Is selling a WordPress plugin still profitable?

Executive Summary & Verdict

Promising — 6/10. Build it. Do not quit the retainers, and do not tell yourself this replaces them inside two years. Three things earn the score: the customer is named and reachable, the demand has a legal deadline attached, and the failure mode costs about $8,300 rather than a career.

The deadline is the whole reason this plan is not a generic plugin idea. Under the Department of Justice's ADA Title II web rule, state and local government entities must bring web content to WCAG 2.1 Level AA [1], and after the April 2026 interim final rule the compliance dates stand at 26 April 2027 for entities with a population of 50,000 or more and 26 April 2028 for smaller entities and special purpose districts [2]. Every agency holding a city or school district retainer is currently being asked, by a client with a date in the calendar, to prove something. Nobody sells them the proof.

The reason this is a 6 and not an 8 is in section 06, and it is not the build cost. It is that a deadline-driven licence is a renewal risk, on top of an annual-licence category that already churns at 29% a year [3]. Section 07 is therefore about sequencing: what to build so that the product still has a reason to exist on 27 April 2028, when the urgency that sold the first two hundred licences has passed.

Idea Validation

The premise holds up because it is narrow. The WordPress plugin directory lists over 72,000 free plugins [1], and the general purpose end of that market — another contact form, another SEO tool, another cache plugin — is saturated past the point where a solo developer can be discovered in it. Narrowness is not a consolation prize here; it is the only viable entry.

What makes this particular narrowness good is that the customer's problem is not "my site should be accessible." It is "I have to hand my client something that says we did the work, on a date, before April." That is a document problem dressed as a technical problem, and document problems are much easier to sell than improvement problems, because the buyer already knows they need one.

The weak point in the answers is the assumption that agencies will pay for evidence rather than produce it themselves with free tooling and a spreadsheet. They will, but only if the export is genuinely client-ready — the format, the wording and the page-by-page detail have to survive being forwarded to a city attorney. That is a content and design problem, not a coding problem, and it is the part of this build most likely to be under-budgeted.

One more validation test, cheap and immediate: you have retainer clients. Three of them are the customer. Ask those three what they are currently sending their public-sector clients about accessibility, and whether they would pay $199 a year to stop assembling it by hand. If all three say they would, you have a product. If they shrug, you have a hobby.

Market & Target Customer

Your market is not "WordPress users." It is not even "agencies." It is the subset of small agencies and solo developers whose client list includes at least one entity covered by the ADA Title II web rule — state and local governments, their agencies and departments, special purpose districts, and the schools, courts, libraries and transit bodies that sit inside them [1].

What that customer actually looks like

• Two to eight people, or one person with a maintenance plan. Maintains 10–80 WordPress sites on monthly retainers.
• Already sells "care plans" — updates, backups, uptime. Accessibility evidence slots into an existing line item they already know how to bill.
• Has been asked about WCAG by a client in the last twelve months and answered with a mix of hedging and a free scanner screenshot.
• Buys tools on an annual licence without a procurement process. This matters enormously: your price point has to stay under the threshold where a purchase becomes a decision.

The timing is the market. In September 2026 the first deadline is seven months away [2], which means the agencies serving larger municipalities are in the middle of the problem right now, and the much larger population of agencies serving small towns and districts has a further year. That gives this plan roughly eighteen months of demand you do not have to create, followed by a cliff you have to plan for. Section 15 treats the cliff as the primary risk, because it is.

Competitive Landscape

You have three competitor categories and only one of them is a real threat.

Free scanners and browser extensions are your feature, not your competitor. They test a page. They do not schedule, they do not remember, and they do not produce a portfolio-level document. Your entire value sits in the words "dated" and "across sites."

Accessibility overlay widgets are the loud incumbents, and the reason your positioning writes itself. An overlay is a front-end script sold as compliance; your customer's client is a public body whose counsel will eventually ask for evidence of remediation rather than a toolbar. Compete by being the thing an overlay cannot be: a record.

