Independent WooCommerce gateway by WebHosting4U for the ePay Paycenter (Piraeus Bank / Euronet Merchant Services) Redirection service.

WebHosting4U Secure Card Gateway for ePay Paycenter (Piraeus Bank)

<h4>What sets this plugin apart</h4>
<ul>
<li>
HPOS-native from day one. Built against WooCommerce&#8217;s High-Performance Order Storage from the very first release. All order metadata uses the HPOS-aware <code>$order-&gt;update_meta_data()</code> / <code>get_meta()</code> API — never the legacy <code>update_post_meta()</code> / <code>get_post_meta()</code> calls that silently fail on HPOS-enabled stores (the WooCommerce default for new installs since 8.x). Your transaction IDs, support reference IDs, and approval codes are preserved whichever storage mode you run.
</li>
<li>
Cloudflare-aware. Automatically detects when your store is served through Cloudflare (via the <code>CF-Ray</code> / <code>CF-Connecting-IP</code> request headers) and surfaces the current Cloudflare IPv4 CIDR ranges right in the gateway settings page, ready to copy. You hand them to Euronet Merchant Services so the bank&#8217;s callbacks are not blocked at their firewall when they arrive via Cloudflare edge IPs. Live list fetched from cloudflare.com/ips-v4 and cached for 12 hours.
</li>
<li>
Built-in WAF / callback self-test. A diagnostic button in the gateway settings sends a realistic, declined-transaction-shaped POST to your own callback URL via loopback and reports whether your host&#8217;s web-application firewall (cPFence, ModSecurity / OWASP CRS, Imunify360, BitNinja, LiteSpeed WAF) silently blocks it before PHP runs. No real order is created or modified — the synthetic payload carries a <code>WAFTEST-</code> merchant reference that cannot match any order in the database. Catches the class of &#8220;callbacks never arrive&#8221; problems before they cost you a sale.
</li>
<li>
Modern admin UI. Card-based layout, dashicons throughout, one-click Copy-to-clipboard for all callback URLs grouped in a single block, environment badge (Test / Live / Production) on the credentials section, collapsible Cloudflare details. Audited against the &#8220;Modern&#8221; admin theme introduced in WordPress 7.0.
</li>
<li>
Audited for WordPress 7.1 on release day. Reviewed against the full breaking-changes list in the WordPress 7.0 Field Guide on 2026-05-20 and again in the WordPress 7.1 Field Guide on 2026-08-28. &#8220;Tested up to&#8221; has tracked the current WordPress release since the very first stable version. The plugin requires PHP 7.4 (the WordPress 7.1 minimum) and uses no API deprecated in 7.0 or 7.1.
</li>
<li>
Fully bilingual (EN + EL). All 179 admin and customer-facing strings translated to Greek and shipped as both classic <code>.mo</code> and WordPress 6.5+ performant <code>.l10n.php</code> payloads. The wp.org page itself ships with an English <code>readme.txt</code> that opens with a Greek summary, plus a parallel full Greek <code>readme-el.txt</code> companion file inside the plugin folder for Greek-speaking merchants.
</li>
</ul>
Ελληνικά:
Ανεξάρτητο πρόσθετο πύλης πληρωμής WooCommerce από τη WebHosting4U για 
την υπηρεσία ePay Paycenter Redirection της Τράπεζας Πειραιώς / 
Euronet Merchant Services. Υλοποιεί πλήρως την επίσημη προδιαγραφή 
Redirection v3.1:
<ul>
<li>Έκδοση μοναδικού εισιτηρίου (TranTicket) μέσω SOAP Ticketing Web 
Service με κωδικοποίηση UTF-8.</li>
<li>Αυτόματη ανακατεύθυνση POST στην ασφαλή σελίδα πληρωμής της τράπεζας 
(<code>pay.aspx</code>) — τα δεδομένα κάρτας δεν περνούν ποτέ από τον διακομιστή 
του καταστήματος.</li>
<li>Πλήρης επαλήθευση HashKey HMAC-SHA256 σε κάθε επιτυχημένη απάντηση 
πριν χαρακτηριστεί η παραγγελία ως εξοφλημένη.</li>
<li>Συναλλαγές Sale (άμεση εκκαθάριση στην επόμενη παρτίδα).</li>
<li>Υποστήριξη IRIS Payments (άμεσες πληρωμές μέσω ΔΙΑΣ). Όταν η 
Euronet Merchant Services ενεργοποιήσει το IRIS στη σύμβασή σας, η 
σελίδα πληρωμής της τράπεζας εμφανίζει στον πελάτη και τις δύο 
επιλογές (κάρτα ή IRIS). Το πρόσθετο αναγνωρίζει τις απαντήσεις IRIS, 
αποθηκεύει το κανάλι πληρωμής στην παραγγελία, και εμφανίζει 
μηνύματα προσαρμοσμένα στα IRIS σενάρια (ακύρωση από την εφαρμογή 
τράπεζας, λήξη QR 5 λεπτών, σφάλμα υπηρεσίας IRIS κ.λπ.).</li>
<li>Πληρωμές Google Pay™ (Redirection v3.1) — γίνονται δεκτές 
αυτόματα, χωρίς καμία ρύθμιση. Η σελίδα της τράπεζας εμφανίζει το 
Google Pay σε συμβατές συσκευές για συναλλαγές αγοράς και προέγκρισης. 
