{"id":10827,"date":"2026-05-21T02:29:48","date_gmt":"2026-05-20T18:29:48","guid":{"rendered":"https:\/\/aeosub.com\/secure-card-gateway-for-epay-paycenter-piraeus-bank\/"},"modified":"2026-05-21T02:29:48","modified_gmt":"2026-05-20T18:29:48","slug":"secure-card-gateway-for-epay-paycenter-piraeus-bank","status":"publish","type":"post","link":"https:\/\/aeosub.com\/zh\/secure-card-gateway-for-epay-paycenter-piraeus-bank\/","title":{"rendered":"WebHosting4U Secure Card Gateway for ePay Paycenter (Piraeus Bank)"},"content":{"rendered":"<div class=\"post-img\" style=\"margin-bottom: 25px\"><img decoding=\"async\" src=\"https:\/\/ps.w.org\/secure-card-gateway-for-epay-paycenter-piraeus-bank\/assets\/banner-1544x500.png?rev=3539821\" alt=\"WebHosting4U Secure Card Gateway for ePay Paycenter (Piraeus Bank)\" style=\"width: 100%;height: auto;border-radius: 12px\"><\/div>\n<div class=\"plugin-info-card\" style=\"border: 1px solid #e2e8f0;border-radius: 10px;overflow: hidden;margin-bottom: 30px;font-family: -apple-system, system-ui, sans-serif;background: #fff\">\n<table style=\"width: 100%;border-collapse: collapse;font-size: 14px\">\n<tr style=\"border-bottom: 1px solid #edf2f7\">\n<th style=\"padding: 15px 20px;text-align: left;width: 35%;color: #4a5568;background: #fcfcfc\"><img decoding=\"async\" src=\"https:\/\/ps.w.org\/secure-card-gateway-for-epay-paycenter-piraeus-bank\/assets\/icon-256x256.png?rev=3539821\" style=\"width: 40px;height: 40px;border-radius: 6px;margin-right: 12px;vertical-align: middle\"> Developer<\/th>\n<td style=\"padding: 15px 20px;font-weight: 500\"><a href=\"https:\/\/profiles.wordpress.org\/webhosting4ugr\/\" target=\"_blank\" rel=\"noopener\">webhosting4ugr<\/a><\/td>\n<\/tr>\n<tr style=\"border-bottom: 1px solid #edf2f7\">\n<th style=\"padding: 12px 20px;text-align: left;color: #4a5568;background: #fcfcfc\">Version<\/th>\n<td style=\"padding: 12px 20px\">v1.0.28<\/td>\n<\/tr>\n<tr style=\"border-bottom: 1px solid #edf2f7\">\n<th style=\"padding: 12px 20px;text-align: left;color: #4a5568;background: #fcfcfc\">Active Installs<\/th>\n<td style=\"padding: 12px 20px\">0 +<\/td>\n<\/tr>\n<tr style=\"border-bottom: 1px solid #edf2f7\">\n<th style=\"padding: 12px 20px;text-align: left;color: #4a5568;background: #fcfcfc\">Requires \/ Tested<\/th>\n<td style=\"padding: 12px 20px\">6.3 \/ 7.0<\/td>\n<\/tr>\n<tr style=\"border-bottom: 1px solid #edf2f7\">\n<th style=\"padding: 12px 20px;text-align: left;color: #4a5568;background: #fcfcfc\">Last Updated<\/th>\n<td style=\"padding: 12px 20px\">2026-05-20 6:17pm GMT<\/td>\n<\/tr>\n<tr>\n<th style=\"padding: 12px 20px;text-align: left;color: #4a5568;background: #fcfcfc\">Official Link<\/th>\n<td style=\"padding: 12px 20px\"><a href=\"https:\/\/wordpress.org\/plugins\/secure-card-gateway-for-epay-paycenter-piraeus-bank\/\" target=\"_blank\" style=\"text-decoration: none;color: #4a3bca;font-weight: bold\" rel=\"noopener\">View Details \u2192<\/a><\/td>\n<\/tr>\n<\/table><\/div>\n<div class=\"plugin-short-desc\" style=\"margin: 20px 0;padding: 12px 15px;background: #f9fafb;border-left: 4px solid #4a3bca;border-radius: 6px;font-style: italic;color: #4a5568\">Independent WooCommerce gateway by WebHosting4U for the ePay Paycenter (Piraeus Bank \/ Euronet Merchant Services) Redirection service.<\/div>\n<p><strong>\u0395\u03bb\u03bb\u03b7\u03bd\u03b9\u03ba\u03ac:<\/strong><\/p>\n<p>\u0391\u03bd\u03b5\u03be\u03ac\u03c1\u03c4\u03b7\u03c4\u03bf \u03c0\u03c1\u03cc\u03c3\u03b8\u03b5\u03c4\u03bf \u03c0\u03cd\u03bb\u03b7\u03c2 \u03c0\u03bb\u03b7\u03c1\u03c9\u03bc\u03ae\u03c2 WooCommerce \u03b1\u03c0\u03cc \u03c4\u03b7 WebHosting4U \u03b3\u03b9\u03b1<br \/>\n\u03c4\u03b7\u03bd \u03c5\u03c0\u03b7\u03c1\u03b5\u03c3\u03af\u03b1 <em>ePay Paycenter Redirection<\/em> \u03c4\u03b7\u03c2 \u03a4\u03c1\u03ac\u03c0\u03b5\u03b6\u03b1\u03c2 \u03a0\u03b5\u03b9\u03c1\u03b1\u03b9\u03ce\u03c2 \/<br \/>\nEuronet Merchant Services. \u03a5\u03bb\u03bf\u03c0\u03bf\u03b9\u03b5\u03af \u03c0\u03bb\u03ae\u03c1\u03c9\u03c2 \u03c4\u03b7\u03bd \u03b5\u03c0\u03af\u03c3\u03b7\u03bc\u03b7 \u03c0\u03c1\u03bf\u03b4\u03b9\u03b1\u03b3\u03c1\u03b1\u03c6\u03ae<br \/>\n<em>Redirection v2.9<\/em>:<\/p>\n<ul>\n<li>\u0388\u03ba\u03b4\u03bf\u03c3\u03b7 \u03bc\u03bf\u03bd\u03b1\u03b4\u03b9\u03ba\u03bf\u03cd \u03b5\u03b9\u03c3\u03b9\u03c4\u03b7\u03c1\u03af\u03bf\u03c5 (TranTicket) \u03bc\u03ad\u03c3\u03c9 SOAP Ticketing Web<br \/>\nService \u03bc\u03b5 \u03ba\u03c9\u03b4\u03b9\u03ba\u03bf\u03c0\u03bf\u03af\u03b7\u03c3\u03b7 UTF-8.<\/li>\n<li>\u0391\u03c5\u03c4\u03cc\u03bc\u03b1\u03c4\u03b7 \u03b1\u03bd\u03b1\u03ba\u03b1\u03c4\u03b5\u03cd\u03b8\u03c5\u03bd\u03c3\u03b7 POST \u03c3\u03c4\u03b7\u03bd \u03b1\u03c3\u03c6\u03b1\u03bb\u03ae \u03c3\u03b5\u03bb\u03af\u03b4\u03b1 \u03c0\u03bb\u03b7\u03c1\u03c9\u03bc\u03ae\u03c2 \u03c4\u03b7\u03c2 \u03c4\u03c1\u03ac\u03c0\u03b5\u03b6\u03b1\u03c2<br \/>\n(<code>pay.aspx<\/code>) \u2014 \u03c4\u03b1 \u03b4\u03b5\u03b4\u03bf\u03bc\u03ad\u03bd\u03b1 \u03ba\u03ac\u03c1\u03c4\u03b1\u03c2 \u03b4\u03b5\u03bd \u03c0\u03b5\u03c1\u03bd\u03bf\u03cd\u03bd \u03c0\u03bf\u03c4\u03ad \u03b1\u03c0\u03cc \u03c4\u03bf\u03bd \u03b4\u03b9\u03b1\u03ba\u03bf\u03bc\u03b9\u03c3\u03c4\u03ae<br \/>\n\u03c4\u03bf\u03c5 \u03ba\u03b1\u03c4\u03b1\u03c3\u03c4\u03ae\u03bc\u03b1\u03c4\u03bf\u03c2.<\/li>\n<li>\u03a0\u03bb\u03ae\u03c1\u03b7\u03c2 \u03b5\u03c0\u03b1\u03bb\u03ae\u03b8\u03b5\u03c5\u03c3\u03b7 HashKey HMAC-SHA256 \u03c3\u03b5 \u03ba\u03ac\u03b8\u03b5 \u03b5\u03c0\u03b9\u03c4\u03c5\u03c7\u03b7\u03bc\u03ad\u03bd\u03b7 \u03b1\u03c0\u03ac\u03bd\u03c4\u03b7\u03c3\u03b7<br \/>\n\u03c0\u03c1\u03b9\u03bd \u03c7\u03b1\u03c1\u03b1\u03ba\u03c4\u03b7\u03c1\u03b9\u03c3\u03c4\u03b5\u03af \u03b7 \u03c0\u03b1\u03c1\u03b1\u03b3\u03b3\u03b5\u03bb\u03af\u03b1 \u03c9\u03c2 \u03b5\u03be\u03bf\u03c6\u03bb\u03b7\u03bc\u03ad\u03bd\u03b7.