The genuine competitor is a spreadsheet and a consultant. Agencies already solve this by paying a specialist for a one-off audit and keeping the findings in a document. That is expensive, out of date within a month, and unrepeatable across 40 sites — which is exactly the argument you make. It is also proof the budget exists.

Where you are structurally weak

• Authority. You are one developer selling compliance evidence. Expect to be asked who you are. A named accessibility specialist reviewing your report template, credited by name, is worth more than any feature you could ship in the same week.
• Discoverability. With 72,000 plugins in the directory [1], directory search is not a growth channel for a term nobody types. Your traffic has to come from the agency-facing content in section 09.
• A well-funded entrant. If this niche proves out, someone with money will enter it. Your defense is the one they cannot buy quickly: two years of accumulated scan history in existing customers' installs, which is switching cost.

Business Model & Monetisation

Get this straight before you write a line of code, because most people who ask whether selling a plugin is profitable have the model wrong. WordPress is released under the GPLv2 (or later) [1], and the GPL explicitly permits selling copies — "the GPL allows everyone to do this. The right to sell copies is part of the definition of free software" — while equally explicitly forbidding you from requiring that anyone who receives the software pays you or notifies you: "a requirement like that would make the program nonfree" [2].

So the commercial object you sell is not the code. You sell a time-limited licence to updates and support. A customer who buys your plugin can legally hand the PHP to a friend; what they cannot hand over is your update server, your ticket queue and your name on the report template. That is not a loophole, it is the actual business, and it is why every serious commercial plugin in this ecosystem sells annual licences rather than code. Gravity Forms, to take a well-known example, sells single-site at $59/year, three sites at $159/year and unlimited sites with priority support at $259/year [3].

The freemium route through the WordPress.org directory is permitted but fenced. The directory guidelines are explicit that "plugins may not contain functionality that is restricted or locked, only to be made available by payment or upgrade," while "attempting to upsell the user on ad-hoc products and features is acceptable, provided it falls within bounds of guideline 11" on hijacking the admin experience [4]. In practice: the free plugin must be a complete, useful thing on its own — it cannot be a demo with padlocks — and your upgrade prompts must be quiet.

What that means for this specific plugin

• Free tier: scan one site, see the current findings, export a plain report. Complete and genuinely useful for a one-site owner. No locked buttons.
• Paid tier: multiple sites under one licence, scheduled scans, retained history, the remediation log, and the client-ready branded PDF. All of it additional code delivered on licence, not disabled code sitting in the free download.
• No lifetime licences. A one-time fee for an obligation to support and update software forever is a liability that compounds while the revenue does not.
• Do not add a services line in year one. Selling audits alongside the plugin converts your product business back into your consulting business at a lower hourly rate.

Finances & Budget

The cash side of a plugin business is small and boring, which is the good news. The table below is the realistic year-one cash cost of getting this specific product to market as a Texas LLC. The Secretary of State filing fee for a certificate of formation is $300 [1], and a USPTO trademark application now costs a $350 base fee per class after the January 2025 consolidation of TEAS Standard and TEAS Plus [2].

The revenue arithmetic, done honestly

Take-rate first, because it comes off the top. Freemius charges 7% plus gateway fees of about 3% and 30¢ per successful charge, on a lifetime-gross schedule that starts at 27% of your first $1,000 and 17% of the next $4,000 before settling at 7% [3]. On a first year of $8,580 gross that is roughly $1,474 in fees, or 17.2%; by the second year, past the tiers, it falls to about 10%.

Now the funnel. Assume 2,500 active installs twelve months after the free plugin lands, which is a realistic outcome for a narrow niche plugin with content behind it and a poor outcome for a general-purpose one. Feature-gated freemium converts at about 2.1% as a general benchmark [4] — that figure is not WordPress-specific, so treat it as an order of magnitude rather than a forecast. It gives roughly 52 paid licences. At a blended $165 across a $79 single-site, $199 ten-site and $399 fifty-site ladder, that is $8,580 gross, $7,106 net of fees — against $8,300 of cash cost. Year one loses about $1,200.

