How to set up PayFast on a WooCommerce store

To set up PayFast on a WooCommerce store, you first open a PayFast Pakistan merchant account, which needs an NTN and a KYC check. Then you install the WooCommerce plugin that PayFast’s team gives you, enter your merchant ID and secured key under WooCommerce, Settings, Payments, make sure your checkout page can show the plugin, and pay one small real order to prove the whole loop works. The plugins named “Payfast” in the WordPress.org directory are for a different company in South Africa, so do not start there.

This guide walks through each step, explains what happens between your store and PayFast when a customer pays, and covers the problems that stop a paid order from showing as paid.

What do you need before you start?

Have these ready before you touch the plugin:

• An approved PayFast merchant account. PayFast’s FAQ page says a valid NTN is mandatory for every merchant, individuals included, and that onboarding takes three to four working days with the KYC check. It also lists a one-time setup fee of Rs 20,000 and no monthly or annual charges. Our guide on whether you need an NTN for a payment gateway covers the paperwork.
• Your merchant ID and secured key. PayFast issues these after onboarding. Its developer page tells merchants to keep them on the server, because they are used to request a one-time token for every payment.
• A store on https. Customers type their details on your checkout, and PayFast sends them back to your site after they pay. If the browser shows “Not secure”, fix that first with our SSL certificate help guide.
• Prices in rupees. The token request in PayFast’s protocol carries the currency code PKR, so set your store currency to Pakistani rupee under WooCommerce, Settings, General.
• Admin access that lets you upload plugins. You will install a zip file, not a plugin from the directory search.

Which PayFast plugin should you install?

We searched the WordPress.org plugin directory for “payfast” through its public API. The first result is “WooCommerce Payfast Gateway”, published by WooCommerce, with more than 30,000 active installs. Its description calls Payfast one of South Africa’s most popular payment gateways. The next PayFast-named result tells you to sign up at payfast.io, the South African company’s site. Neither one talks to a PayFast Pakistan merchant account, and no plugin from PayFast Pakistan appeared in the results.

PayFast Pakistan’s checkout page says it has ready-made plugins for WooCommerce, Shopify and Magento. Ask the onboarding team for the WooCommerce plugin when your account is approved, and install only the file they send you. A plugin from a forum post or a file-sharing link can send your secured key anywhere.

If you are still choosing a gateway, our guide to accepting online payments on WooCommerce in Pakistan compares PayFast with the other options, including cash on delivery.

How do you install and set up the plugin?

The steps below follow the PayFast plugin build installed on a WooCommerce store we run. Field names can differ in a newer build, so match them against what PayFast sends you.

1. Upload the zip. Go to Plugins, Add New, Upload Plugin, choose the file and click Install Now.
2. Activate it while the store is quiet. The build we installed switched itself on as a payment method straight after activation, filled with a demo merchant ID instead of yours. Activate it at a time when no customer is checking out, and go straight to the next step.
3. Open its settings. Go to WooCommerce, Settings, Payments and click Manage next to PayFast.
4. Enter your details. Paste your merchant ID and secured key, and type the merchant name you want customers to see on PayFast’s page. The build we installed also had fields for a secret word and a store ID. Our account did not need them, so they stayed empty. Leave any field empty unless PayFast gave you a value for it.
5. Set the title and description. These are the words customers see at checkout. Something plain such as “Pay by card or wallet through PayFast” works.
6. Save, then check the checkout page as a customer. Add a product to the cart in a private browser window and open the checkout. If PayFast is missing, read the next section.

Paste the secured key straight from PayFast into the field. Do not send it through chat, email or a screenshot. Anyone who has it can sign a fake “payment successful” message for your store.

Why doesn’t PayFast show on the block checkout?

WooCommerce has two checkout pages. The newer block checkout is the default on new stores, and the older classic checkout uses the [woocommerce_checkout] shortcode. A payment plugin has to be built for the block checkout to appear there. WooCommerce’s guide to customizing the cart and checkout pages says that a gateway that is not compatible with the block checkout may not appear as a payment option there. If every active gateway is incompatible, customers see a warning that no payment methods are available.

The PayFast build on the store we run did not support the block checkout, so that store uses the classic checkout. Check your own build the same way:

1. Open the Checkout page in the editor and select the Checkout block. WooCommerce can show a notice that names incompatible extensions, with a button to switch to the classic checkout.
2. If there is no notice but PayFast still does not appear for customers, ask PayFast whether your plugin version supports the block checkout.

To switch back to the classic checkout, WooCommerce’s guide gives these steps. Open the Checkout page in the editor. With a block theme, that is Appearance, Editor, Pages. With an older theme, it is Pages, All Pages. Select the Checkout block in the List View, click the Transform button at the left of the block toolbar, choose Classic Shortcode and save. Do the same for the Cart page, because the cart and checkout blocks are meant to be switched together.

What happens when a customer pays?

