Aligns with Redirection Manual v3.1: Google Pay is accepted automatically (no configuration) on eligible devices and recorded on the order via the new PanCardType field. Also hardens failure-callback authentication (HashKey verified when the bank signs the response) and records recharge attempts on already-paid orders with a clear customer message. No payment-flow, database, or configuration change.<\/p>","1.0.33":"
Security release. Fixes a payment-bypass flaw where the transaction ticket (the HMAC key that authenticates the bank callback) was exposed in the browser redirect form, letting a shopper forge a paid-order callback. Update immediately; no configuration changes required.<\/p>","1.0.32":"
Docs-only release: adds a security-contact FAQ entry pointing to the Patchstack Vulnerability Disclosure Program. No code, database, or payment-flow change.<\/p>","1.0.31":"
Docs-only release. Readme Description trimmed to fit the wp.org 2,500-word limit (the 1.0.30 plugin page was truncated). No code or behaviour change \u2014 the in-admin WAF diagnostic, IRIS support, installments picker and tiered installments from 1.0.30 are all preserved.<\/p>","1.0.30":"
Adds IRIS payments support (auto-detected when Euronet enables IRIS on your account) and a customer-selectable installments dropdown on classic WC checkout with tiered max-installments by order amount. Existing installments config preserved. Blocks checkout customers default to one-time payment.<\/p>","1.0.28":"
Compatibility with WordPress 7.0 (Modern admin theme, iframed editor, PHP 7.4 minimum). No payment-flow, database, or callback-handler change.<\/p>","1.0.27":"
Settings screen reorganized: merchant credentials now sit above bank integration data, the bank-data card is collapsed by default, and the five callback URLs share one grey "Copy" block. No payment-flow, database, or callback-handler change.<\/p>","1.0.20":"
Text domain corrected to match plugin slug. Cloudflare IP fetch documented in External services. echo wrapped with wp_kses_post(). No payment-flow or database change.<\/p>","1.0.19":"
Plugin renamed to "WebHosting4U Secure Card Gateway for ePay Paycenter (Piraeus Bank)" with slug wh4u-* per Plugin Review Team feedback. External services fully documented with terms \/ privacy links. Deprecated libxml_disable_entity_loader() removed. No payment-flow change.<\/p>","1.0.18":"
Checkout icon changed from piraeus.svg to a responsive wp-cards.png image (400 px desktop, scales on mobile). Block checkout now shows card brands. Front-end CSS enqueued on checkout. Drop-in upgrade.<\/p>","1.0.17":"
Greek translation backfilled with all strings from 1.0.10-1.0.16: scenario labels, decline notices, admin notes, WAF self-test UI. POT regenerated. No PHP\/database\/payment-flow change.<\/p>","1.0.16":"
Fixes decline notice not appearing after bank redirect. Hook priority collision with WooCommerce core resolved (priority 5 vs core 10). Works on every theme. No database or payment-flow change.<\/p>","1.0.15":"
Aligns with Redirection Manual v2.9 section 5 scenario table. Fixes misleading ResultCode 1048 message, widens 50x matching to 500-599, adds AdminTool hint on 1045. Drop-in upgrade.<\/p>","1.0.14":"
Fixes decline message not appearing after bank redirect due to SameSite=Lax stripping the session cookie. Notices now queued as order-scoped transients. No database or payment-flow change.<\/p>","1.0.13":"
