+     * Falls back to parent product, then to default settings
+     */
+    public function is_bound_to_version(): bool
+    {
+        // Check variation-specific setting first
+        $value = $this->get_meta('_licensed_bind_to_version', true);
+        if ($value !== '' && $value !== null) {
+            return $value === 'yes';
+        }
+
+        // Fall back to parent product
+        $parent = wc_get_product($this->get_parent_id());
+        if ($parent && method_exists($parent, 'is_bound_to_version')) {
+            return $parent->is_bound_to_version();
+        }
+
+        return SettingsController::getDefaultBindToVersion();
+    }
+
+    /**
+     * Check if variation has custom bind to version setting
+     */
+    public function has_custom_bind_to_version(): bool
+    {
+        $value = $this->get_meta('_licensed_bind_to_version', true);
+        return $value !== '' && $value !== null;
+    }
+
+    /**
+     * Get the license duration label for display
+     */
+    public function get_license_duration_label(): string
+    {
+        $days = $this->get_validity_days();
+
+        if ($days === null) {
+            return __('Lifetime', 'wc-licensed-product');
+        }
+
+        if ($days === 30) {
+            return __('Monthly', 'wc-licensed-product');
+        }
+
+        if ($days === 90) {
+            return __('Quarterly', 'wc-licensed-product');
+        }
+
+        if ($days === 365) {
+            return __('Yearly', 'wc-licensed-product');
+        }
+
+        return sprintf(
+            /* translators: %d: number of days */
+            _n('%d day', '%d days', $days, 'wc-licensed-product'),
+            $days
+        );
+    }
+
+    /**
+     * Get current software version from parent product
+     */
+    public function get_current_version(): string
+    {
+        $parent = wc_get_product($this->get_parent_id());
+        if ($parent && method_exists($parent, 'get_current_version')) {
+            return $parent->get_current_version();
+        }
+
+        $versionManager = new VersionManager();
+        $latestVersion = $versionManager->getLatestVersion($this->get_parent_id());
+
+        return $latestVersion ? $latestVersion->getVersion() : '';
+    }
+
+    /**
+     * Get major version number from parent product
+     */
+    public function get_major_version(): int
+    {
+        $parent = wc_get_product($this->get_parent_id());
+        if ($parent && method_exists($parent, 'get_major_version')) {
+            return $parent->get_major_version();
+        }
+
+        $versionManager = new VersionManager();
+        $latestVersion = $versionManager->getLatestVersion($this->get_parent_id());
+
+        if ($latestVersion) {
+            return $latestVersion->getMajorVersion();
+        }
+
+        return 1;
+    }
+}

