The Multi-Tenant Licensing Crisis: Tracking Per-Seat vs. Per-Site Agency Tooling
DEV Community

The Multi-Tenant Licensing Crisis: Tracking Per-Seat vs. Per-Site Agency Tooling

Executive Summary

For years, many WordPress agencies built their margins on “unlimited site” developer licenses. One agency key, a standard plugin stack and a few hundred client sites was a workable model, and vendors encouraged it.

The picture in late 2026 is more mixed than “unlimited licenses are gone.” Several vendors have retired or capped their unlimited tiers. Others still sell them. Either way, the pricing metric now drives agency margin, whether it counts sites, seats, or both.

WP Rocket began phasing out its Infinite plan in 2025 and replaced it with Multi tiers of 50, 100 and 500 sites. Astra announced in April 2025 that it no longer offers unlimited-site licenses. Elementor now lists Essential, Advanced Solo, Advanced, Expert and One plans plus a One Agency tier. According to a September 2026 pricing roundup, the older Studio and Agency plans were removed from its price list.

ACF PRO, Gravity Forms and WPML still sell unlimited-site agency tiers, at $249/year, $259/year and €199/year respectively.

The core operational problem is unchanged. When a client leaves, a license key often stays active on a site the agency no longer earns from. It consumes a site slot, can push you into a more expensive tier at renewal, and can leave a client’s site tied to a key the agency should no longer control.

Unmonitored keys on offboarded sites create two risks:

  • Margin leakage: paying for site slots or seats that no longer produce revenue.
  • Compliance and continuity risk: running vendor licenses on sites outside your contract, and cutting off a former client’s access to updates without warning.

This article covers how per-seat and per-site pricing differ, what vendors actually do when licenses lapse, and a practical framework for auditing and governing licenses across client environments.

1. The Anatomy of Multi-Tenant License Leakage

When an agency builds dozens or hundreds of sites on a standard stack, developers often paste the agency’s key into each site’s settings. The key can also end up in wp-config.php, a deployment blueprint or a shared password manager.

  • Agency master license (site-capped tier)
  • ├── Active client (retainer paid) → key active, generating revenue
  • ├── Offboarded client site ("ghost") → key active, no revenue
  • └── Staging / dev instance → may or may not count against the cap, depending on the vendor's detection rules

The “Ghost Site” Problem

Offboarding checklists usually cover credentials, DNS and hosting. Application-level license activations are easy to forget. They live in the database, in wp-config.php or in environment variables, and they stay registered on the vendor’s side until someone deactivates them.

If a former client moves the site to a new host with the key still in place, the vendor’s licensing system can keep counting that domain against the agency’s allocation.

How Silent Margin Drift Happens

Tier selection at renewal: WP Rocket’s transition of Infinite customers shows how site count can drive price. Its email to customers said the Infinite license would move to a Multi tier based on the customer’s current website count, excluding staging sites. In the example shared publicly, an agency was moved to Multi 500, with a regular price of $599/year. Ghost sites inflate that count.

Hard activation caps: ACF PRO’s Freelancer tier covers 10 sites, and Agency covers unlimited. A published agency case study describes an “Activation limit reached” error when an additional site was activated. Hitting a cap with ghost sites on the account means blocked activations for live projects, or a forced tier upgrade.

Per-seat creep: Seat-based tools such as Figma, Asana and HubSpot charge per user. Former contractors or client staff left active in shared workspaces add cost month after month until someone audits the user list.

Staging and dev sites: Vendors handle these differently, so assuming they are free is risky. ACF PRO and WPML exclude recognized staging and development sites, but ACF’s detection depends on hostname patterns. A published ACF license walkthrough notes that a staging copy under a path such as /staging on the production domain is treated as production. WP Rocket’s FAQ says local domains don’t count and that subdomains and subfolders share one license under one top-level domain.

2. How Vendor Licensing Actually Behaves

Public documentation is less dramatic than “audits and blacklists.” In practice, the documented consequences of license problems are mostly about updates, support, new activations and tier changes, not sudden site breakage.

Gravity Forms: If a license expires, the plugin and add-ons stay installed and keep operating. You can no longer download the core plugin or add-ons, you see expiry reminders in the admin, and you can’t use that key to register a new site, even when restoring a backup. Gravity Forms also warns that an un-updated installation may eventually fail in unpredictable ways as WordPress and integrations change.

