How to accept online payments on WooCommerce in Pakistan

A WooCommerce store in Pakistan can take payment in four ways. Cash on delivery and direct bank transfer are built into WooCommerce and need no extra plugin. Card and wallet payments need a Pakistani payment gateway such as PayFast or Safepay, which means a merchant account, the gateway’s plugin and, at PayFast, an NTN. Most new stores start with cash on delivery and bank transfer, then add a gateway once the paperwork is done.

This guide covers each option, what a gateway asks for before it opens your account, what it charges, how a card payment works behind the scenes, and how to test the whole thing before a real customer pays.

What payment methods does WooCommerce include?

WooCommerce ships with offline payment methods. You turn them on under WooCommerce, Settings, Payments. Two of them matter in Pakistan.

How does cash on delivery work in WooCommerce?

According to WooCommerce’s cash on delivery documentation, a COD order goes to “Processing” and stays there until you collect the money. You, the store owner, confirm that the courier has paid you before you mark the order “Complete”.

Cash on delivery costs nothing to set up, and many shoppers are used to it. The work comes later. You match each courier payment against your orders, and you carry the cost of parcels that come back. Because the customer pays nothing up front, call to confirm large or unusual orders before you ship them.

How does direct bank transfer work?

The direct bank transfer documentation describes it as an offline method. The customer sends the money from their own bank, and WooCommerce puts the order “On hold” until you check your account and see the deposit. You add your account name, bank and IBAN in the settings, and WooCommerce shows them on the order received page and in the order email.

Bank transfer has no fees on your side, but every order needs a manual check. That is fine at five orders a day and tiring at fifty.

Which payment gateways work with WooCommerce in Pakistan?

A payment gateway takes the card or wallet payment on its own secure page, then pays the money into your bank account. Two Pakistani gateways publish their terms openly on their own sites, PayFast and Safepay. Some banks also publish WooCommerce plugins of their own, so ask your bank as well.

What does PayFast offer?

PayFast now calls itself Premier PayFast. Its home page says it is licensed as a PSP and MSP by the State Bank of Pakistan. Its FAQ page lists the details a store owner needs:

• Payment methods. Visa and Mastercard with 3D Secure, UnionPay, PayPak, bank transfers, JazzCash, Easypaisa, and Raast QR and Request to Pay.
• International cards. Accepted through Visa and Mastercard. Local methods work only in Pakistan.
• Setup fee. A one-time, non-refundable fee of Rs 20,000, with no monthly or annual charges. The FAQ does not print the per-transaction rate, so ask for it in writing.
• Settlement. T+2 working days, which means the money reaches you two working days after the payment, not counting weekends and public holidays.
• NTN. Mandatory for every merchant, individuals included.
• Onboarding. Three to four working days, including the KYC check.

What does Safepay offer?

Safepay describes itself as a regulated PSO and PSP. Its pricing page lists a standard plan with no setup fee and no monthly fee:

• 2.9% plus Rs 30 per successful charge on a domestic card
• an extra 0.3% on international cards
• 1.5% per successful wallet charge
• up to 1.5% per Raast payment
• Rs 3,000 per card dispute (a chargeback)

As a worked example, a Rs 2,500 order paid by a Pakistani card would cost Rs 72.50 plus Rs 30, so Rs 102.50 in fees. The same page says its WooCommerce plugin adds no extra fee on the standard plan.

Both gateways change their prices from time to time. Read the current page on the day you sign, and keep a copy.

What do you need before you apply to a gateway?

Get these ready before you fill in the sign-up form, so the KYC check does not stall halfway:

• An NTN. PayFast will not onboard you without one. If you do not have one yet, register with FBR first.
• A bank account for settlements. Ask the gateway whose name the account must be in before you apply.
• Your identity and business documents. Each gateway has its own list. Ask for it at the start.
• A finished store. Real products with prices, a refund policy, terms, delivery information and a way to contact you, all on pages a customer can find.
• A working https address. The gateway sends customers back to your site after they pay, and your checkout pages carry personal details. If your site still shows “Not secure”, fix that first with our guide to getting a free SSL certificate for WordPress.

Why can’t you find the right plugin in the WordPress directory?

We searched the WordPress.org plugin directory for both gateways and read the listings. Two things stand out.

The “Payfast” plugins there are for a different company. A search for “payfast” puts WooCommerce Payfast Gateway first. It is published by WooCommerce, has more than 30,000 active installs, and its own description calls Payfast “one of South Africa’s most popular payment gateways”. The second result, “Payfast Gateway for WooCommerce”, tells you to sign up at payfast.io, which is the South African company’s site. Neither plugin is built for a PayFast Pakistan merchant account. PayFast Pakistan’s own WooCommerce plugin did not appear in the search, so ask PayFast’s onboarding team for it.

