BareBits - Lightning Payments via Bitcoin

BareBits makes it easy for your WooCommerce shop accept Bitcoin — on-chain and over the Lightning Network — with funds going straight to wallets you control. No payment processor account, no approval process, no chargebacks. Low 1% fee. This plugin connects your WooCommerce installation to your BareBits server, which can run on any web hosting account (no VPS required). During plugin installation, you connect to your self-hosted BareBits server by entering its URL. (The plugin's full build, distributed on the project's GitHub releases page, can additionally install a BareBits server alongside WordPress for you automatically see https://github.com/BareBits/cashupayserver ) The plugin then installs and configures the "BTCPay for WooCommerce" gateway plugin, points it at your BareBits server, registers the payment webhook, and can apply an automatic checkout discount for Bitcoin payments — on both the classic and the block-based checkout, with the percentage advertised in the payment method's title. The BareBits server itself is a separate, self-hosted application (https://github.com/BareBits/cashupayserver) with its own license. This plugin contains no BareBits server code and talks to it purely over its HTTP API.

1. Install and activate WooCommerce, if it isn't active already.
2. Install and activate this plugin, then open BareBits in the wp-admin menu — onboarding starts there.
3. Enter the URL of your self-hosted BareBits server and approve the pairing request on the server's dashboard.
4. Finish onboarding: the plugin installs and configures the "BTCPay for WooCommerce" gateway plugin, registers the payment webhook, and enables Bitcoin at checkout. Optionally, set a percentage discount for customers paying with Bitcoin.

Don't have a BareBits server yet? Any host that can run WordPress can run one — see https://github.com/BareBits/cashupayserver. (The plugin's full build, distributed on the project's GitHub releases page, can also install a server alongside WordPress for you.)

1.7

• Security release — every server and WordPress install should upgrade. Server-side: exported Cashu tokens can no longer be handed out twice and are tracked in a Recent exports list; withdrawals cannot pay twice; invoices paid late are still credited; unused Lightning fee reserves come back (NUT-08); proof storage is atomic and a stale mint reply can never revive spent ecash; an imported recovery phrase is scanned at the mint before new payments; mint and recovery-phrase changes on a funded store need confirmation; the setup wizard and login are hardened (CSRF on every wizard step, atomic lockout counting, global sign-in budget); mint and Lightning-address requests follow the same SSRF policy as everything else.

1.6.3

• Server-side (for installs updating the companion BareBits server): after an update, the admin banner's "Update applied — reload the page" notice goes away once the page has been reloaded, and the "apply it as soon as you can" wording only appears while an update is actually available.

1.6.2

• Server-side (for installs updating the companion BareBits server): the admin "update available" banner now also clears when the stale verdict was left behind by the build that performed the update (1.6 → 1.6.1 kept advertising 1.6).

1.6.1

• Server-side (for installs updating the companion BareBits server): the admin "update available" banner no longer keeps advertising the release you just installed; the self-serve pay page accepts fiat amounts typed without a leading zero (".10").

1.6

• Server-side (for installs updating the companion BareBits server): a per-store "Payment order" setting chooses whether the invoice page shows on-chain or Lightning first; self-serve product links with optional tips; per-store ordering of Lightning payment paths and on-chain address sources; block-explorer failover and rate-provider cooldowns so an outage no longer slows checkout; a Share button on the invoice page; collapsible Lightning payment sections; automatic updates are now opt-in with a one-time email when a new release is available; the Android PWA install banner is gone.

1.5.3

• The plugin page's Description now opens with the essentials the tagline already stated: no approval process, no middlemen, low 1% fee.

1.5.2

• First release distributed through the wordpress.org plugin directory: stable releases now publish there automatically, and the directory page gained its art (banner, icon, screenshots) plus this readme's Installation and Screenshots sections.
• The BareBits ₿ mark replaces the legacy icon everywhere it survived: the server's browser favicon and the dashboard's home-screen (PWA) icon.

1.5.1

• The readme now documents every external service the plugin communicates with (your own BareBits server, the wordpress.org plugin directory, and — in the full build — GitHub), and the BareBits server project gained a plain-language Privacy Policy (PRIVACY.md) covering every external service the server itself contacts, linked from its setup wizard's terms step.
• Server-side: QR codes are now rendered by libraries bundled with the software instead of loaded from public CDNs, so no third party sits in the path of payment pages — neither observing visitors nor able to tamper with what a QR encodes.

1.5

• All admin styling and scripts now load as enqueued asset files, every admin action carries explicit capability and nonce checks, request input is sanitized on read and output escaped on print, and plugin-owned names use the barebits prefix throughout — per wordpress.org plugin review feedback.
• Server-side (for installs updating the companion BareBits server): on-chain receive through a Strike account, a confirmation-policy step for every on-chain source, and a fix for background payment polling that could miss payments made after the customer closed the payment page.

1.4.2

• The plugin's text domain now matches the wordpress.org plugin slug (barebits-lightning-payments-via-bitcoin), so community language packs from translate.wordpress.org will load.

1.4.1

• The plugin now passes WordPress.org's Plugin Check with zero errors and zero warnings: escaped output everywhere, WordPress filesystem/URL APIs, sanitized request input, and readme metadata kept in sync with the plugin version by the build.
• A wordpress.org distribution variant is now built alongside the full plugin. It omits the install-alongside flow (the plugin directory's guidelines forbid plugins downloading executable code) and connects to a BareBits server by URL only; the full plugin from GitHub releases is unchanged.

1.4

• The Bitcoin checkout discount is now applied by this plugin itself instead of the third-party ELEX plugin, and works on the block-based checkout as well as the classic one. The percentage (decimals allowed) is editable on the BareBits Connection page and in the gateway's WooCommerce settings, and the payment method's title always advertises the current value.
• Pairing with an existing BareBits server no longer shows "page not found" on servers whose host ignores rewrite rules: the plugin now always opens the authorization page by its real file name (/api-keys/authorize.php).
• The install-alongside server checks now show directly on the onboarding chooser, below the two options, instead of on a separate page afterwards. When a check fails, the install option is disabled with the reason in view.
• Onboarding and Connection-page actions, the pairing approval's return to this site, and the password reveal now wait out WordPress's brief maintenance windows (auto-updates) instead of landing on the "briefly unavailable" screen with the action lost.

1.3.1

• The plugin no longer bundles the BareBits server. Onboarding now connects an existing server by URL or installs the latest stable release alongside WordPress.