Year two is where the model either works or does not. Say installs reach 6,000 as the smaller districts approach their 2028 date, giving about 126 paid licences at the same 2.1%. Of your 52 first-year customers, Freemius' 29% average annual churn [5] would retain 37 — but a licence bought to clear a deadline renews worse than average, and at a more honest 55% you retain 29. Call year two $20,790 gross, about $18,700 net of fees, and roughly $17,000 after fixed costs.

Then divide by hours. Year one is roughly 610 hours: 240 to build, 40 on submission and documentation, 180 on post-launch development, 90 on support, 60 on marketing. Year two is roughly 619 hours, of which 299 are support — free-forum support for 6,000 installs included, which you cannot decline and cannot bill. That produces an effective rate of negative $2 an hour in year one and about $27 an hour in year two, against your $85 client rate. Two years, 1,229 hours, about $15,800 of cumulative net cash, and roughly $104,000 of billable time not billed.

What justifies the Promising verdict despite those hourly numbers is the shape of the downside and the shape of the asset. The worst case is $8,300 and a year of evenings, with the retainers intact. The better case is a product with two years of accumulated scan history inside customer installs, recurring revenue, and a resale value that consulting hours never accumulate. Judge this as equity, not as wages.

MVP & What to Build First

The sequencing question here is not "what is the smallest thing that works." It is "what do I build first so that support does not eat me, and what do I build so the product outlives the April 2028 deadline." Those are the two constraints from section 06, and they order the roadmap.

Build first — the twelve weeks that matter

• The report export, before the scanner. Build the document your customer will forward to a city attorney, get three agencies to tell you it is usable, and only then build the engine that fills it. Building the scanner first is how developers spend six months shipping something nobody can hand to a client.
• A single-site scan on a schedule, with history. History is the moat and the differentiator. It is also trivially cheap to add at the start and painful to retrofit.
• The remediation log. Findings, who marked them fixed, when, and the re-test that confirmed it. This is the "evidence of good-faith effort" story that sells the licence.
• Documentation as a product surface. Every page of docs you write before launch is support hours you never spend. Given the arithmetic in section 06, treat the knowledge base as a feature with a deadline, not as an afterthought.

Defer, deliberately

• Automatic remediation. Tempting, enormous support surface, and it drags you toward the overlay category you are positioned against. Do not.
• Multisite and white-label at launch. Both are real agency asks. Both are support multipliers. They belong in version 1.2, sold as the reason to upgrade a tier.
• A hosted dashboard outside WordPress. The moment you run scans on your own infrastructure you acquire uptime obligations, per-customer server cost and a data-protection position. Keep the work inside the customer's install for as long as you can.
• Anything for non-government sites, until year two. The European Accessibility Act and private-sector demand are the answer to the 2028 cliff, not the launch market. Note it on the roadmap and ignore it for now.

On timing: assume the directory does not block you but does not hurry either. The plugin handbook states that "if your plugin is small and all the code is correct, it should be approved within fourteen days of initial review," with the team aiming to reply within ten business days after you submit corrections [1]. The review team's own June 2026 update records a queue peaking around 1,050 plugins in mid-April 2026 before falling to effectively zero, while submissions hit a record of about 700 a week [2] — so the queue is currently healthy, and is also visibly volatile. Plan for four to six weeks between submission and a public listing, and do not schedule a launch campaign against a date you do not control.

Go-to-Market & Launch Plan

You have an unfair advantage and it is not technical: you already have retainer clients who are the customer, and you already know a dozen other developers who serve the same kind of client. Launch through that, not through a directory listing.

• Three design partners before you build. Pick three agencies from your own network. Give them the paid tier free for a year in exchange for weekly feedback and, in writing, the right to publish the case study. Their real client reports are your marketing assets.
• Launch to the free directory second, not first. Get the plugin reviewed and listed — it is your distribution and your credibility — but do not expect the listing to sell anything. With 72,000 plugins in the directory, nobody is browsing to you.
• One webinar, aimed at agency owners, timed to the deadline. "What you owe your city and school district clients before 26 April 2027" [1] is a title that fills a room of exactly the right people. Sell nothing for the first fifty minutes.
• Go where the agencies are, once. One WordPress-focused conference, with the report template printed and in your hand. That is the $1,400 launch line in section 06 and it buys more than twelve months of social posting.
• Do not discount at launch. A founding-customer price sets a permanent anchor and teaches an annually renewing market to wait for offers. If you want an incentive, give more sites at the same price, never a lower price.
• Do not announce a date until the plugin has cleared review [2]. The timeline is not yours, and a missed launch date is the worst possible first impression on an audience buying evidence of reliability.