src/Product/LicensedVariableProduct.php

@@ -0,0 +1,350 @@
+<?php
+/**
+ * Licensed Variable Product Class
+ *
+ * @package Jeremias\WcLicensedProduct\Product
+ */
+
+declare(strict_types=1);
+
+namespace Jeremias\WcLicensedProduct\Product;
+
+use Jeremias\WcLicensedProduct\Admin\SettingsController;
+use WC_Product_Variable;
+
+/**
+ * Licensed Variable Product type extending WooCommerce Variable Product
+ *
+ * This allows selling license subscriptions with different durations
+ * (e.g., monthly, yearly, lifetime) as product variations.
+ */
+class LicensedVariableProduct extends WC_Product_Variable
+{
+    /**
+     * Product type
+     */
+    protected $product_type = 'licensed-variable';
+
+    /**
+     * Constructor
+     */
+    public function __construct($product = 0)
+    {
+        parent::__construct($product);
+    }
+
+    /**
+     * Get product type
+     */
+    public function get_type(): string
+    {
+        return 'licensed-variable';
+    }
+
+    /**
+     * Check if product is of a certain type
+     * Override to return true for 'variable' as well, so WooCommerce internal
+     * checks pass (many methods in WC_Product_Variable check is_type('variable'))
+     */
+    public function is_type($type): bool
+    {
+        if (is_array($type)) {
+            return in_array($this->get_type(), $type, true) || in_array('variable', $type, true);
+        }
+        return $this->get_type() === $type || 'variable' === $type;
+    }
+
+    /**
+     * Licensed products are always virtual
+     */
+    public function is_virtual(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Licensed variable products are purchasable if the parent check passes
+     * Variable products don't have a direct price - their variations do
+     */
+    public function is_purchasable(): bool
+    {
+        // Use the parent WC_Product_Variable logic
+        // which checks exists() and status, not price
+        return parent::is_purchasable();
+    }
+
+    /**
+     * Licensed products are always in stock (virtual, no inventory)
+     */
+    public function is_in_stock(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get children (variations) for this product
+     * Override because WC_Product_Variable::get_children() checks is_type('variable')
+     * which fails for our 'licensed-variable' type
+     */
+    public function get_children($context = 'view'): array
+    {
+        if (!$this->get_id()) {
+            return [];
+        }
+
+        // Query variations directly from database since WooCommerce's data store
+        // doesn't work properly with custom variable product types
+        global $wpdb;
+        $children = $wpdb->get_col($wpdb->prepare(
+            "SELECT ID FROM {$wpdb->posts}
+             WHERE post_parent = %d
+             AND post_type = 'product_variation'
+             AND post_status IN ('publish', 'private')
+             ORDER BY menu_order ASC, ID ASC",
+            $this->get_id()
+        ));
+
+        $children = array_map('intval', $children);
+
+        if ('view' === $context) {
+            $children = apply_filters('woocommerce_get_children', $children, $this, false);
+        }
+
+        return is_array($children) ? $children : [];
+    }
+
+    /**
+     * Get variation attributes for this product
+     * Override because WC_Product_Variable uses data_store which doesn't work
+     * properly with custom variable product types
+     */
+    public function get_variation_attributes(): array
+    {
+        $attributes = $this->get_attributes();
+
+        if (!$attributes || !is_array($attributes)) {
+            return [];
+        }
+
+        $variation_attributes = [];
+
+        foreach ($attributes as $attribute) {
+            // For WC_Product_Attribute objects
+            if ($attribute instanceof \WC_Product_Attribute) {
+                if ($attribute->get_variation()) {
+                    $attribute_name = $attribute->get_name();
+
+                    // For taxonomy attributes, get term slugs
+                    if ($attribute->is_taxonomy()) {
+                        $attribute_terms = wc_get_product_terms(
+                            $this->get_id(),
+                            $attribute_name,
+                            ['fields' => 'slugs']
+                        );
+                        $variation_attributes[$attribute_name] = $attribute_terms;
+                    } else {
+                        // For custom attributes, get options directly
+                        $variation_attributes[$attribute_name] = $attribute->get_options();
+                    }
+                }
+            }
+            // For array-based attributes (older format)
+            elseif (is_array($attribute) && !empty($attribute['is_variation'])) {
+                $attribute_name = $attribute['name'];
+                $values = isset($attribute['value']) ? explode('|', $attribute['value']) : [];
+                $variation_attributes[$attribute_name] = array_map('trim', $values);
+            }
+        }
+
+        return $variation_attributes;
+    }
+
+    /**
+     * Get variation prices (regular, sale, and final prices)
+     * Override because WC_Product_Variable uses data_store which doesn't work
+     * properly with custom variable product types
+     */
+    public function get_variation_prices($for_display = false): array
+    {
+        $children = $this->get_children();
+
+        if (empty($children)) {
+            return [
+                'price' => [],
