NMI for WooCommerce

NMI for WooCommerce is a powerful payment gateway plugin that allows you to securely accept credit cards and ACH payments directly on your WooCommerce store. Built with PCI compliance in mind, this plugin ensures that every transaction is handled safely and efficiently through the NMI (Network Merchants, Inc.) gateway, one of the most reliable payment processors in the market that offers robust payment solutions for merchants to accept a variety of payment methods online, including ACH eChecks. Key Features of NMI for WooCommerce

• Easy Installation: Streamlined setup process with minimal configuration. Once installed, browse WooCommerce Settings - Payments and fill out a few fields, and you’ll be set up to accept credit card payments on your store.
• Secure ACH Processing: Leverages NMI's tokenization library for secure ACH payments, ensuring PCI compliance.
• Secure Payment Processing: Leverages the Collect.js tokenization library to securely transmit payment data directly to NMI, eliminating the need for PCI-DSS certification concerns.
• Card Verification: The plugin integrates card processing and verification to process credit card payments synchronized with card verification.
• Refund Management: Process full or partial refunds directly from the WooCommerce dashboard, including one-time orders.
• Restrict Card Types: Optionally choose to restrict certain card types, hiding their icons and providing proper error messages on checkout.
• Authorize and Capture: Option to authorize transactions initially and capture funds later.
• Payment Method Restriction: Restrict certain card types during checkout with appropriate error messaging.
• Gateway Receipts: Option to send payment receipts directly from your NMI account.
• Detailed Logging: Enable logging to troubleshoot and debug any issues, providing valuable insights when needed.
• Manage Subscriptions [Enterprise Version]: Utilize the WooCommerce Subscriptions extension to create and manage recurring payment products, offering residual revenue that you can monitor.
• No Sensitive Data Stored On-Site: Uses NMI's "customer vault" to charge future payments without storing sensitive data on your site.
• Customizable Payment Experience: Tailor the payment experience to match your brand's look and feel by adjusting settings like displayed payment methods and transaction descriptions.
• Advanced Security: Uses encryption and tokenization to protect sensitive customer data, minimizing data breach risks and ensuring PCI compliance.
• Extensive Reporting & Analytics: Access transaction history, manage refunds, and analyze gateway performance to optimize sales strategies. Integrating the NMI Gateway into your WooCommerce store not only streamlines the payment process but also enhances customer trust. By providing a secure environment for transactions, you can reassure shoppers that their sensitive information is protected. This confidence often leads to higher conversion rates and repeat business.

The plugin supports a variety of payment options, catering to diverse customer preferences. Whether your clientele prefers using credit cards or opting for ACH payments, the NMI Gateway ensures that their needs are met. This flexibility can significantly broaden your customer base and improve overall sales. NMI Gateway for WooCommerce Platform is an essential tool for any online merchant looking to enhance their payment processing capabilities. With its robust security features, user-friendly interface, and extensive customization options, it stands out as a leading choice for businesses of all sizes. https://www.youtube.com/watch?v=b_il2F8cTu0 Requirements

• Active NMI account.
• WooCommerce version 3.3 or later.
• Valid SSL certificate for secure transactions and PCI DSS compliance. This plugin does not store sensitive payment data on your site.

Disclaimer This plugin is not affiliated with or endorsed by NMI, WooCommerce, or Automattic. All trademarks are the property of their respective owners.

1.0.7 Fixed (Checkout block)

• The card fields could stay hidden on the Checkout block. The classic checkout script also loaded on the block page and hid the card form, and the block never fires the classic events that show it again, so the result depended on which script ran first. The classic script no longer loads on pages that use the Checkout block; the order-pay page still uses it.
• The Expiration and CVV row could spill outside the payment panel in the Checkout block. The card form now contains its floated rows.

Thanks again to the store owner who reported these on the support forum. 1.0.6 Fixed (Cart and Checkout blocks)

• Card fields did not appear in the Checkout block. The block script passed customCss inside fields, which the current Collect.js rejects ("You provided too many fields in customCss"), so CollectJS.configure() failed and the card number, expiry and CVV fields never loaded.
• Every Checkout block card order asked NMI to create a Customer Vault record, even with Saved Cards turned off. WooCommerce's block checkout always sends the save-card field, set to false when the box is unticked; the plugin tested only whether the field was present. It now checks the value, and never saves a card while Saved Cards is off. Accounts without Customer Vault no longer get "300 - Your account is not set up to use the Customer Vault" on every order.
• A declined card caused a critical error in the Checkout block instead of showing the decline reason. Declines, gateway errors and failed 3D Secure checks now return a proper failure result, so the shopper sees the reason (for example "225-CVV2 Mismatch").
• Saving a new card at checkout, for a shopper who already had a saved card, sent the old Customer Vault ID in place of the new card.

Improved

• Gateway.js errors such as "3DSecure is inactive on your account" are now shown to the shopper. Previously the Checkout block showed only "Gateway error." and classic checkout showed nothing.
• The Public Checkout Key setting now explains that it is only used for 3D Secure, and that entering it turns 3D Secure on for every card payment. Leave it empty if 3D Secure is not active on your NMI account.
• The classic checkout script is now versioned with the plugin, so browsers load the updated script after an update.

