Title: Optimist Hub Payment Gateway with Moka United for WooCommerce
Author: Optimist Hub
Published: <strong>October 14, 2026</strong>
Last modified: October 15, 2026

---

Search plugins

![](https://ps.w.org/optimisthub-moka-united-payment-for-woocommerce/assets/banner-
772x250.png?rev=3746562)

![](https://ps.w.org/optimisthub-moka-united-payment-for-woocommerce/assets/icon-
256x256.png?rev=3746562)

# Optimist Hub Payment Gateway with Moka United for WooCommerce

 By [Optimist Hub](https://profiles.wordpress.org/optimisthub/)

[Download](https://downloads.wordpress.org/plugin/optimisthub-moka-united-payment-for-woocommerce.1.1.12.zip)

 * [Details](https://wordpress.org/plugins/optimisthub-moka-united-payment-for-woocommerce/#description)
 * [Reviews](https://wordpress.org/plugins/optimisthub-moka-united-payment-for-woocommerce/#reviews)
 *  [Installation](https://wordpress.org/plugins/optimisthub-moka-united-payment-for-woocommerce/#installation)
 * [Development](https://wordpress.org/plugins/optimisthub-moka-united-payment-for-woocommerce/#developers)

 [Support](https://wordpress.org/support/plugin/optimisthub-moka-united-payment-for-woocommerce/)

## Description

This plugin adds a **Moka United** virtual POS integration to your WooCommerce store,
for merchants taking payments in Turkey.

It uses Moka United’s **hosted payment page** (Ortak Ödeme Sayfası / WebPos): the
customer is redirected to Moka United to pay, so you can start taking cards without
ever handling card data yourself.

The card number, expiry date and CVC code are therefore never entered on your site,
never pass through your server and are never stored in your database. Your PCI-DSS
scope stays at **SAQ A**.

**How it works**

 1. The customer selects “Moka United” at checkout. The plugin renders no card fields
    at all (`has_fields = false`) — only your description text.
 2. The plugin creates a payment session on Moka United’s WebPos service and redirects
    the customer to Moka United’s hosted payment page.
 3. The customer enters their card details, chooses an installment plan and completes
    3D Secure entirely on Moka United’s page.
 4. Moka United returns the customer to your store with a signed result. The plugin
    verifies the signature, re-checks the amount and confirms the transaction server-
    to-server with Moka United before marking the order as paid.

**Features**

 * Redirect (hosted payment page) flow — no card data is ever collected by the store(
   PCI scope SAQ A)
 * 3D Secure authentication
 * Installments, including the interest/commission rates of the customer’s own card,
   shown on Moka United’s payment page
 * An installment table on the product page, so shoppers can see the monthly cost
   before they reach checkout
 * The card brand logos and per-installment totals are read live from your Moka 
   United dealer account
 * Compatible with both the classic (shortcode) and the block-based checkout
 * High-Performance Order Storage (HPOS) compatible
 * Test mode, which points every request at the Moka United test environment so 
   you can rehearse the full flow before going live
 * Transaction log screen
 * English source with a bundled Turkish (tr_TR) translation; the interface follows
   the site language

**Requirements**

 * WordPress 6.4 or higher
 * WooCommerce 8.0 or higher
 * PHP 7.4 or higher
 * A Moka United merchant account (dealer code, API username and password)
 * TLS 1.2 or higher

### External services

This plugin connects to Moka United services in order to process payments. This 
section describes exactly what data is sent, to which service, for what purpose 
and when.

