Skillmerc Payment Gateway for PayFast

Skillmerc Payment Gateway for PayFast lets South African stores take payments through PayFast’s hosted payment page (card, instant EFT, SnapScan and Mobicred) and keeps WooCommerce order statuses in step with what PayFast actually reports.

It was written to fix the things South African merchants complain about most: order statuses that never update because the ITN callback silently fails, no refund path from the order screen, no High-Performance Order Storage support, and settings scattered across several screens.

What it does

• PayFast hosted checkout for card, instant EFT, SnapScan and Mobicred.
• One toggle to switch between the PayFast sandbox and your live account. Each mode keeps its own credentials, so switching back and forth never means retyping keys.
• Order status sync through Instant Transaction Notification (ITN), with signature verification, source host verification, amount matching, server confirmation and replay protection. Every rejection is logged with the reason, so a broken callback is diagnosable instead of silent.
• Refunds sent to PayFast straight from the WooCommerce order screen (needs API access on your PayFast account).
• Full High-Performance Order Storage (HPOS) compatibility, with no legacy post meta.
• Optional South African number formatting for Rand amounts (R 1 234,56).
• Works the moment you activate it: sandbox mode is on with PayFast’s published test credentials already filled in.
• Every setting is on one screen, at WooCommerce → Settings → Payments → Skillmerc Payment Gateway for PayFast.

External services

This plugin talks to PayFast, and only to PayFast. There is no tracking, no analytics and no phone-home of any kind.

• Shoppers are redirected to https://www.payfast.co.za (or https://sandbox.payfast.co.za in sandbox mode) to complete payment. The order number, order total, item description and the billing name and email address are sent so PayFast can process and receipt the payment.
• When PayFast notifies your store of a payment, the plugin posts the notification back to https://www.payfast.co.za/eng/query/validate (or the sandbox equivalent) to confirm PayFast really sent it. This is PayFast’s documented server confirmation step and is what makes a forged callback unusable.
• If you switch refunds on, refund requests are sent to https://api.payfast.co.za. This only happens when you refund an order in WooCommerce, and the setting is off by default.
• Source host verification does a DNS lookup of PayFast’s ITN hostnames. You can switch it off with the wc_payfast_pro_verify_itn_source filter if your host sits behind a proxy.

PayFast is a service of DPO South Africa (Pty) Ltd. Terms: https://payfast.io/legal/ and privacy policy: https://payfast.io/privacy-policy/