You could just name it to something like “Do Not Alter”. If they’re going to buy your script, I would assume they are over 13 (as most developers are) and would therefore have matured to have decency and respect.
They will have a local copy of the plugin you wrote so they won’t mess up yours. Why are you so keen on hiding plugin code if not for malicious purposes? As for code in your game, exploiters can take everything not in ServerScriptService or ServerStorage as long as it is not a Script/it needs to be a modulescript/localscript.
As for HTTP requests, you can limit and give clearance to ones on your server you are connecting to.