**1. Moka United — Hosted Payment Page (payment session creation)**

 * Service address: `https://clientwebpos.mokaunited.com` (test environment: `https://
   clientwebpos.refmokaunited.com`)
 * Endpoint: `POST /Api/WebPos/CreateWebPosRequest`
 * Data sent: payment amount and currency, order number, order description, buyer
   full name, buyer email address, buyer phone number (optional), buyer address,
   basket line items (product name, quantity, unit price), dealer code and API username
 * Purpose: to create a payment session and redirect the customer to Moka United’s
   secure hosted payment page
 * When: when the customer places the order and the payment is initiated
 * **No card number, expiry date or CVC code is sent in this request.** Those details
   are entered by the customer directly on Moka United’s own page, in the customer’s
   own browser.
 * Provider policies (Moka United) — terms of use: https://www.mokaunited.com/legal-
   documents-and-representatives/terms-of-use ; privacy policy: https://www.mokaunited.
   com/legal-documents-and-representatives/privacy-policy

**2. Moka United — PaymentDealer services (transaction verification)**

 * Service address: `https://service.mokaunited.com` (test environment: `https://
   service.refmokaunited.com`)
 * Endpoints: `POST /PaymentDealer/GetDealerPaymentTrxDetailList` (transaction verification)
 * Data sent: transaction code and order number for verification; dealer code, API
   username and password for authentication
 * Purpose: to confirm server-to-server that the payment actually succeeded
 * When: on the payment return (callback)
 * Provider policies (Moka United) — terms of use: https://www.mokaunited.com/legal-
   documents-and-representatives/terms-of-use ; privacy policy: https://www.mokaunited.
   com/legal-documents-and-representatives/privacy-policy

**3. Moka United — dealer information**

 * Service address: `https://service.mokaunited.com` (test environment: `https://
   service.refmokaunited.com`)
 * Endpoint: `POST /Dealer/GetDealer`
 * Data sent: dealer code and API username
 * Purpose: to validate the connection credentials
 * When: when the settings are saved
 * Provider policies (Moka United) — terms of use: https://www.mokaunited.com/legal-
   documents-and-representatives/terms-of-use ; privacy policy: https://www.mokaunited.
   com/legal-documents-and-representatives/privacy-policy

**4. Moka United — card logo CDN**

 * Service address: `https://cdn.moka.com/Content/BankLogo/`
 * Data sent: nothing by the plugin. The customer’s browser requests one PNG image
   per card family shown in the installment table (for example `https://cdn.moka.
   com/Content/BankLogo/AXESS.png`). As with any other image on a web page, that
   request carries the image URL, the visitor’s IP address and the browser’s referrer
   and user agent.
 * Purpose: to display the card family logo (Axess, Bonus, Maximum, …) beside that
   family’s rows in the installment table.
 * When: when a product page, or a page containing the `[moka_taksit_tablosu]` shortcode,
   renders the installment table. The image is fetched by the visitor’s browser,
   never by the store’s server.
 * This is a static asset host. No payment data, no personal data and no credentials
   are sent to it, and the table works without it: a card family whose logo is unavailable
   is shown with its name only.
 * Provider policies (Moka United) — terms of use: https://www.mokaunited.com/legal-
   documents-and-representatives/terms-of-use ; privacy policy: https://www.mokaunited.
   com/legal-documents-and-representatives/privacy-policy

When **Test Mode** is enabled, requests 2 and 3 are sent to the Moka United test
environment (`service.refmokaunited.com`) instead, and request 1 is sent to the 
test WebPos address (`clientwebpos.refmokaunited.com`). The card logo CDN has no
test counterpart; it is a static asset host. No request is made to Moka United at
all while the gateway is disabled.

**No card data is ever sent to any Moka United service by this plugin, and no card
data is ever collected on your site.** Card details travel from the customer’s browser
directly to Moka United’s payment page. The plugin neither collects, nor transmits,
nor stores them (PCI scope SAQ A).

The service provider is **Moka United** (Moka Ödeme Kuruluşu A.Ş.), not Optimist
Hub. The terms of use and privacy policy of that provider are linked under each 
service above. Because this plugin uses Moka United’s payment service, the following
also applies:

 * Moka United terms and conditions of payment services: https://www.mokaunited.
   com/legal-documents-and-representatives/terms-and-conditions-of-payment-services

This plugin contacts no other external service. It does not use its own update server;
updates are delivered through WordPress.org.