WPML: If you don’t renew, you can’t update WPML to new versions.

WP Rocket: The Multi license requires yearly renewal for continued access to support and updates.

ACF PRO: A WP Engine community thread quotes ACF’s documentation as saying field data outside the ACF admin screens isn’t affected by license status. The same thread’s answers suggest that revoking a key you share across sites is a coarse tool, and that having clients buy their own license avoids the problem.

Why Licensing Terms Have Tightened

Two documented reasons stand out:

  • Incentive misalignment on unlimited plans. A Freemius analysis argues that with an unlimited license, the vendor wants to minimize abuse of the agency’s key while the agency has no reason to care about site count. WP Rocket’s own customer notice said it had offered the Infinite license for over a decade before phasing it out.
  • Ownership and strategy shifts. ACF was acquired by WP Engine in 2022. WP Engine has been majority-owned by private equity firm Silver Lake since a $250 million investment in 2018. In October 2024, WordPress forked ACF’s free plugin into Secure Custom Fields. The dispute is a reminder that a plugin’s ownership, update channel and licensing can change quickly.

Each vendor’s terms of service define its enforcement rights, so read them directly. This article found no vendor publicly documenting retroactive invoicing for excess site activations, so budget for the documented behaviors above rather than for audit penalties.

The Real Operational Risks

Lost update access: On a lapsed or reassigned key, a client’s site can’t pull updates. For a security-critical plugin, that gap matters. Gravity Forms’ July 2025 supply-chain incident is a reminder of how important clean, current plugin sources are. Malicious code was found in manually downloaded versions 2.9.11.1 and 2.9.12 from the official download page on July 9-10, 2025, and Gravity Forms said its licensing and update API was not compromised.

Blocked new activations: An expired or capped key can block you from licensing a new client site in the middle of a launch.

Reputation and support load: Clients who see expired-license notices in their admin will ask the agency about them, whether or not the site still works.

3. Per-Seat vs. Per-Site: A Structural Comparison

  • Criteria
  • Per-Seat (user/operator)
  • Per-Site (domain/installation)
  • Hybrid (seat + site limits)
  • Billing metric: Number of user accounts. / Number of sites or domains activated. / User cap plus site limit.
  • Typical examples: Figma, Asana, HubSpot / ACF PRO, Gravity Forms, WPML, Elementor, WP Rocket / Plans combining both metrics
  • Margin effect: Overhead tied to team and contractor headcount. / Closer to a per-client cost, so it can be re-billed. / Needs allocation per client contract.
  • Offboarding failure mode: Unused seats keep billing. / Ghost sites consume capacity or push you to a higher tier. / Both failure modes at once.
  • Main audit task: Reconcile the user list against current staff and contractors. / Reconcile the activation list against active client domains. / Do both.

4. Illustrative Math: What Ghost Sites Can Cost

The numbers below are a hypothetical model, not a measured industry average. Substitute your own vendor tiers and churn rate.

Assumptions: an agency runs 150 live client sites, offboards 20% of clients each year (30 sites) and adds 30 new ones. No keys are deactivated at offboarding.

  • Year / Live client sites / Activated sites on vendor account / Ghost sites
  • 1 / 150 / 150 / 0
  • 2 / 150 / 180 / 30
  • 3 / 150 / 210 / 60

By year 3, 60 of 210 activations (about 29%) belong to former clients. Whether that costs money depends entirely on the vendor’s tiers.

Take a purely hypothetical per-site vendor with a 200-site tier at $400/year and a 500-site tier at $700/year. Crossing 200 activations means paying the higher tier, an extra $300/year for ghost sites, and that excess would recur every year until the keys are cleaned up. Check your actual contracts.

If a vendor sells an unlimited tier, as ACF, Gravity Forms and WPML still do, ghost sites may cost nothing in license fees, though they still carry the security and ownership risks above. The place where ghost-site math bites hardest is capped tiers such as WP Rocket Multi (50/100/500) and Elementor Expert (25).

