Opayo Direct Gateway for Gravity Forms

This add-on connects Gravity Forms to Opayo Direct (formerly Sage Pay Direct), so you can take payments inside your forms without sending shoppers to an external payment page. What you get

• On-form card fields: number, expiry, and security code are submitted securely to Opayo using the Direct integration.
• Test and live modes, plus global settings for vendor name and transaction type (Payment, Deferred, or Authenticate).
• Optional per-form feed overrides for vendor name, mode, and transaction type when you need different Opayo settings per form.
• 3-D Secure support: when Opayo requires authentication, the shopper is guided through the challenge and returns to your site to complete the payment.
• Gravity Forms payment features: product and donation pricing, feed conditional logic (where configured in Gravity Forms), delayed notifications until payment succeeds, and payment-related notification events.

Requirements

• Gravity Forms 2.5 or newer with the Payment Add-On framework (required by this plugin).
• An Opayo merchant account with Direct enabled.
• HTTPS (SSL) on your site. Card data is collected on your domain; you are responsible for PCI DSS compliance for your environment.

Support and custom work Send ideas and feedback to PatSaTECH. We also build custom payment gateway integrations. More plugins:

• Easy Digital Downloads
• Gravity Forms
• WooCommerce

Before you start

1. Install and activate Gravity Forms (a licensed copy that includes payment functionality).
2. Confirm your site uses HTTPS and meets your PCI obligations for collecting card details on-site.

Install the plugin

1. Download the plugin ZIP (or clone/unzip the package).
2. In WordPress, go to Plugins → Add New → Upload Plugin, choose the ZIP, and click Install Now — or upload the plugin folder to wp-content/plugins/ via FTP/SFTP.
3. Activate Opayo Direct Gateway for Gravity Forms under Plugins.

Connect Opayo

1. In the WordPress admin, open Forms → Settings → Opayo Direct (or the add-on’s settings screen under Gravity Forms).
2. Choose Test or Production, enter your Vendor Name, and set the default Transaction Type.
3. Copy the IPN / notification URL shown on that page and add it in your Opayo account if your integration or support documentation requires it (it is used for 3-D Secure and callback handling).

Create a payment feed

1. Edit the form that should accept payments.
2. Open Settings → Opayo Direct (or Payment settings for that form, depending on your Gravity Forms version).
3. Add a feed: map products or totals, billing fields, and the credit card field; save and test in Test mode before going live.

1.0.0

• Initial Release

1.0.1

• Updated to change the branding from SagePay to Opayo

1.0.2

• Raised Tested up to WordPress 6.9.4 in the plugin header and readme.

1.0.3

• Gravity Forms: minimum version 2.5; aligned with current Payment Add-On patterns; subscribe() returns a clear error (subscriptions are not implemented for this gateway).
• Feed settings: billing First/Last name mappings use get_field / replace_field and scan nested Address-style field maps (no brittle fixed section index).
• Billing data for Opayo: ISO 3166-1 alpha-2 country codes (UK→GB, common alpha-3 map, Gravity Forms country helpers); resolve country from submission, entry, and Address field .6 when needed; clear validation if country is missing.
• Billing address: resolve street, city, state, postcode, email, and phone from submission data, entry, and Address sub-inputs .1–.5; promote line 2 to line 1 when line 1 is empty; trim values to typical Opayo field lengths.
• Callback / IPN: validate oid, session, and entry; per-feed test/live mode for gateway URLs; home_url()-based IPN URLs; sanitized inputs; escaped output on challenge and status pages; HOUR_IN_SECONDS for transients where used.
• 3-D Secure: optional parent page with embedded iframe for the challenge (filter gf_sagepay_direct_3ds_use_iframe to disable if an issuer blocks iframes); after authentication, redirect targets the top window using session state so the thank-you page is not trapped inside the frame (ACS may omit query parameters on return).
• Reliability: JSON.stringify for delayed-notification IDs; strict notification ID matching; fixed error URL message parameter (legacy meesage still accepted); update_post_meta only when the entry has a post_id; HTTP timeouts and default TLS verification for gateway wp_remote_post calls; wp_safe_redirect / confirmation redirects where appropriate.