Moment Payments for WooCommerce

Moment Payments for WooCommerce integrates the Moment hosted checkout into your WooCommerce store. Customers are redirected to a secure Moment-hosted payment page and returned to your store after completion. Order status is driven by signed webhooks — no polling required.

Features

• One-time payments via hosted checkout redirect
• EFT and wallet support
• Subscriptions (requires WooCommerce Subscriptions)
• Full and partial refunds from the WooCommerce admin
• Block checkout and classic shortcode checkout support
• HMAC-SHA256 webhook signature verification with replay-attack protection
• Configurable verify-on-return API check to close the redirect–webhook race
• Admin notices for missing credentials, no HTTPS, and WooCommerce version checks
• Debug logging via WooCommerce log viewer (tagged source=moment-payments)

Requirements

• WordPress 6.0+
• WooCommerce 8.0+
• PHP 7.4+
• A Moment merchant account (sign up)
• Store currency must be ZAR

External services

This plugin connects to the Moment payments API (https://api.momentpay.net) operated by Moment. The connection is required for the plugin to function as a payment gateway.

What is sent and when

• When a customer places an order, the plugin sends the order ID, order key, currency, amount, customer email, and billing details (name, address) to Moment to create a hosted-checkout payment session.
• After the customer is redirected back to the store, if the “Verify on return” option is enabled, the plugin queries Moment for the session status using the session ID.
• When a card last-4 / scheme is needed for display in the WooCommerce admin, the plugin queries Moment for the payment object using its payment ID.
• When a merchant issues a refund from the WooCommerce admin, the plugin sends the payment ID, amount, and optional reason to Moment.
• Moment delivers signed webhook events (payment_session.updated, payment.refunded) inbound to the plugin’s webhook endpoint; the plugin verifies the HMAC-SHA256 signature and updates order status accordingly.

No card data ever touches the merchant site — card details are entered only on Moment’s hosted checkout pages, which the plugin does not control.

Service provider

• Service: Moment — https://momentco.net
• Terms of service and privacy policy: https://momentco.net/legal