Some further domains appear in the plugin’s code but are never contacted. They are
listed here so the list above is exhaustive:

 * `moka.com` — the host allow-list used when validating a logo URL that the Moka
   API returned. It is a validation rule, not a connection; the only logo requests
   actually made are the `cdn.moka.com` images described in 4.
 * `service.moka.com` — the bundled Moka PHP client’s built-in default address. 
   The plugin always sets the PaymentDealer address explicitly (see 2 and 3 above),
   so this default is never used.
 * `service.refmoka.com` — a retired test address. It appears only in a code comment
   recording that it no longer works; nothing calls it.
 * `github.com` — appears only in the file headers that the Strauss build tool writes
   into the bundled library, crediting itself. No request is made.

## Screenshots

[⌊The Moka United payment method in the WooCommerce payment methods list.⌉⌊The Moka
United payment method in the WooCommerce payment methods list.⌉[

The Moka United payment method in the WooCommerce payment methods list.

[⌊The Moka United settings screen.⌉⌊The Moka United settings screen.⌉[

The Moka United settings screen.

[⌊The Moka United option on the checkout page, showing the redirect notice and no
card fields.⌉⌊The Moka United option on the checkout page, showing the redirect 
notice and no card fields.⌉[

The Moka United option on the checkout page, showing the redirect notice and no 
card fields.

[⌊The Moka United hosted payment page where the customer enters their card details.⌉⌊
The Moka United hosted payment page where the customer enters their card details
.⌉[

The Moka United hosted payment page where the customer enters their card details.

[⌊The Moka United status tab, showing the connection test result and the system 
report — which lists the most recent payment attempts.⌉⌊The Moka United status tab,
showing the connection test result and the system report — which lists the most 
recent payment attempts.⌉[

The Moka United status tab, showing the connection test result and the system report—
which lists the most recent payment attempts.

[⌊The installment table on the product page, listing the per-installment and total
amounts for every card family, read live from your Moka United dealer account.⌉⌊
The installment table on the product page, listing the per-installment and total
amounts for every card family, read live from your Moka United dealer account.⌉[

The installment table on the product page, listing the per-installment and total
amounts for every card family, read live from your Moka United dealer account.

## Installation

 1. Install and activate the plugin from your WordPress dashboard.
 2. Go to **WooCommerce  Settings  Payments**.
 3. Find **Moka United**, click **Manage**, enable it and enter the **Dealer Code**,**
    API Username** and **API Password** provided by Moka United.
 4. Leave **Test Mode** on until you have verified the payment flow, then turn it off
    to go live.

## FAQ

### Do I need a Moka United account?

Yes, for live payments. You need a Moka United merchant account and the dealer code,
API username and API password issued to you. Moka United also issues a separate 
test account, which you can use with Test Mode to rehearse the whole flow — placing
an order, paying on the hosted page and receiving the callback — without moving 
real money.

### How do I enable test mode?

Go to **WooCommerce  Settings  Payments  Moka United** and tick **Test Mode**. While
it is on, all requests go to the Moka United test environment. Remember to turn 
it off before going live: sending a test dealer to the live environment returns 
an `InvalidAccount` error.

### How do I enable installments?

Installment options are rendered by Moka United on its own payment page. In the 
plugin settings you control whether installments are offered at all (**Installment
Options** / “Taksit Seçenekleri”), the highest installment count to offer (**Maximum
Installment** / “Maksimum Taksit”), and exactly which installment counts are listed(**
Installment List** / “Taksit Listesi”, for example `1,2,3,6,9,12`). Tick **Reflect
Commission in Installments** / “Komisyonu Taksite Yansıt” if you want Moka United
to apply the card BIN’s commission rates to the displayed installment amounts.

