Self-hosted E-commerce: what licence are you actually agreeing to

“Self-hosted” and “open source” are not the same promise, and the lists that recommend these projects rarely separate them. This page sorts 25 e-commerce projects by the licence you are actually agreeing to, as read on 2026-08-20.

11 of 25 are permissive: run them, change them, keep your changes to yourself. 2 are AGPL, where serving a modified copy over a network obliges you to publish those changes, which is the clause that catches people who self-host for a team. 2 are not open source at all, carrying a proprietary or restricted-use licence. The remaining 10 are ordinary copyleft.

Project	Licence	What that means	Stars	Maintenance	Language
MedusaJs	MIT	Permissive, no strings	35,917	Active	TypeScript
Bagisto	MIT	Permissive, no strings	27,984	Active	PHP
Saleor	BSD-3-Clause	Permissive, no strings	23,242	Active	Python
Spree Commerce	BSD-3-Clause	Permissive, no strings	15,632	Active	Ruby
Sylius	MIT	Permissive, no strings	8,511	Active	PHP
Vendure	MIT	Permissive, no strings	8,356	Active	TypeScript
Solidus	BSD-3-Clause	Permissive, no strings	5,320	Active	Ruby
Open Source POS	MIT	Permissive, no strings	4,355	Active	PHP
Shopware Community Edition	MIT	Permissive, no strings	3,406	Active	PHP
myCart	MIT	Permissive, no strings	361	Active	Go
s-cart	MIT	Permissive, no strings	11	Active	Blade
Magento Open Source	OSL-3.0	Copyleft, publish your changes	12,168	Active	PHP
WooCommerce	GPL-3.0	Copyleft, publish your changes	10,462	Active	PHP
EverShop	GPL-3.0	Copyleft, publish your changes	10,398	Active	TypeScript
PrestaShop	OSL-3.0	Copyleft, publish your changes	9,193	Active	PHP
OpenCart	GPL-3.0	Copyleft, publish your changes	8,184	Active	PHP
Aimeos	LGPL-3.0, MIT	Copyleft, publish your changes	5,450	Active	JavaScript
Thelia	LGPL-3.0	Copyleft, publish your changes	876	Active	PHP
Discount Bandit	GPL-3.0	Copyleft, publish your changes	729	Active	PHP
CoreShop	GPL-3.0	Copyleft, publish your changes	292	Active	PHP
Drupal Commerce	GPL-2.0	Copyleft, publish your changes	-	Not measured	PHP
Hi.Events	AGPL-3.0	AGPL, network copyleft	3,987	Active	PHP
Pretix	AGPL-3.0	AGPL, network copyleft	2,496	Active	Python
Sharetribe	⊘ Proprietary	Not open source, restricted use	2,446	Active	Ruby
OXID eShop	⊘ Proprietary	Not open source, restricted use	237	Active	PHP

What the licence column means

Permissive (MIT, Apache-2.0, BSD, ISC): do what you like, keep changes private.
Copyleft (GPL, LGPL, MPL, EPL): changes you distribute must ship their source.
AGPL, network copyleft: the same, and running it for others over a network counts as distribution. This is the one that surprises people who self-host for a team or a side business.
Source-available (SSPL, BUSL, Elastic, Commons Clause): not open source. Reading and self-use are usually fine; offering it as a service is not.
Other / unstated: the dataset lists no licence we could classify. Check the repo before you rely on it.

The Maintenance column is a second, independent check: the age of the most recent commit on the default branch, read from the GitHub API on 2026-08-20. Active is within 180 days, Slowing is 180 to 365, Dormant is over a year, Archived means the maintainer marked the repo read-only, and Not measured means the project is hosted outside GitHub so the check does not apply.

Source data from awesome-selfhosted-data, used under CC BY-SA 3.0. Licence family grouping and maintenance status are computed by this site (from the upstream licence fields and the GitHub API) and are not part of the upstream dataset. Licence classification is a summary, not legal advice: check the project’s own LICENSE file before you rely on it. This page is published under the same licence.