How to accept crypto payments on WooCommerce

What you need before accepting crypto

A WooCommerce store can add cryptocurrency without rebuilding its checkout. The practical route is a payment gateway plugin: it adds a payment method, creates an invoice when the order is placed, sends the buyer to a secure payment page, and updates the WooCommerce order when the blockchain payment confirms.

Before installation, make sure WordPress and WooCommerce are current, HTTPS is enabled, and you can place a normal test order. You also need a BluPay merchant shop, an API key, and a webhook secret. Start with a sandbox key so you can test the entire flow without moving real funds.

Choose the right crypto gateway model

The most important decision is custodial versus self-custodied payment processing. A self-custodied setup can send funds directly to wallets you control, but your team must manage addresses, chain monitoring, confirmations, refund operations, exchange-rate timing, and private-key security. A custodial gateway handles that payment infrastructure and records the funds in a merchant balance.

BluPay is custodial. The buyer chooses an enabled asset and network on the hosted checkout, BluPay monitors the payment, and the WooCommerce plugin receives status updates through signed webhooks. That keeps wallet keys and blockchain listeners away from your WordPress installation. Review the security model and your business’s compliance requirements before choosing any provider.

Also compare the operational details: supported coins and networks, settlement options, gateway and network fees, refund workflow, checkout-block compatibility, webhook security, and sandbox quality. A long coin list is less useful than reliable support for the assets your customers actually use. BluPay’s current supported assets include stablecoins and native assets across Tron, Ethereum, BNB Smart Chain, Bitcoin, and Solana.

Set up BluPay on WooCommerce in six steps

1. Create a shop. Register for BluPay, add a shop, select who covers the service and network fees, and generate a sandbox API key. Each key belongs to one shop, which limits its scope.
2. Install the plugin. Download BluPay for WooCommerce 0.3.0. In WordPress, go to Plugins → Add New Plugin → Upload Plugin, choose the ZIP, install it, and activate it.
3. Open the payment settings. Go to WooCommerce → Settings → Payments → BluPay (Crypto). Enable the gateway and keep Environment set to Sandbox while testing.
4. Add credentials. Paste the shop API key and webhook secret. Shop ID is optional because the API key already identifies the shop. Choose whether paid orders should become Processing (physical fulfilment remains) or Completed (commonly used for digital-only orders).
5. Register the webhook. Copy the read-only webhook URL shown in WooCommerce and add it to the BluPay shop. This endpoint is how a confirmed payment reaches your order system even if the customer closes the browser.
6. Save and test the connection. Save the gateway settings, then use Test Connection. BluPay should now appear as “Pay with crypto” in checkout. You can customize the title and short customer-facing description.

Test the complete payment lifecycle

Do not stop after seeing the payment method in checkout. A useful test starts with a new WooCommerce order and ends with the correct final order state. Test both classic checkout and block checkout if your theme exposes both.

• Place an order and select BluPay as the payment method.
• Confirm the store creates one BluPay invoice and redirects to its hosted payment URL.
• Check the order total and currency sent to the invoice.
• Simulate payment in sandbox and verify the order moves from Pending payment to Processing or Completed.
• Confirm the order records the invoice link, crypto amount, asset, network, and transaction hash.
• Send the same webhook event twice and verify the second delivery does not apply the order transition again.
• Test an invalid signature and an old timestamp; both should be rejected.

BluPay gateway events can be logged under WooCommerce → Status → Logs with the source blupay. Keep logging on during testing and the first production transactions, then review your data-retention policy before leaving verbose logs enabled indefinitely.

WooCommerce crypto payment security checklist

Payment plugins sit at a sensitive boundary between checkout, an external API, and order fulfilment. HTTPS is the minimum. In addition, protect WordPress administrator accounts with strong unique passwords and two-factor authentication, restrict who can view or change payment settings, and keep WordPress, WooCommerce, the theme, and every plugin patched.

Treat the BluPay API key and webhook secret like passwords. Do not paste them into support tickets, screenshots, analytics, or public repositories. If either value is exposed, rotate it immediately. The plugin masks secrets in settings and uses the API key in an HTTP request header rather than placing it in a URL.

A redirect back to your store is not proof of payment. Customers can close or manipulate browser navigation, so fulfilment must follow a verified server-to-server event. BluPay webhooks use HMAC-SHA256 signatures, a timestamp window, and event identifiers. The plugin verifies these before changing the order, which reduces forged and replayed status updates.

Understand fees, refunds, and accounting

BluPay charges a flat 1% gateway fee on successfully paid invoices, while blockchain network fees are passed through at cost. A shop setting decides whether the customer covers those fees or they are deducted from the merchant settlement. There are no setup or monthly fees listed on the BluPay pricing page.

Crypto payments should still enter the same accounting and fulfilment controls as card or bank payments. Record the WooCommerce order total, fiat currency, received crypto asset and amount, transaction identifier, gateway fees, and settlement value. Decide how your business handles underpayments, overpayments, expired invoices, refunds, and exchange-rate changes before launch. Your local tax and accounting treatment may depend on jurisdiction, so obtain professional advice where required.

Frequently asked questions