What is the logic of obfuscation of php code under a domain name?

Question

PHP

Interested in the logic of obfuscation of php code under a domain name.
I describe the situation, there are some php files with complex logical functions that have been written for several months and need high-quality obfuscation to avoid mass free distribution. There are a lot of files, they all have their own license keys, something like this $key = md5(md5($domain) . md5($hash)).
Where:
$domain = $_SERVER['HTTP_HOST'];
$hash = Absolutely random key that will be responsible for the version of the main encoding; (hardcode)
Actually, $_SERVER['HTTP_HOST'] itself can be changed at the beginning of the code. That is, everything would be fine, but it can still be bypassed.
Tell me, what can I link to in order to exclude domain name spoofing? Also, the logic of working with subdomains is not clear. Enough links to sources. Thank you!

Answer 1

obfuscation will in no way save you from getting into warez, any experienced dev will "treat" without any problems.
encoders like ioncube can help. but exactly until your product becomes popular and in demand.
the only effective way to protect the code is not to give it away, but to file it with saas.

Answer 2

1. If you really have super-duper secret algorithms that no one knows or can repeat.
Use only the SaaS model or perform calculations through your server (but the product will still be on the client's server).
2. If there are no Google / Pentagon / ISIL / Telegram hacking algorithms there.
Just give open source to work.
3. If you write very bad code and feel ashamed or good code but you are greedy.
Use SaaS.
Technologies allow you to bind a client's domain to you, create a separate workspace (virtual / server) for it, and everything you can think of.
http://sanasol.ws/2017/06/22/%d0%ba%d0%be%d0%b3%d0...

Answer 3

https://github.com/pk-fr/yakpro-po
(or ionCube, but there is a problem in code performance drawdown and not always everything goes smoothly... I bought it)
Parameters on the DNS server, for each site: IP, hash signature, domain (or regex mask).
In PHP - you just read them from DNS through obfuscated PHP code, and if the hash for the current server is different (from the one on DNS), then write that "so low!".

Answer 4

The following data can be used in the key: domain name, document_root, server_ip. And don't check it at all on your server. Like WHMCS for example.
Of course, if everything is covered by ionCube.