Thanks to the store owner who reported these on the support forum. 1.0.5 Security

• The private NMI security key is no longer written to the WooCommerce debug log. Credentials in the outbound request are replaced with ***REDACTED*** before logging (CWE-532). Redaction walks nested arrays and objects, and any configured credential value is scrubbed from the log text as a final safety net.
• Enabled TLS certificate verification (sslverify) on every request to the NMI API. The key was previously sent over an unverified connection.
• Webhook signature comparison now uses hash_equals(), removing a timing side channel on the webhook signing key.
• The webhook client IP is validated and unslashed before the allow-list check.
• Raw gateway responses are no longer printed into customer-facing checkout notices or order notes.
• process_payment() and add_payment_method() now verify the gateway nonce themselves, so block (Store API) checkout is covered as well as classic checkout. The eCheck form gained the nonce field it was missing.
• Added wp_unslash() to all remaining $_POST / $_SERVER reads, and sanitized the eCheck descriptor, processor_id and merchant_defined_field values.

Fixed

• Checkout could not complete on WooCommerce 11. The form was submitted with a native submit(), which does not contribute the Place Order button's own name/value pair; WooCommerce gates WC_Form_Handler::checkout_action() on exactly that field, so the request was discarded with no order, no error notice and no log entry. The field is now sent explicitly.
• Removed the customCss block passed to CollectJS.configure(). Collect.js validates it against a narrow whitelist and rejects the whole call if any property falls outside it, which left the hosted card fields unmounted so no token was ever produced.
• The Cart and Checkout blocks payment method no longer declares a jquery-blockui dependency. WooCommerce registers that script as wc-jquery-blockui and keeps jquery-blockui only as a legacy handle on the classic frontend, so in the blocks context the dependency was unresolvable and WooCommerce deactivated the payment method. BlockUI is now called through helpers that no-op when it is unavailable.
• get_icon() no longer echoes. The cardtypes multiselect defaults to a bare string, so the is_array() branch never matched on a fresh install and control fell through to a branch that printed markup; WooCommerce also calls this method while assembling Store API JSON for block checkout, where that output corrupts the response.
• The admin settings screen now hangs its stylesheet off the hook suffix add_submenu_page() returns instead of a hand-reconstructed one, and a stray brace in the stylesheet was removed.
• Credit card merchant_defined_field_1-20 values were written to the eCheck argument array and never sent to the gateway.
• The NMI Settings page no longer fatals when the Freemius global is unset.
• Declared every gateway property explicitly. PHP 8.2 deprecates creating them dynamically, which emitted roughly 38 notices per request on PHP 8.2 and later.
• Corrected the Installation instructions, which named a directory the plugin has never shipped as.

Compatibility

• Tested up to WordPress 7.1 and WooCommerce 11.0; minimum PHP raised to 7.4 and minimum WordPress to 6.0.
• Updated the bundled Freemius SDK from 2.13.0 to 2.13.4.
• Updated Plugin URI and Author URI (wpclubz.com no longer resolves).

Coding standards

• Global functions now use the unique nmifw_ prefix instead of the three-character nmi_, and the checkout block class was renamed from WC_NMI_Blocks_Payment_Method to NMIFW_Blocks_Payment_Method so it no longer sits in WooCommerce'''s WC_ class namespace. Gateway class names, gateway IDs and the plugin'''s public filter names are unchanged, so saved settings, tokens and third-party integrations keep working.
• Replaced the hand-rolled request encoding with http_build_query() (byte-identical output) and print_r() debug dumps with a redaction-aware JSON helper.
• Removed the discouraged load_plugin_textdomain() call; WordPress loads translations automatically for plugins hosted on WordPress.org.
• The readme name now matches the plugin header and drops the restricted term "wp".
• Added the missing translators comments and replaced json_encode() with wp_json_encode(). The plugin reports no errors or warnings under the WordPress Coding Standards security, i18n and database sniffs.
• The admin stylesheet now only loads on the plugin'''s own screens.

1.0.4

• Load Gateway.js and Collect.js from NMI official CDN URLs (fixes JavaScript syntax errors from corrupted bundled vendor files; aligns with NMI documentation)
• Added WooCommerce Checkout Block support (registerPaymentMethod + Collect.js / 3DS via Store API)
• Fixed "Payment Token not received" by reading POST with wp_unslash instead of filter_input (PHP/WP compatibility)
• Fixed payment token hidden inputs: use jQuery .val() so JSON is not corrupted in HTML attributes
• Fixed process_payment: decode Collect.js JSON as object; derive card display fields after vault branch (saved cards no longer hit NMI card object first)
• Inline card field mode shows a clear message in block checkout (use classic checkout or disable inline fields)

1.0.3

• Added High-Performance Order Storage (HPOS) compatibility declaration
• Replaced all update_post_meta/get_post_meta with HPOS-compatible $order methods
• Replaced deprecated direct property access ($order->id, $order->parent_id) with getter methods

1.0.2

• Fixed "Nonce Value Missing" error on checkout
• Fixed JavaScript event and selector mismatches preventing Collect.js tokenization
• Fixed saved card token field name references to match gateway ID
• Added nonce security field to the payment form
• Guarded eCheck gateway registration when class is not loaded

1.0.1

• Integrated Freemius SDK

1.0.0

• Initial release version