Nodewatch Monero Payments for WooCommerce

Add Monero to your WooCommerce checkout and let WordPress do the rest. There is no backend to run, no account to open, and no company sitting between you and your buyer. Each order is paid straight to your own wallet, and WordPress checks the blockchain itself, in PHP, to confirm the payment. Most stores are live in a few minutes. You enter your Monero address, your view key, and a node URL, pick the recommended mode, and you are done. Why merchants pick it You keep your money. Every order pays your wallet directly. The plugin never holds funds and never sees a spend key, so no one but you can move the coins. Nothing to run. The two default modes verify payments inside WordPress, in pure PHP, against a public Monero node. No separate service, no wallet RPC daemon, nothing awake at 3am waiting to break. No accounts, no API keys, no fee to a processor. The only outside thing you need is a Monero node, and a public one is fine. It fits your checkout. Works with the modern WooCommerce Blocks checkout and the classic one, and it is HPOS ready. The numbers are exact. Amounts are figured in piconero with integer math, so there is no rounding drift. Discounts, shipping and tax are already in the order total, so they just work. Live progress and receipts. The order received page shows the on chain status as it settles. Overpayment is recorded for a manual refund, and paid orders can carry a signed receipt anyone can verify offline. Pick the mode that suits you Auto detect (recommended). The buyer does nothing special. They pay a per order address, and WordPress scans the chain with your view key and completes the order on its own. Buyer taps "I've paid". The lightest option. The buyer pays your address and pastes the transaction ID, and WordPress verifies it on chain. Agent (advanced). You run the separate xmr-pay daemon, which holds the view key and notifies your store with a signed webhook. The two default modes need no server, just your WordPress and a Monero node. Your host needs the PHP GMP and BCMath extensions, which most hosts already have. Pricing Price in XMR directly (set your store currency to XMR, no price feed needed), or price in your local currency and convert with CoinGecko, your own price URL, or a fixed rate.

Accepting Monero takes about five minutes. There is a screenshot for each step below.

1. Install and activate. In your dashboard go to Plugins, Add New, Upload Plugin, and choose the zip. Activate it. WooCommerce needs to be active too.
2. Open the settings. Go to WooCommerce, Settings, Payments, and click Monero (Nodewatch). The setup wizard opens on first activation.
3. Choose a mode. Pick Auto detect in WordPress. It is the recommended one and needs no action from your buyer.
4. Enter your details. Paste your Monero address, your private view key, and a node URL. Leave confirmations at 1 to start. Click Check setup: the plugin confirms the node is reachable, the network matches your address, and the view key really belongs to it.
5. Go live. Once Check setup is green, save. Monero now shows up at checkout.

Test on stagenet first. Point the address, view key and node at a stagenet wallet, run a full order, then swap in your mainnet details when you are happy. There is a public stagenet demo at https://demo.xmrpay.shop More private. Instead of pasting the view key in the settings, put define( 'XMRPAY_VIEW_KEY', '...' ); in wp-config.php. Agent mode (advanced). Run the separate xmr-pay daemon (npm i xmr-pay monero-ts, then scanner-agent.js with your address, view key, node and a webhook secret, bound to localhost, see docs/AGENT.md). Choose Agent mode and enter the Agent URL, token and webhook secret it prints. Authenticated nodes Each node has its own authentication setting. Choose None for an open endpoint, Basic for HTTP Basic authentication, or Digest for HTTP Digest authentication. Enter the username and password in that node's card. Credentials are not placed in the URL or reused for another node during failover. Digest requires PHP cURL. Use HTTPS or a private network for Basic authentication. For Umbrel, enter the private node URL such as http://umbrel.local:18081, then select the authentication type and credentials configured for that endpoint. Check setup tests every configured node, up to 10, and shows health and response time on each card. A secondary-node failure is a warning while at least one matching node remains available.

1.1.4

• Check setup tests every configured node, up to 10, and reports health, response time and secondary-node warnings.
• Node settings use separate numbered cards with their own authentication fields.
• The diagnostic timeout scales with the number of nodes and remains filterable.
• Custom Monero RPC ports accumulate across scanners created during the same WordPress request.
• The checkout reports a copied address only after the browser confirms success. It uses a fallback when the Clipboard API is unavailable and reports failure honestly.