Fixes "-1" body when Success\/Failure URL is doubled in the Euronet portal. Malformed wc-api values normalised at parse_request. Please also correct the URL in the portal.<\/p>","1.0.12":"
Declined-transaction handling per Redirection Manual v2.9 section 5. Issuer decline shown to customer, failures redirect to pay-for-order URL. Fixes "-1" body via plugins_loaded binding.<\/p>","1.0.11":"
Adds "Test callback URL" button on the settings screen. Detects host WAF interception (cPFence, ModSec, Imunify360, BitNinja, LiteSpeed). No database or payment-flow change.<\/p>","1.0.10":"
Adds a "Callback envelope" forensic log line at every callback reach so\nhost-WAF-blocked transactions can be distinguished from plugin-rejected\nones, and refines the customer-facing wording per Paycenter ResultCode\nand ResponseCode. Safe drop-in upgrade, no database change.<\/p>","1.0.9":"
Greek translation rewritten in plain, merchant-friendly Greek. Banking\njargon replaced with everyday terms; field labels shortened so the\nWooCommerce settings layout is not stretched. Safe drop-in upgrade.<\/p>","1.0.8":"
Plugin Check compliance: adds the standard Plugin Review compliance: the bank redirect auto-submit helper is now\nloaded via wp_enqueue_script() from a standalone asset file instead of\nan inline `` block in the receipt template. Safe drop-in\nupgrade, no database or payment-flow change.<\/p>","1.0.6":" Adds a complete Greek (el) translation, regenerates the POT catalog from\nthe live source, and ships WP 6.5+ performant-translations Plugin Check compliance: sanitizes $_SERVER input on the settings\nscreen, switches statistics queries to $wpdb->prepare() with the %i\nidentifier placeholder, and trims the 1.0.2 upgrade notice under the\n300-char limit. No functional change.<\/p>","1.0.4":" Adds Cloudflare auto-detection and a help notice on the gateway\nsettings page instructing store owners to email Euronet Merchant\nServices to whitelist Cloudflare's IPv4 ranges. Safe drop-in upgrade.<\/p>","1.0.3":" Stops the WC-API callback endpoint from spamming the WooCommerce error\nlog with "Callback missing MerchantReference" entries when hit by bots,\nscanners or direct browser visits. No functional or security change.<\/p>","1.0.2":" Redesigned settings screen with status overview and an auto-generated\nBank integration data block listing the exact Website, Referrer,\nSuccess, Failure and Backlink URLs, server IP and response method\nasked for by Euronet Merchant Services. Safe drop-in upgrade.<\/p>","1.0.1":" Compliance, security and packaging fixes. Recommended for all users;\nno database migration required.<\/p>","1.0.0":" Initial release.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3539821,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3539821,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3539821,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3539821,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.27","1.0.28","1.0.30","1.0.31","1.0.32","1.0.33","1.0.34"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3539821,"resolution":"1","location":"assets","locale":"","width":1883,"height":773},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3539821,"resolution":"2","location":"assets","locale":"","width":1888,"height":810}},"screenshots":{"1":"ePay Paycenter gateway entry in WooCommerce \u2192 Settings \u2192 Payments<\/strong> with editable title and description shown to the customer. \/ \u039a\u03b1\u03c4\u03b1\u03c7\u03ce\u03c1\u03b7\u03c3\u03b7 \u03c0\u03cd\u03bb\u03b7\u03c2 ePay Paycenter \u03c3\u03c4\u03bf WooCommerce \u2192 \u03a1\u03c5\u03b8\u03bc\u03af\u03c3\u03b5\u03b9\u03c2 \u2192 \u03a0\u03bb\u03b7\u03c1\u03c9\u03bc\u03ad\u03c2<\/strong> \u03bc\u03b5 \u03b5\u03c0\u03b5\u03be\u03b5\u03c1\u03b3\u03ac\u03c3\u03b9\u03bc\u03bf \u03c4\u03af\u03c4\u03bb\u03bf \u03ba\u03b1\u03b9 \u03c0\u03b5\u03c1\u03b9\u03b3\u03c1\u03b1\u03c6\u03ae.","2":"Gateway settings page: Merchant credentials<\/strong> (AcquirerId, MerchantId, PosId, Username, Password) above Bank integration data<\/strong> with the Success \/ Failure \/ Backlink URLs grouped into a single grey block with a one-click Copy button. \/ \u03a3\u03b5\u03bb\u03af\u03b4\u03b1 \u03c1\u03c5\u03b8\u03bc\u03af\u03c3\u03b5\u03c9\u03bd \u03c0\u03cd\u03bb\u03b7\u03c2: \u03a3\u03c4\u03bf\u03b9\u03c7\u03b5\u03af\u03b1 \u03c0\u03c1\u03cc\u03c3\u03b2\u03b1\u03c3\u03b7\u03c2 \u03b5\u03bc\u03c0\u03cc\u03c1\u03bf\u03c5<\/strong> \u03c0\u03ac\u03bd\u03c9 \u03b1\u03c0\u03cc \u03c4\u03b1 \u03a3\u03c4\u03bf\u03b9\u03c7\u03b5\u03af\u03b1 \u03c3\u03cd\u03bd\u03b4\u03b5\u03c3\u03b7\u03c2 \u03bc\u03b5 \u03c4\u03b7\u03bd \u03c4\u03c1\u03ac\u03c0\u03b5\u03b6\u03b1<\/strong>, \u03bc\u03b5 \u03c4\u03b1 Success \/ Failure \/ Backlink URLs \u03c3\u03b5 \u03b5\u03bd\u03b9\u03b1\u03af\u03bf \u03b3\u03ba\u03c1\u03b9 \u03c0\u03b5\u03b4\u03af\u03bf \u03ba\u03b1\u03b9 \u03ba\u03bf\u03c5\u03bc\u03c0\u03af \u03b1\u03bd\u03c4\u03b9\u03b3\u03c1\u03b1\u03c6\u03ae\u03c2 \u03bc\u03b5 \u03ad\u03bd\u03b1 \u03ba\u03bb\u03b9\u03ba."}},"plugin_section":[],"plugin_tags":[11475,207503,6593,263735,286],"plugin_category":[45],"plugin_contributors":[260181],"plugin_business_model":[],"class_list":["post-304109","plugin","type-plugin","status-publish","hentry","plugin_tags-credit-card","plugin_tags-greece","plugin_tags-payment-gateway","plugin_tags-piraeus-bank","plugin_tags-woocommerce","plugin_category-ecommerce","plugin_contributors-webhosting4ugr","plugin_committers-webhosting4ugr"],"banners":{"banner":"https:\/\/ps.w.org\/secure-card-gateway-for-epay-paycenter-piraeus-bank\/assets\/banner-772x250.png?rev=3539821","banner_2x":"https:\/\/ps.w.org\/secure-card-gateway-for-epay-paycenter-piraeus-bank\/assets\/banner-1544x500.png?rev=3539821","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/secure-card-gateway-for-epay-paycenter-piraeus-bank\/assets\/icon-128x128.png?rev=3539821","icon_2x":"https:\/\/ps.w.org\/secure-card-gateway-for-epay-paycenter-piraeus-bank\/assets\/icon-256x256.png?rev=3539821","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/secure-card-gateway-for-epay-paycenter-piraeus-bank\/assets\/screenshot-1.png?rev=3539821","caption":"ePay Paycenter gateway entry in WooCommerce \u2192 Settings \u2192 Payments<\/strong> with editable title and description shown to the customer. \/ \u039a\u03b1\u03c4\u03b1\u03c7\u03ce\u03c1\u03b7\u03c3\u03b7 \u03c0\u03cd\u03bb\u03b7\u03c2 ePay Paycenter \u03c3\u03c4\u03bf WooCommerce \u2192 \u03a1\u03c5\u03b8\u03bc\u03af\u03c3\u03b5\u03b9\u03c2 \u2192 \u03a0\u03bb\u03b7\u03c1\u03c9\u03bc\u03ad\u03c2<\/strong> \u03bc\u03b5 \u03b5\u03c0\u03b5\u03be\u03b5\u03c1\u03b3\u03ac\u03c3\u03b9\u03bc\u03bf \u03c4\u03af\u03c4\u03bb\u03bf \u03ba\u03b1\u03b9 \u03c0\u03b5\u03c1\u03b9\u03b3\u03c1\u03b1\u03c6\u03ae."