5. A Framework for License Governance

  • Phase 1: Ingestion / Phase 2: Deployment / Phase 3: Offboarding
  • • Central key inventory / • Keys supplied via config / • Deactivate site activations
  • • Client ID binding / • Environment scoping / • Remove keys from client host
  • • Renewal dates tracked / • Staging naming rules / • Notify client of next steps

Phase 1: Keep Keys Out of Site Settings Where You Can

Several vendors support defining the key in code:

  • ACF PRO supports an ACF_PRO_LICENSE constant in wp-config.php. ACF’s own code checks for the constant and activates the key.
  • Gravity Forms supports GF_LICENSE_KEY, but it only pre-populates the key at installation on a single-site install, or when new sites are created on a multisite network. It is not a way to change keys on already-installed sites.
// wp-config.php - read the key from the server environment rather than hardcoding it
define( 'ACF_PRO_LICENSE', getenv( 'AGENCY_ACF_LICENSE_KEY' ) );
define( 'GF_LICENSE_KEY', getenv( 'AGENCY_GRAVITY_FORMS_KEY' ) ); // install-time only

Two caveats apply:

  • A constant means the master key lives on the client’s server. Offboarding must therefore include removing it from the host, because the key sits in the client’s environment either way.
  • Activation data may still be stored by the plugin after activation. Don’t assume a constant means nothing is written to the database.

For staging and development, don’t try to block vendor license calls in code. It is fragile and can break plugin behavior. Instead, use hostnames the vendor recognizes as non-production. For ACF, that means a staging subdomain, not a path on the production domain. Confirm each vendor’s current rules in its documentation.

Phase 2: Prefer Client-Owned Licenses Where It Makes Commercial Sense

A centralized proxy that forwards license checks under your master key is technically possible, but it is risky. It likely conflicts with vendor terms, depends on spoofable request data, and can break when a vendor changes its API.

A better pattern for most agencies:

  • Use the agency tier for sites you actively manage and bill under a retainer.
  • Have clients buy their own license for tools you only configure once.
  • Use a vendor’s own multi-site management tools where one exists, instead of building around its licensing system.

Phase 3: Offboarding Checklist

When a client leaves, run license cleanup alongside access revocation:

  • Deactivate the site’s activation in each vendor account.
  • Remove license constants and keys from the client’s host or config.
  • Confirm the plugin shows an unlicensed state, with no agency key left in the database.
  • Send the client direct purchase links for the licenses they now need, and note the update implications from Section 2.
  • Update your inventory and close out any seat assignments in shared tools.

6. Contract and Record-Keeping Steps

Contract Language

Update client agreements to say who owns each license and what happens at termination. Have your lawyer review the wording. A starting point:

“Software licenses provided under the Agency Maintenance Retainer remain the property of the Agency. On termination, agency-provided premium software keys will be deregistered, and the Client is responsible for procuring its own licenses to continue receiving updates and support.”

A Central License Inventory

Keep one source of truth that ties each client, domain and vendor license together. A spreadsheet works at small scale. A record per client might look like:

{
  "client_id": "CLI-88402",
  "domain": "example-client.com",
  "contract_status": "Active",
  "licenses": [
    {
      "vendor": "Advanced Custom Fields",
      "tier": "Agency",
      "registered": "2025-01-15",
      "renewal": "2026-01-15"
    },
    {
      "vendor": "Gravity Forms",
      "tier": "Elite",
      "registered": "2025-01-15",
      "renewal": "2026-01-15"
    }
  ]
}

Reconciliation

Compare active client domains against each vendor’s activation list on a schedule. Most vendors expose activated sites in an account dashboard. Some may offer an API, so check each vendor’s documentation before building automation.

# Reconcile active client domains against a vendor activation export (CSV or API data)
ACTIVE_CLIENT_DOMAINS = { "alpha.com", "beta.io", "gamma.net" }

def find_orphaned_activations(vendor_activations):
    """vendor_activations: iterable of dicts with at least a 'domain' key."""
    return [a for a in vendor_activations if a["domain"] not in ACTIVE_CLIENT_DOMAINS]

# Example input, e.g. loaded from a vendor dashboard export
activations = [
    {"domain": "alpha.com", "activated": "2025-01-15"},
    {"domain": "former-client.com", "activated": "2024-03-02"},
]

for orphan in find_orphaned_activations(activations):
    print(f"REVIEW: {orphan['domain']} (activated {orphan['activated']})")
Read on DEV Community ↗ ← Back to News

Comments

No comments yet. Start the discussion.