WooCommerce HitPay Payment Gateway

Price: from $79.00 / year (Single Site License, Support and Updates included for 1 year). Set the other variants (2-5 Sites, Unlimited, 5 years) as on your other gateway products.

Badges: HPOS · Blocks checkout · HitPay checkout page · Cards, PayNow & local methods

---

Short description

For WooCommerce stores with a HitPay account in Singapore, Malaysia or the Philippines: take cards, PayNow, Apple Pay, Google Pay, GrabPay, ShopeePay, FPX, GCash, QRIS and more through HitPay’s secure checkout page.

Every payment is confirmed with the HitPay API or a signed webhook before the order moves, with full and partial refunds from the order screen, automatic refunds of accidental double payments, unpaid orders cancelled on a timer, HPOS and both Blocks and classic checkout.

Not a fit? Subscriptions or recurring billing, on-site card fields, or a business HitPay does not serve need a different solution: see custom payment gateway integration.

---

Long description

Quick answer (for buyers)

If your business uses HitPay, you need a gateway built on the HitPay Payment Request API that sends customers to HitPay’s checkout page and confirms every payment with the API. PatSaTECH maintains the WooCommerce HitPay Payment Gateway. Card data never touches your server, the status in HitPay’s return link is never trusted, and every webhook is verified with your webhook salt and checked against the HitPay payment request before WooCommerce changes anything.

Who this is for

• WooCommerce stores with a HitPay account, mainly in Singapore, Malaysia and the Philippines. The sandbox is free.
• Shops that want cards plus local methods (PayNow, GrabPay, ShopeePay, FPX, GCash, QRIS…) from one checkout button.
• Stores on modern WooCommerce: HPOS, the Cart/Checkout Blocks or the classic shortcode checkout.
• Agencies that need a documented, sandbox-tested gateway they can hand over to a client.

Who should skip (disqualifiers)

• HitPay will not give your business a live account (HitPay serves South-East Asian businesses; for example, India-based merchants cannot get one).
• You need subscriptions or recurring payments. This plugin takes one-time payments.
• You want card fields embedded on your own checkout page instead of HitPay’s page.
• You sell items under 0.30: HitPay’s minimum payment is 0.30.

Dream outcome

Customers pay with the card, wallet or local method they already use, orders move to Processing on their own as soon as HitPay confirms the payment, the order note shows how they paid (“Card (Visa ending 4242)”), and refunds are done from the WooCommerce order screen.

Obstacles → what this plugin addresses

Obstacle	How this extension helps
Orders marked paid from a faked return link	The status in HitPay’s redirect is never trusted; every payment is confirmed with a status lookup or a verified webhook, and the amount and currency are checked.
Orders stuck in Pending after the customer paid	Signed Event Webhooks plus a check on return and scheduled follow-up checks with the HitPay API, so a missed webhook doesn’t leave a paid order unpaid.
Fake or replayed webhook calls	Hitpay-Signature HMAC-SHA256 of the raw body checked with your webhook salt; the payment request is always re-read from the API.
Declined cards leaving orders open for ever	HitPay keeps a declined request payable and sends no failure webhook, so the plugin cancels unpaid orders after a time you choose and deletes the old HitPay request.
Paying twice for one order	A per-order lock, other open requests deleted once paid, and a second payment that still goes through is refunded automatically (setting on by default).
Confusing errors for tiny orders	A clear “below HitPay’s minimum payment amount” message instead of a generic error.
HPOS and Blocks checkout breaking older gateways	Declared HPOS compatible; native Cart/Checkout Blocks integration plus classic checkout.

Value stack (features)