<\/li>\n<li>\u03a5\u03c0\u03bf\u03c3\u03c4\u03ae\u03c1\u03b9\u03be\u03b7 \u03c3\u03c5\u03bd\u03b1\u03bb\u03bb\u03b1\u03b3\u03ce\u03bd Sale \u03ba\u03b1\u03b9 \u03a0\u03c1\u03bf\u03ad\u03b3\u03ba\u03c1\u03b9\u03c3\u03b7\u03c2 (Preauthorization).<\/li>\n<li>\u03a3\u03c5\u03bc\u03c0\u03bb\u03ae\u03c1\u03c9\u03c3\u03b7 \u03c0\u03b5\u03b4\u03af\u03c9\u03bd 3-D Secure \u03b1\u03c0\u03cc \u03c4\u03b7 \u03b4\u03b9\u03b5\u03cd\u03b8\u03c5\u03bd\u03c3\u03b7 \u03c7\u03c1\u03ad\u03c9\u03c3\u03b7\u03c2 \/ \u03b1\u03c0\u03bf\u03c3\u03c4\u03bf\u03bb\u03ae\u03c2<br \/>\n\u03c4\u03bf\u03c5 WooCommerce.<\/li>\n<li>\u03a3\u03c5\u03bc\u03b2\u03b1\u03c4\u03cc\u03c4\u03b7\u03c4\u03b1 \u03bc\u03b5 HPOS (Custom Order Tables) \u03ba\u03b1\u03b9 WooCommerce Blocks<br \/>\ncheckout.<\/li>\n<\/ul>\n<p><strong>\u03a0\u03c1\u03bf\u03cb\u03c0\u03cc\u03b8\u03b5\u03c3\u03b7:<\/strong> \u03c0\u03c1\u03ad\u03c0\u03b5\u03b9 \u03bd\u03b1 \u03ad\u03c7\u03b5\u03c4\u03b5 \u03c5\u03c0\u03bf\u03b3\u03b5\u03b3\u03c1\u03b1\u03bc\u03bc\u03ad\u03bd\u03bf \u03c3\u03c5\u03bc\u03b2\u03cc\u03bb\u03b1\u03b9\u03bf \u03b1\u03c0\u03bf\u03b4\u03bf\u03c7\u03ae\u03c2 \u03bc\u03b5 \u03c4\u03b7\u03bd<br \/>\nEuronet Merchant Services \/ \u03a4\u03c1\u03ac\u03c0\u03b5\u03b6\u03b1 \u03a0\u03b5\u03b9\u03c1\u03b1\u03b9\u03ce\u03c2 \u03ba\u03b1\u03b9 \u03bd\u03b1 \u03b4\u03b9\u03b1\u03b8\u03ad\u03c4\u03b5\u03c4\u03b5 \u03c4\u03b1<br \/>\n\u03b4\u03b9\u03b1\u03c0\u03b9\u03c3\u03c4\u03b5\u03c5\u03c4\u03ae\u03c1\u03b9\u03b1 <code>AcquirerId<\/code>, <code>MerchantId<\/code>, <code>PosId<\/code>, <code>Username<\/code>,<br \/>\n    Password. \u03a4\u03bf \u03c0\u03c1\u03cc\u03c3\u03b8\u03b5\u03c4\u03bf \u03b4\u03b5\u03bd \u03c0\u03b1\u03c1\u03ad\u03c7\u03b5\u03b9 \u03b4\u03b9\u03ba\u03bf\u03cd\u03c2 \u03c4\u03bf\u03c5 \u03b4\u03bf\u03ba\u03b9\u03bc\u03b1\u03c3\u03c4\u03b9\u03ba\u03bf\u03cd\u03c2<br \/>\n\u03bb\u03bf\u03b3\u03b1\u03c1\u03b9\u03b1\u03c3\u03bc\u03bf\u03cd\u03c2.<\/p>\n<p>\u0397 \u03c0\u03bb\u03ae\u03c1\u03b7\u03c2 \u03b5\u03bb\u03bb\u03b7\u03bd\u03b9\u03ba\u03ae \u03bc\u03b5\u03c4\u03ac\u03c6\u03c1\u03b1\u03c3\u03b7 \u03c4\u03b7\u03c2 \u03c3\u03b5\u03bb\u03af\u03b4\u03b1\u03c2 \u03c4\u03bf\u03c5 \u03c0\u03c1\u03bf\u03c3\u03b8\u03ad\u03c4\u03bf\u03c5 \u03c3\u03c4\u03bf WordPress.org<br \/>\n\u03b8\u03b1 \u03b5\u03af\u03bd\u03b1\u03b9 \u03b4\u03b9\u03b1\u03b8\u03ad\u03c3\u03b9\u03bc\u03b7 \u03bc\u03ad\u03c3\u03c9 \u03c4\u03bf\u03c5 <a href=\"https:\/\/translate.wordpress.org\/projects\/wp-plugins\/secure-card-gateway-for-epay-paycenter-piraeus-bank\/\" rel=\"nofollow ugc noopener\" target=\"_blank\">translate.wordpress.org<\/a><br \/>\n\u03bc\u03cc\u03bb\u03b9\u03c2 \u03b5\u03b3\u03ba\u03c1\u03b9\u03b8\u03b5\u03af \u03b1\u03c0\u03cc \u03c4\u03b7\u03bd \u03ba\u03bf\u03b9\u03bd\u03cc\u03c4\u03b7\u03c4\u03b1. \u0394\u03b5\u03af\u03c4\u03b5 \u03b5\u03c0\u03af\u03c3\u03b7\u03c2 \u03c4\u03bf \u03c3\u03c5\u03bd\u03bf\u03b4\u03b5\u03c5\u03c4\u03b9\u03ba\u03cc<br \/>\n    readme-el.txt \u03b3\u03b9\u03b1 \u03c4\u03b7\u03bd \u03bf\u03bb\u03bf\u03ba\u03bb\u03b7\u03c1\u03c9\u03bc\u03ad\u03bd\u03b7 \u03b5\u03bb\u03bb\u03b7\u03bd\u03b9\u03ba\u03ae \u03c4\u03b5\u03ba\u03bc\u03b7\u03c1\u03af\u03c9\u03c3\u03b7.<\/p>\n<p><strong>English:<\/strong><\/p>\n<p>This plugin integrates WooCommerce with the ePay Paycenter Redirection<br \/>\nservice operated by Piraeus Bank \/ Euronet Merchant Services. It implements<br \/>\nthe official Redirection v2.9 specification end to end:<\/p>\n<ul>\n<li>SOAP Ticketing Web Service (<code>IssueNewTicket<\/code>) with UTF-8 payload.<\/li>\n<li>Auto-submitted HTML form POST redirection to the Paycenter secure<br \/>\npayment page (<code>pay.aspx<\/code>) so card data never touches your server.<\/li>\n<li>Full HMAC-SHA256 HashKey verification for every successful callback<br \/>\nbefore marking an order as paid.<\/li>\n<li>Support for Sale and Preauthorization transactions.<\/li>\n<li>3-D Secure auxiliary fields populated from the WooCommerce billing \/<br \/>\nshipping address.<\/li>\n<li>HPOS (Custom Order Tables) and WooCommerce Blocks checkout support.<\/li>\n<\/ul>\n<p><strong>You must have signed an acquiring contract with Euronet Merchant<br \/>\nServices \/ Piraeus Bank and obtained <code>AcquirerId<\/code>, <code>MerchantId<\/code>, <code>PosId<\/code>,<br \/>\n    Username and <code>Password<\/code> credentials before using this plugin.<\/strong> The<br \/>\nplugin does not provide test or sandbox accounts on its own; please<br \/>\ncontact Euronet Merchant Services to request one.<\/p>\n<h4>Affiliation and trademark notice<\/h4>\n<p>This plugin is independent software published by <strong>WebHosting4U<\/strong> and is<br \/>\n<strong>not affiliated with, endorsed by, sponsored by, or otherwise officially<br \/>\nconnected to<\/strong> Piraeus Bank S.A., Euronet Merchant Services, or<br \/>\nAutomattic Inc. The third-party names &#8220;ePay&#8221;, &#8220;Paycenter&#8221;, &#8220;Piraeus Bank&#8221;<br \/>\nand &#8220;WooCommerce&#8221; are trademarks of their respective owners and are<br \/>\nused here in good faith, after the unaffiliation marker &#8220;for&#8221;, solely<br \/>\nto describe the third-party service this plugin integrates with, in<br \/>\nline with the WordPress.org Detailed Plugin Guidelines on third-party<br \/>\ntrademarks. The bundled accepted card brands image<br \/>\n(<code>assets\/img\/wp-cards.png<\/code>) is included with the rights-holder&#8217;s<br \/>\nauthorization for the merchant distribution scope of this plugin.