Poth Checkout for WooCommerce

Description

Poth (pronounced POTH, Bengali for “path”) is the checkout funnel builder your WooCommerce store deserves. Multi-step checkout, order bumps, one-click post-purchase upsells, and a custom thank-you page — self-hosted, block-native, at half the price of CartFlows.

Why Poth?

WooCommerce checkout conversion averages 45–55%. Shopify’s averages 75%. The gap isn’t the platform — it’s the checkout experience. CartFlows dominates the WooCommerce funnel-builder market at $299/year and locks you into their template ecosystem. Poth ships the same core features for $99/year, is built block-first (works with WooCommerce Cart/Checkout Blocks natively), and integrates deeply with the rest of the Nishchoy family.

By the makers of Nishchoy Reviews, Uttor AEO, and Chala Subscriptions.

Features (free)

• Multi-step checkout — split default one-page checkout into 2 or 3 pages (Contact → Shipping → Payment)
• Visual field editor — add, remove, and reorder checkout fields
• Order bump — offer a related product above the payment button (“Add this too?”)
• Custom thank-you page — replace default order-received with a Gutenberg-built page
• 5 pre-built templates — Minimal, Split, Sidebar, Wide, Classic
• Distraction-free checkout mode — hide header, footer, sidebar
• Trust badges section — upload up to 5 badges
• Basic conversion analytics — checkout starts, completions, bump take rate
• Blocks + shortcodes — works with classic and block themes
• HPOS-native
• REST API — headless-friendly
• WP-CLI — wp poth funnel list, wp poth stats
• Import from CartFlows Free — one-click migration
• Own your data — everything in your WordPress database

Pro version

Poth Pro adds full sales funnel builder (landing → checkout → upsell → downsell → thank-you), one-click post-purchase upsells, multiple order bumps with A/B testing, cart abandonment recovery via your own SMTP, 20+ premium templates, exit-intent popups, countdown timers, advanced field logic, and full funnel analytics with drop-off visualization.

Better with Chala Subscriptions

Poth’s one-click post-purchase upsells work with any payment gateway when Chala Subscriptions is installed — Stripe, PayPal, Razorpay, Mollie, Paystack, Square. Without Chala, upsells work only with Stripe and PayPal (via WooCommerce’s native saved-card flows).

You can also offer subscription upsells at checkout: convert a one-time buyer into a subscriber with one click.

Better with Nishchoy Reviews

Show top product reviews on the checkout page for social proof. Show review count and average rating on order bump offers.

Better with Uttor AEO

Correct Order, Offer, and CheckoutPage schema output for AI search visibility.

Nishchoy family bundle

Get all four plugins — Reviews + Uttor + Chala + Poth — for $329/year (vs $476 separately). Available at bytloop.com.

Developer-friendly

Every checkout event fires an action. Every computed value has a filter. Full REST API. Overridable templates. See the developer docs.

External services

Poth Checkout does not contact any external service for its free features.
Multi-step checkout, order bumps, the thank-you page and the analytics reports
all run entirely on your own server. There is no telemetry, no usage tracking,
no phone-home, no external CDN asset and no remotely loaded font.

One optional feature does contact an external service: the post-purchase
upsell. If a merchant configures an upsell and a customer accepts the offer,
the plugin has to charge the payment method that customer used moments earlier.
It does that by calling the payment provider the store is already using, with
the API credentials the merchant already entered into that provider’s own
WooCommerce gateway plugin.

If no upsell is configured, or no customer accepts one, no request is ever made.

Stripe

What it is: Stripe is a payment provider. It is contacted only to charge a
customer who has just accepted a post-purchase upsell, by creating one
off-session PaymentIntent against the payment method already stored against
that customer by the official Stripe gateway plugin.

When data is sent: once per accepted upsell offer, at the moment the customer
accepts it. Never on any other page load, and never in the admin.

What is sent: the amount, the currency, the Stripe customer and payment-method
identifiers that Stripe itself issued and the Stripe gateway plugin already
stored, a short order description, and an idempotency key. No card details pass
through this plugin — it never renders a card field and never receives one.

