Optimist Hub Payment Gateway with Moka United for WooCommerce
| 开发者 |
optimisthub
fatih-toprak |
|---|---|
| 更新时间 | 2026年10月15日 22:58 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPL-3.0-or-later |
| 版权网址: | 版权信息 |
详情介绍:
- The customer selects "Moka United" at checkout. The plugin renders no card fields at all (
has_fields = false) — only your description text. - The plugin creates a payment session on Moka United's WebPos service and redirects the customer to Moka United's hosted payment page.
- The customer enters their card details, chooses an installment plan and completes 3D Secure entirely on Moka United's page.
- Moka United returns the customer to your store with a signed result. The plugin verifies the signature, re-checks the amount and confirms the transaction server-to-server with Moka United before marking the order as paid.
- Redirect (hosted payment page) flow — no card data is ever collected by the store (PCI scope SAQ A)
- 3D Secure authentication
- Installments, including the interest/commission rates of the customer's own card, shown on Moka United's payment page
- An installment table on the product page, so shoppers can see the monthly cost before they reach checkout
- The card brand logos and per-installment totals are read live from your Moka United dealer account
- Compatible with both the classic (shortcode) and the block-based checkout
- High-Performance Order Storage (HPOS) compatible
- Test mode, which points every request at the Moka United test environment so you can rehearse the full flow before going live
- Transaction log screen
- English source with a bundled Turkish (tr_TR) translation; the interface follows the site language
- WordPress 6.4 or higher
- WooCommerce 8.0 or higher
- PHP 7.4 or higher
- A Moka United merchant account (dealer code, API username and password)
- TLS 1.2 or higher
安装:
- Install and activate the plugin from your WordPress dashboard.
- Go to WooCommerce → Settings → Payments.
- Find Moka United, click Manage, enable it and enter the Dealer Code, API Username and API Password provided by Moka United.
- Leave Test Mode on until you have verified the payment flow, then turn it off to go live.
屏幕截图:
常见问题:
Do I need a Moka United account?
Yes, for live payments. You need a Moka United merchant account and the dealer code, API username and API password issued to you. Moka United also issues a separate test account, which you can use with Test Mode to rehearse the whole flow — placing an order, paying on the hosted page and receiving the callback — without moving real money.
How do I enable test mode?
Go to WooCommerce → Settings → Payments → Moka United and tick Test Mode. While it is on, all requests go to the Moka United test environment. Remember to turn it off before going live: sending a test dealer to the live environment returns an InvalidAccount error.
How do I enable installments?
Installment options are rendered by Moka United on its own payment page. In the plugin settings you control whether installments are offered at all (Installment Options / "Taksit Seçenekleri"), the highest installment count to offer (Maximum Installment / "Maksimum Taksit"), and exactly which installment counts are listed (Installment List / "Taksit Listesi", for example 1,2,3,6,9,12). Tick Reflect Commission in Installments / "Komisyonu Taksite Yansıt" if you want Moka United to apply the card BIN's commission rates to the displayed installment amounts.
Are my customers' card details safe?
They are never seen by your store. The card number, expiry date and CVC code are entered by the customer directly on Moka United's page, which is operated by Moka United, not by this plugin. The plugin does not collect, transmit or store card data under any circumstance — not even in debug logs. This keeps your PCI-DSS scope at SAQ A.
Can I issue refunds?
Not from this plugin. Refunds are handled in the Moka United merchant panel (https://pos.mokaunited.com). The plugin deliberately does not declare WooCommerce refund support, so the refund button is hidden on the order screen rather than offering an action that cannot complete.
How do I migrate from the old plugin?
The old moka-woocommerce plugin distributed through GitHub used the same gateway ID (mokapay), so your existing settings are inherited automatically. Both plugins also define the same constants, so they cannot run at the same time: if the old plugin is still active when you activate this one, it is deactivated for you automatically and a notice explains what happened. On upgrade, the plugin also purges any card data that the old version may have recorded in plain text, and removes a table the old version no longer uses. Take a database backup first.
Which languages are supported?
The plugin ships in English and includes a Turkish (tr_TR) translation, so a Turkish WordPress site shows the interface in Turkish and any other locale shows English. Every string is translatable, so additional languages can be added through translate.wordpress.org. If you want to ship your own translation, drop a .po/.mo pair into the plugin's languages/ folder.
Which order status is assigned after payment?
You choose it in the plugin settings. The default is Completed.
更新日志:
- Added: the Moka United payment reference is now a column in the WooCommerce orders list, next to the order number, and the orders search finds an order by it. Previously the reference was only visible after opening the order, which is the value store owners need when they contact Moka United about a payment.
- Fixed: a fatal error when the plugin was activated while the old moka-woocommerce plugin was still active. Both plugins define the same constants, so the new plugin ended up reading the old plugin's folder and could not load its own classes. The plugin now stops cleanly, shows an explanatory notice, and deactivates moka-woocommerce automatically during activation so the migration can finish.
- Changed: the bundled Turkish translation now matches the wording approved by the Turkish translation team on translate.wordpress.org (for example "Test kipi" rather than "Test modu", and "parola" rather than "şifre"), so the bundled file and the official language pack read the same.
- Changed: strings that translators could not get right were rewritten. Sentences are no longer glued together in code (the "WARNING" and "MISSING" report lines), and short state words are no longer bare fragments ("Payment method: enabled" instead of a separate "enabled"), so word order and context survive translation.