<\/p>\n<h4>User tracking and consent<\/h4>\n<p>This plugin does <strong>not<\/strong> load any analytics, telemetry, advertising,<br \/>\nfingerprinting, profiling or behavioural tracking code, neither on the<br \/>\nstorefront nor in the WordPress admin. It does not set cookies on<br \/>\nvisitor browsers, does not contact any first-party or third-party<br \/>\nanalytics endpoint, and does not collect aggregated or individual<br \/>\nusage statistics from the merchant&#8217;s installation. The only outbound<br \/>\nnetwork traffic the plugin generates is the strictly transactional<br \/>\ntraffic documented in the <em>External services<\/em> section below, which<br \/>\nis required to complete a payment the merchant has explicitly<br \/>\nconfigured the plugin to perform. No user-tracking consent prompt is<br \/>\ntherefore required by this plugin (Plugin Review Team Guidelines 7<br \/>\nand 9).<\/p>\n<h3>External services<\/h3>\n<p>This plugin reaches out to three external services. Two are operated<br \/>\nby Euronet Merchant Services on behalf of Piraeus Bank S.A. for the<br \/>\n&#8220;ePay Paycenter&#8221; payment redirection product (mandatory for the<br \/>\nplugin&#8217;s core function). The third is a publicly available Cloudflare<br \/>\nendpoint used only in the admin panel to help store owners configure<br \/>\nfirewall rules for payment callbacks.<\/p>\n<h4>1. ePay Paycenter Ticketing Web Service<\/h4>\n<ul>\n<li>What it is: a SOAP \/ ASMX endpoint published by Euronet Merchant<br \/>\nServices that issues a single-use <code>TranTicket<\/code> for each card<br \/>\npayment attempt. The ticket is then handed to the customer&#8217;s<br \/>\nbrowser as a hidden form field that POSTs to the secure payment<br \/>\npage, so cardholder data never touches the merchant server.<\/li>\n<li>Endpoint: <code>https:\/\/paycenter.piraeusbank.gr\/services\/tickets\/issuer.asmx<\/code><\/li>\n<li>What is sent: the merchant credentials provided by Euronet Merchant<br \/>\nServices (AcquirerId, MerchantId, PosId, Username and an MD5 hash<br \/>\nof the Password), the order&#8217;s MerchantReference (numeric WooCommerce<br \/>\norder id with a short random suffix), the transaction amount and<br \/>\nISO 4217 numeric currency code, the request type (Sale or<br \/>\nPreauthorization), and the 3-D Secure auxiliary fields populated<br \/>\nfrom the WooCommerce order: billing email, cardholder name,<br \/>\nbilling address (city \/ lines \/ post code \/ state \/ ISO 3166<br \/>\nnumeric country code), shipping address when present, and the<br \/>\ncustomer&#8217;s mobile phone number formatted as <code>CC-Number<\/code>. No<br \/>\ncardholder data, no PAN, no CVV, no expiry, and no analytics<br \/>\nidentifier is ever transmitted; cardholder data is collected<br \/>\nexclusively on the bank&#8217;s secure payment page.