Endpoint: https://api.stripe.com
Terms of service: https://stripe.com/legal
Privacy policy: https://stripe.com/privacy

PayPal

What it is: PayPal is a payment provider. It is contacted only to charge a
customer who has just accepted a post-purchase upsell, by obtaining an OAuth
token and then creating one order against the payment method that customer
already vaulted with PayPal through the official PayPal gateway plugin.

When data is sent: once per accepted upsell offer, at the moment the customer
accepts it. Never on any other page load, and never in the admin.

What is sent: the amount, the currency, the PayPal vault identifier PayPal
itself issued, a short order description, and a request id used for
idempotency. No card details pass through this plugin.

Endpoint: https://api-m.paypal.com, or https://api-m.sandbox.paypal.com when
the PayPal gateway is in sandbox mode.
Terms of service (PayPal Legal Agreements, including the User Agreement):
https://www.paypal.com/legalhub/home
Privacy policy: https://www.paypal.com/legalhub/privacy-full

If Chala Subscriptions is installed

When the Chala Subscriptions plugin is active, Poth hands the charge to Chala’s
gateway layer instead of calling a provider itself, and makes no external
request of its own at all. Whether Chala then contacts a provider, and which
one, is governed by Chala and disclosed in that plugin’s own readme.

Why the credentials are read from another plugin

The Stripe and PayPal credentials are read from the “woocommerce_stripe_settings”
and “woocommerce-ppcp-settings” options that those official gateway plugins
already store, rather than asking the merchant to paste a second copy of a live
secret key into another plugin. They can be overridden with the filters
poth_stripe_secret_key, poth_paypal_client_id and poth_paypal_client_secret for
stores that keep credentials in environment variables.

Source code and build process

Every compiled file in this plugin is built from source that ships inside the
plugin itself, in the assets-src/ directory. Nothing is minified without its
source being included, and no code is obfuscated.

• build/checkout-steps.js is built from assets-src/checkout/checkout-steps.js
• build/checkout-steps-blocks.js is built from assets-src/blocks/checkout-steps-blocks.js
• build/order-bump.js is built from assets-src/blocks/order-bump.js
• build/order-bump-checkout.js is built from assets-src/blocks/order-bump-checkout.js
• build/trust-badges.js is built from assets-src/blocks/trust-badges.js
• build/thank-you-summary.js is built from assets-src/blocks/thank-you-summary.js
• build/upsell.js is built from assets-src/upsell/upsell.js
• build/funnel-builder.js is built from assets-src/admin/funnel-builder.js

How to rebuild them

package.json and webpack.config.js ship in the plugin as well, so build/ can be
regenerated from the plugin directory alone, with no other download:

npm install
npm run build

The build tool is @wordpress/scripts (webpack), the standard WordPress build
toolchain. The exact versions are pinned in package.json.

Bundled third-party library

One third-party library is compiled into a build file:

• preact, version 10 (MIT licence) – https://github.com/preactjs/preact

It is bundled into build/funnel-builder.js only, which is the admin funnel
builder screen, and is used in place of React to keep that admin bundle small.
It is not used anywhere on the front end.

Every other dependency resolves at runtime to the wp.* and wc.* globals that
WordPress and WooCommerce already enqueue. Those are declared in the generated
build/*.asset.php dependency files rather than bundled, so no other third-party
code is included in this plugin.

There is no vendored PHP library, no bundled font, and no minified PHP. The two
payment integrations above are plain wp_remote_post() calls to documented
endpoints.

Privacy

Poth stores its analytics in your own database, in four tables prefixed
{$wpdb->prefix}poth_. Nothing is sent anywhere.

Visitors are recognised across the steps of one checkout with a single
first-party cookie, poth_sid, holding a random 32-character token. Only a
salted SHA-256 hash of that token is ever written to the database, so the
stored analytics contain no personal data; a customer is linked to a row only
by order id, and only once the order exists. The cookie is HttpOnly,
SameSite=Lax, Secure over HTTPS, and expires after two days. No third-party
cookie is set and no cross-site identifier is used.

Nothing is deleted when the plugin is uninstalled unless the merchant
explicitly enables “Delete everything when the plugin is deleted” in the
settings, which is off by default.