SagePay Form Gateway for WooCommerce

This plugin adds a WooCommerce payment gateway for Opayo Form integration (Sage Pay Form / Elavon hosted form). Customers pay on Opayo’s secure page, so your site does not collect or store card numbers, which reduces PCI scope compared with on-site card fields. How it works:

• At checkout, the shopper is redirected to Opayo with an encrypted payload (Crypt) built from the order.
• After payment, Opayo sends the customer back to your site; the plugin decrypts the response, checks the order and amount, and completes the order when the payment is successful.
• Supports classic checkout and registers with WooCommerce Blocks checkout when the block checkout is enabled.

Requirements:

• WordPress and WooCommerce (see readme headers for tested versions).
• An Opayo account with Form integration and credentials from MyOpayo (Vendor name, Encryption password).
• HTTPS is strongly recommended for checkout and payment return URLs.

Notes:

• Uses Elavon’s current Form register hosts (sandbox.opayo.eu.elavon.com / live.opayo.eu.elavon.com) and VPSProtocol 4.00. Override the register URL with the woocommerce_sagepayform_register_url filter if your account requires a different endpoint.
• Override the return/notify URL with woocommerce_sagepayform_notify_url if needed.

Use Elavon / Opayo’s official documentation for account setup, test cards, and regional rules.

1. Install and activate WooCommerce.
2. Install this plugin:
3. WordPress admin: Plugins → Add New → Upload Plugin, select the zip, Install Now, then Activate; or
4. Copy the plugin folder into wp-content/plugins/ (FTP, Git deploy, etc.), then activate under Plugins.
5. Open WooCommerce → Settings → Payments, enable “SagePay Form”, then Manage / Set up.
6. Enter Vendor Name, Encryption password, Vendor email, and set Mode to Test or Live to match your MyOpayo (sandbox vs live). Adjust 3-D Secure, transaction type (Payment / Deferred / Authenticate), emails, and card icons as needed.
7. Save settings. Complete a test payment in Test mode using Opayo’s test card details before going live.

After installation:

• Use HTTPS on the storefront and ensure pretty permalinks (or your server rules) allow the WooCommerce API callback at /wc-api/woocommerce_sagepayform.
• For staging or extra domains, configure allowed URLs or IPs in MyOpayo so Success/Failure redirects are accepted.

1.0.0

• Initial Release

1.4.0

• Updated to work with WooCommerce 2.6+

1.4.1

• Updated to resolve a basket shipping calculation bug.

1.4.2

• Updated to work with WooCommerce 3.x

1.4.3

• Updated the tested upto for Wordpress and Woocommerce.

1.4.4

• Updated to support the PHP version 7.0 and above.

1.4.5

• Updated to support WooCommerce 3.7+ and Wordpress 5.2+

1.4.6 Security and reliability:

• Return URL follows your site URL (HTTPS when configured) instead of forcing HTTP. Override with filter woocommerce_sagepayform_notify_url.
• Callback runs only on the WooCommerce API route (wc-api), not on every init request. Payment verification:
• Validates decrypted Opayo data before completing an order.
• Remembers each generated VendorTxCode on the order (supports multiple pending attempts, e.g. refresh or extra tabs); regex fallback for older VendorTxCode formats.
• Verifies amount and currency against the order; skips duplicate completion if the order is already paid.
• Records VPSTxId via payment_complete() for the WooCommerce transaction id.
• Safer decrypt path when crypt is missing, malformed, or invalid. Fixes and compatibility:
• US eMailMessage: applies when billing or shipping country is US (fixes incorrect get_shipping_state usage).
• WooCommerce Blocks: guards when the gateway is missing from the registry.
• Blocks checkout script text domain aligned with the main plugin (woo-sagepayform-patsatech).
• Uses wc_get_order() and a paid-status fallback when wc_get_is_paid_statuses() is unavailable.

1.4.7

• Declares support tested through WordPress 6.9 and WooCommerce 10.6 (plugin header and readme Tested up to / WC tested up to).
• Elavon Opayo Form URL migration: registration POSTs target opayo.eu.elavon.com instead of legacy sagepay.com hosts; path stays /gateway/service/vspform-register.vsp.
• Test mode: https://sandbox.opayo.eu.elavon.com/gateway/service/vspform-register.vsp (was https://test.sagepay.com/gateway/service/vspform-register.vsp).
• Live mode: https://live.opayo.eu.elavon.com/gateway/service/vspform-register.vsp (was https://live.sagepay.com/gateway/service/vspform-register.vsp).
• VPSProtocol raised from 3.00 to 4.00 on each Form registration request (Opayo current requirement).
• Filter woocommerce_sagepayform_register_url — override the register URL per $mode (test or live) for legacy sagepay.com URLs or account-specific endpoints during migration.