- Fixed: the translatable template no longer lists the compiled JavaScript bundle as a source; only the real source file is referenced.
- Added: a JSON translation file for the block checkout strings, so the block checkout follows the site language too.
- Fixed: the Turkish translation no longer rewrites the plugin name. Proper nouns and brand names are left as they are.
- Changed: the source strings are English, following the WordPress.org convention. The interface was Turkish-only before, which meant an English site also showed Turkish.
- Added: a bundled Turkish (tr_TR) translation, so Turkish sites keep the Turkish interface. Every string is now translatable and additional languages can be contributed on translate.wordpress.org.
- Changed: the plugin author is Optimist Hub again, linking to the https://profiles.wordpress.org/optimisthub/ profile.
- Added: a screenshot of the installment table to the plugin page.
- Fixed: the tag list had six entries; WordPress.org only keeps the first five and silently drops the rest, so one tag was being discarded without any warning. The list is now exactly five tags: woocommerce, payment gateway, moka, moka united, united payment. The "taksit" tag was removed.
- Changed: the display name is now "Optimist Hub Payment Gateway with Moka United for WooCommerce" (the brand name is written in two words). The slug is unchanged.
- Added: the "united payment" tag, so the plugin is found by the payment provider's own name as well as by "moka united".
- Changed: the plugin author is now Fatih Toprak (https://profiles.wordpress.org/fatih-toprak/).
- Added: screenshots to the plugin page.
- Fixed: the payment method did not appear at all on the block checkout ("There are no payment methods available"). WooCommerce Blocks requires a
canMakePaymentproperty in the registration; without it the registry threw a TypeError and the method was never registered. The classic checkout was unaffected, which is why this went unnoticed. - Fixed: the currency is now sent to Moka. It was never sent, so Moka applied its own default (TL) — a store whose currency was not TRY would have had the right amount charged in the wrong currency. Moka accepts TL, USD, EUR, GBP, CHF, JPY, RUB, CAD, AUD, SAR, KWD, SEK, NOK and DKK;
TRYis mapped to Moka's own codeTL. - Added: the gateway is no longer offered when the store currency is one Moka does not accept, and the settings screen explains why instead of letting the method disappear silently.
- Fixed: the test-mode warning was printed twice on the block checkout.
- Added: the Moka United card logo CDN (
cdn.moka.com) to the "External services" section, together with what the visitor's browser sends when it loads a logo. - Added: the public Moka United terms of use and privacy policy. The previous readme said no public terms page existed; that was wrong. The links are now listed under each individual service, as the review asks, and the payment services terms are linked as well.
- Security: the payment callback is now sanitized on the same line its
$_GET/$_POSTvalues are read, so no raw request value can reach the callback handler or the payload stored asorder_details. That stored payload is text-sanitized as well. - Fixed: the product tab escapes its output with
wp_kses()and an explicit tag list instead of echoing it unescaped. - Fixed: the bundled Moka client no longer contains an unsanitized
$_SERVERread.
- Renamed: the plugin is now "OptimistHub Payment Gateway with Moka United for WooCommerce" and its slug is
optimisthub-moka-united-payment-for-woocommerce, which is the text domain as well. - Fixed: a fatal error on PHP 7.4 when a card logo URL had to be checked against Moka's CDN (
str_ends_with()is PHP 8.0+). The same check now also rejects a bare.moka.comhost. - Fixed: the installment table stylesheet is now loaded with
wp_enqueue_style()instead of being printed into the page as an inline<style>block; the remaining inlinestyleattributes moved into that stylesheet. - Security: the bundled Moka client now reads every
$_SERVERvalue through a sanitising helper and validates theClientIPit falls back to, so a request header can no longer carry an unvalidated value into a payment request.ClientPortis reduced to digits before use. - Security: sensitive-field redaction now has a second layer that works on the value, not only on the field name. Any value that looks like a card number (13-19 digits, Luhn-valid, with or without spaces or dashes) is replaced with
[purged]whatever the field happens to be called, so the promise that card data never reaches a debug log or a database row no longer depends on knowing every field name in advance. - Added: the
Requires Plugins: woocommerceheader, so WordPress verifies WooCommerce is present before activation. - Changed: the bundled Moka client no longer uses cURL. Every request goes through the WordPress HTTP API (
wp_remote_request()), which is the transport the plugin already injected at runtime. - Changed: Plugin URI now points at https://optimisthub.com/ (the previous URL returned 404).
- Security: server-to-server verification now requires both
PaymentStatus = 2andTrxStatus = 1. Previously onlyTrxStatuswas checked, so cancelled (3,1) and pre-authorised (1,1) transactions were treated as paid even though no money was captured. - Security: the API response gate is now fail-closed. A top-level
ResultCodeerror is no longer accepted merely becauseData.IsSuccessfulistrue— that flag means "the request was processed", not "the payment succeeded".
- Initial release.
- Redirect payment through the Moka United Hosted Payment Page (WebPos).
- No card data collected, transmitted or stored — PCI scope SAQ A.
- 3D Secure flow, installment display and commission handling managed on Moka United's page.
- Server-to-server transaction verification with signature and amount checks.
- Classic and block-based checkout support.
- HPOS compatibility.
- Test mode.
- Transaction log screen.
- Automatic inheritance of settings from the previous
moka-woocommerceplugin (gateway IDmokapay).