<\/li>\n<li>When it is sent: once per successful checkout submission, at the<br \/>\nmoment WooCommerce hands control to the gateway&#8217;s<br \/>\n<em>Pay for order<\/em> page, immediately before the customer is<br \/>\nauto-redirected to the bank.<\/li>\n<\/ul>\n<h4>2. ePay Paycenter Redirection page<\/h4>\n<ul>\n<li>What it is: the bank-hosted secure payment page where the customer<br \/>\nenters card details and completes the 3-D Secure challenge. The<br \/>\nplugin renders an auto-submitted HTML form whose <code>action<\/code> attribute<br \/>\nis the URL below.<\/li>\n<li>Endpoint: <code>https:\/\/paycenter.piraeusbank.gr\/redirection\/pay.aspx<\/code><\/li>\n<li>What is sent: the merchant identifiers (AcquirerId, MerchantId,<br \/>\nPosId, User), the language code, the MerchantReference issued<br \/>\nduring ticketing, and a per-order ParamBackLink so the bank&#8217;s<br \/>\nCancel button returns the customer to the correct WordPress<br \/>\nendpoint. The TranTicket itself is read by the customer&#8217;s<br \/>\nbrowser from the hidden form field; the merchant server is not<br \/>\nthe originator of the redirect POST.<\/li>\n<li>When it is sent: once per checkout, immediately after the<br \/>\nTicketing call above succeeds.<\/li>\n<li>Inbound counterpart: Paycenter posts a signed transaction<br \/>\nresponse (HMAC-SHA256 HashKey) back to the plugin&#8217;s WC-API<br \/>\ncallback URL on the merchant site<br \/>\n(<code>https:\/\/&lt;merchant-site&gt;\/?wc-api=epay_paycenter<\/code>). This is the<br \/>\nsame service &#8211; the merchant site is the Notification \/ Success \/<br \/>\nFailure \/ Backlink target the merchant configures in the<br \/>\nEuronet portal. No data leaves the merchant server on this<br \/>\ninbound leg; the plugin only reads, verifies, and acts on the<br \/>\nresponse.<\/li>\n<\/ul>\n<h4>Service operator and legal links<\/h4>\n<p>Both endpoints above are operated by Euronet Merchant Services<br \/>\n(epay) for Piraeus Bank S.A.. Before activating the gateway,<br \/>\nmerchants must review and agree to the operator&#8217;s terms and<br \/>\nprivacy policy:<\/p>\n<ul>\n<li>Service homepage: <a href=\"https:\/\/epayworldwide.com\/\" rel=\"nofollow ugc noopener\" target=\"_blank\">https:\/\/epayworldwide.com\/<\/a> (Euronet Merchant<br \/>\nServices \/ epay corporate site)<\/li>\n<li>Greek market homepage: <a href=\"https:\/\/www.epaygreece.gr\/\" rel=\"nofollow ugc noopener\" target=\"_blank\">https:\/\/www.epaygreece.gr\/<\/a><\/li>\n<li>Terms of Service: <a href=\"https:\/\/www.epaygreece.gr\/oroi-xrisis\/\" rel=\"nofollow ugc noopener\" target=\"_blank\">https:\/\/www.epaygreece.gr\/oroi-xrisis\/<\/a><\/li>\n<li>Privacy Policy: <a href=\"https:\/\/www.epaygreece.gr\/politiki-aporritou\/\" rel=\"nofollow ugc noopener\" target=\"_blank\">https:\/\/www.epaygreece.gr\/politiki-aporritou\/<\/a><\/li>\n<li>Piraeus