Επειδή το Google Pay επιστρέφει την τυπική απάντηση κάρτας, 
επαληθεύεται με το ίδιο HashKey HMAC-SHA256· το πρόσθετο καταγράφει 
επιπλέον το πεδίο <code>PanCardType</code> (FPAN πραγματικός αριθμός κάρτας / 
DPAN token συσκευής) στην παραγγελία.</li>
<li>Συμπλήρωση πεδίων 3-D Secure από τη διεύθυνση χρέωσης / αποστολής 
του WooCommerce.</li>
<li>Συμβατότητα με HPOS (Custom Order Tables) και WooCommerce Blocks 
checkout.</li>
</ul>
Προϋπόθεση: πρέπει να έχετε υπογεγραμμένο συμβόλαιο αποδοχής με την 
Euronet Merchant Services / Τράπεζα Πειραιώς και να διαθέτετε τα 
διαπιστευτήρια <code>AcquirerId</code>, <code>MerchantId</code>, <code>PosId</code>, <code>Username</code>, 
 Password. Το πρόσθετο δεν παρέχει δικούς του δοκιμαστικούς 
λογαριασμούς.
Η πλήρης ελληνική μετάφραση της σελίδας του προσθέτου στο WordPress.org 
θα είναι διαθέσιμη μέσω του <a href="https://translate.wordpress.org/projects/wp-plugins/secure-card-gateway-for-epay-paycenter-piraeus-bank/" rel="nofollow ugc">translate.wordpress.org</a> 
μόλις εγκριθεί από την κοινότητα. Δείτε επίσης το συνοδευτικό 
 readme-el.txt για την ολοκληρωμένη ελληνική τεκμηρίωση.
English:
This plugin integrates WooCommerce with the ePay Paycenter Redirection 
service operated by Piraeus Bank / Euronet Merchant Services. It implements 
the official Redirection v3.1 specification end to end:
<ul>
<li>SOAP Ticketing Web Service (<code>IssueNewTicket</code>) with UTF-8 payload.</li>
<li>Auto-submitted HTML form POST redirection to the Paycenter secure 
payment page (<code>pay.aspx</code>) so card data never touches your server.</li>
<li>Full HMAC-SHA256 HashKey verification for every successful callback 
before marking an order as paid.</li>
<li>Sale transactions, settled in the next batch with no further merchant 
action required.</li>
<li>IRIS payments (Greek instant payment / DIAS) accepted transparently 
when enabled by Euronet Merchant Services on the merchant agreement. 
The bank&#8217;s hosted page presents card and IRIS as the two payment 
options; the plugin recognises the IRIS-specific response payload 
(<code>CardType=15</code>, <code>PaymentMethod=IRIS</code>), surfaces IRIS-tailored decline 
messages for the IRIS-only ResponseCodes (05 user-cancelled-in-bank-app, 
06 service error, 09 pending, 68 5-minute QR timeout, 70 IRIS service 
error) and records the channel on the order so card vs IRIS settlements 
are distinguishable in your reports.</li>
<li>Google Pay™ (Redirection v3.1) accepted automatically — no 
configuration needed. The bank&#8217;s hosted page shows Google Pay on 
eligible devices/browsers for purchase and pre-authorization 
transactions (with or without installments). Because Google Pay 
returns the standard card success payload, it is verified against the 
same HMAC-SHA256 HashKey as any card; the plugin additionally records 
the <code>PanCardType</code> (FPAN real card number / DPAN device token) on the 
order and notes &#8220;Paid via Google Pay&#8221; so wallet settlements are 
distinguishable in your reports.</li>
<li>3-D Secure auxiliary fields populated from the WooCommerce billing / 
shipping address.</li>
<li>HPOS (Custom Order Tables) and WooCommerce Blocks checkout support.</li>
</ul>
You must have signed an acquiring contract with Euronet Merchant 
Services / Piraeus Bank and obtained <code>AcquirerId</code>, <code>MerchantId</code>, <code>PosId</code>, 
 Username and <code>Password</code> credentials before using this plugin. The 
plugin does not provide test or sandbox accounts on its own; please 
contact Euronet Merchant Services to request one.