+                'regular_price' => [],
+                'sale_price' => [],
+            ];
+        }
+
+        $prices = [
+            'price' => [],
+            'regular_price' => [],
+            'sale_price' => [],
+        ];
+
+        foreach ($children as $child_id) {
+            $variation = wc_get_product($child_id);
+            if ($variation) {
+                $price = $variation->get_price();
+                $regular_price = $variation->get_regular_price();
+                $sale_price = $variation->get_sale_price();
+
+                if ('' !== $price) {
+                    $prices['price'][$child_id] = $price;
+                }
+                if ('' !== $regular_price) {
+                    $prices['regular_price'][$child_id] = $regular_price;
+                }
+                if ('' !== $sale_price) {
+                    $prices['sale_price'][$child_id] = $sale_price;
+                }
+            }
+        }
+
+        // Sort prices
+        asort($prices['price']);
+        asort($prices['regular_price']);
+        asort($prices['sale_price']);
+
+        $this->prices_array = $prices;
+
+        return $this->prices_array;
+    }
+
+    /**
+     * Get available variations for this product
+     * Override because WC_Product_Variable uses data_store which doesn't work
+     * properly with custom variable product types
+     */
+    public function get_available_variations($return = 'array')
+    {
+        $children = $this->get_children();
+        $available_variations = [];
+
+        foreach ($children as $child_id) {
+            $variation = wc_get_product($child_id);
+
+            if (!$variation) {
+                continue;
+            }
+
+            // Check if variation should be available
+            if (!$variation->exists()) {
+                continue;
+            }
+
+            // Check if purchasable (has price)
+            if (!$variation->is_purchasable()) {
+                continue;
+            }
+
+            // Build variation data
+            if ($return === 'array') {
+                $variationData = $this->get_available_variation($variation);
+                // Override availability_html to be empty for licensed products
+                $variationData['availability_html'] = '';
+                $available_variations[] = $variationData;
+            } else {
+                $available_variations[] = $variation;
+            }
+        }
+
+        if ($return === 'array') {
+            $available_variations = array_values(array_filter($available_variations));
+        }
+
+        return $available_variations;
+    }
+
+    /**
+     * Get max activations for this product (parent default)
+     * Falls back to default settings if not set on product
+     */
+    public function get_max_activations(): int
+    {
+        $value = $this->get_meta('_licensed_max_activations', true);
+        if ($value !== '' && $value !== null) {
+            return max(1, (int) $value);
+        }
+        return SettingsController::getDefaultMaxActivations();
+    }
+
+    /**
+     * Check if product has custom max activations set
+     */
+    public function has_custom_max_activations(): bool
+    {
+        $value = $this->get_meta('_licensed_max_activations', true);
+        return $value !== '' && $value !== null;
+    }
+
+    /**
+     * Get validity days (parent default - variations override this)
+     * Falls back to default settings if not set on product
+     */
+    public function get_validity_days(): ?int
+    {
+        $value = $this->get_meta('_licensed_validity_days', true);
+        if ($value !== '' && $value !== null) {
+            return (int) $value > 0 ? (int) $value : null;
+        }
+        return SettingsController::getDefaultValidityDays();
+    }
+
+    /**
+     * Check if product has custom validity days set
+     */
+    public function has_custom_validity_days(): bool
+    {
+        $value = $this->get_meta('_licensed_validity_days', true);
+        return $value !== '' && $value !== null;
+    }
+
+    /**
+     * Check if license should be bound to major version
+     * Falls back to default settings if not set on product
+     */
+    public function is_bound_to_version(): bool
+    {
+        $value = $this->get_meta('_licensed_bind_to_version', true);
+        if ($value !== '' && $value !== null) {
+            return $value === 'yes';
+        }
+        return SettingsController::getDefaultBindToVersion();
+    }
+
+    /**
+     * Check if product has custom bind to version setting
+     */
+    public function has_custom_bind_to_version(): bool
+    {
+        $value = $this->get_meta('_licensed_bind_to_version', true);
+        return $value !== '' && $value !== null;
+    }
+
+    /**
+     * Get current software version (derived from latest product version)
+     */
+    public function get_current_version(): string
+    {
+        $versionManager = new VersionManager();
+        $latestVersion = $versionManager->getLatestVersion($this->get_id());
+
+        return $latestVersion ? $latestVersion->getVersion() : '';
+    }
+
+    /**
+     * Get major version number from version string
+     */
+    public function get_major_version(): int
+    {
+        $versionManager = new VersionManager();
+        $latestVersion = $versionManager->getLatestVersion($this->get_id());
+
+        if ($latestVersion) {
+            return $latestVersion->getMajorVersion();
+        }
+
+        return 1;
+    }
+}