Marketing & Growth

Your growth problem is that the person who needs this does not search for a plugin. They search for the obligation. That single fact should determine where every hour of marketing goes.

Write for the obligation, not the product. The queries that convert here are what the Title II rule requires, what WCAG 2.1 AA means for a municipal site, what to tell a client who asks whether they are compliant, and what happens after April 2027. An agency owner who finds a clear, accurate answer to those will look at what you sell. One who finds a plugin landing page will not.

The free tier is the marketing budget. At a 2.1%-order conversion rate the free plugin is not a giveaway, it is a distribution channel that costs support hours instead of ad dollars — and that trade only works if every free user is one click from documentation that answers their question without a ticket.

Grow through the agency relationship, not the site count. The highest-yield motion here is an existing customer moving from 10 client sites to 40, and the second is that customer recommending you to another agency owner. Both are retention work, not acquisition work: a customer at 40 sites who renews for four years is worth more than fifty free installs and cheaper to keep than to find.

Pricing Strategy

Price on sites, not on features, because your customer's value scales with portfolio size and so does your support load. The ladder in the arithmetic — $79 single site, $199 up to ten sites, $399 up to fifty — sits deliberately inside the range the market already accepts: a widely used commercial plugin like Gravity Forms runs $59 to $259 a year across three site tiers [1].

• Annual, never lifetime. The licence buys updates and support for twelve months. That is the only durable commercial model on GPL-licensed code, and it is what the whole category has settled on.
• Do not sell monthly. Freemius' own data shows monthly licences churning at 10.32% a year against 29% for annual [2] — but monthly also multiplies your transaction count, and at 30¢ plus ~3% per charge [3] twelve small charges cost materially more than one.
• Charge the agency tier properly. Your $199 tier is bought by someone billing their client for accessibility work. It is cheap at $199 and it will be cheap at $299. The single-site tier is the one that must stay low, because it is a price-sensitive buyer with the same support cost.
• Do not discount renewals by default. An automatic renewal discount is a permanent revenue haircut applied to the customers least likely to leave. Keep discounts as a retention tool you deploy on request, not a policy.
• Raise prices annually for new customers only. Grandfather existing licences for at least two renewals. In a market where 29% leave each year anyway [2], giving them a second reason is expensive.

One arithmetic check worth doing before you set the final numbers: divide your target annual revenue by the price, then multiply the resulting licence count by your honest estimate of support minutes per licence. If that product exceeds the hours you have, the price is wrong, not the target.

Legal Setup & IP

This is the section most plugin founders get wrong, and the mistakes are public and enforceable. Start with licensing. WordPress is released under the GPLv2 (or later) [1], and the first of the WordPress.org plugin guidelines is absolute: "all code, data, and images — anything stored in the plugin directory hosted on WordPress.org — must comply with the GPL or a GPL-Compatible license" [2]. That applies to every library, icon set, font and stock image you bundle. Check the licence of each one before you ship it, not after a reviewer asks.

Then accept what the GPL actually means for your revenue. You may sell copies — "the GPL allows everyone to do this" — and you may charge whatever you like for distributing them. What you may not do is require that a recipient pay you or notify you: "a requirement like that would make the program nonfree" [3]. In plain terms, once a customer has your PHP they can lawfully pass it on, and the GPL-reseller sites that redistribute commercial plugins are not, in respect of the PHP itself, doing anything the licence forbids. Your protection is not enforcement. It is that a redistributed copy comes with no updates, no security fixes, no support and no right to your trademarks — which is exactly why the licence you sell is a licence to those things.