Bank corporate site: <a href=\"https:\/\/www.piraeusbank.gr\/\" rel=\"nofollow ugc noopener\" target=\"_blank\">https:\/\/www.piraeusbank.gr\/<\/a><\/li>\n<li>Piraeus Bank Privacy Policy: <a href=\"https:\/\/www.piraeusbank.gr\/en\/idiwtes\/protection-of-personal-data\" rel=\"nofollow ugc noopener\" target=\"_blank\">https:\/\/www.piraeusbank.gr\/en\/idiwtes\/protection-of-personal-data<\/a><\/li>\n<\/ul>\n<p>If any of the above URLs change after publication, please consult<br \/>\nthe live operator websites for the current version of the relevant<br \/>\ndocument. The plugin&#8217;s behaviour is not affected by such updates<br \/>\nbecause the operator&#8217;s terms apply to the merchant&#8217;s relationship<br \/>\nwith Euronet Merchant Services \/ Piraeus Bank, not to the plugin<br \/>\nitself. Merchants remain responsible for keeping their own<br \/>\nprivacy policy and terms aligned with the data flows documented<br \/>\nabove (notably the transmission of billing \/ shipping address<br \/>\nfields and customer email \/ phone to the bank for 3-D Secure<br \/>\nauthentication).<\/p>\n<h4>3. Cloudflare IPv4 list<\/h4>\n<ul>\n<li>What it is: a publicly available plain-text file published by<br \/>\nCloudflare, Inc. that lists the current IPv4 CIDR ranges used by<br \/>\nCloudflare&#8217;s edge network. The plugin fetches this file once every<br \/>\n12 hours (or 15 minutes on failure) via <code>wp_safe_remote_get()<\/code> and<br \/>\ncaches the result in a WordPress transient.<\/li>\n<li>Endpoint: <code>https:\/\/www.cloudflare.com\/ips-v4\/<\/code><\/li>\n<li>What is sent: a standard HTTP GET request with no personal data,<br \/>\nno order information, no credentials, and no cookies. The only<br \/>\nidentifying information in the request is the plugin&#8217;s <code>User-Agent<\/code><br \/>\nstring (<code>secure-card-gateway-for-epay-paycenter-piraeus-bank\/VERSION<\/code>).<\/li>\n<li>Why: when the plugin&#8217;s admin settings page detects that the<br \/>\nWordPress site is served through Cloudflare (via the CF-Ray \/<br \/>\nCF-Connecting-IP \/ CDN-Loop request headers), it displays the<br \/>\ncurrent Cloudflare IPv4 ranges so the store owner can copy them<br \/>\ninto an email to Euronet Merchant Services to whitelist them for<br \/>\npayment callbacks. Without this list, callbacks routed through<br \/>\nCloudflare edge IPs may be rejected by the bank&#8217;s firewall.<\/li>\n<li>When: only when an administrator views the gateway&#8217;s WooCommerce<br \/>\nsettings page and Cloudflare is detected on the incoming request.<br \/>\nIt is never triggered on the storefront or by guest\/customer visits.