1.1.3

• Added None, HTTP Basic and HTTP Digest authentication for each Monero node.
• Credentials remain attached to their node during failover and are not returned in settings or diagnostics.
• Setup checks distinguish rejected credentials, unreachable nodes and unavailable Digest support.

1.1.2

• Hardening (Agent mode): Agent URLs are now enforced as localhost-only in the setup wizard, gateway settings, Blocks availability, and runtime client, closing an avoidable server-side request surface before WordPress.org review.
• Fix (remote node setup): WordPress's wp_safe_remote_* only allows a short list of ports and silently blocks Monero RPC ports like 18081 (mainnet) and 38089 (stagenet), so pointing the plugin at a remote node failed until you hand-added an http_allowed_safe_ports filter. The plugin now whitelists the ports of your configured node(s) automatically (and only those; the safe-HTTP SSRF guard still protects every other host and port). Thanks to the tester who reported this. No settings change.

1.1.1

• Fix (payment detection): the per-output scan loop wrapped ownership and amount/commitment decoding in one catch, so an error while decoding an output that IS yours (e.g. a pruned node, a malformed blob) was indistinguishable from "not yours" and could report a real payment as unpaid. Ownership and decoding are now separated: an undecodable but owned output fails closed and is surfaced (found-but-unverified), never silently missed. Hardening only; no settings or data change.

1.1.0

• Non-custodial refunds (claim-link). Refund an order and the buyer gets a link to enter a Monero receive address (a tx never reveals the sender); you pay it by hand and mark it sent. Configurable link expiry with one-click reissue, address and network validation, and a reopen on a later refund so additional money is never stranded.
• Monero payments report and CSV export under WooCommerce (owed, received, overpaid, confirmations, state, refund status), spreadsheet-formula-injection safe.
• Resilient multi-node. Comma-separated nodes now genuinely fail over, and the block height is cross-checked across them (the lowest is used), so a lagging node can only delay a payment, never confirm it early.
• Critical fix: the order-completion and proof paths used a non-existent WordPress function for their lock; replaced with a real atomic mutex. Also: a watch order is no longer created in an unscannable state when the node is briefly unreachable (the checkout fails cleanly so the buyer retries), a wrong-network refund address is rejected, and a mempool double-spend is never credited.
• Tested PHP 7.4, 8.1 and 8.3 in CI.

1.0.1

• Security: burning-bug defence. The no-server scanner now deduplicates payments by the one-time output key, not by the transaction id. Two outputs that share a one-time key (a 2018-style burn, even across different transactions) are at most one spendable output, so they can never credit an order twice.
• Requires both GMP and BCMath. The pure-PHP verifier needs the BCMath extension (for base58) in addition to GMP (for the money math). The gateway now hides itself, and the settings warn, on a host missing either one, instead of failing after a buyer paid.
• Hardened the settlement math to be fully order-independent (a duplicate that disagrees on lock status can never change the verdict by row order).

1.0.0

• First stable release. The no-server (pure-PHP) and agent modes are both production-tested with an adversarial test suite (order-independence, dedup, byzantine duplicates, false-paid hunting).
• No-server mode now sums multiple payments. A buyer who pays in installments, or sends a small test transaction then the rest, now completes automatically once the total reaches the price, matching the agent mode. Previously the WP-native scanner tracked only the first transaction.
• Funds are never stranded. A watch-mode order that received a partial payment is flagged and kept open (never auto-cancelled at expiry) and completes on a top-up.
• Hardened the settlement math to be independent of the order the node returns transactions in, so a duplicate or out-of-order response can never over- or under-credit an order.

0.1.8 (beta)

• Clearer network indicator. The settings now show which network you are on (mainnet, stagenet or testnet) as a badge, and the wizard and address field explain that the network follows your address; there is no separate toggle. To go live, swap the address, view key and node to your mainnet ones.