The naming rule that catches almost everyone. The WordPress Foundation's trademark policy states that it is not permitted to use WordPress "as part of a product, project, service, domain name, or company name," and that "under no circumstances is it permitted to use WordPress or WordCamp as part of a domain name or top-level domain name" — a consulting firm may offer "WordPress consulting" but may not call itself "The WordPress Consulting Company" [4]. The policy also cautions specifically about confusing uses of the "WP" shorthand that imply an affiliation that does not exist. The directory guidelines carry the same rule for slugs: "the use of trademarks or other projects as the sole or initial term of a plugin slug is prohibited unless proof of legal ownership/representation can be confirmed" [2] — and a slug cannot be changed after approval [5], so get it right the first time.

WooCommerce is stricter still, and worth knowing even though this plugin does not touch it: "never use or incorporate WooCommerce or any Woo Mark as part of your brand, company, product, service or feature names," and "never use or incorporate the Woo Marks as part of your domain names," with the permitted form being your own distinctive name followed by "for WooCommerce" [6]. The practical pattern for any plugin in this ecosystem: own distinctive brand, descriptive compatibility statement after it.

The rest of the legal setup

• Entity. A single-member LLC is the default here; the Texas certificate of formation filing fee is $300 [7]. Take advice on tax treatment rather than defaulting — see section 12.
• Your own trademark. Clear the name before you print anything. A USPTO application is a $350 base fee per class, with a $100-per-class surcharge for insufficient information and $200 per class for using the free-form identification text box [8]. Budget attorney time on top; a refused application is worse than no application.
• Your EULA sits on top of the GPL, not against it. You cannot restrict the GPL-covered code. You can and should set terms for the licence key, the update service, the support entitlement, refunds, and use of your marks in the report output.
• Be careful what your report claims. A document that says "compliant" where it means "no automated failures detected against WCAG 2.1 AA" is a legal exposure for your customer and eventually for you. Have the wording reviewed, and state plainly what automated testing cannot detect.
• Contributor and design-partner paperwork. If anyone else touches the code — a contractor, a design-partner developer — get assignment in writing before they commit.

Tax, Invoicing & Admin

As a sole member LLC taxed as a disregarded entity, your product income lands on Schedule C, which reports "income or loss from a business you operated or a profession you practiced as a sole proprietor" [1] — the same form your consulting income already uses. On top of income tax, net earnings from self-employment carry self-employment tax at 15.3%, being 12.4% for Social Security and 2.9% for Medicare, computed on Schedule SE, and you must file if net self-employment earnings were $400 or more [2]. The Social Security portion applies only up to an annually indexed wage base, so confirm the current year's figure with your CPA rather than carrying last year's over.

Estimated taxes are the admin item that actually bites first-time product sellers, because plugin revenue arrives in small amounts all year with nothing withheld. Sole proprietors "generally have to make estimated tax payments if they expect to owe tax of $1,000 or more when their return is filed," using Form 1040-ES across four payment periods; the standard safe harbours are paying at least 90% of the current year's tax or 100% of the prior year's, rising to 110% for higher-income filers [3]. With a consulting income already in place, the prior-year safe harbour is usually the simplest route.

Sales tax and VAT: the part a merchant of record solves

Selling software to consumers and businesses in every state and dozens of countries creates a tax-collection problem out of all proportion to the revenue. Two illustrations of why. In your own state, Texas taxes data processing services — "entering, storing, manipulating, or retrieving a customer's data is taxable" — at a 6.25% state rate plus local tax [4], and separately applies a remote-seller safe harbour under which sellers with less than $500,000 of total Texas revenue in the preceding twelve calendar months need not collect [5]. Every other state has its own answer and its own threshold. In the EU there is no such comfort: a business established outside the EU with no EU fixed establishment uses the non-Union One Stop Shop scheme, charges VAT "at the customer's country rate," and registers in one EU country to file a quarterly return — with no turnover threshold mentioned for the non-Union scheme [6]. In practice that means your first sale to a German customer creates an EU VAT obligation.