},{"src":"https:\/\/ps.w.org\/secure-card-gateway-for-epay-paycenter-piraeus-bank\/assets\/screenshot-2.png?rev=3539821","caption":"Gateway settings page: Merchant credentials<\/strong> (AcquirerId, MerchantId, PosId, Username, Password) above Bank integration data<\/strong> with the Success \/ Failure \/ Backlink URLs grouped into a single grey block with a one-click Copy button. \/ \u03a3\u03b5\u03bb\u03af\u03b4\u03b1 \u03c1\u03c5\u03b8\u03bc\u03af\u03c3\u03b5\u03c9\u03bd \u03c0\u03cd\u03bb\u03b7\u03c2: \u03a3\u03c4\u03bf\u03b9\u03c7\u03b5\u03af\u03b1 \u03c0\u03c1\u03cc\u03c3\u03b2\u03b1\u03c3\u03b7\u03c2 \u03b5\u03bc\u03c0\u03cc\u03c1\u03bf\u03c5<\/strong> \u03c0\u03ac\u03bd\u03c9 \u03b1\u03c0\u03cc \u03c4\u03b1 \u03a3\u03c4\u03bf\u03b9\u03c7\u03b5\u03af\u03b1 \u03c3\u03cd\u03bd\u03b4\u03b5\u03c3\u03b7\u03c2 \u03bc\u03b5 \u03c4\u03b7\u03bd \u03c4\u03c1\u03ac\u03c0\u03b5\u03b6\u03b1<\/strong>, \u03bc\u03b5 \u03c4\u03b1 Success \/ Failure \/ Backlink URLs \u03c3\u03b5 \u03b5\u03bd\u03b9\u03b1\u03af\u03bf \u03b3\u03ba\u03c1\u03b9 \u03c0\u03b5\u03b4\u03af\u03bf \u03ba\u03b1\u03b9 \u03ba\u03bf\u03c5\u03bc\u03c0\u03af \u03b1\u03bd\u03c4\u03b9\u03b3\u03c1\u03b1\u03c6\u03ae\u03c2 \u03bc\u03b5 \u03ad\u03bd\u03b1 \u03ba\u03bb\u03b9\u03ba."}],"raw_content":"\n HPOS-native from day one.<\/strong> Built against WooCommerce's High-Performance Order Storage from the very first release. All order metadata uses the HPOS-aware Cloudflare-aware.<\/strong> Automatically detects when your store is served through Cloudflare (via the Built-in WAF \/ callback self-test.<\/strong> A diagnostic button in the gateway settings sends a realistic, declined-transaction<\/em>-shaped POST to your own callback URL via loopback and reports whether your host's web-application firewall (cPFence, ModSecurity \/ OWASP CRS, Imunify360, BitNinja, LiteSpeed WAF) silently blocks it before PHP runs. No real order is created or modified \u2014 the synthetic payload carries a Modern admin UI.<\/strong> Card-based layout, dashicons throughout, one-click Copy-to-clipboard for all callback URLs grouped in a single block, environment badge (Test \/ Live \/ Production) on the credentials section, collapsible Cloudflare details. Audited against WordPress 7.0's \"Modern\" admin theme.<\/p><\/li>\n Audited for WordPress 7.0 on release day.<\/strong> Reviewed against the full WordPress 7.0 Field Guide breaking-changes list on 2026-05-20. \"Tested up to: 7.0\" from the very first stable release. The plugin requires PHP 7.4 (the new WordPress 7.0 minimum) and uses no APIs deprecated in 7.0.<\/p><\/li>\n Fully bilingual (EN + EL).<\/strong> All 179 admin and customer-facing strings translated to Greek and shipped as both classic \u0395\u03bb\u03bb\u03b7\u03bd\u03b9\u03ba\u03ac:<\/strong><\/p>\n\n \u0391\u03bd\u03b5\u03be\u03ac\u03c1\u03c4\u03b7\u03c4\u03bf \u03c0\u03c1\u03cc\u03c3\u03b8\u03b5\u03c4\u03bf \u03c0\u03cd\u03bb\u03b7\u03c2 \u03c0\u03bb\u03b7\u03c1\u03c9\u03bc\u03ae\u03c2 WooCommerce \u03b1\u03c0\u03cc \u03c4\u03b7 WebHosting4U \u03b3\u03b9\u03b1\n\u03c4\u03b7\u03bd \u03c5\u03c0\u03b7\u03c1\u03b5\u03c3\u03af\u03b1 ePay Paycenter Redirection<\/em> \u03c4\u03b7\u03c2 \u03a4\u03c1\u03ac\u03c0\u03b5\u03b6\u03b1\u03c2 \u03a0\u03b5\u03b9\u03c1\u03b1\u03b9\u03ce\u03c2 \/\nEuronet Merchant Services. \u03a5\u03bb\u03bf\u03c0\u03bf\u03b9\u03b5\u03af \u03c0\u03bb\u03ae\u03c1\u03c9\u03c2 \u03c4\u03b7\u03bd \u03b5\u03c0\u03af\u03c3\u03b7\u03bc\u03b7 \u03c0\u03c1\u03bf\u03b4\u03b9\u03b1\u03b3\u03c1\u03b1\u03c6\u03ae\nRedirection v3.1<\/em>:<\/p>\n\n \u03a0\u03c1\u03bf\u03cb\u03c0\u03cc\u03b8\u03b5\u03c3\u03b7:<\/strong> \u03c0\u03c1\u03ad\u03c0\u03b5\u03b9 \u03bd\u03b1 \u03ad\u03c7\u03b5\u03c4\u03b5 \u03c5\u03c0\u03bf\u03b3\u03b5\u03b3\u03c1\u03b1\u03bc\u03bc\u03ad\u03bd\u03bf \u03c3\u03c5\u03bc\u03b2\u03cc\u03bb\u03b1\u03b9\u03bf \u03b1\u03c0\u03bf\u03b4\u03bf\u03c7\u03ae\u03c2 \u03bc\u03b5 \u03c4\u03b7\u03bd\nEuronet Merchant Services \/ \u03a4\u03c1\u03ac\u03c0\u03b5\u03b6\u03b1 \u03a0\u03b5\u03b9\u03c1\u03b1\u03b9\u03ce\u03c2 \u03ba\u03b1\u03b9 \u03bd\u03b1 \u03b4\u03b9\u03b1\u03b8\u03ad\u03c4\u03b5\u03c4\u03b5 \u03c4\u03b1\n\u03b4\u03b9\u03b1\u03c0\u03b9\u03c3\u03c4\u03b5\u03c5\u03c4\u03ae\u03c1\u03b9\u03b1 \u0397 \u03c0\u03bb\u03ae\u03c1\u03b7\u03c2 \u03b5\u03bb\u03bb\u03b7\u03bd\u03b9\u03ba\u03ae \u03bc\u03b5\u03c4\u03ac\u03c6\u03c1\u03b1\u03c3\u03b7 \u03c4\u03b7\u03c2 \u03c3\u03b5\u03bb\u03af\u03b4\u03b1\u03c2 \u03c4\u03bf\u03c5 \u03c0\u03c1\u03bf\u03c3\u03b8\u03ad\u03c4\u03bf\u03c5 \u03c3\u03c4\u03bf WordPress.org\n\u03b8\u03b1 \u03b5\u03af\u03bd\u03b1\u03b9 \u03b4\u03b9\u03b1\u03b8\u03ad\u03c3\u03b9\u03bc\u03b7 \u03bc\u03ad\u03c3\u03c9 \u03c4\u03bf\u03c5 translate.wordpress.org<\/a>\n\u03bc\u03cc\u03bb\u03b9\u03c2 \u03b5\u03b3\u03ba\u03c1\u03b9\u03b8\u03b5\u03af \u03b1\u03c0\u03cc \u03c4\u03b7\u03bd \u03ba\u03bf\u03b9\u03bd\u03cc\u03c4\u03b7\u03c4\u03b1. \u0394\u03b5\u03af\u03c4\u03b5 \u03b5\u03c0\u03af\u03c3\u03b7\u03c2 \u03c4\u03bf \u03c3\u03c5\u03bd\u03bf\u03b4\u03b5\u03c5\u03c4\u03b9\u03ba\u03cc\n readme-el.txt \u03b3\u03b9\u03b1 \u03c4\u03b7\u03bd \u03bf\u03bb\u03bf\u03ba\u03bb\u03b7\u03c1\u03c9\u03bc\u03ad\u03bd\u03b7 \u03b5\u03bb\u03bb\u03b7\u03bd\u03b9\u03ba\u03ae \u03c4\u03b5\u03ba\u03bc\u03b7\u03c1\u03af\u03c9\u03c3\u03b7.<\/p>\n\n\n\n English:<\/strong><\/p>\n\n This plugin integrates WooCommerce with the ePay Paycenter Redirection\nservice operated by Piraeus Bank \/ Euronet Merchant Services. It implements\nthe official Redirection v3.1 specification end to end:<\/p>\n\n You must have signed an acquiring contract with Euronet Merchant\nServices \/ Piraeus Bank and obtained This plugin is independent software published by WebHosting4U<\/strong> and is\nnot affiliated with, endorsed by, sponsored by, or otherwise officially\nconnected to<\/strong> Piraeus Bank S.A., Euronet Merchant Services, or\nAutomattic Inc. The third-party names \"ePay\", \"Paycenter\", \"Piraeus Bank\"\nand \"WooCommerce\" are trademarks of their respective owners and are\nused here in good faith, after the unaffiliation marker \"for\", solely\nto describe the third-party service this plugin integrates with, in\nline with the WordPress.org Detailed Plugin Guidelines on third-party\ntrademarks. The bundled accepted card brands image\n( This plugin does not<\/strong> load any analytics, telemetry, advertising,\nfingerprinting, profiling or behavioural tracking code, neither on the\nstorefront nor in the WordPress admin. It does not set cookies on\nvisitor browsers, does not contact any first-party or third-party\nanalytics endpoint, and does not collect aggregated or individual\nusage statistics from the merchant's installation. The only outbound\nnetwork traffic the plugin generates is the strictly transactional\ntraffic documented in the External services<\/em> section below, which\nis required to complete a payment the merchant has explicitly\nconfigured the plugin to perform. No user-tracking consent prompt is\ntherefore required by this plugin (Plugin Review Team Guidelines 7\nand 9).