src/Product/ProductVersion.php

@@ -24,6 +24,7 @@ class ProductVersion
     private ?string $downloadUrl;
     private ?int $attachmentId;
     private ?string $fileHash;
+    private int $downloadCount;
     private bool $isActive;
     private \DateTimeInterface $releasedAt;
     private \DateTimeInterface $createdAt;
@@ -44,6 +45,7 @@ class ProductVersion
         $version->downloadUrl = $data['download_url'] ?: null;
         $version->attachmentId = !empty($data['attachment_id']) ? (int) $data['attachment_id'] : null;
         $version->fileHash = $data['file_hash'] ?? null;
+        $version->downloadCount = (int) ($data['download_count'] ?? 0);
         $version->isActive = (bool) $data['is_active'];
         $version->releasedAt = new \DateTimeImmutable($data['released_at']);
         $version->createdAt = new \DateTimeImmutable($data['created_at']);
@@ -144,6 +146,11 @@ class ProductVersion
         return $this->fileHash;
     }
 
+    public function getDownloadCount(): int
+    {
+        return $this->downloadCount;
+    }
+
     /**
      * Get the download URL from attachment
      */
@@ -197,6 +204,7 @@ class ProductVersion
             'download_url' => $this->downloadUrl,
             'attachment_id' => $this->attachmentId,
             'file_hash' => $this->fileHash,
+            'download_count' => $this->downloadCount,
             'is_active' => $this->isActive,
             'released_at' => $this->releasedAt->format('Y-m-d H:i:s'),
             'created_at' => $this->createdAt->format('Y-m-d H:i:s'),

src/Product/VersionManager.php

@@ -276,4 +276,98 @@ class VersionManager
 
         return (int) $count > 0;
     }
+
+    /**
+     * Increment download count for a version
+     */
+    public function incrementDownloadCount(int $versionId): bool
+    {
+        global $wpdb;
+
+        $tableName = Installer::getVersionsTable();
+        $result = $wpdb->query(
+            $wpdb->prepare(
+                "UPDATE {$tableName} SET download_count = download_count + 1 WHERE id = %d",
+                $versionId
+            )
+        );
+
+        return $result !== false;
+    }
+
+    /**
+     * Get total download count across all versions
+     */
+    public function getTotalDownloadCount(): int
+    {
+        global $wpdb;
+
+        $tableName = Installer::getVersionsTable();
+        $count = $wpdb->get_var("SELECT COALESCE(SUM(download_count), 0) FROM {$tableName}");
+
+        return (int) $count;
+    }
+
+    /**
+     * Get download statistics per product
+     */
+    public function getDownloadStatistics(): array
+    {
+        global $wpdb;
+
+        $tableName = Installer::getVersionsTable();
+
+        // Get total downloads
+        $totalDownloads = $this->getTotalDownloadCount();
+
+        // Get downloads per product (top 10)
+        $byProduct = $wpdb->get_results(
+            "SELECT product_id, SUM(download_count) as downloads
+             FROM {$tableName}
+             GROUP BY product_id
+             ORDER BY downloads DESC
+             LIMIT 10",
+            ARRAY_A
+        );
+
+        // Get downloads per version (top 10)
+        $byVersion = $wpdb->get_results(
+            "SELECT id, product_id, version, download_count
+             FROM {$tableName}
+             WHERE download_count > 0
+             ORDER BY download_count DESC
+             LIMIT 10",
+            ARRAY_A
+        );
+
+        // Enrich product data with names
+        $productsWithNames = [];
+        foreach ($byProduct ?: [] as $row) {
+            $product = wc_get_product((int) $row['product_id']);
+            $productsWithNames[] = [
+                'product_id' => (int) $row['product_id'],
+                'product_name' => $product ? $product->get_name() : __('Unknown Product', 'wc-licensed-product'),
+                'downloads' => (int) $row['downloads'],
+            ];
+        }
+
+        // Enrich version data with product names
+        $versionsWithNames = [];
+        foreach ($byVersion ?: [] as $row) {
+            $product = wc_get_product((int) $row['product_id']);
+            $versionsWithNames[] = [
+                'version_id' => (int) $row['id'],
+                'product_id' => (int) $row['product_id'],
+                'product_name' => $product ? $product->get_name() : __('Unknown Product', 'wc-licensed-product'),
+                'version' => $row['version'],
+                'downloads' => (int) $row['download_count'],
+            ];
+        }
+
+        return [
+            'total' => $totalDownloads,
+            'by_product' => $productsWithNames,
+            'by_version' => $versionsWithNames,
+        ];
+    }
 }

