Two plugins, two licences

Licensing

The free plugin is free software under the GNU General Public License, version 2 or later — the same license as WordPress itself. Loyal Security Pro, the paid add-on, is commercial software under its own licence agreement.

The short version

Loyal Security (the free plugin, on WordPress.org) is GPLv2-or-later free software: use it anywhere, read it, change it, pass it on. Loyal Security Pro (the paid add-on, sold here) is not GPL as of version 1.11.0 — it is licensed per site under the agreement below. Pro versions up to 1.10.11 went out under the GPL and keep those terms for anyone who holds a copy.

The grant — free plugin

Loyal Security
Copyright (C) 2026

This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
MA 02110-1301 USA.

Read the full text at gnu.org/licenses/gpl-2.0.html. This covers the free plugin only; for Pro, see the Pro licence.

What that actually means for you

This section is about the free plugin.

You may

  • Use the free plugin on as many sites as you like, commercial or not
  • Read the entire source — it ships unobfuscated, with no compiled blobs
  • Modify it for your own needs
  • Redistribute it, modified or not, under the same GPL terms
  • Audit it before trusting it, which for a security plugin you arguably should

You must

  • Keep the same GPL license on anything you redistribute
  • Include the license text and copyright notice
  • Make your source available if you distribute a modified version
  • Not present a modified version as the official release
Source-available on purpose

A security plugin asks for extraordinary trust: it reads every request, touches every file, and holds your two-factor secrets. That trust should be verifiable. Every line of PHP and JavaScript ships readable in both tiers, and the dashboard runs on WordPress core's own bundled React — there is no build step hiding what actually executes. Pro is not GPL, but it is not obfuscated either: you can still read every line of what runs on your server.

The Pro licence

Loyal Security Pro is a separate plugin, sold here and delivered from our own licence server. It has never been distributed through WordPress.org. From version 1.11.0 it is commercial software under the Loyal Security Pro End User Licence Agreement — not the GPL.

The free plugin stays GPLv2-or-later, and this change does not reach back: every Pro release up to and including 1.10.11 went out under the GPL, and those grants stand for everyone holding a copy. A new licence can only apply to new versions.

You may

  • Run Pro on the number of sites your plan covers, plus a staging copy of each
  • Install it on client sites you administer, within that count
  • Read the whole source — Pro ships unobfuscated, with no compiled blobs
  • Modify your own copy for your own licensed sites, and keep that private
  • Keep backups, and keep running the version you have

You may not

  • Redistribute, resell, publish or bundle Pro, or share a licence key outside your organisation
  • Use one licence on more sites than the plan covers
  • Remove or bypass the licence check or the signature verification
  • Use Pro, or what you learn from reading it, to build a competing product

Pro features are gated locally by cryptographic token verification, so the plugin does not make an HTTP call on every request to decide what you are entitled to. Circumventing that gate does not unlock the service behind it: without a valid licence the threat-intel feed and reputation endpoints have nothing to return.

What a subscription pays for

A licence to run Pro on your sites, and with it the parts that cannot ship in a zip: the live threat-intelligence service — hourly WAF signature updates, CVE-matched virtual patches and cloud reputation verdicts — Sentinel AI analysis, which runs on our infrastructure, outside uptime monitoring, and support and continued development. Let a licence lapse and those stop; the copy you have installed keeps running with the data it last downloaded.

On nulled copies

Pirated copies of security plugins are a well-established malware distribution channel — the attacker's edit is trivially hidden in code you were never going to read. Installing a nulled security plugin hands root of your site to whoever repackaged it. The free tier is a complete, permanently free security plugin; there is no reason to run a tampered one.

Full Pro agreement

This is the agreement that ships as LICENSE.txt inside the Pro plugin, in full. It is the authoritative text; the summary above is a reading aid, not a substitute.

Loyal Security Pro End User Licence Agreement — version 1.0
LOYAL SECURITY PRO — END USER LICENCE AGREEMENT
Version 1.0, effective with Loyal Security Pro 1.11.0 (2026-10-21)

This is a commercial, proprietary licence. It is NOT the GNU General Public License.

Copyright (C) 2026 Ioannis Afaloniatis, trading as "Loyal Security".
All rights reserved.


0. THE FREE PLUGIN IS NOT COVERED BY THIS LICENCE

Loyal Security Pro is an add-on. The separate free plugin it requires, "Loyal
Security" (distributed through WordPress.org), is and remains free software under
the GNU General Public License, version 2 or later. Nothing in this agreement
limits, replaces or reinterprets your rights over that free plugin, which you may
use, read, modify and redistribute under the GPL exactly as before.

