Compare
Three ways to put a premium plugin or theme into a WordPress project, row by row. The repository is the third column; it does not replace the vendor’s license, it packages the code you are licensed to run.
| Criterion | Random download sites and “nulled” zips | The vendor’s own portal, manual zip | This Composer repository (composer.meteorgpl.com) |
|---|---|---|---|
| Source integrity | Unknown origin, often modified; nothing to verify a download against. | The original archive, straight from the vendor. | The original code, with a SHA-256 for every version, scanned for malware before publication. |
| License checks | Stripped or patched out; the product cannot be registered with the vendor. | Intact; activated with your key. | Intact; activated with your own key bought from the vendor. |
| Versioning and composer.lock reproducibility | None; a file name is the only version hint. | Manual: download, unzip, upload; no lock file records what runs where. | Semver tags; composer.lock pins the version and the dist checksum, so every environment installs the same bytes. |
| Updates | Download again from wherever, with the same risk each time. | Through the WordPress admin with a valid key, or another manual zip. | composer update. |
| Rollback | Only if you kept the old zip. | Only if the vendor still offers the old version. | Every published version stays available. |
| Bedrock and twelve-factor fit | None. | Plugins live outside the dependency graph; deploys need manual steps. | Dependencies declared in composer.json, installed by the build, no vendored code in your repository. |
| Legal clarity | Unclear provenance, modified code. | The vendor’s license terms. | GPL code redistribution plus the vendor license you buy; a published takedown policy. |
| Vendor support and update entitlement | None. | With the license. | With the license: it stays with the vendor; the repository does not replace it. |
| CI automation | Not possible without committing zips. | Not possible without committing zips or scripting portal logins. | auth.json or COMPOSER_AUTH in the pipeline. |
| Cost | “Free”, with the risk of malware and no support. | The vendor’s license. | The vendor’s license plus a repository subscription. |
What is stripped and why
The GPL covers the code a vendor declares under it. Artwork, fonts, media, documents and demo content bundled with a product are often licensed separately, so the repository does not redistribute them: raster images are replaced by same-size placeholders (layouts keep working), fonts are removed except icon fonts, audio, video, documents, demo content and nested archives are removed. The package page states the declared license and a license profile; the licensing page has the full policy. Obtain the original assets from the vendor with your license.
What is never changed
PHP, JavaScript, CSS and the rest of the code are shipped as the vendor wrote them. License checks, activation flows, update checks and the vendor’s telemetry are not altered, removed or stubbed. Archives that arrive with such modifications are restored to the original code where a clean reference exists and are not published otherwise. Activate with your key; the vendor remains your point of support.