src/Update/PluginUpdateChecker.php

@@ -0,0 +1,417 @@
+<?php
+/**
+ * Plugin Update Checker
+ *
+ * Checks for plugin updates from the configured license server.
+ *
+ * @package Jeremias\WcLicensedProduct\Update
+ */
+
+declare(strict_types=1);
+
+namespace Jeremias\WcLicensedProduct\Update;
+
+use Jeremias\WcLicensedProduct\License\PluginLicenseChecker;
+use Symfony\Component\HttpClient\HttpClient;
+
+/**
+ * Handles checking for plugin updates from the license server
+ *
+ * This class hooks into WordPress's native plugin update system to check for
+ * updates from the configured license server. It validates the license and
+ * provides download authentication.
+ */
+final class PluginUpdateChecker
+{
+    /**
+     * Cache key for update info
+     */
+    private const CACHE_KEY = 'wclp_update_info';
+
+    /**
+     * Default cache TTL (12 hours)
+     */
+    private const DEFAULT_CACHE_TTL = 43200;
+
+    /**
+     * Singleton instance
+     */
+    private static ?self $instance = null;
+
+    /**
+     * Plugin slug
+     */
+    private string $pluginSlug;
+
+    /**
+     * Plugin basename (slug/slug.php)
+     */
+    private string $pluginBasename;
+
+    /**
+     * Get singleton instance
+     */
+    public static function getInstance(): self
+    {
+        if (self::$instance === null) {
+            self::$instance = new self();
+        }
+
+        return self::$instance;
+    }
+
+    /**
+     * Private constructor for singleton
+     */
+    private function __construct()
+    {
+        $this->pluginSlug = 'wc-licensed-product';
+        $this->pluginBasename = WC_LICENSED_PRODUCT_PLUGIN_BASENAME;
+    }
+
+    /**
+     * Register WordPress hooks for update checking
+     */
+    public function register(): void
+    {
+        // Skip if auto-updates are disabled
+        if ($this->isAutoUpdateDisabled()) {
+            return;
+        }
+
+        // Check for updates
+        add_filter('pre_set_site_transient_update_plugins', [$this, 'checkForUpdates']);
+
+        // Provide plugin information for the update modal
+        add_filter('plugins_api', [$this, 'getPluginInfo'], 10, 3);
+
+        // Add authentication headers to download requests
+        add_filter('http_request_args', [$this, 'addAuthHeaders'], 10, 2);
+
+        // Clear cache on settings save
+        add_action('update_option_wc_licensed_product_plugin_license_key', [$this, 'clearCache']);
+        add_action('update_option_wc_licensed_product_plugin_license_server_url', [$this, 'clearCache']);
+    }
+
+    /**
+     * Check if auto-updates are disabled
+     */
+    private function isAutoUpdateDisabled(): bool
+    {
+        // Check constant
+        if (defined('WC_LICENSE_DISABLE_AUTO_UPDATE') && WC_LICENSE_DISABLE_AUTO_UPDATE) {
+            return true;
+        }
+
+        // Check setting
+        $enabled = get_option('wc_licensed_product_plugin_auto_update_enabled', 'yes');
+        return $enabled !== 'yes';
+    }
+
+    /**
+     * Check for plugin updates
+     *
+     * @param object $transient The update_plugins transient
+     * @return object Modified transient
+     */
+    public function checkForUpdates($transient)
+    {
+        if (empty($transient->checked)) {
+            return $transient;
+        }
+
+        // Get cached update info or fetch fresh
+        $updateInfo = $this->getUpdateInfo();
+
+        if (!$updateInfo || !isset($updateInfo['update_available']) || !$updateInfo['update_available']) {
+            return $transient;
+        }
+
+        // Compare versions
+        $currentVersion = $transient->checked[$this->pluginBasename] ?? WC_LICENSED_PRODUCT_VERSION;
+
+        if (version_compare($updateInfo['version'], $currentVersion, '>')) {
+            $transient->response[$this->pluginBasename] = $this->buildUpdateObject($updateInfo);
+        }
+
+        return $transient;
+    }
+
+    /**
+     * Get plugin information for the update modal
+     *
+     * @param false|object|array $result The result object or array
+     * @param string $action The API action
+     * @param object $args Request arguments
+     * @return false|object
+     */
+    public function getPluginInfo($result, string $action, object $args)
+    {
+        if ($action !== 'plugin_information') {
+            return $result;
+        }
+
+        if (!isset($args->slug) || $args->slug !== $this->pluginSlug) {
+            return $result;
+        }
+
+        // Get update info
+        $updateInfo = $this->getUpdateInfo(true);
+
+        if (!$updateInfo) {
+            return $result;
+        }
+
+        return $this->buildPluginInfoObject($updateInfo);
+    }
+
+    /**
+     * Add authentication headers to download requests
+     *
+     * @param array $args HTTP request arguments
+     * @param string $url Request URL
+     * @return array Modified arguments
+     */
+    public function addAuthHeaders(array $args, string $url): array
+    {
+        // Only modify requests to our license server
+        $serverUrl = $this->getLicenseServerUrl();
+        if (empty($serverUrl) || strpos($url, parse_url($serverUrl, PHP_URL_HOST)) === false) {
+            return $args;
+        }
+
+        // Only modify download requests
+        if (strpos($url, 'license-download') === false) {
+            return $args;
+        }
+
+        // Add license key to headers for potential server-side verification
+        $licenseKey = $this->getLicenseKey();
+        if (!empty($licenseKey)) {
+            $args['headers']['X-License-Key'] = $licenseKey;
+        }
+
+        return $args;
+    }
+
+    /**
+     * Get update info from cache or server
+     *
+     * @param bool $forceRefresh Force refresh from server
+     * @return array|null Update info or null if unavailable
+     */
+    public function getUpdateInfo(bool $forceRefresh = false): ?array
+    {
+        // Check cache unless force refresh
+        if (!$forceRefresh) {
+            $cached = get_transient(self::CACHE_KEY);
+            if ($cached !== false) {
+                return $cached;
+            }
+        }
+
+        // Fetch from server
+        $updateInfo = $this->fetchUpdateInfo();
+
+        if ($updateInfo) {
+            // Cache the result
+            $cacheTtl = $this->getCacheTtl();