<h4>Affiliation and trademark notice</h4>
This plugin is independent software published by WebHosting4U and is 
not affiliated with, endorsed by, sponsored by, or otherwise officially 
connected to Piraeus Bank S.A., Euronet Merchant Services, or 
Automattic Inc. The third-party names &#8220;ePay&#8221;, &#8220;Paycenter&#8221;, &#8220;Piraeus Bank&#8221; 
and &#8220;WooCommerce&#8221; are trademarks of their respective owners and are 
used here in good faith, after the unaffiliation marker &#8220;for&#8221;, solely 
to describe the third-party service this plugin integrates with, in 
line with the WordPress.org Detailed Plugin Guidelines on third-party 
trademarks. The bundled accepted card brands image 
(<code>assets/img/wp-cards.png</code>) is included with the rights-holder&#8217;s 
authorization for the merchant distribution scope of this plugin.
<h4>User tracking and consent</h4>
This plugin does not load any analytics, telemetry, advertising, 
fingerprinting, profiling or behavioural tracking code, neither on the 
storefront nor in the WordPress admin. It does not set cookies on 
visitor browsers, does not contact any first-party or third-party 
analytics endpoint, and does not collect aggregated or individual 
usage statistics from the merchant&#8217;s installation. The only outbound 
network traffic the plugin generates is the strictly transactional 
traffic documented in the External services section below, which 
is required to complete a payment the merchant has explicitly 
configured the plugin to perform. No user-tracking consent prompt is 
therefore required by this plugin (Plugin Review Team Guidelines 7 
and 9).
<h3>External services</h3>
This plugin reaches out to three external services. Two are operated 
by Euronet Merchant Services on behalf of Piraeus Bank S.A. for the 
&#8220;ePay Paycenter&#8221; payment redirection product (mandatory for the 
plugin&#8217;s core function). The third is a publicly available Cloudflare 
endpoint used only in the admin panel to help store owners configure 
firewall rules for payment callbacks.
<h4>1. ePay Paycenter Ticketing Web Service</h4>
<ul>
<li>What it is: a SOAP / ASMX endpoint published by Euronet Merchant 
Services that issues a single-use <code>TranTicket</code> for each card 
payment attempt. The ticket is kept server-side only (never exposed 
to the browser) and used solely to verify the HMAC-SHA256 HashKey on 
the bank&#8217;s callback; the customer&#8217;s browser is redirected to the 
secure payment page by a form carrying only non-secret fields, so 
cardholder data never touches the merchant server.</li>
<li>Endpoint: <code>https://paycenter.piraeusbank.gr/services/tickets/issuer.asmx</code></li>
<li>What is sent: the merchant credentials provided by Euronet Merchant 
Services (AcquirerId, MerchantId, PosId, Username and an MD5 hash 
of the Password), the order&#8217;s MerchantReference (numeric WooCommerce 
order id with a short random suffix), the transaction amount and 
ISO 4217 numeric currency code, the request type (always Sale), 
and the 3-D Secure auxiliary fields populated 
from the WooCommerce order: billing email, cardholder name, 
billing address (city / lines / post code / state / ISO 3166 
numeric country code), shipping address when present, and the 
customer&#8217;s mobile phone number formatted as <code>CC-Number</code>. No 
cardholder data, no PAN, no CVV, no expiry, and no analytics 
identifier is ever transmitted; cardholder data is collected 
exclusively on the bank&#8217;s secure payment page.</li>
<li>When it is sent: once per successful checkout submission, at the 
moment WooCommerce hands control to the gateway&#8217;s 
Pay for order page, immediately before the customer is 
auto-redirected to the bank.</li>
</ul>
<h4>2. ePay Paycenter Redirection page</h4>
<ul>
<li>What it is: the bank-hosted secure payment page where the customer 
enters card details and completes the 3-D Secure challenge. The 
plugin renders an auto-submitted HTML form whose <code>action</code> attribute 
is the URL below.</li>
<li>Endpoint: <code>https://paycenter.piraeusbank.gr/redirection/pay.aspx</code></li>
<li>What is sent: the merchant identifiers (AcquirerId, MerchantId, 
PosId, User), the language code, the MerchantReference issued 
during ticketing, and a per-order ParamBackLink so the bank&#8217;s 
Cancel button returns the customer to the correct WordPress 
endpoint. The TranTicket itself is read by the customer&#8217;s 
browser from the hidden form field; the merchant server is not 