0.1.7 (beta)

• Privacy: Monero orders no longer store the buyer's IP address or user-agent. WooCommerce records both on every order; since Monero is irreversible (no chargebacks), there is no dispute reason to keep them, so the plugin strips them from its orders.
• The order's confirmation count now updates while the payment is maturing. The admin shows progress ("received, N confirmations") before the order settles, not just the final value. (The buyer's checkout page already updated live.)

0.1.6 (beta)

• No-server modes: accept Monero with no external agent. The plugin can now verify payments in pure PHP (vendored Monero crypto: ed25519, Keccak, base58), in two new modes: Auto-detect (a view-only watch over your address and node) and "I've paid" (the buyer pastes a transaction ID, verified on-chain). The advanced Agent mode is still there. The no-server modes need the GMP and BCMath PHP extensions (most hosts have both, or can enable them).
• Mode-aware setup wizard with a live "Check setup" that confirms the node is reachable, the network matches your address, and your view key actually belongs to the address before you go live.
• Pricing your way. Fixed-rate fallback when a feed is down, and you can point at your own price-source URL (JSON) instead of CoinGecko. The custom URL is fetched with SSRF protection.
• Fix: the setup wizard (and the post-activation redirect) could return "Sorry, you are not allowed to access this page." The hidden admin page is now registered so direct access works.
• Fix: the "Check setup" and "Test connection" buttons returned HTTP 400. Their admin-ajax handlers are now registered correctly.
• WordPress.org readiness: all inline scripts moved into enqueued asset files, ABSPATH guards on bundled files, translation template (.pot), and an "External services" privacy disclosure in the readme.
• Refreshed the bundled checkout widget to the latest build.

0.1.5 (beta)

• Pairs with the xmr-pay 0.4.0-beta agent (payment-correctness and reliability release). No store reconfiguration needed.
• Funds are never orphaned on expiry. A partially-paid order is no longer auto-cancelled when its window lapses. The plugin asks the agent, keeps it on hold, and shows a "your funds are safe, contact us" message with the QR hidden.
• Overpayment is surfaced. When a buyer overpays, the exact excess is recorded on the order (meta and note) and shown in the admin payment meta box.
• Reconcile safety net. A 5-minute cron re-polls the agent for on-hold orders and completes (or flags) any the webhook missed, covering webhook outages and node catch-up.
• Sync-status on the checkout. When the agent's node is catching up, the payment page shows "node catching up..." instead of a silent "unpaid".
• Settings now note that underpayment tolerance, confirmations and expiry are configured agent-side (XMR_TOLERANCE_XMR, XMR_MIN_CONFIRMATIONS, XMR_EXPIRY_HOURS).

0.1.4 (beta)

• Guided setup wizard: a step-by-step onboarding (welcome, connect agent, webhook, pricing, go live) that mirrors the npx xmr-pay agent flow, so the three values the agent prints (Agent URL, token, webhook secret) land in the right places without hunting through the full settings form. Live "Test connection" gates the step; the webhook URL is shown with a copy button. Opens automatically on activation; reachable any time from the plugins list ("Setup wizard") or the admin notice. The full settings page is unchanged for fine-tuning.

0.1.3 (beta)

• Cryptographic receipts: once an order is paid, the order-received page shows a "Download receipt" (a merchant-signed receipt) plus a one-click link to a bundled, offline, dependency-free verifier. Anyone can verify it forever, no third party. The signed receipt is also stored on the order.
• New "Redirect after payment (URL)" setting: send the buyer to a custom page (a thank-you, a digital download, etc.) the moment the payment confirms. Supports {order_id} and {order_key} placeholders.
• test_amount override is now honoured only when the agent is on a confirmed test network (stagenet or testnet); it can never silently fix the price on a live store.

0.1.2 (beta)

• Add a "Payment box theme" setting (light or dark) so the QR and payment box match your store theme instead of always rendering light.

0.1.1 (beta)

• Fix: the "open the payment page" link in the order email pointed at the order-pay page, which redirects for on-hold orders. It now links to the order-received page that renders the QR and live status.

0.1.0 (beta)

• First public beta. Gateway (classic and Blocks), HPOS support, XMR-native and CoinGecko/fixed pricing, live on-chain progress and top-up, signed HMAC webhooks, exact piconero math, "Test connection", order payment meta box, debug logging.