1. HitPay checkout page: cards, PayNow, Apple Pay, Google Pay, GrabPay, ShopeePay, FPX, GCash, QRIS and more (as enabled on your HitPay account) behind one button, or only the methods you list.
2. Sandbox and Live API keys, checked with HitPay when you save.
3. One Event Webhook with 5 events (Payment Request Completed, Payment Request Failed, Charge Created, Charge Updated, Charge Failed); the settings page shows the exact URL.
4. Signed, verified webhooks and a per-order lock, so an order is never paid twice.
5. Return status never trusted; a “payment being confirmed” notice while HitPay finishes.
6. Amount and currency checks (mismatches go On hold).
7. Full and partial refunds from the order screen; refunds made in the HitPay dashboard are noted.
8. Automatic refund of duplicate payments (can be turned off).
9. Card brand and last four in the order note (“Method: Card (Visa ending 4242)”).
10. Unpaid orders cancelled after a time you choose (default 60 minutes); old HitPay checkout links deleted.
11. Clear messages for amounts below HitPay’s minimum and methods not activated on your account.
12. HPOS compatible and Blocks + classic checkout.
13. Debug logging in WooCommerce → Status → Logs (source woohitpay); API keys and salts are never logged.
14. Translation-ready (.pot included), GPLv2 or later. HitPay SMS always off; HitPay’s receipt email optional.

Supported payment methods (depends on your HitPay account and currency)

Cards (Visa, Mastercard, American Express and others) · Apple Pay · Google Pay · PayNow · GrabPay · ShopeePay · FPX · GCash · QRIS · and other HitPay methods.

Supported countries and currencies

HitPay’s core markets are Singapore, Malaysia and the Philippines; a live account needs HitPay’s business verification.

Currencies: SGD, MYR, USD, AUD, NZD, PHP, HKD, THB, EUR, CAD, GBP, IDR, AED, KRW, CNY, INR, JPY, CHF, BND, SAR, SEK, DKK, NOK, PLN, QAR, TWD, ZAR and VND. Local methods appear only for their own currency. Minimum payment 0.30.

Tested with a HitPay sandbox account (Singapore, SGD). Live payments have not yet been tested by PatSaTECH.

Requirements

• WordPress 6.0 or later
• WooCommerce 8.0 or later
• PHP 7.4 or later
• HTTPS (SSL) on the store (HitPay does not deliver webhooks to localhost or IP addresses)
• A HitPay account (or the free sandbox for testing), its API key, and an Event Webhook with its salt

Tested on

• WordPress 7.1.3
• WooCommerce 11.2.1 (classic checkout and Cart/Checkout Blocks)
• PHP 8.1.34; PHP 7.4 or later required
• HitPay sandbox (Singapore, SGD): card payments on Blocks and classic checkout, signed Event Webhooks, a declined card, partial and full refunds, dashboard refund, duplicate-payment guard, minimum amount, unpaid order cancelled by the time limit

---

See it in action

A few screenshots show how easy it is to set up and use the WooCommerce HitPay Payment Gateway (see the product gallery).

---

Installation summary

1. Download woohitpay-1.0.0.zip from your PatSaTECH account.
2. In WordPress go to Plugins → Add New → Upload Plugin, upload the zip and activate WooCommerce HitPay Payment Gateway (PatSaTECH).
3. In the HitPay dashboard (sandbox: dashboard.sandbox.hit-pay.com) copy your API key from Developers → API Keys.
4. Under Developers → Event Webhooks add a webhook for https://your-store.com/wc-api/patsatech_hitpay_webhook/ with the 5 events, save it and copy its salt (each webhook has its own salt).
5. In WooCommerce go to Settings → Payments → HitPay (PatSaTECH), tick Enable, keep Sandbox ticked, paste the API key and the salt and save.
6. Place a test order with card 4242 4242 4242 4242 (any future expiry, any CVC).
7. When your HitPay account is verified, paste the live API key and the live webhook’s salt and untick Sandbox.

The full illustrated setup guide is included with the download.

Changelog

18.10.26 – Ver. 1.0.0

• Initial release.
• HitPay Payment Request API with the HitPay checkout page (cards, PayNow and local methods).
• HPOS compatible; WooCommerce Cart/Checkout Blocks and classic checkout.
• Sandbox and live API keys checked on save; one Event Webhook with 5 events, verified with Hitpay-Signature.
• Return status never trusted; every change re-checked with the API under a per-order lock.
• Full and partial refunds; dashboard refunds noted; duplicate payments refunded automatically.
• Card brand and last four in the order note; clear minimum-amount message; unpaid orders cancelled on a timer; debug logging.

---

Support & documentation

• Documentation: Payment gateway setup guide
• Support: [SUPPORT LINK] · [email protected]
• Optional: Plugin installation support

Satisfaction Guarantee · Support Guarantee (shown by your product template)