This is why the platform choice in section 06 is a tax decision as much as a payments decision. A merchant of record is the legal seller to your customer and takes on that liability itself. Freemius acts as your reseller and states plainly that it "takes care of the collection of taxes and automatically issues invoices on all purchases. You don't have to do anything related to sales tax or EU VAT," including real-time EU VAT ID validation for B2B [7]. Lemon Squeezy is likewise merchant of record at 5% + 50¢ per transaction with global VAT and sales tax collection and filing included [8], and Paddle describes itself as a complete merchant-of-record solution at 5% + 50¢ covering registration, filing and remittance [9].

The alternative — self-hosting with Easy Digital Downloads, whose annual plans run from $79.60 for Personal up to $349.65 for All Access, with Software Licensing & API included only on the Professional and All Access tiers [10] — is cheaper per transaction and leaves every sales-tax and VAT obligation with you. On this plan's volume, paying 5–17% to make the tax problem somebody else's is not a luxury. It is the difference between shipping and spending your twelve hours a week on registrations.

• EIN and a separate business bank account before the first sale, even as a single-member LLC.
• Separate the two income streams in your bookkeeping from day one. You cannot judge whether the product is working if it is mixed with retainer income.
• Keep the refund policy in writing and honour it fast. Plugin refund rates of 2–8% are normal [11]; argued refunds cost more in support hours than they save.
• Expect a 1099-K style report from your platform and reconcile it against gross, not net. Platform fees are a deductible expense, not a reduction in revenue.

Tech, Hosting & Security

Your infrastructure needs are unusually small, and that is a deliberate design choice worth protecting. The plugin runs inside the customer's WordPress install; you host a documentation site, a licence and update endpoint, and a help desk. That is the whole stack.

• Licence and update delivery. Either your platform provides it — Freemius includes it, and Easy Digital Downloads puts Software Licensing & API on its Professional and All Access tiers [1] — or you build and maintain an update server yourself. Do not build it yourself in year one.
• Update-endpoint uptime is a security obligation, not a convenience. If your endpoint is down, customers do not get security fixes. Treat it as the one piece of infrastructure that must not fail.
• Declare every external service. The directory guidelines are clear that executing outside code within a plugin when not acting as a service is not allowed, while acting as an interface to an external service is permitted, including paid ones [2]. Document exactly what your plugin sends where, in the readme and in the admin UI.
• Your plugin is a privileged target. It reads page content across a portfolio of government sites. Capability checks, nonces, escaped output everywhere, and the independent pre-submission review budgeted in section 06. One vulnerability in a compliance plugin for public-sector sites is an existential event, not a patch note.
• Keep scan data in the customer's database by default. It removes a class of breach exposure and a class of data-protection argument, and it makes the "your data never leaves your server" line on your sales page true.
• Your own admin UI must pass the standard you are auditing against. An accessibility plugin with an inaccessible settings screen will be publicly and correctly mocked.

Regional Compliance & Privacy

Three layers apply here, and only one of them is about your own business.

The standard your product is measured against. The Department of Justice's Title II web rule requires covered web content and mobile apps to conform to WCAG 2.1 Level AA [1], with compliance dates of 26 April 2027 for entities with a population of 50,000 or more and 26 April 2028 for smaller entities and special purpose districts [2]. Your product's credibility depends on tracking the exact version and level, not "accessibility" in general — and on being explicit that automated testing cannot evaluate every success criterion. A report that overstates what it proves is worse than no report, because your customer will forward it to somebody's lawyer.

Your own data obligations. There is no single federal privacy statute covering a business like this; obligations come from state laws that differ by state and by revenue and data volume thresholds, and the safest architecture is the one in section 13 — keep scan findings in the customer's own database, collect only the licence email and domain you actually need, and disclose what leaves the site. Confirm your specific position with a licensed attorney in your state rather than relying on a summary, this one included.

Cross-border selling. The moment you sell to an EU customer you are in the non-Union One Stop Shop position described in section 12 — VAT at the customer's country rate, quarterly returns, no threshold mentioned for that scheme [3] — and a merchant of record is what makes that a non-event. A related point worth noting for the 2028 roadmap: the European Accessibility Act creates a parallel private-sector demand in the EU, which is a reason to be structurally able to sell into Europe rather than an argument for targeting it now.