+            set_transient(self::CACHE_KEY, $updateInfo, $cacheTtl);
+        }
+
+        return $updateInfo;
+    }
+
+    /**
+     * Fetch update info from the license server
+     */
+    private function fetchUpdateInfo(): ?array
+    {
+        $serverUrl = $this->getLicenseServerUrl();
+        $licenseKey = $this->getLicenseKey();
+
+        if (empty($serverUrl) || empty($licenseKey)) {
+            return null;
+        }
+
+        try {
+            $httpClient = HttpClient::create([
+                'timeout' => 15,
+                'verify_peer' => true,
+            ]);
+
+            $updateCheckUrl = rtrim($serverUrl, '/') . '/wp-json/wc-licensed-product/v1/update-check';
+
+            $response = $httpClient->request('POST', $updateCheckUrl, [
+                'json' => [
+                    'license_key' => $licenseKey,
+                    'domain' => $this->getCurrentDomain(),
+                    'plugin_slug' => $this->pluginSlug,
+                    'current_version' => WC_LICENSED_PRODUCT_VERSION,
+                ],
+            ]);
+
+            if ($response->getStatusCode() !== 200) {
+                return null;
+            }
+
+            $data = $response->toArray();
+
+            // Verify response structure
+            if (!isset($data['success']) || !$data['success']) {
+                return null;
+            }
+
+            return $data;
+        } catch (\Throwable $e) {
+            // Log error but don't break the site
+            if (defined('WP_DEBUG') && WP_DEBUG) {
+                error_log('WC Licensed Product: Update check failed - ' . $e->getMessage());
+            }
+            return null;
+        }
+    }
+
+    /**
+     * Build WordPress update object for transient
+     */
+    private function buildUpdateObject(array $updateInfo): object
+    {
+        $update = new \stdClass();
+        $update->id = $this->pluginSlug;
+        $update->slug = $updateInfo['slug'] ?? $this->pluginSlug;
+        $update->plugin = $this->pluginBasename;
+        $update->new_version = $updateInfo['version'];
+        $update->url = $updateInfo['homepage'] ?? '';
+        $update->package = $updateInfo['download_url'] ?? $updateInfo['package'] ?? '';
+
+        if (isset($updateInfo['tested'])) {
+            $update->tested = $updateInfo['tested'];
+        }
+
+        if (isset($updateInfo['requires'])) {
+            $update->requires = $updateInfo['requires'];
+        }
+
+        if (isset($updateInfo['requires_php'])) {
+            $update->requires_php = $updateInfo['requires_php'];
+        }
+
+        if (isset($updateInfo['icons'])) {
+            $update->icons = $updateInfo['icons'];
+        }
+
+        return $update;
+    }
+
+    /**
+     * Build plugin info object for plugins_api
+     */
+    private function buildPluginInfoObject(array $updateInfo): object
+    {
+        $info = new \stdClass();
+        $info->name = $updateInfo['name'] ?? 'WC Licensed Product';
+        $info->slug = $updateInfo['slug'] ?? $this->pluginSlug;
+        $info->version = $updateInfo['version'];
+        $info->author = '<a href="https://src.bundespruefstelle.ch/magdev">Marco Graetsch</a>';
+        $info->homepage = $updateInfo['homepage'] ?? '';
+        $info->requires = $updateInfo['requires'] ?? '6.0';
+        $info->tested = $updateInfo['tested'] ?? '';
+        $info->requires_php = $updateInfo['requires_php'] ?? '8.3';
+        $info->downloaded = 0;
+        $info->last_updated = $updateInfo['last_updated'] ?? '';
+        $info->download_link = $updateInfo['download_url'] ?? $updateInfo['package'] ?? '';
+
+        // Sections for the modal
+        $info->sections = [];
+
+        if (isset($updateInfo['sections']['description'])) {
+            $info->sections['description'] = $updateInfo['sections']['description'];
+        } else {
+            $info->sections['description'] = __(
+                'WooCommerce plugin for selling licensed software products with domain-bound license keys.',
+                'wc-licensed-product'
+            );
+        }
+
+        if (isset($updateInfo['sections']['changelog']) || isset($updateInfo['changelog'])) {
+            $info->sections['changelog'] = $updateInfo['sections']['changelog'] ?? $updateInfo['changelog'];
+        }
+
+        // Banners and icons
+        if (isset($updateInfo['banners'])) {
+            $info->banners = $updateInfo['banners'];
+        }
+
+        if (isset($updateInfo['icons'])) {
+            $info->icons = $updateInfo['icons'];
+        }
+
+        return $info;
+    }
+
+    /**
+     * Clear the update cache
+     */
+    public function clearCache(): void
+    {
+        delete_transient(self::CACHE_KEY);
+    }
+
+    /**
+     * Get cache TTL from settings or default
+     */
+    private function getCacheTtl(): int
+    {
+        $hours = (int) get_option('wc_licensed_product_update_check_frequency', 12);
+        return max(1, $hours) * HOUR_IN_SECONDS;
+    }
+
+    /**
+     * Get the license server URL from settings
+     */
+    private function getLicenseServerUrl(): string
+    {
+        // Check constant override first
+        if (defined('WC_LICENSE_UPDATE_CHECK_URL') && WC_LICENSE_UPDATE_CHECK_URL) {
+            return WC_LICENSE_UPDATE_CHECK_URL;
+        }
+
+        return (string) get_option('wc_licensed_product_plugin_license_server_url', '');
+    }
+
+    /**
+     * Get the license key from settings
+     */
+    private function getLicenseKey(): string
+    {
+        return (string) get_option('wc_licensed_product_plugin_license_key', '');
+    }
+
+    /**
+     * Get the current domain from the site URL
+     */
+    private function getCurrentDomain(): string
+    {
+        $siteUrl = get_site_url();
+        $parsed = parse_url($siteUrl);
+        $host = $parsed['host'] ?? 'localhost';
+
+        if (isset($parsed['port'])) {
+            $host .= ':' . $parsed['port'];
+        }
+
+        return strtolower($host);
+    }
+
+    /**
+     * Force an immediate update check
+     *
+     * Useful for admin interfaces where user clicks "Check for updates"
+     */
+    public function forceUpdateCheck(): ?array
+    {
+        $this->clearCache();
+        return $this->getUpdateInfo(true);
+    }
+}