### Are my customers’ card details safe?

They are never seen by your store. The card number, expiry date and CVC code are
entered by the customer directly on Moka United’s page, which is operated by Moka
United, not by this plugin. The plugin does not collect, transmit or store card 
data under any circumstance — not even in debug logs. This keeps your PCI-DSS scope
at SAQ A.

### Can I issue refunds?

Not from this plugin. Refunds are handled in the Moka United merchant panel
 (https://
pos.mokaunited.com). The plugin deliberately does not declare WooCommerce refund
support, so the refund button is hidden on the order screen rather than offering
an action that cannot complete.

### How do I migrate from the old plugin?

The old `moka-woocommerce` plugin distributed through GitHub used the same gateway
ID (`mokapay`), so your existing settings are inherited automatically. Both plugins
also define the same constants, so they cannot run at the same time: if the old 
plugin is still active when you activate this one, it is deactivated for you automatically
and a notice explains what happened. On upgrade, the plugin also purges any card
data that the old version may have recorded in plain text, and removes a table the
old version no longer uses. Take a database backup first.

### Which languages are supported?

The plugin ships in English and includes a Turkish (tr_TR) translation, so a Turkish
WordPress site shows the interface in Turkish and any other locale shows English.
Every string is translatable, so additional languages can be added through [translate.wordpress.org](https://translate.wordpress.org/projects/wp-plugins/optimisthub-moka-united-payment-for-woocommerce/).
If you want to ship your own translation, drop a `.po`/`.mo` pair into the plugin’s`
languages/` folder.

### Which order status is assigned after payment?

You choose it in the plugin settings. The default is **Completed**.

## Reviews

There are no reviews for this plugin.

## Contributors & Developers

“Optimist Hub Payment Gateway with Moka United for WooCommerce” is open source software.
The following people have contributed to this plugin.

Contributors

 *   [ Optimist Hub ](https://profiles.wordpress.org/optimisthub/)
 *   [ Fatih Toprak ](https://profiles.wordpress.org/fatih-toprak/)

“Optimist Hub Payment Gateway with Moka United for WooCommerce” has been translated
into 1 locale. Thank you to [the translators](https://translate.wordpress.org/projects/wp-plugins/optimisthub-moka-united-payment-for-woocommerce/contributors)
for their contributions.

[Translate “Optimist Hub Payment Gateway with Moka United for WooCommerce” into your language.](https://translate.wordpress.org/projects/wp-plugins/optimisthub-moka-united-payment-for-woocommerce)

### Interested in development?

[Browse the code](https://plugins.trac.wordpress.org/browser/optimisthub-moka-united-payment-for-woocommerce/),
check out the [SVN repository](https://plugins.svn.wordpress.org/optimisthub-moka-united-payment-for-woocommerce/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/optimisthub-moka-united-payment-for-woocommerce/)
by [RSS](https://plugins.trac.wordpress.org/log/optimisthub-moka-united-payment-for-woocommerce/?limit=100&mode=stop_on_copy&format=rss).

## Changelog

#### 1.1.12

 * Fixed: a fatal error when the plugin was activated while the old moka-woocommerce
   plugin was still active. Both plugins define the same constants, so the new plugin
   ended up reading the old plugin’s folder and could not load its own classes. 
   The plugin now stops cleanly, shows an explanatory notice, and deactivates moka-
   woocommerce automatically during activation so the migration can finish.

#### 1.1.11

 * Changed: the bundled Turkish translation now matches the wording approved by 
   the Turkish translation team on translate.wordpress.org (for example “Test kipi”
   rather than “Test modu”, and “parola” rather than “şifre”), so the bundled file
   and the official language pack read the same.

#### 1.1.10

 * Changed: strings that translators could not get right were rewritten. Sentences
   are no longer glued together in code (the “WARNING” and “MISSING” report lines),
   and short state words are no longer bare fragments (“Payment method: enabled”
   instead of a separate “enabled”), so word order and context survive translation.
 * Fixed: the translatable template no longer lists the compiled JavaScript bundle
   as a source; only the real source file is referenced.
 * Added: a JSON translation file for the block checkout strings, so the block checkout
   follows the site language too.

