IMPORTANT: This security release clears your stored M-Pesa credentials (Consumer Key\/Secret, Passkey). You MUST re-enter and save them on the M-Pesa settings page after updating, or checkout will not work. See the full changelog for details.<\/p>","1.2.0":"
Telemetry is now a real, working opt-in feature (was previously scaffolded but inert). Off by default \u2014 no behavior change unless you explicitly enable it under Payments > M-Pesa Till > Anonymous Usage Data.<\/p>","1.1.1":"
Security hardening release: re-enables SSL certificate verification on M-Pesa API calls and adds callback authentication. Update is strongly recommended for all sites.<\/p>","1.1.0":"
This version adds support for WooCommerce block-based checkout. No breaking changes. Simply update and M-Pesa will work on both classic and block checkouts.<\/p>","1.0.0":"
Initial release. Please test in sandbox mode before using in production.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3719802,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3719802,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3719802,"resolution":false,"location":"assets","locale":false}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3719802,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3719802,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.6.3"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3719802,"resolution":"1","location":"assets","locale":"","width":1280,"height":900},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3719802,"resolution":"2","location":"assets","locale":"","width":1280,"height":900},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3719802,"resolution":"3","location":"assets","locale":"","width":1200,"height":800},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3719802,"resolution":"4","location":"assets","locale":"","width":1280,"height":1641},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3719802,"resolution":"5","location":"assets","locale":"","width":1280,"height":1250},"screenshot-6.png":{"filename":"screenshot-6.png","revision":3719802,"resolution":"6","location":"assets","locale":"","width":1280,"height":900}},"screenshots":{"1":"Gateway settings page with M-Pesa configuration","2":"Checkout page showing M-Pesa payment option (Block checkout)","3":"STK Push prompt on customer's phone","4":"Transaction reports dashboard","5":"Order received page with payment status","6":"Payment settings and encryption management"}},"plugin_section":[],"plugin_tags":[37731,3050,6593,277553,286],"plugin_category":[45],"plugin_contributors":[283503],"plugin_business_model":[],"class_list":["post-367444","plugin","type-plugin","status-publish","hentry","plugin_tags-kenya","plugin_tags-mpesa","plugin_tags-payment-gateway","plugin_tags-safaricom","plugin_tags-woocommerce","plugin_category-ecommerce","plugin_contributors-marto46","plugin_committers-marto46"],"banners":{"banner":"https:\/\/ps.w.org\/marupurupu-checkout-for-mpesa\/assets\/banner-772x250.png?rev=3719802","banner_2x":"https:\/\/ps.w.org\/marupurupu-checkout-for-mpesa\/assets\/banner-1544x500.png?rev=3719802","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":"https:\/\/ps.w.org\/marupurupu-checkout-for-mpesa\/assets\/icon.svg?rev=3719802","icon":"https:\/\/ps.w.org\/marupurupu-checkout-for-mpesa\/assets\/icon.svg?rev=3719802","icon_2x":false,"generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/marupurupu-checkout-for-mpesa\/assets\/screenshot-1.png?rev=3719802","caption":"Gateway settings page with M-Pesa configuration"},{"src":"https:\/\/ps.w.org\/marupurupu-checkout-for-mpesa\/assets\/screenshot-2.png?rev=3719802","caption":"Checkout page showing M-Pesa payment option (Block checkout)"},{"src":"https:\/\/ps.w.org\/marupurupu-checkout-for-mpesa\/assets\/screenshot-3.png?rev=3719802","caption":"STK Push prompt on customer's phone"},{"src":"https:\/\/ps.w.org\/marupurupu-checkout-for-mpesa\/assets\/screenshot-4.png?rev=3719802","caption":"Transaction reports dashboard"},{"src":"https:\/\/ps.w.org\/marupurupu-checkout-for-mpesa\/assets\/screenshot-5.png?rev=3719802","caption":"Order received page with payment status"},{"src":"https:\/\/ps.w.org\/marupurupu-checkout-for-mpesa\/assets\/screenshot-6.png?rev=3719802","caption":"Payment settings and encryption management"}],"raw_content":"\n
