Skillmerc Payment Gateway for PayFast

Get it free on WordPress.org

Skillmerc Payment Gateway for PayFast lets South African stores take payments through PayFast’s hosted payment page (card, instant EFT, SnapScan and Mobicred) and keeps WooCommerce order statuses in step with what PayFast actually reports.

It was written to fix the things South African merchants complain about most: order statuses that never update because the ITN callback silently fails, no refund path from the order screen, no High-Performance Order Storage support, and settings scattered across several screens.

What it does

• PayFast hosted checkout for card, instant EFT, SnapScan and Mobicred.
• One toggle to switch between the PayFast sandbox and your live account. Each mode keeps its own credentials, so switching back and forth never means retyping keys.
• Order status sync through Instant Transaction Notification (ITN), with signature verification, source host verification, amount matching, server confirmation and replay protection. Every rejection is logged with the reason, so a broken callback is diagnosable instead of silent.
• Refunds sent to PayFast straight from the WooCommerce order screen (needs API access on your PayFast account).
• Full High-Performance Order Storage (HPOS) compatibility, with no legacy post meta.
• Optional South African number formatting for Rand amounts (R 1 234,56).
• Works the moment you activate it: sandbox mode is on with PayFast’s published test credentials already filled in.
• Every setting is on one screen, at WooCommerce → Settings → Payments → Skillmerc Payment Gateway for PayFast.

Pro version

The free plugin covers once-off payments. Skillmerc PayFast Pro adds PayFast subscriptions (sign-up, automatic renewal and cancel from WooCommerce), a notification log, and an automatic re-query every 15 minutes that marks orders paid when PayFast confirms a payment whose notification never arrived, plus Ozow instant EFT and Yoco card payments (both in beta). USD 49 a year for one site, with a 14-day money-back guarantee: https://checkout.freemius.com/plugin/40911/plan/70874/licenses/1/

The free plugin stays fully functional without Pro. Nothing is locked or time-limited. The gateway settings screen shows one short panel about Pro, which any admin can hide with one click, and the Plugins screen shows a “Get Pro” link. Neither appears once Pro is active, and there are no notices anywhere else in your dashboard.

Switching from another PayFast plugin

If your current PayFast plugin leaves paid orders stuck on pending, throws errors on your PHP version, or has no refund button, you can move over in a few minutes:

1. Install and activate this plugin. It uses its own gateway ID, so it does not clash with other PayFast plugins.
2. Enter the same merchant ID, merchant key and salt passphrase you already use. Your PayFast account does not change.
3. Place a test order in sandbox mode, then switch to live.
4. Disable the old PayFast gateway under WooCommerce, Settings, Payments, so shoppers only see one PayFast option. Keep the old plugin installed (just disabled) while you still have older orders that were paid through it.

The code is checked on PHP 7.4 through 8.5 and tested end to end against the PayFast sandbox on PHP 8.2.

External services

This plugin talks to PayFast, and only to PayFast. There is no tracking, no analytics and no phone-home of any kind.

• Shoppers are redirected to https://www.payfast.co.za (or https://sandbox.payfast.co.za in sandbox mode) to complete payment. The order number, order total, item description and the billing name and email address are sent so PayFast can process and receipt the payment.
• When PayFast notifies your store of a payment, the plugin posts the notification back to https://www.payfast.co.za/eng/query/validate (or the sandbox equivalent) to confirm PayFast really sent it. This is PayFast’s documented server confirmation step and is what makes a forged callback unusable.
• If you switch refunds on, refund requests are sent to https://api.payfast.co.za. This only happens when you refund an order in WooCommerce, and the setting is off by default.
• Source host verification does a DNS lookup of PayFast’s ITN hostnames. You can switch it off with the wc_payfast_pro_verify_itn_source filter if your host sits behind a proxy.

PayFast is a service of DPO South Africa (Pty) Ltd. Terms: https://payfast.io/legal/ and privacy policy: https://payfast.io/privacy-policy/

Troubleshooting PayFast in WooCommerce

• PayFast payment successful but WooCommerce order still pending: how to fix it
• PayFast ITN invalid signature in WooCommerce: causes and fix
• PayFast salt passphrase: where to set it and how to fix a mismatch
• PayFast refunds in WooCommerce: dashboard refunds vs. refunding from the order
• PayFast ITN bad source IP behind Cloudflare: why it fails and how to fix it