Customer Plugin Downloads

Download and install a plugin after purchase.

A verified, signed-in customer can download the latest active plugin ZIP from a paid order or the organisation's Licences page. The customer must have license.read permission and an active, unexpired licence for the same organisation and product. Manual licences and the configured billing environment are supported. A retired price or plan does not cancel an existing licence.

The initial download requires no WordPress activation and consumes no activation slot. The paid-order page offers it only after confirmed payment. The licence page also supports operator-issued evaluation licences. The seven-day key retrieval window is separate from download eligibility.

Customer installation

1. Sign in, select your organisation and open Licences, or open your paid order.
2. Select Download plugin ZIP. Leave the ZIP compressed.
3. In WordPress, open Plugins → Add New Plugin → Upload Plugin. Install and activate the ZIP.
4. Open the plugin's licence settings, paste the licence key and activate the website.

ILS 0.24.3 includes production trust settings for a fresh installation. Existing staging/custom settings are retained. Sandbox customers need administrator-configured sandbox trust settings. Never copy a private signing key to WordPress. Installing the plugin does not provide translation-provider credentials; configure your translation provider separately.

Access and integrity

GET /organizations/{organization}/licenses/{license}/download uses verified session authentication, organisation permission and licence scope checks, and a 20 requests/minute limit. Every request rechecks licence eligibility and release availability. The newest semantic version for that product is selected. Expired, revoked or wrong-environment licences receive 403; unavailable/withdrawn/wrong-product releases receive 404; missing or corrupt package bytes receive 503.

The package is served directly from private release storage after checking its size and SHA-256. Responses use private, no-store, nosniff and no-referrer headers. No filesystem path, raw licence key or installation credential is placed in the page. Successful authorization is audited as release.downloaded.customer; this records serving authorization, not proof that the browser completed its transfer. Existing installation update tickets and their checks remain in place.

Acceptance on staging

• With an active staging licence and a published package, download from both the paid order and Licences page. Confirm ZIP version and checksum against the imported release.
• Confirm no activation slot is consumed. Install on the WordPress staging site and confirm its existing connection settings persist.
• Sign out and revisit the download URL: sign-in is required. Another organisation cannot download the licence's package.
• Confirm expired/revoked licences and withdrawn packages cannot be downloaded.

Local automated checks are recorded in the platform validation notes. This release has not been deployed by the assistant; staging browser acceptance remains required.