templates/admin/licenses.html.twig

@@ -1,6 +1,6 @@
 <div class="wrap">
     <h1 class="wp-heading-inline">{{ __('Licenses') }}</h1>
-    <a href="{{ admin_url }}?action=export_csv" class="page-title-action">
+    <a href="{{ export_csv_url() }}" class="page-title-action">
         <span class="dashicons dashicons-download" style="vertical-align: middle;"></span>
         {{ __('Export CSV') }}
     </a>
@@ -143,8 +143,8 @@
                             </td>
                             <td class="wclp-editable-cell" data-field="status" data-license-id="{{ item.license.id }}">
                                 <span class="wclp-display-value">
-                                    <span class="license-status license-status-{{ item.license.status }}">
-                                        {{ item.license.status|capitalize }}
+                                    <span class="license-status license-status-{{ esc_attr(item.license.status) }}">
+                                        {{ esc_html(item.license.status)|capitalize }}
                                     </span>
                                 </span>
                                 <button type="button" class="wclp-edit-btn button-link" title="{{ __('Edit') }}">

templates/frontend/licenses.html.twig

@@ -1,78 +1,150 @@
-{% if not has_licenses %}
+{% if not has_packages %}
     <p>{{ __('You have no licenses yet.') }}</p>
 {% else %}
     <div class="woocommerce-licenses">
-        {% for item in licenses %}
-            <div class="license-card">
-                <div class="license-header">
-                    <h3>
-                        {% if item.product_url %}
-                            <a href="{{ esc_url(item.product_url) }}">{{ esc_html(item.product_name) }}</a>
-                        {% else %}
-                            {{ esc_html(item.product_name) }}
-                        {% endif %}
-                    </h3>
-                    <span class="license-status license-status-{{ item.license.status }}">
-                        {{ item.license.status|capitalize }}
+        {% for package in packages %}
+            <div class="license-package">
+                <div class="package-header">
+                    <div class="package-title">
+                        <h3>
+                            {% if package.product_url %}
+                                <a href="{{ esc_url(package.product_url) }}">{{ esc_html(package.product_name) }}</a>
+                            {% else %}
+                                {{ esc_html(package.product_name) }}
+                            {% endif %}
+                        </h3>
+                        <span class="package-order">
+                            {{ __('Order') }}
+                            {% if package.order_url %}
+                                <a href="{{ esc_url(package.order_url) }}">#{{ esc_html(package.order_number) }}</a>
+                            {% else %}
+                                #{{ esc_html(package.order_number) }}
+                            {% endif %}
+                        </span>
+                    </div>
+                    <span class="package-license-count">
+                        {{ package.licenses|length }} {{ package.licenses|length == 1 ? __('License') : __('Licenses') }}
                     </span>
                 </div>
 
-                <div class="license-details">
-                    <div class="license-key-row">
-                        <label>{{ __('License Key:') }}</label>
-                        <code class="license-key" data-license-key="{{ esc_attr(item.license.licenseKey) }}">
-                            {{ esc_html(item.license.licenseKey) }}
-                        </code>
-                        <button type="button" class="copy-license-btn" data-license-key="{{ esc_attr(item.license.licenseKey) }}" title="{{ __('Copy to clipboard') }}">
-                            <span class="dashicons dashicons-clipboard"></span>
-                        </button>
-                    </div>
-
-                    <div class="license-info-row">
-                        <span class="license-domain-display" data-license-id="{{ item.license.id }}">
-                            <strong>{{ __('Domain:') }}</strong>
-                            <span class="domain-value">{{ esc_html(item.license.domain) }}</span>
-                            {% if item.license.status == 'active' or item.license.status == 'inactive' %}
-                                <button type="button" class="wclp-transfer-btn"
-                                        data-license-id="{{ item.license.id }}"
-                                        data-current-domain="{{ esc_attr(item.license.domain) }}"
-                                        title="{{ __('Transfer to new domain') }}">
-                                    <span class="dashicons dashicons-randomize"></span>
-                                    {{ __('Transfer') }}
-                                </button>
+                <div class="package-licenses">
+                    {% for license in package.licenses %}
+                        <div class="license-entry license-entry-{{ esc_attr(license.status) }}">
+                            <div class="license-row-primary">
+                                <div class="license-key-group">
+                                    <code class="license-key">{{ esc_html(license.license_key) }}</code>
+                                    <span class="license-status license-status-{{ esc_attr(license.status) }}">
+                                        {{ esc_html(license.status)|capitalize }}
+                                    </span>
+                                </div>
+                                <div class="license-actions">
+                                    <button type="button" class="copy-license-btn" data-license-key="{{ esc_attr(license.license_key) }}" title="{{ __('Copy to clipboard') }}">
+                                        <span class="dashicons dashicons-clipboard"></span>
+                                    </button>
+                                    {% if license.is_transferable %}
+                                        <button type="button" class="wclp-transfer-btn"
+                                                data-license-id="{{ license.id }}"
+                                                data-current-domain="{{ esc_attr(license.domain) }}"
+                                                title="{{ __('Transfer to new domain') }}">
+                                            <span class="dashicons dashicons-randomize"></span>
+                                        </button>
+                                    {% endif %}
+                                </div>
+                            </div>
+                            <div class="license-row-secondary">
+                                <span class="license-meta-item license-domain">
+                                    <span class="dashicons dashicons-admin-site-alt3"></span>
+                                    {{ esc_html(license.domain) }}
+                                </span>
+                                <span class="license-meta-item license-expiry">
+                                    <span class="dashicons dashicons-calendar-alt"></span>
+                                    {% if license.expires_at %}
+                                        {{ license.expires_at|date('Y-m-d') }}
+                                    {% else %}
+                                        <span class="lifetime">{{ __('Lifetime') }}</span>
+                                    {% endif %}
+                                </span>
+                            </div>
+                            {% if signing_enabled and license.customer_secret %}
+                                <div class="license-row-secret">
+                                    <button type="button" class="secret-toggle" aria-expanded="false">
+                                        <span class="dashicons dashicons-lock"></span>
+                                        {{ __('API Verification Secret') }}
+                                        <span class="dashicons dashicons-arrow-down-alt2 toggle-arrow"></span>
+                                    </button>
+                                    <div class="secret-content" style="display: none;">
+                                        <p class="secret-description">
+                                            {{ __('Use this secret to verify signed API responses. Keep it secure.') }}
+                                        </p>
+                                        <div class="secret-value-wrapper">
+                                            <code class="secret-value">{{ esc_html(license.customer_secret) }}</code>
+                                            <button type="button" class="copy-secret-btn" data-secret="{{ esc_attr(license.customer_secret) }}" title="{{ __('Copy to clipboard') }}">
+                                                <span class="dashicons dashicons-clipboard"></span>
+                                            </button>
+                                        </div>
+                                    </div>
+                                </div>
                             {% endif %}
-                        </span>
-                        <span><strong>{{ __('Expires:') }}</strong>
-                            {% if item.license.expiresAt %}
-                                {{ item.license.expiresAt|date('Y-m-d') }}
-                            {% else %}
-                                {{ __('Never') }}
-                            {% endif %}
-                        </span>
-                    </div>
+                        </div>
+                    {% endfor %}
                 </div>
 
