Protecting JavaScript in WordPress Themes and Plugins

// 1. First, save your original JavaScript file (for future updates)
// my-plugin-original.js

// 2. Obfuscate using JS Obfuscator Pro with these recommended settings:
// - Enable String Array with RC4 encoding
// - Set moderate Control Flow Flattening (0.4 threshold)
// - Enable Self-Defending
// - Disable Source Map in production

// 3. Save the obfuscated output as your main JS file
// my-plugin.js

// 4. Enqueue normally in your WordPress theme/plugin
function my_plugin_enqueue_scripts() {
    wp_enqueue_script(
        'my-plugin-js',
        plugin_dir_url( __FILE__ ) . 'js/my-plugin.js',
        array('jquery'),
        '1.0.0',
        true
    );
}

// Server-side validation in your plugin's PHP code
function check_license_key() {
    $license_key = get_option('my_plugin_license_key');
    $domain = $_SERVER['HTTP_HOST'];
    
    // Make API call to your license server
    $response = wp_remote_post('https://yourlicenseserver.com/validate', [
        'body' => [
            'license_key' => $license_key,
            'domain' => $domain,
            'product_id' => 'your-plugin-id'
        ]
    ]);
    
    $license_data = json_decode(wp_remote_retrieve_body($response));
    
    // Store license status in WordPress options
    update_option('my_plugin_license_status', $license_data->status);
    
    return $license_data->status === 'valid';
}

// Pass license status to JavaScript
function my_plugin_enqueue_scripts() {
    wp_enqueue_script(
        'my-plugin-js',
        plugin_dir_url( __FILE__ ) . 'js/my-plugin.js',
        array('jquery'),
        '1.0.0',
        true
    );
    
    // Pass license data to JavaScript
    wp_localize_script(
        'my-plugin-js',
        'MyPluginData',
        array(
            'license_status' => get_option('my_plugin_license_status'),
            'ajax_url' => admin_url('admin-ajax.php'),
            'nonce' => wp_create_nonce('my-plugin-nonce')
        )
    );
}

// Client-side validation in your JavaScript (which will be obfuscated)
// my-plugin-original.js
(function($) {
    // Check license status
    if (MyPluginData.license_status !== 'valid') {
        // Disable premium features or entire plugin
        console.error('Invalid license. Premium features disabled.');
        return;
    }
    
    // Periodically verify license via AJAX
    function verifyLicense() {
        $.ajax({
            url: MyPluginData.ajax_url,
            type: 'POST',
            data: {
                action: 'verify_license',
                nonce: MyPluginData.nonce
            },
            success: function(response) {
                if (!response.success) {
                    // Disable functionality if license becomes invalid
                    deactivatePremiumFeatures();
                }
            }
        });
    }
    
    // Regular license verification
    setInterval(verifyLicense, 1000 * 60 * 60); // Check every hour
    
    // Your premium functionality here
    function initializePremiumFeatures() {
        // ...
    }
    
    function deactivatePremiumFeatures() {
        // ...
    }
    
    // Initialize features
    initializePremiumFeatures();
})(jQuery);

// In your plugin's PHP code
add_action('wp_ajax_get_dynamic_js', 'my_plugin_generate_js');
add_action('wp_ajax_nopriv_get_dynamic_js', 'my_plugin_generate_js');

function my_plugin_generate_js() {
    // Verify user is allowed to access this code
    if (!check_license_key()) {
        wp_send_json_error('Invalid license');
        exit;
    }
    
    // Add nonce verification
    check_ajax_referer('my-plugin-js-nonce', 'nonce');
    
    // Set JavaScript header
    header('Content-Type: application/javascript');
    
    // Get the site-specific seed or parameter
    $site_key = get_option('my_plugin_site_key');
    if (!$site_key) {
        $site_key = wp_generate_password(32, false);
        update_option('my_plugin_site_key', $site_key);
    }
    
    // Load JavaScript template
    $js_template = file_get_contents(dirname(__FILE__) . '/js/template.js');
    
    // Replace placeholders with dynamic values
    $js = str_replace('{{SITE_KEY}}', $site_key, $js_template);
    $js = str_replace('{{TIMESTAMP}}', time(), $js);
    $js = str_replace('{{USER_ID}}', get_current_user_id(), $js);
    
    // Add additional server-generated values
    $encrypted_data = my_plugin_encrypt_sensitive_data();
    $js = str_replace('{{ENCRYPTED_DATA}}', $encrypted_data, $js);
    
    // Optional: Obfuscate the generated code
    $js = my_plugin_obfuscate_js($js);
    
    // Output the JavaScript
    echo $js;
    exit;
}

// In your main JavaScript, load the dynamic code
function my_plugin_enqueue_scripts() {
    wp_enqueue_script(
        'my-plugin-loader',
        plugin_dir_url( __FILE__ ) . 'js/loader.js',
        array('jquery'),
        '1.0.0',
        true
    );
    
    wp_localize_script(
        'my-plugin-loader',
        'MyPluginLoader',
        array(
            'ajax_url' => admin_url('admin-ajax.php'),
            'nonce' => wp_create_nonce('my-plugin-js-nonce')
        )
    );
}

// loader.js - This small loader file fetches the main functionality
(function($) {
    // Load the dynamic JavaScript
    $.ajax({
        url: MyPluginLoader.ajax_url,
        type: 'POST',
        data: {
            action: 'get_dynamic_js',
            nonce: MyPluginLoader.nonce
        },
        dataType: 'text',
        success: function(code) {
            // Execute the dynamically loaded code
            try {
                eval(code); // Or use a more sophisticated approach
            } catch (e) {
                console.error('Failed to load plugin functionality', e);
            }
        },
        error: function() {
            console.error('Failed to load plugin functionality');
        }
    });
})(jQuery);

// Register custom endpoint that requires authentication
add_action('rest_api_init', function () {
    register_rest_route('my-plugin/v1', '/premium-data', array(
        'methods' => 'GET',
        'callback' => 'my_plugin_get_premium_data',
        'permission_callback' => function () {
            // Only provide data to authenticated users with valid license
            return is_user_logged_in() && check_license_key();
        }
    ));
});

// In your JavaScript
function fetchPremiumData() {
    $.ajax({
        url: wpApiSettings.root + 'my-plugin/v1/premium-data',
        method: 'GET',
        beforeSend: function (xhr) {
            xhr.setRequestHeader('X-WP-Nonce', wpApiSettings.nonce);
        },
        success: function(data) {
            // Process the data only available to authenticated users
        }
    });
}

// Add custom capability to paying customers
function add_premium_capabilities($user_id) {
    $user = get_user_by('id', $user_id);
    $user->add_cap('access_premium_features');
}

// Check capabilities in your JavaScript via localized data
function my_plugin_enqueue_scripts() {
    wp_enqueue_script('my-plugin-js', plugin_dir_url(__FILE__) . 'js/my-plugin.js');
    
    $user = wp_get_current_user();
    wp_localize_script('my-plugin-js', 'MyPluginData', array(
        'has_premium_access' => user_can($user->ID, 'access_premium_features')
    ));
}