Marupurupu Checkout for M-Pesa allows you to accept payments via M-Pesa (Safaricom) using the STK Push (Lipa Na M-Pesa Online) feature. This plugin integrates seamlessly with WooCommerce and supports both classic shortcode-based checkout and modern block-based checkout.<\/p>\n\n
Independent plugin \u2014 no affiliation.<\/strong> This plugin is developed independently. It is not affiliated with, endorsed by, or sponsored by Safaricom, M-Pesa, WooCommerce or Automattic. M-Pesa, Safaricom and WooCommerce are trademarks of their respective owners, used here only to describe what the plugin works with.<\/p>\n\n Required Settings:<\/strong>\n* Consumer Key (Production & Test)\n* Consumer Secret (Production & Test)\n* Business Short Code (Your Till Number)\n* Passkey (From Daraja Portal)\n* Test Mode toggle<\/p>\n\n Optional Settings:<\/strong>\n* Payment instructions for customers\n* Debug logging\n* Telemetry (usage tracking)<\/p>\n\n This plugin connects to the third-party services below. Nothing is sent to Safaricom until you configure the plugin and a payment is attempted, and nothing is sent to the usage-statistics collector unless you opt in.<\/p>\n\n Safaricom Daraja API<\/strong> ( Plugin usage-statistics collector<\/strong> ( WordPress.org secret-key generator<\/strong> ( This plugin:\n* Stores M-Pesa transaction data in your WordPress database\n* Sends payment requests to Safaricom M-Pesa API\n* Optionally tracks anonymous usage data (opt-in telemetry) \u2014 see below\n* Does not share customer data with third parties (except Safaricom for payment processing)\n* Encrypts sensitive credentials at rest<\/p>\n\n Anonymous usage telemetry is off by default<\/strong>. It only activates if you\ncheck \"Help improve this plugin by sharing anonymous usage data\" under\nWooCommerce > Settings > Payments > M-Pesa Till > Anonymous Usage Data, and\nstops sending anything as soon as you uncheck it (any leftover scheduled\ntasks then do nothing). If you had opted in, deactivating the plugin sends one final Site identifier<\/strong>: every event includes a What's sent, by event type<\/strong> (the Never included, in any event, ever<\/strong>: phone numbers, order details,\ncustomer names or addresses, or M-Pesa credentials (Consumer Key\/Secret,\nPasskey, callback secret) in any form.<\/p>\n\n Telemetry, when enabled, is sent to a dedicated collector endpoint operated\nby the plugin author ( Also recorded by the collector<\/strong>: like any web server, it receives the IP\naddress of the server that sends each event, and stores it with the event. It\nis used only for rate limiting and abuse investigation and is not shown on the\ncollector's dashboard. Events (including that IP address) are currently kept\nuntil they are deleted manually \u2014 there is no automatic expiry. To have the\nevents for your site removed, ask in this plugin's support forum on\nWordPress.org and include your site's identifier ( Developed by: Martin Mburu\nBased on: Safaricom Daraja API\nUses: WooCommerce Payment Gateway API\nBlocks Integration: WooCommerce Blocks API<\/p>\n\nFeatures<\/h4>\n\n
\n
Requirements<\/h4>\n\n
\n
Setup<\/h4>\n\n
\n
\/wp-content\/plugins\/marupurupu-checkout-for-mpesa\/<\/code><\/li>\nConfiguration<\/h4>\n\n
External services<\/h4>\n\n
