=== iPOSpays Payment Gateway for WooCommerce ===
Contributors: ipospays
Tags: woocommerce, payment gateway, credit card, bank, google pay, apple pay, paypal
Requires at least: 7.0
Tested up to: 7.1.2
Requires PHP: 7.4
Stable tag: 1.4.7
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Accept all major credit/debit cards, ACH (Bank), Apple Pay, Google Pay, PayPal, and other alternative payment methods with WooCommerce.

== Description ==

The iPOSpays Payment Gateway for WooCommerce enables merchants to securely accept Credit/Debit Cards, ACH (Bank), Apple Pay, Google Pay, PayPal, and other supported payment methods through Embedded and Hosted Payment Page (HPP) checkout experiences.

= Supported Payment Methods (Hosted Payment Page - Redirect) =

* Credit/Debit Cards
* Google Pay
* Apple Pay
* ACH (Bank)
* Alternative Payment Methods

= Supported Payment Methods (Embedded Checkout) =

* Credit/Debit Cards
* Google Pay
* Apple Pay
* ACH (Bank)

To use Google Pay, customers must use a supported browser such as Google Chrome.

To use Apple Pay, customers must use a supported Apple device and Safari browser.

For Embedded Checkout, you must whitelist your domain: [How to Setup Whitelisted Domain on iPOSpays](https://s3.us-east-1.amazonaws.com/assets.ipospays.com/How+to+Setup+Whitelisted+Domain+on+iPOSpays.mp4)

= Demo =

View all supported payment methods:

[Demo Store](https://docs.ipospays.tech/product/anchor-bracelet/)

== Google Pay Support ==

iPOSpays supports Google Pay, allowing customers to complete secure and fast payments using their Google Account on supported mobile and desktop devices.

[Google Pay Privacy Policy](https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=en-GB) and [Google Pay Terms of Service](https://payments.google.com/payments/apis-secure/get_legal_document?ldt=googlepaytos)

== Apple Pay Support ==

iPOSpays supports Apple Pay, enabling customers to complete fast and secure payments using Apple devices.

To enable Apple Pay, merchants must have an Apple Developer Account and register their domain with Apple. [How to set up Apple Pay for Your iPOSpays Merchant Account](INSERT_YOUR_APPLE_PAY_GUIDE_URL_HERE)

[Apple Pay Privacy Policy](https://www.apple.com/legal/privacy/) and [Apple Pay Terms of Service](https://www.apple.com/legal/internet-services/terms/site.html)

== Frequently Asked Questions ==

= How do I test this plugin? =

Enable Test Mode in the plugin settings to simulate payment transactions.

= Does this plugin support WooCommerce Subscriptions? =

Currently, WooCommerce Subscriptions are not supported. We may consider adding support in a future release.

= Where can I find documentation? =

You can find our detailed documentation [here](https://docs.ipospays.com/iPOSpays-WooCommerce-Extension).

= Where can I get support? =

Please use the WordPress Plugin Support Forum.

== Changelog ==

= 1.4.7 - 2026-10-15 =

**Security (IP-10014)**
* Fixed: HPP Redirect orders could be marked paid from unverified browser callback parameters. Reported by Pedro Pinho (via WPScan).
* HPP Redirect: orders are not marked paid from browser returnUrl parameters alone.
* Server-to-server postAPI (/payment-notify) with AES-256-GCM authHeader Authorization validation.
* Status Check (/iposTransactStatus) used as fallback only (SCENARIO 1 / SCENARIO 2).
* Base amount validation against stored order cents; tips/fees/taxes applied as fee line items.
* Atomic order-completion lock to prevent duplicate payment_complete() under concurrent callbacks.

**Improvements**
* Clear postAPI success completes the order without Status API; a decline leaves the order Pending.
* SCENARIO 1: incomplete/unusable postAPI waits 90 seconds then calls Status API once.
* SCENARIO 2: returnUrl while order still unpaid calls Status API immediately.
* Structured redirect logging ([INCOMING], [DECISION], [SENDING], [RECEIVED]).
* Card, ACH, and Google Pay postAPI payload handling improvements.

= 1.4.6 - 2026-09-23 =

**Security**
* Fixed WooCommerce SSL Security Error.
* Fixed SSL security error while doing cron job.

= 1.4.5 - 2026-08-24 =

**New**
* Added VeriCheck ACH payment processor support.
* Added Plugin Uninstall Survey.
* Added permanent uninstall event logging.

**Improvements**
* Added support for 9-digit ZIP Codes in ACH transactions.
* Added Birth Year validation for ACH transactions.
* Improved ACH checkout and form rendering.
* Improved plugin uninstall cleanup.

**Security**
* Enhanced payment security and input validation.
* Improved API security and request handling.
* Strengthened overall plugin stability and security.
* Resolved issues identified during the security assessment.

[See changelog for all versions](https://plugins.svn.wordpress.org/ipospays-gateways-wc/trunk/changelog.txt)