<\/p>\n\n This plugin reaches out to three external services. Two are operated\nby Euronet Merchant Services on behalf of Piraeus Bank S.A. for the\n\"ePay Paycenter\" payment redirection product (mandatory for the\nplugin's core function). The third is a publicly available Cloudflare\nendpoint used only in the admin panel to help store owners configure\nfirewall rules for payment callbacks.<\/p>\n\n Both endpoints above are operated by Euronet Merchant Services\n(epay) for Piraeus Bank S.A.. Before activating the gateway,\nmerchants must review and agree to the operator's terms and\nprivacy policy:<\/p>\n\n If any of the above URLs change after publication, please consult\nthe live operator websites for the current version of the relevant\ndocument. The plugin's behaviour is not affected by such updates\nbecause the operator's terms apply to the merchant's relationship\nwith Euronet Merchant Services \/ Piraeus Bank, not to the plugin\nitself. Merchants remain responsible for keeping their own\nprivacy policy and terms aligned with the data flows documented\nabove (notably the transmission of billing \/ shipping address\nfields and customer email \/ phone to the bank for 3-D Secure\nauthentication).<\/p>\n\n No data is sent to any third party other than the three endpoints\nlisted above.<\/p>\n\n\n Visa, Mastercard, Maestro, and (subject to agreement with Euronet\nMerchant Services) Diners \/ Discover and American Express.<\/p><\/dd>\n Yes. When IRIS is enabled on your merchant agreement by Euronet Merchant\nServices, customers can choose between card and IRIS directly on the\nbank's hosted payment page \u2014 the plugin does not need a separate setting\nto \"turn IRIS on\" because the choice is made server-side at the bank,\nnot in your checkout. The plugin recognises IRIS responses (CardType=15\nor PaymentMethod=IRIS in the bank's HMAC-verified callback), shows\nIRIS-tailored messages for the IRIS-only decline scenarios (user\ncancelled in their banking app, 5-minute QR timeout, IRIS service error,\netc.) and records the payment channel on the order so card and IRIS\ntransactions are distinguishable in your reports.<\/p>\n\n Per Piraeus Bank policy, IRIS payments do not support installments<\/strong>\n(the full amount is charged) and refunds are not supported for IRIS\ntransactions<\/strong> (ResponseCode 9167). These restrictions are enforced by\nthe bank, not by the plugin.<\/p><\/dd>\n No. Cardholder data is entered exclusively on the Paycenter secure\npayment page and never transits your server. The plugin stores only\nnon-sensitive metadata such as approval code, response code and\n SupportReferenceID for reconciliation.<\/p><\/dd>\n The order is set to On hold<\/em> and a notice is logged. Verification is\nmandatory before an order is marked paid; a mismatching HashKey is\ntreated as a potentially forged callback.<\/p><\/dd>\n The plugin transmits only the minimum data required for the transaction\n(order total, currency, merchant reference, and 3-D Secure auxiliary\nfields such as billing email and address). No analytics or telemetry is\ncollected.<\/p><\/dd>\n Shared-hosting firewalls sometimes flag Paycenter's decline-callback\npayload because it contains patterns (dash-only The plugin's settings page includes a Test callback URL<\/strong> diagnostic\nthat POSTs a realistic declined-transaction payload to your own callback\nURL via loopback and reports whether a host WAF intercepts it. Run it\nonce before going live. If a WAF is intercepting, ask your hosting\nprovider to whitelist the URL The literal defined( 'ABSPATH' ) || exit;<\/code>\nguard at the top of the performant-translations .l10n.php<\/code> file. No\nruntime or database change, safe drop-in upgrade.<\/p>","1.0.7":".l10n.php<\/code>\nfiles next to every .mo<\/code>. Safe drop-in upgrade, no database change.<\/p>","1.0.5":"What sets this plugin apart<\/h4>\n\n