the originator of the redirect POST.</li>
<li>When it is sent: once per checkout, immediately after the 
Ticketing call above succeeds.</li>
<li>Inbound counterpart: Paycenter posts a signed transaction 
response (HMAC-SHA256 HashKey) back to the plugin&#8217;s WC-API 
callback URL on the merchant site 
(<code>https://&lt;merchant-site&gt;/?wc-api=epay_paycenter</code>). This is the 
same service &#8211; the merchant site is the Notification / Success / 
Failure / Backlink target the merchant configures in the 
Euronet portal. No data leaves the merchant server on this 
inbound leg; the plugin only reads, verifies, and acts on the 
response.</li>
</ul>
<h4>Service operator and legal links</h4>
Both endpoints above are operated by Euronet Merchant Services 
(epay) for Piraeus Bank S.A.. Before activating the gateway, 
merchants must review and agree to the operator&#8217;s terms and 
privacy policy:
<ul>
<li>Service homepage: <a href="https://epayworldwide.com/" rel="nofollow ugc">https://epayworldwide.com/</a> (Euronet Merchant 
Services / epay corporate site)</li>
<li>Greek market homepage: <a href="https://www.epaygreece.gr/" rel="nofollow ugc">https://www.epaygreece.gr/</a></li>
<li>Terms of Service: <a href="https://www.epaygreece.gr/oroi-xrisis/" rel="nofollow ugc">https://www.epaygreece.gr/oroi-xrisis/</a></li>
<li>Privacy Policy: <a href="https://www.epaygreece.gr/politiki-aporritou/" rel="nofollow ugc">https://www.epaygreece.gr/politiki-aporritou/</a></li>
<li>Piraeus Bank corporate site: <a href="https://www.piraeusbank.gr/" rel="nofollow ugc">https://www.piraeusbank.gr/</a></li>
<li>Piraeus Bank Privacy Policy: <a href="https://www.piraeusbank.gr/en/idiwtes/protection-of-personal-data" rel="nofollow ugc">https://www.piraeusbank.gr/en/idiwtes/protection-of-personal-data</a></li>
</ul>
If any of the above URLs change after publication, please consult 
the live operator websites for the current version of the relevant 
document. The plugin&#8217;s behaviour is not affected by such updates 
because the operator&#8217;s terms apply to the merchant&#8217;s relationship 
with Euronet Merchant Services / Piraeus Bank, not to the plugin 
itself. Merchants remain responsible for keeping their own 
privacy policy and terms aligned with the data flows documented 
above (notably the transmission of billing / shipping address 
fields and customer email / phone to the bank for 3-D Secure 
authentication).
<h4>3. Cloudflare IPv4 list</h4>
<ul>
<li>What it is: a publicly available plain-text file published by 
Cloudflare, Inc. that lists the current IPv4 CIDR ranges used by 
Cloudflare&#8217;s edge network. The plugin fetches this file once every 
12 hours (or 15 minutes on failure) via <code>wp_safe_remote_get()</code> and 
caches the result in a WordPress transient.</li>
<li>Endpoint: <code>https://www.cloudflare.com/ips-v4/</code></li>
<li>What is sent: a standard HTTP GET request with no personal data, 
no order information, no credentials, and no cookies. The only 
identifying information in the request is the plugin&#8217;s <code>User-Agent</code> 
string (<code>secure-card-gateway-for-epay-paycenter-piraeus-bank/VERSION</code>).</li>
<li>Why: when the plugin&#8217;s admin settings page detects that the 
WordPress site is served through Cloudflare (via the CF-Ray / 
CF-Connecting-IP / CDN-Loop request headers), it displays the 
current Cloudflare IPv4 ranges so the store owner can copy them 
into an email to Euronet Merchant Services to whitelist them for 
payment callbacks. Without this list, callbacks routed through 
Cloudflare edge IPs may be rejected by the bank&#8217;s firewall.</li>
<li>When: only when an administrator views the gateway&#8217;s WooCommerce 
settings page and Cloudflare is detected on the incoming request. 
It is never triggered on the storefront or by guest/customer visits.</li>
<li>Cloudflare service homepage: <a href="https://www.cloudflare.com/" rel="nofollow ugc">https://www.cloudflare.com/</a></li>
<li>Cloudflare Privacy Policy: <a href="https://www.cloudflare.com/privacypolicy/" rel="nofollow ugc">https://www.cloudflare.com/privacypolicy/</a></li>
<li>Cloudflare Terms of Service: <a href="https://www.cloudflare.com/terms/" rel="nofollow ugc">https://www.cloudflare.com/terms/</a></li>
</ul>
No data is sent to any third party other than the three endpoints 
listed above.

Alternative Plugins for

Discover the Lists with WebHosting4U Secure Card Gateway for ePay Paycenter (Piraeus Bank)