Finally, the directory's own compliance layer. Your plugin lives or dies by the guidelines in section 11: GPL-compatible licensing on every bundled asset, no locked functionality, quiet upsells, no trademarks in the slug, and disclosure of external services [4]. Read them once properly before you submit. Being pulled from the directory after launch removes your distribution channel and your credibility in the same afternoon.

Risks & Common Pitfalls

• The renewal cliff in year two — the one that decides this plan. Annual plugin licences churn at about 29% a year on average [1], and yours were bought to clear a dated obligation. Model 50–60%, not 71%, and build the reason to renew — continuing evidence, re-tests, new criteria — into the product rather than into a renewal email.
• The April 2028 demand cliff. The compliance dates that sell this product pass on 26 April 2027 and 26 April 2028 [2]. After that the buyer's urgency becomes maintenance, and maintenance is a quieter sale. Start the private-sector and EU positioning in year two, not year three.
• Support at scale. One agent per 3,000–5,000 paying customers is the industry shape [3], but you are the agent and the developer, and free-forum support is unbillable and unavoidable. Documentation and a hard triage rule are the only levers.
• Getting the licensing story wrong in public. Claiming your code cannot be redistributed, or restricting the GPL-covered PHP, is both wrong and reputationally costly in this community [4]. Sell updates and support; say so plainly.
• Naming. A product name containing "WordPress" or "Woo", or a slug starting with a trademark, is a rejection or a demand letter waiting to happen — and the slug cannot be changed after approval [5].
• Bundling a non-GPL-compatible library. Every asset in the directory must be GPL or GPL-compatible [4]. One convenient chart library with the wrong licence can mean a rewrite.
• Overclaiming compliance. The single legal risk unique to this product. Say what the scan tested, on what date, against which criteria, and what it cannot test.
• Discoverability. 72,000 plugins in the directory [6] and your buyer does not search for plugins. If the content in section 09 does not happen, the product does not get found, however good it is.
• The retainers. Your working capital is your client work, and product work will start to crowd it. Losing a retainer to ship a feature is the quiet way this plan actually fails.

Action Plan: 30 / 60 / 90 Days

This plan assumes you keep every retainer. If at any point in the next ninety days you have to drop client work to hit a product milestone, the milestone is wrong.

Days 1–30 — validate and name, spend under $2,000

• Interview five agency owners from your own network. Ask what they send public-sector clients about accessibility today and what they would pay to stop assembling it by hand.
• Draft the report export as a PDF mock-up with no code behind it. Show it to those five. Redraft until one asks when they can have it.
• Settle the name against the WordPress and Woo trademark rules and check the slug and domain [1]. Remember the slug is permanent after approval [2].
• Form the Texas LLC ($300 filing fee [3]), get the EIN, open the business account.
• Read the plugin guidelines end to end once [1] and audit your intended dependency list for GPL compatibility.

Days 31–60 — build the narrow thing

• Single-site scheduled scan, retained history, remediation log, and the report export. Nothing else.
• Write the documentation as you build each feature, not afterwards. Target: every support question you can imagine has a URL.
• Pick the platform. Merchant of record unless you have a specific reason not to — Freemius, Lemon Squeezy or Paddle — and let it own the sales tax and EU VAT problem.
• Sign the three design partners in writing, including the right to publish the case study.
• Have the EULA, privacy policy and the report's compliance wording reviewed by an attorney.
• Set up the estimated-tax plan with your CPA now, while the product revenue is still zero [4].

Days 61–90 — submit, launch quietly, measure the right number

• Independent security review, fix what it finds, then submit to the directory. Assume four to six weeks and announce nothing [2].
• Publish three long pieces aimed at the obligation, not the product, with the 2027 and 2028 dates in the titles.
• Run one agency webinar. Sell nothing for the first fifty minutes.
• Turn on paid tiers at $79 / $199 / $399 with no launch discount.
• Instrument support minutes per licence from the first ticket. That single metric, not installs and not revenue, tells you at day 90 whether this business scales past 150 customers — and it is the number that produced this report's verdict.