How it works
-
1
Add your licences
Enter the licence keys you bought, one by one or imported from a WordPress site that already uses them. They are encrypted and only ever sent to the vendor.
-
2
We fetch the official updates
Every few hours we ask each vendor’s own update service for new versions, exactly as your licensed site would.
-
3
We check every release
Each version is scanned for malware, compared with the previous one and matched against known vulnerabilities before it reaches you.
-
4
You install with Composer
Your own repository serves every version to you, your team, your CI and the clients you choose.
More than a mirror
The same checks, history and access control as the MeteorGPL repository, for the licences you own.
Every version, kept
All versions since you joined stay available: pin, compare and roll back with Composer constraints.
Scanned on arrival
Malware scan and a file-by-file diff of each release, with the report beside the version.
Vulnerability alerts
Known vulnerabilities of your plugins, in your notifications and in composer audit.
Tokens with limits
A token per person, project, CI pipeline or client — limited to chosen packages and versions, with an expiry date.
Teams and clients
Organisations with roles, seats and an audit log; invite a client to the packages of their site only.
Notifications and webhooks
New releases, failed updates, licences about to expire — by e-mail, push, Slack, Discord or your own webhook.
Import from a site
A small WP-CLI command reads the licences of an existing site and imports them in one go.
One composer.json
Use it beside the MeteorGPL repository: the catalogue and your own licences in the same project.
Planned support at launch
The update systems premium plugins and themes use. More are added on request.
- Easy Digital Downloads
- Freemius
- WooCommerce.com
- Envato Market
- Gravity Forms
- ACF PRO
- Elementor Pro
- WP Rocket
- WPML
- Yoast
- Admin Columns
- LearnDash
- FacetWP
- Vendor Composer repositories
- GitHub releases
- Any download URL
- Upload
Why not host it yourself?
Nothing to run
No WordPress install, server or plugin to keep alive just to serve your plugins to Composer.
Checks you would not run
Malware scanning, release diffs and vulnerability matching come with every update.
Access you can hand out
Separate, limited, revocable tokens for every person, project, pipeline and client.
Questions
Which plugins and themes will be supported?
Any whose vendor delivers updates through Easy Digital Downloads, Freemius, a Composer repository, WooCommerce.com, Envato Market or its own update server. The first set covers the most common systems and more are added on request; anything else can come from a download URL, GitHub releases or an upload.
Do you change the plugins?
No. You receive the vendor’s own files, unchanged, with checksums. We scan them and keep the report beside each version.
How are my licence keys protected?
They are encrypted with a key kept apart from the rest of the application, used only to fetch updates from the vendor, and never shown again after you save them. You can delete them at any time.
Does it use one of my licence’s site activations?
Some vendors count every site that asks for updates. You choose which licensed site the requests are made for, as when a WordPress site checks for updates.
Can my clients and my CI use it?
Yes: tokens for each person, project, pipeline or client, limited to the packages you choose, with an expiry date if you want one.
Does it replace a MeteorGPL subscription?
No, it complements it. The MeteorGPL repository serves the catalogue; MeteorGPL Private serves the licences you own, including plugins the catalogue does not have.
When does it open, and what will it cost?
We are building it now. Prices are announced with the launch, billed yearly by the number of packages; people on the early-access list hear first.