SagePay Form Gateway for WooCommerce

SagePay Form integration is the easiest way to start processing online payments. It can take as little as 20 minutes to set up and is by far the quickest way to integrate Sage Pay.

Form integration is designed to pass transaction details from your website to Sage Pay to carry out authorisation. Outsourcing your payment processing in this way means that no sensitive data is collected, stored or transferred from your site.

This Plugin allows you to accept SagePay Payments removing the need for you to maintain highly secure encrypted databases, obtain digital certificates and invest in high-level PCI DSS compliance.

1. Download and unzip the latest release zip file.
2. If you use the WordPress plugin uploader to install this plugin skip to step 4.
3. Upload the entire plugin directory to your /wp-content/plugins/ directory.
4. Activate the plugin through the ‘Plugins’ menu in WordPress Administration.

1.0.0

• Initial Release

1.4.0

• Updated to work with WooCommerce 2.6+

1.4.1

• Updated to resolve a basket shipping calculation bug.

1.4.2

• Updated to work with WooCommerce 3.x

1.4.3

• Updated the tested upto for WordPress and Woocommerce.

1.4.4

• Updated to support the PHP version 7.0 and above.

1.4.5

• Updated to support WooCommerce 3.7+ and WordPress 5.2+

1.4.6

Security and reliability:
* Return URL follows your site URL (HTTPS when configured) instead of forcing HTTP. Override with filter woocommerce_sagepayform_notify_url.
* Callback runs only on the WooCommerce API route (wc-api), not on every init request.

Payment verification:
* Validates decrypted Opayo data before completing an order.
* Remembers each generated VendorTxCode on the order (supports multiple pending attempts, e.g. refresh or extra tabs); regex fallback for older VendorTxCode formats.
* Verifies amount and currency against the order; skips duplicate completion if the order is already paid.
* Records VPSTxId via payment_complete() for the WooCommerce transaction id.
* Safer decrypt path when crypt is missing, malformed, or invalid.

Fixes and compatibility:
* US eMailMessage: applies when billing or shipping country is US (fixes incorrect get_shipping_state usage).
* WooCommerce Blocks: guards when the gateway is missing from the registry.
* Blocks checkout script text domain aligned with the main plugin (woo-sagepayform-patsatech).
* Uses wc_get_order() and a paid-status fallback when wc_get_is_paid_statuses() is unavailable.

1.4.7

Elavon Opayo hostname update (Form register endpoint path unchanged):
* Test: https://sandbox.opayo.eu.elavon.com/gateway/service/vspform-register.vsp (was https://test.sagepay.com/gateway/service/vspform-register.vsp).
* Live: https://live.opayo.eu.elavon.com/gateway/service/vspform-register.vsp (was https://live.sagepay.com/gateway/service/vspform-register.vsp).

Developer hook:
* Filter woocommerce_sagepayform_register_url — return a custom URL for each $mode (test or live) for legacy sagepay.com hosts or account-specific endpoints during migration.