This agreement covers only the files distributed as part of Loyal Security Pro.


1. EARLIER VERSIONS KEEP THEIR OLD TERMS

Every release of Loyal Security Pro up to and including 1.10.11 was distributed
under the GNU General Public License, version 2 or later. Those grants are not
withdrawn and cannot be: if you hold a copy of 1.10.11 or earlier, your rights in
that copy are the GPL rights you already received.

This agreement applies to version 1.11.0 and to every later version. Installing,
copying or using 1.11.0 or later is acceptance of it. If you do not accept it, do
not install this version: keep the version you have, or uninstall Pro and continue
with the free plugin, which is complete on its own.


2. DEFINITIONS

"Software"   Loyal Security Pro: all PHP, JavaScript, CSS, data files, images and
             documentation distributed in its package, version 1.11.0 or later,
             including every update and upgrade we supply, unless an update ships
             with its own replacement terms.
"We", "us"   Ioannis Afaloniatis, trading as "Loyal Security", Greece.
"You"        the individual or legal entity that purchased the Licence, or on
             whose behalf it was purchased.
"Licence"    the subscription you purchased, identified by a licence key issued by
             licensekit.loyalsecuritywp.com.
"Site"       one WordPress installation reachable at one registered domain. A
             multisite network counts as one Site per activation unless your
             Licence tier states otherwise. One staging or development copy of a
             licensed Site, not publicly reachable and not used to serve real
             visitors, is included at no extra activation.
"Services"   the hosted parts a Licence unlocks: the threat-intelligence feed, CVE
             data, cloud reputation lookups, Sentinel AI analysis, uptime
             monitoring, Loyal Hub, and the LicenseKit portal and update server.
"Term"       the period for which your Licence is active and paid for.


3. LICENCE GRANT

While your Licence is active and you comply with this agreement, we grant you a
non-exclusive, non-transferable, non-sublicensable, revocable licence to:

  (a) install and run one copy of the Software on each Site your Licence tier
      covers, plus the staging or development copy described in clause 2;
  (b) make backup copies, as many as your normal backup practice requires;
  (c) modify the Software for use on your own licensed Sites, and keep those
      modifications private. We do not support modified copies, and a modification
      may stop working at any update;
  (d) install it on Sites you administer for your clients, where the Licence tier
      covers that number of Sites. Your client's use is your responsibility and is
      subject to these same terms.

Nothing else is granted. We reserve all rights not expressly given here.


4. RESTRICTIONS

You may not:

  (a) distribute, publish, sell, resell, rent, lease, lend, sublicense or otherwise
      make the Software, or any part of it, available to anyone who does not hold
      their own Licence, including by uploading it to a public repository, a file
      host, a marketplace, a "GPL club", a theme or plugin bundle, or a Git host
      others can read;
  (b) use one Licence on more Sites than the tier covers, or share a licence key
      outside your organisation;
  (c) remove, disable, bypass or tamper with the licence check, the signature
      verification, or any notice of authorship, copyright or these terms;
  (d) use the Software, or anything derived from reading it, to build or improve a
      product that competes with Loyal Security;
  (e) use the Services other than through the Software, or in a way that places an
      unreasonable load on them, or to attack, probe or scan a system you do not
      own or do not have written permission to test.

Decompilation and reverse engineering are not permitted except to the extent that
mandatory law allows it despite this clause. In particular, nothing here limits the
rights you may have under Articles 5 and 6 of Directive 2009/24/EC
(interoperability, error correction, back-up), or any equivalent provision of the
law that applies to you. The Software ships as readable source in any case, so
there is nothing to decompile.


5. OWNERSHIP

The Software is licensed to you, not sold. We retain all copyright and all other
intellectual property rights in it, including in every update. Any modification you
make under clause 3(c) remains subject to our rights in the underlying Software.

"Loyal Security" and its logo are our trademarks. WordPress, WooCommerce,
Cloudflare, Google, Slack, Microsoft Teams, PagerDuty and Opsgenie are the
trademarks of their respective owners; we name them only to describe what the
Software works with, and we are not affiliated with, endorsed by or sponsored by
any of them.


6. UPDATES, SERVICES AND SUPPORT

Updates to the Software, access to the Services and support are provided while the
Licence is active, in accordance with the Terms of Service published at
https://loyalsecuritywp.com/terms.html, which form part of this agreement for
everything concerning purchase, renewal, refunds, acceptable use and the Services.