#### 1.1.9

 * Fixed: the Turkish translation no longer rewrites the plugin name. Proper nouns
   and brand names are left as they are.

#### 1.1.8

 * Changed: the source strings are English, following the WordPress.org convention.
   The interface was Turkish-only before, which meant an English site also showed
   Turkish.
 * Added: a bundled Turkish (tr_TR) translation, so Turkish sites keep the Turkish
   interface. Every string is now translatable and additional languages can be contributed
   on translate.wordpress.org.

#### 1.1.7

 * Changed: the plugin author is Optimist Hub again, linking to the https://profiles.
   wordpress.org/optimisthub/ profile.

#### 1.1.6

 * Added: a screenshot of the installment table to the plugin page.

#### 1.1.5

 * Fixed: the tag list had six entries; WordPress.org only keeps the first five 
   and silently drops the rest, so one tag was being discarded without any warning.
   The list is now exactly five tags: woocommerce, payment gateway, moka, moka united,
   united payment. The “taksit” tag was removed.

#### 1.1.4

 * Changed: the display name is now “Optimist Hub Payment Gateway with Moka United
   for WooCommerce” (the brand name is written in two words). The slug is unchanged.
 * Added: the “united payment” tag, so the plugin is found by the payment provider’s
   own name as well as by “moka united”.

#### 1.1.3

 * Changed: the plugin author is now Fatih Toprak (https://profiles.wordpress.org/
   fatih-toprak/).
 * Added: screenshots to the plugin page.

#### 1.1.2

 * Fixed: the payment method did not appear at all on the block checkout (“There
   are no payment methods available”). WooCommerce Blocks requires a `canMakePayment`
   property in the registration; without it the registry threw a TypeError and the
   method was never registered. The classic checkout was unaffected, which is why
   this went unnoticed.
 * Fixed: the currency is now sent to Moka. It was never sent, so Moka applied its
   own default (TL) — a store whose currency was not TRY would have had the right
   amount charged in the wrong currency. Moka accepts TL, USD, EUR, GBP, CHF, JPY,
   RUB, CAD, AUD, SAR, KWD, SEK, NOK and DKK; `TRY` is mapped to Moka’s own code`
   TL`.
 * Added: the gateway is no longer offered when the store currency is one Moka does
   not accept, and the settings screen explains why instead of letting the method
   disappear silently.
 * Fixed: the test-mode warning was printed twice on the block checkout.

#### 1.1.1

 * Added: the Moka United card logo CDN (`cdn.moka.com`) to the “External services”
   section, together with what the visitor’s browser sends when it loads a logo.
 * Added: the public Moka United terms of use and privacy policy. The previous readme
   said no public terms page existed; that was wrong. The links are now listed under
   each individual service, as the review asks, and the payment services terms are
   linked as well.
 * Security: the payment callback is now sanitized on the same line its `$_GET`/`
   $_POST` values are read, so no raw request value can reach the callback handler
   or the payload stored as `order_details`. That stored payload is text-sanitized
   as well.
 * Fixed: the product tab escapes its output with `wp_kses()` and an explicit tag
   list instead of echoing it unescaped.
 * Fixed: the bundled Moka client no longer contains an unsanitized `$_SERVER` read.