We built the card checkout on this site on PayFast’s hosted payment page. It follows the same protocol as PayFast’s WooCommerce plugin, so your store goes through the same five steps:

1. Your server asks PayFast for a one-time token. It sends your merchant ID, secured key, the amount, the order number and the currency, server to server. The secured key never reaches the customer’s browser.
2. The customer’s browser goes to PayFast. On the store we run, the plugin shows WooCommerce’s order payment page, which holds a form with the token, amount, order number and return addresses. That form sends the customer on to PayFast’s payment page.
3. The customer pays on PayFast’s page. Card or wallet details and the 3D Secure or OTP step all happen there. The card number never touches your hosting.
4. PayFast reports the result. On our checkout the result arrives twice, once through the customer’s browser and once straight from PayFast’s server. On the store we run, the plugin receives it at an address that ends in /wc-api/CALLBACK.
5. Your store checks the signature. It computes a SHA-256 hash of the order number, the secured key, the merchant ID and the result code, joined with a vertical bar, and compares it with the validation hash PayFast sent. Only a matching hash with result code 000 marks the order as paid. Any other code means the payment did not go through.

Step 5 is the reason the secured key must stay private. It is also why a “thank you” page alone proves nothing. Anyone can type a return address into a browser, but only someone with your secured key can produce a matching hash.

How do you test PayFast before customers use it?

PayFast’s developer documentation says a sandbox is available. Ask the onboarding team whether your plugin can use it and which test details to enter. If you only have live keys, test with real money:

1. Create a cheap test product, for example a hidden Rs 100 item.
2. Buy it yourself with your own card, from a private browser window.
3. Check that the order moves from “Pending payment” to “Processing” on its own, without you touching it.
4. Check that you got the new order email and the customer address got the order confirmation. If not, see our guide on why WooCommerce order emails don’t arrive.
5. Find the same payment in your PayFast merchant dashboard and match the amount and order number.
6. Refund it. PayFast’s FAQ says the merchant starts a refund and it takes 7 to 21 working days, depending on the customer’s bank.

Then test the failures. Cancel on PayFast’s page, try a card without enough balance, and close the tab halfway through. Each one should leave the order unpaid, and no failure should mark an order as “Processing”.

Why do paid orders stay on “Pending payment”?

When the customer’s bank shows a payment but the order still says “Pending payment”, the result from PayFast did not reach your store, or your store rejected it. WooCommerce’s email troubleshooting guide makes the same point. A paid order stuck on “Pending payment” means the gateway is having trouble talking to your site, and no order email goes out until the status changes.

Check these in order:

• A firewall or security plugin. PayFast’s server has to reach your callback address. A security plugin, a firewall rule or a bot check in front of your site can block it while customers browse normally.
• Maintenance or “coming soon” mode. A page that blocks visitors also blocks PayFast’s server.
• The wrong secured key. If the key in WooCommerce does not match your account, every hash check fails and the store refuses every result. Paste it again from PayFast.
• Http and https mixed up. If your WordPress address still starts with http, return addresses can point to the wrong place. Set both addresses under Settings, General to https.
• A cache in front of the callback. Exclude the callback address and the checkout pages from page caching.

Open the order notes on a stuck order too. If the plugin wrote a result there, the callback arrived and the problem is the check. If there is nothing, the callback never got through.

When does the money reach your bank?

PayFast’s FAQ gives settlement on a T+2 working day cycle, which means two working days after the payment, not counting weekends and public holidays. The FAQ lists Visa and Mastercard with 3D Secure, UnionPay, PayPak, bank transfers, JazzCash, Easypaisa, and Raast QR and Request to Pay. It does not print the per-transaction rate, so ask for it in writing before you sign.

If you sell subscriptions, ask PayFast before you build around automatic renewals. Its developer page describes stored card tokens and recurring charges on its API, but that does not tell you whether the WooCommerce plugin you receive uses them.

From your hosting, PayFast needs a site on https and a callback address it can reach. If your store is hosted with us, open a ticket once your merchant account is approved and we will help you through the setup. The WooCommerce hosting page has the details.

Frequently asked questions

Is the Payfast plugin in the WordPress directory the same as PayFast Pakistan?

No. The plugins named Payfast in the WordPress.org directory are built for Payfast in South Africa, a different company. Get the WooCommerce plugin from PayFast Pakistan’s own team.

Can I set up PayFast without an NTN?

No. PayFast’s FAQ says a valid NTN is mandatory for all merchants, including individuals. For an individual, the NTN is your CNIC number once you register on FBR’s Iris portal.

Why is PayFast not showing on my checkout page?

Check that it is enabled under WooCommerce, Settings, Payments. If it is enabled but missing, your checkout is probably the block checkout and your plugin build does not support it. Switch the Cart and Checkout blocks to the classic shortcode, or ask PayFast for a build that supports blocks.

How much does PayFast cost?

PayFast’s FAQ lists a one-time setup fee of Rs 20,000, which is not refundable, and no monthly or annual charges. It does not publish the per-transaction rate, so ask for it before you sign.

The customer paid, so why is the order still “Pending payment”?

PayFast’s result did not reach your store, or your store rejected it. Check for a firewall or security plugin blocking the callback, maintenance mode, page caching on the callback address, and a wrong secured key.