api.safaricom.co.ke<\/code>, or sandbox.safaricom.co.ke<\/code> when Test Mode is on) \u2014 the service that actually takes the M-Pesa payment.\n* Used for: requesting an access token, sending an STK Push payment prompt to the customer's phone, and checking the status of a payment. Safaricom also posts the payment result back to your site's callback URL.\n* Sent, and when: your Consumer Key and Consumer Secret (to obtain a token \u2014 whenever one is needed and when you click \"Test M-Pesa Connection\"); and, when a customer pays, your Business Short Code and Till Number, a request password derived from your Passkey, the order amount, the customer's M-Pesa phone number, an order reference (\"Order-\" plus the order number) and your site's callback URL.\n* Provider: Safaricom PLC. Daraja developer portal: https:\/\/developer.safaricom.co.ke\/ \u2014 Terms and Conditions and Privacy Policy: https:\/\/developer.safaricom.co.ke\/terms<\/p>\n\ntelemetry.billtoolbox.com<\/code>) \u2014 optional and off by default; used only if you tick \"Help improve this plugin by sharing anonymous usage data\" in the gateway settings. Exactly what is sent, and when, is listed field by field under \"Privacy Policy\" below. Operated by the plugin author. It has no separate terms document: the complete disclosure of what it receives, stores and for how long is the \"Privacy Policy\" section below.<\/p>\n\napi.wordpress.org\/secret-key\/1.1\/salt\/<\/code>) \u2014 only a link in an admin notice shown when your site's security keys are missing. The plugin sends nothing to it; your browser opens it only if you click the link.<\/p>\n\nTechnical Details<\/h3>\n\n
Compatibility<\/h4>\n\n
\n
Security<\/h4>\n\n
\n
Performance<\/h4>\n\n
\n
Privacy Policy<\/h3>\n\n
Telemetry (opt-in)<\/h4>\n\n
deactivation<\/code> event (described below).<\/p>\n\nsite_id<\/code> \u2014 a SHA-256 hash of\nyour site's URL. This is a stable, unique-per-install pseudonymous\nidentifier, not full anonymity: because it's stable, events from your site\ncan be correlated with each other over time (e.g. to see version-upgrade\nhistory), even though your actual site URL, domain, or any other\nidentifying detail is never transmitted.<\/p>\n\nfeature_usage<\/code>, error<\/code> and performance<\/code> events are supported by the code but the plugin does not currently trigger them; they are listed so the disclosure stays complete if that changes):<\/p>\n\n\n
heartbeat<\/code> (weekly) \u2014 WordPress, WooCommerce, PHP, and MySQL version\nnumbers; server software string; PHP memory limit and max execution\ntime; whether OpenSSL and cURL are available; whether High-Performance\nOrder Storage (HPOS) is enabled; site language and timezone; whether the\nsite is a WordPress Multisite install; whether stored M-Pesa credentials\nare encrypted (a boolean only \u2014 never the credentials themselves).<\/li>\ndaily_stats<\/code> (daily) \u2014 transaction counts by status (completed\/pending\/\nfailed), success rate, minimum\/maximum\/average transaction amounts<\/strong>,\nand a distribution of M-Pesa result\/failure codes. No order IDs, phone\nnumbers, or customer identities are included \u2014 only aggregate numbers.<\/li>\nfeature_usage<\/code> (weekly aggregate) \u2014 which plugin features were used and\nhow many times, with no reference to which orders\/customers triggered\nthem.<\/li>\nerror<\/code> \u2014 an error category and code (e.g. api_error<\/code> \/ 1037<\/code>), plus a\nshort sanitized context string. The context field only ever contains the\nfixed category labels already used internally by the plugin's error\ntracking \u2014 never raw request bodies, stack traces, or user input.<\/li>\nperformance<\/code> (weekly aggregate) \u2014 timing metrics (count\/min\/max\/average\nduration in milliseconds) for named internal operations, with no\nreference to which orders they came from.<\/li>\ndeactivation<\/code> \u2014 sent once when the plugin is deactivated (and only if you\nhad opted in): just the event name, the anonymous site identifier, the\nplugin version and a timestamp. No event is sent on activation.<\/li>\n<\/ul>\n\ntelemetry.billtoolbox.com<\/code>) \u2014 a separate WordPress\ninstall used only for this purpose, isolated from any other site.<\/p>\n\nsite_id<\/code>: the SHA-256 hash\nof your site URL described above).<\/p>\n\nCredits<\/h3>\n\n
Third-party libraries<\/h4>\n\n