#### 1.1.0

 * Renamed: the plugin is now “OptimistHub Payment Gateway with Moka United for 
   WooCommerce” and its slug is `optimisthub-moka-united-payment-for-woocommerce`,
   which is the text domain as well.
 * Fixed: a fatal error on PHP 7.4 when a card logo URL had to be checked against
   Moka’s CDN (`str_ends_with()` is PHP 8.0+). The same check now also rejects a
   bare `.moka.com` host.
 * Fixed: the installment table stylesheet is now loaded with `wp_enqueue_style()`
   instead of being printed into the page as an inline `<style>` block; the remaining
   inline `style` attributes moved into that stylesheet.
 * Security: the bundled Moka client now reads every `$_SERVER` value through a 
   sanitising helper and validates the `ClientIP` it falls back to, so a request
   header can no longer carry an unvalidated value into a payment request. `ClientPort`
   is reduced to digits before use.
 * Security: sensitive-field redaction now has a second layer that works on the **
   value**, not only on the field name. Any value that looks like a card number (
   13-19 digits, Luhn-valid, with or without spaces or dashes) is replaced with `[
   purged]` whatever the field happens to be called, so the promise that card data
   never reaches a debug log or a database row no longer depends on knowing every
   field name in advance.
 * Added: the `Requires Plugins: woocommerce` header, so WordPress verifies WooCommerce
   is present before activation.
 * Changed: the bundled Moka client no longer uses cURL. Every request goes through
   the WordPress HTTP API (`wp_remote_request()`), which is the transport the plugin
   already injected at runtime.
 * Changed: Plugin URI now points at https://optimisthub.com/ (the previous URL 
   returned 404).

#### 1.0.1

 * Security: server-to-server verification now requires both `PaymentStatus = 2`
   and `TrxStatus = 1`. Previously only `TrxStatus` was checked, so cancelled (3,1)
   and pre-authorised (1,1) transactions were treated as paid even though no money
   was captured.
 * Security: the API response gate is now fail-closed. A top-level `ResultCode` 
   error is no longer accepted merely because `Data.IsSuccessful` is `true` — that
   flag means “the request was processed”, not “the payment succeeded”.

#### 1.0.0

 * Initial release.
 * Redirect payment through the Moka United Hosted Payment Page (WebPos).
 * No card data collected, transmitted or stored — PCI scope SAQ A.
 * 3D Secure flow, installment display and commission handling managed on Moka United’s
   page.
 * Server-to-server transaction verification with signature and amount checks.
 * Classic and block-based checkout support.
 * HPOS compatibility.
 * Test mode.
 * Transaction log screen.
 * Automatic inheritance of settings from the previous `moka-woocommerce` plugin(
   gateway ID `mokapay`).

## Meta

 *  Version **1.1.12**
 *  Last updated **2 hours ago**
 *  Active installations **Fewer than 10**
 *  WordPress version ** 6.4 or higher **
 *  Tested up to **7.1.3**
 *  PHP version ** 7.4 or higher **
 *  Languages
 * [English (US)](https://wordpress.org/plugins/optimisthub-moka-united-payment-for-woocommerce/)
   and [Turkish](https://tr.wordpress.org/plugins/optimisthub-moka-united-payment-for-woocommerce/).
 *  [Translate into your language](https://translate.wordpress.org/projects/wp-plugins/optimisthub-moka-united-payment-for-woocommerce)
 * Tags
 * [payment gateway](https://wordpress.org/plugins/tags/payment-gateway/)[united payment](https://wordpress.org/plugins/tags/united-payment/)
   [woocommerce](https://wordpress.org/plugins/tags/woocommerce/)
 *  [Advanced View](https://wordpress.org/plugins/optimisthub-moka-united-payment-for-woocommerce/advanced/)

## Ratings

No reviews have been submitted yet.

[Your review](https://wordpress.org/support/plugin/optimisthub-moka-united-payment-for-woocommerce/reviews/#new-post)

[See all reviews](https://wordpress.org/support/plugin/optimisthub-moka-united-payment-for-woocommerce/reviews/)

## Contributors

 *   [ Optimist Hub ](https://profiles.wordpress.org/optimisthub/)
 *   [ Fatih Toprak ](https://profiles.wordpress.org/fatih-toprak/)

## Support

Got something to say? Need help?

 [View support forum](https://wordpress.org/support/plugin/optimisthub-moka-united-payment-for-woocommerce/)