\n
$order->update_meta_data()<\/code> \/ get_meta()<\/code> API \u2014 never the legacy update_post_meta()<\/code> \/ get_post_meta()<\/code> calls that silently fail on HPOS-enabled stores (the WooCommerce default for new installs since 8.x). Your transaction IDs, support reference IDs, and approval codes are preserved whichever storage mode you run.<\/p><\/li>\nCF-Ray<\/code> \/ CF-Connecting-IP<\/code> request headers) and surfaces the current Cloudflare IPv4 CIDR ranges right in the gateway settings page, ready to copy. You hand them to Euronet Merchant Services so the bank's callbacks are not blocked at their firewall when they arrive via Cloudflare edge IPs. Live list fetched from cloudflare.com\/ips-v4 and cached for 12 hours.<\/p><\/li>\nWAFTEST-<\/code> merchant reference that cannot match any order in the database. Catches the class of \"callbacks never arrive\"<\/em> problems before they cost you a sale.<\/p><\/li>\n.mo<\/code> and WordPress 6.5+ performant .l10n.php<\/code> payloads. The wp.org page itself ships with an English readme.txt<\/code> that opens with a Greek summary, plus a parallel full Greek readme-el.txt<\/code> companion file inside the plugin folder for Greek-speaking merchants.<\/p><\/li>\n<\/ul>\n\n\n\n\n
pay.aspx<\/code>) \u2014 \u03c4\u03b1 \u03b4\u03b5\u03b4\u03bf\u03bc\u03ad\u03bd\u03b1 \u03ba\u03ac\u03c1\u03c4\u03b1\u03c2 \u03b4\u03b5\u03bd \u03c0\u03b5\u03c1\u03bd\u03bf\u03cd\u03bd \u03c0\u03bf\u03c4\u03ad \u03b1\u03c0\u03cc \u03c4\u03bf\u03bd \u03b4\u03b9\u03b1\u03ba\u03bf\u03bc\u03b9\u03c3\u03c4\u03ae\n\u03c4\u03bf\u03c5 \u03ba\u03b1\u03c4\u03b1\u03c3\u03c4\u03ae\u03bc\u03b1\u03c4\u03bf\u03c2.<\/li>\nPanCardType<\/code> (FPAN \u03c0\u03c1\u03b1\u03b3\u03bc\u03b1\u03c4\u03b9\u03ba\u03cc\u03c2 \u03b1\u03c1\u03b9\u03b8\u03bc\u03cc\u03c2 \u03ba\u03ac\u03c1\u03c4\u03b1\u03c2 \/\nDPAN token \u03c3\u03c5\u03c3\u03ba\u03b5\u03c5\u03ae\u03c2) \u03c3\u03c4\u03b7\u03bd \u03c0\u03b1\u03c1\u03b1\u03b3\u03b3\u03b5\u03bb\u03af\u03b1.<\/li>\nAcquirerId<\/code>, MerchantId<\/code>, PosId<\/code>, Username<\/code>,\n Password. \u03a4\u03bf \u03c0\u03c1\u03cc\u03c3\u03b8\u03b5\u03c4\u03bf \u03b4\u03b5\u03bd \u03c0\u03b1\u03c1\u03ad\u03c7\u03b5\u03b9 \u03b4\u03b9\u03ba\u03bf\u03cd\u03c2 \u03c4\u03bf\u03c5 \u03b4\u03bf\u03ba\u03b9\u03bc\u03b1\u03c3\u03c4\u03b9\u03ba\u03bf\u03cd\u03c2\n\u03bb\u03bf\u03b3\u03b1\u03c1\u03b9\u03b1\u03c3\u03bc\u03bf\u03cd\u03c2.<\/p>\n\n\n
IssueNewTicket<\/code>) with UTF-8 payload.<\/li>\npay.aspx<\/code>) so card data never touches your server.<\/li>\nCardType=15<\/code>, PaymentMethod=IRIS<\/code>), surfaces IRIS-tailored decline\nmessages for the IRIS-only ResponseCodes (05 user-cancelled-in-bank-app,\n06 service error, 09 pending, 68 5-minute QR timeout, 70 IRIS service\nerror) and records the channel on the order so card vs IRIS settlements\nare distinguishable in your reports.<\/li>\nPanCardType<\/code> (FPAN real card number \/ DPAN device token) on the\norder and notes \"Paid via Google Pay\" so wallet settlements are\ndistinguishable in your reports.<\/li>\nAcquirerId<\/code>, MerchantId<\/code>, PosId<\/code>,\n Username and Password<\/code> credentials before using this plugin.<\/strong> The\nplugin does not provide test or sandbox accounts on its own; please\ncontact Euronet Merchant Services to request one.<\/p>\n\nAffiliation and trademark notice<\/h4>\n\n