When a Licence lapses or is deactivated, the Services stop and new versions stop
being offered. The copy of the Software already installed keeps running, with the
feature set it has and the data it last downloaded, under the licence grant in
clause 3, which ends with the Term. In plain terms: we will not break your site on
the day you stop paying, but continuing to run the Software on an expired Licence is
not a right this agreement gives you.


7. NO WARRANTY

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE AND NONINFRINGEMENT.

No security product can guarantee that a site will not be compromised. The Software
raises the cost of attacking your site and gives you the means to detect and recover
from a compromise quickly. It is one layer in a practice that also includes keeping
software updated, strong unique credentials, restricting administrator access, and
keeping tested off-site backups.


8. LIMITATION OF LIABILITY

TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE ARE NOT LIABLE FOR ANY INDIRECT,
INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, NOR FOR LOST PROFITS,
REVENUE, DATA, GOODWILL OR BUSINESS INTERRUPTION, ARISING OUT OF OR RELATED TO THE
SOFTWARE OR THE SERVICES, ON ANY THEORY OF LIABILITY, EVEN IF WE HAVE BEEN ADVISED
OF THE POSSIBILITY OF SUCH DAMAGES.

OUR TOTAL AGGREGATE LIABILITY UNDER OR IN CONNECTION WITH THIS AGREEMENT IS LIMITED
TO THE AMOUNT YOU ACTUALLY PAID US FOR THE LICENCE IN THE TWELVE MONTHS BEFORE THE
EVENT GIVING RISE TO THE CLAIM.

Nothing in this agreement excludes or limits liability that cannot lawfully be
excluded or limited, including liability for death or personal injury caused by
negligence, for fraud or fraudulent misrepresentation, or for gross negligence or
wilful misconduct.


9. TERM AND TERMINATION

This agreement runs for the Term. It ends automatically, without notice, if you
breach clause 4, and in that case you must stop using the Software and delete every
copy of it. Clauses 1, 5, 7, 8 and 10 survive termination.

Termination does not entitle you to a refund except as the Terms of Service
provide, and does not affect your rights in the free plugin or in Pro versions
1.10.11 and earlier.


10. GENERAL

This agreement, together with the Terms of Service, is the whole agreement between
us about the Software. If a provision is held unenforceable, the rest stays in
force, and the unenforceable part is read down to the minimum extent needed to make
it enforceable.

This agreement is governed by the laws of Greece. If you are a consumer resident in
the European Union, the United Kingdom or any other jurisdiction whose consumer
protection law gives you mandatory rights, those rights are not affected by this
agreement, and you keep the right to bring proceedings in the courts of your place
of residence. Otherwise, the courts of Athens, Greece have exclusive jurisdiction.

You may not assign this agreement without our written consent. We may assign it to a
successor to the business, including a company we incorporate to carry it on; we will
say so at https://loyalsecuritywp.com/terms.html and in the plugin's changelog if we
do.


CONTACT

Ioannis Afaloniatis, trading as "Loyal Security", Greece
https://loyalsecuritywp.com/support.html
[email protected]

No warranty

Both licences provide the software without warranty of any kind — the GPL's own disclaimer for the free plugin, clause 7 of the Pro agreement for Pro. In plain terms: no security product can guarantee a site will not be compromised. Loyal Security raises the cost of attacking your site substantially, and gives you the tools to detect and recover from a compromise quickly — but it is one layer in a practice that also includes keeping software updated, using strong unique credentials, restricting who has administrator access, and keeping tested off-site backups.


Third-party components

Both plugins are self-contained: no Composer dependencies, no npm packages, no vendor directory, and no third-party datasets in the Pro zip. It builds on WordPress core's own bundled libraries — notably React via wp-element — which are covered by WordPress's own GPL licensing.

Where the plugin consults external data (WordPress.org checksums, the Have I Been Pwned Pwned Passwords API), it uses those public services under their own terms; it does not bundle or redistribute their data. See the privacy disclosure for exactly what is queried and when.

This marketing site loads Tailwind, GSAP and Three.js from public CDNs under their respective MIT licenses, and typefaces from Google Fonts under the SIL Open Font License.

Trademarks

WordPress and WooCommerce are trademarks of their respective owners. Loyal Security is an independent project and is not affiliated with, endorsed by, or sponsored by WordPress.org, the WordPress Foundation or Automattic. Cloudflare, Google, Slack, Microsoft Teams, PagerDuty and OpsGenie are trademarks of their respective owners and are named here only to describe interoperability.