Safepay’s directory plugin is the old one. The Safepay for WooCommerce listing is published by Safepay, but it has not been updated in years and says it was tested only up to WordPress 5.5. The current WordPress release is 7.1. Safepay’s own setup article for the new WooCommerce plugin says the directory version is deprecated and lacks webhook support, and links to the current plugin as a zip file instead.

The rule that follows is simple. Install a gateway plugin only from a link in the gateway’s own documentation, or from a directory listing you have checked against that documentation.

How does a card payment work behind the scenes?

We built the card checkout on this site on PayFast’s hosted payment page. It follows the same protocol as PayFast’s WooCommerce plugin, so these are the steps your store goes through too:

1. Your server asks for a one-time token. When the customer places the order, your site sends the merchant ID, the secured key, the amount and the order number to PayFast, server to server. The secured key never reaches the customer’s browser.
2. The customer goes to the gateway’s page. The browser posts the token, amount, order number and return addresses to PayFast’s payment page.
3. The customer pays there. Card or wallet details, and the 3D Secure or OTP step, all happen on the gateway’s page. The card number never touches your hosting.
4. The gateway reports back. PayFast sends the result to your callback address. On our checkout the result arrives twice, once through the customer’s browser and once directly from PayFast’s server.
5. Your store checks the signature. Before it changes the order, the store recomputes a validation hash, a SHA-256 of the order number, the secured key, the merchant ID and the result code, and compares it with the one PayFast sent. Only a matching hash with result code 000 marks the order as paid.

Step 5 matters because anyone can type a return address into a browser. Without the hash check, a made-up “success” link could mark an unpaid order as paid. A good gateway plugin does this check for you. A plugin that marks orders paid as soon as the customer lands back on your site is one to avoid.

Two practical points follow from this flow:

• Keep the secured key out of screenshots, support chats and shared documents. Anyone with it can sign fake results.
• If customers say they paid but orders stay “Pending payment”, the gateway’s callback is probably not reaching your site. Check whether a security plugin, a firewall rule or maintenance mode is blocking it.

How do you test a gateway before real customers use it?

Test before you tell anyone the store is open.

• Use a sandbox if there is one. Safepay’s setup article describes a separate sandbox dashboard with its own API keys, where test cards move no real money. PayFast’s developer documentation says a sandbox is available for its API, so ask whether your plugin can use it.
• If you only have live keys, pay a small real order yourself. Check that the order moves to “Processing”, that both you and the customer get the email, and that the amount shows in the gateway’s dashboard. Then refund it. PayFast’s FAQ says the merchant starts a refund and it takes 7 to 21 working days, depending on the customer’s bank, so use an amount you can wait for.
• Test the failures too. Cancel on the gateway’s page, use a card with too little balance, and press the back button halfway. Each one should leave the order unpaid, with a clear message for the customer.

Which option should you start with?

It depends on what you sell and to whom:

• Physical products, mostly local customers, no NTN yet. Start with cash on delivery and bank transfer. Both work on day one.
• Digital products, courses or services. Cash on delivery makes no sense here. You need a gateway, or bank transfer with a manual check on every order.
• Customers outside Pakistan. You need a gateway that takes international Visa and Mastercard. Both gateways above say they do.
• Growing order volume. Add up the time you spend each day matching bank deposits to orders, and compare it with the gateway fees on your own order sizes.

From your hosting, a gateway needs two things: a site on https, and a callback address it can reach. If your store is hosted with us, open a ticket once your merchant account is approved and we will walk you through the plugin setup. The WooCommerce hosting page has the details, and our checklist on what to check before you buy hosting covers the rest.

Frequently asked questions

Can I use PayFast without an NTN?

No. PayFast’s FAQ says a valid NTN is mandatory for all merchants, including individuals.

Is the “Payfast” plugin in the WordPress directory the same as PayFast Pakistan?

No. The plugins named Payfast in the WordPress.org directory are built for Payfast in South Africa, a different company. Get PayFast Pakistan’s WooCommerce plugin from PayFast itself.

Do I need a plugin for cash on delivery?

No. Cash on delivery and direct bank transfer are built into WooCommerce. Turn them on under WooCommerce, Settings, Payments.

How long does PayFast take to pay me?

PayFast’s FAQ gives T+2 working days, which means two working days after the payment, not counting weekends and public holidays.

Can customers outside Pakistan pay my store?

Yes, with a gateway that takes international cards. PayFast accepts international Visa and Mastercard, and Safepay charges an extra 0.3% on international cards. Local wallets such as JazzCash and Easypaisa work only for customers in Pakistan.