assets\/img\/wp-cards.png<\/code>) is included with the rights-holder's\nauthorization for the merchant distribution scope of this plugin.<\/p>\n\nUser tracking and consent<\/h4>\n\n
External services<\/h3>\n\n
1. ePay Paycenter Ticketing Web Service<\/h4>\n\n
\n
TranTicket<\/code> for each card\npayment attempt. The ticket is kept server-side only (never exposed\nto the browser) and used solely to verify the HMAC-SHA256 HashKey on\nthe bank's callback; the customer's browser is redirected to the\nsecure payment page by a form carrying only non-secret fields, so\ncardholder data never touches the merchant server.<\/li>\nhttps:\/\/paycenter.piraeusbank.gr\/services\/tickets\/issuer.asmx<\/code><\/li>\nCC-Number<\/code>. No\ncardholder data, no PAN, no CVV, no expiry, and no analytics\nidentifier is ever transmitted; cardholder data is collected\nexclusively on the bank's secure payment page.<\/li>\n2. ePay Paycenter Redirection page<\/h4>\n\n
\n
action<\/code> attribute\nis the URL below.<\/li>\nhttps:\/\/paycenter.piraeusbank.gr\/redirection\/pay.aspx<\/code><\/li>\nhttps:\/\/<merchant-site>\/?wc-api=epay_paycenter<\/code>). This is the\nsame service - the merchant site is the Notification \/ Success \/\nFailure \/ Backlink target the merchant configures in the\nEuronet portal. No data leaves the merchant server on this\ninbound leg; the plugin only reads, verifies, and acts on the\nresponse.<\/li>\n<\/ul>\n\nService operator and legal links<\/h4>\n\n
\n
3. Cloudflare IPv4 list<\/h4>\n\n
\n
wp_safe_remote_get()<\/code> and\ncaches the result in a WordPress transient.<\/li>\nhttps:\/\/www.cloudflare.com\/ips-v4\/<\/code><\/li>\nUser-Agent<\/code>\nstring (secure-card-gateway-for-epay-paycenter-piraeus-bank\/VERSION<\/code>).<\/li>\n\n
wp-content\/plugins\/wh4u-secure-card-gateway-for-epay-paycenter-piraeus-bank\/<\/code>.<\/li>\n\n
https:\/\/your-site.tld\/wc-api\/epay_paycenter\/<\/code><\/li>\nhttps:\/\/your-site.tld\/wc-api\/epay_paycenter\/<\/code><\/li>\nhttps:\/\/your-site.tld\/wc-api\/epay_paycenter\/<\/code><\/li>\n\n
Which cards are supported?<\/h3><\/dt>\n
Does the plugin support IRIS payments?<\/h3><\/dt>\n
Does the plugin store any card data?<\/h3><\/dt>\n
What happens if the HashKey cannot be verified?<\/h3><\/dt>\n
Is this plugin GDPR-compatible?<\/h3><\/dt>\n
My host's WAF (cPFence, ModSecurity, Imunify360, BitNinja, LiteSpeed) is blocking the bank callback. What do I do?<\/h3><\/dt>\n
TransactionDateTime<\/code>,\nempty HashKey<\/code> on declined transactions, Greek ResponseDescription<\/code>\ntext) that overlap with default attack signatures. Symptoms: callbacks\nfor failed transactions never arrive and orders get stuck in pending\npayment<\/em>.<\/p>\n\n\/?wc-api=epay_paycenter<\/code> (callback-URL\nscope only \u2014 never disable rules server-wide). CDN-level WAFs\n(Cloudflare, Sucuri, Akamai) must be configured separately at the CDN \u2014\nthe in-admin diagnostic only exercises the origin server's WAF.<\/p><\/dd>\nMy customer sees only \"-1\" after the bank return. What happened?<\/h3><\/dt>\n
-1<\/code> comes from WooCommerce core's WC_API<\/code> handler. For\nthis plugin it usually means one of three things:<\/p>\n\n\n
https:\/\/<your-site>\/?wc-api=epay_paycenter<\/code> (no\ntrailing slash, no extra path). Copy it from the gateway settings\npage where the plugin displays the canonical form.<\/li>\n