-                {% if item.downloads is defined and item.downloads is not empty %}
-                    <div class="license-downloads">
+                {% if package.downloads is defined and package.downloads is not empty %}
+                    <div class="package-downloads">
                         <h4>{{ __('Available Downloads') }}</h4>
                         <ul class="download-list">
-                            {% for download in item.downloads %}
-                                <li>
-                                    <a href="{{ esc_url(download.download_url) }}" class="download-link">
+                            {# Show only the latest version (first item) #}
+                            {% set latest = package.downloads|first %}
+                            <li class="download-item download-item-latest">
+                                <div class="download-row-file">
+                                    <a href="{{ esc_url(latest.download_url) }}" class="download-link">
                                         <span class="dashicons dashicons-download"></span>
-                                        {{ esc_html(download.filename ?: 'Version ' ~ download.version) }}
+                                        {{ esc_html(latest.filename ?: 'Version ' ~ latest.version) }}
                                     </a>
-                                    <span class="download-version">v{{ esc_html(download.version) }}</span>
-                                    <span class="download-date">{{ esc_html(download.released_at) }}</span>
-                                    {% if download.file_hash %}
-                                        <span class="download-hash" title="{{ esc_attr(download.file_hash) }}">
+                                    <span class="download-version-badge">{{ __('Latest') }}</span>
+                                </div>
+                                <div class="download-row-meta">
+                                    <span class="download-date">{{ esc_html(latest.released_at) }}</span>
+                                    {% if latest.file_hash %}
+                                        <span class="download-hash" title="{{ esc_attr(latest.file_hash) }}">
                                             <span class="dashicons dashicons-shield"></span>
-                                            <code>{{ download.file_hash[:12] }}...</code>
+                                            <code>{{ latest.file_hash[:12] }}...</code>
                                         </span>
                                     {% endif %}
-                                </li>
-                            {% endfor %}
+                                </div>
+                            </li>
                         </ul>
+
+                        {# Show older versions in collapsible if more than one version exists #}
+                        {% if package.downloads|length > 1 %}
+                            <div class="older-versions-section">
+                                <button type="button" class="older-versions-toggle" aria-expanded="false">
+                                    <span class="dashicons dashicons-arrow-down-alt2"></span>
+                                    {{ __('Older versions') }} ({{ package.downloads|length - 1 }})
+                                </button>
+                                <ul class="download-list older-versions-list" style="display: none;">
+                                    {% for download in package.downloads|slice(1) %}
+                                        <li class="download-item">
+                                            <div class="download-row-file">
+                                                <a href="{{ esc_url(download.download_url) }}" class="download-link">
+                                                    <span class="dashicons dashicons-download"></span>
+                                                    {{ esc_html(download.filename ?: 'Version ' ~ download.version) }}
+                                                </a>
+                                            </div>
+                                            <div class="download-row-meta">
+                                                <span class="download-date">{{ esc_html(download.released_at) }}</span>
+                                                {% if download.file_hash %}
+                                                    <span class="download-hash" title="{{ esc_attr(download.file_hash) }}">
+                                                        <span class="dashicons dashicons-shield"></span>
+                                                        <code>{{ download.file_hash[:12] }}...</code>
+                                                    </span>
+                                                {% endif %}
+                                            </div>
+                                        </li>
+                                    {% endfor %}
+                                </ul>
+                            </div>
+                        {% endif %}
                     </div>
                 {% endif %}
             </div>

wc-licensed-product.php

@@ -3,7 +3,7 @@
  * Plugin Name: WooCommerce Licensed Product
  * Plugin URI: https://src.bundespruefstelle.ch/magdev/wc-licensed-product
  * Description: WooCommerce plugin to sell software products using license keys with domain-based validation.
- * Version: 0.3.3
+ * Version: 0.6.0
  * Author: Marco Graetsch
  * Author URI: https://src.bundespruefstelle.ch/magdev
  * License: GPL-2.0-or-later
@@ -28,7 +28,7 @@ if (!defined('ABSPATH')) {
 }
 
 // Plugin constants
-define('WC_LICENSED_PRODUCT_VERSION', '0.3.3');
+define('WC_LICENSED_PRODUCT_VERSION', '0.6.0');
 define('WC_LICENSED_PRODUCT_PLUGIN_FILE', __FILE__);
 define('WC_LICENSED_PRODUCT_PLUGIN_DIR', plugin_dir_path(__FILE__));
 define('WC_LICENSED_PRODUCT_PLUGIN_URL', plugin_dir_url(__FILE__));