<\/li>\n<li>Cloudflare service homepage: <a href=\"https:\/\/www.cloudflare.com\/\" rel=\"nofollow ugc noopener\" target=\"_blank\">https:\/\/www.cloudflare.com\/<\/a><\/li>\n<li>Cloudflare Privacy Policy: <a href=\"https:\/\/www.cloudflare.com\/privacypolicy\/\" rel=\"nofollow ugc noopener\" target=\"_blank\">https:\/\/www.cloudflare.com\/privacypolicy\/<\/a><\/li>\n<li>Cloudflare Terms of Service: <a href=\"https:\/\/www.cloudflare.com\/terms\/\" rel=\"nofollow ugc noopener\" target=\"_blank\">https:\/\/www.cloudflare.com\/terms\/<\/a><\/li>\n<\/ul>\n<p>No data is sent to any third party other than the three endpoints<br \/>\nlisted above.<\/p>\n<h3>WAF compatibility<\/h3>\n<p>Payment-gateway callbacks are a recurring source of false-positive hits<br \/>\non shared-hosting firewalls. Paycenter&#8217;s failure-case response bodies<br \/>\ncontain patterns &#8211; <code>TransactionDateTime=-<\/code>, empty <code>HashKey<\/code> on declined<br \/>\ntransactions, dash-only separators, Greek <code>ResponseDescription<\/code> text &#8211;<br \/>\nthat overlap with signatures used for SQL injection, generic anomaly<br \/>\nscoring, and Java \/ Jetty CVE probes. If your host enables those<br \/>\nrules with default severity, callbacks for every test case except the<br \/>\napproved one can be dropped with a <code>403 Forbidden<\/code> before they reach<br \/>\nPHP, leaving you with an order stuck in <em>pending payment<\/em> and no<br \/>\nentry in WooCommerce logs.<\/p>\n<p>The plugin ships three things to help with this:<\/p>\n<ol>\n<li>A &#8220;Callback diagnostics&#8221; card on the gateway settings screen with a<br \/>\none-click <strong>Test callback URL<\/strong> button. It POSTs a realistic<br \/>\ndeclined-transaction payload from the WordPress server to the<br \/>\nplugin&#8217;s own <code>?wc-api=epay_paycenter<\/code> endpoint and reports whether<br \/>\nthe request was intercepted by a host WAF (403 \/ 406 \/ 501) or<br \/>\nreached PHP (302 redirect back to checkout, the expected outcome<br \/>\nfor a synthetic merchant reference). No order state is modified.<br \/>\nUse it <em>before<\/em> enabling live payments.<\/li>\n<li>An early &#8220;Callback envelope&#8221; INFO log line (since 1.0.10) so any<br \/>\ncallback that is accepted by PHP but rejected later can be<br \/>\ndistinguished from callbacks that never reached PHP at all.<\/li>\n<li>The following copy-paste exclusion snippets for the most common<br \/>\nhosting stacks. Always scope exclusions to your callback URL, never<br \/>\nglobally:<\/li>\n<\/ol>\n<ul>\n<li>\n<p><strong>cPanel \/ cPFence<\/strong> (the rule that flagged this plugin with<br \/>\n id 243420 is a Jetty CVE rule that has no defensive value on a<br \/>\n PHP \/ WordPress site):<\/p>\n<pre><code> cpfence --disable-waf-domain-byid yourdomain.tld 243420\n<\/code><\/pre>\n<p>If further generic-anomaly rules fire, prefer domain-scoped<br \/>\n disables over server-wide ones.<\/p>\n<\/li>\n<li>\n<p><strong>ModSecurity + OWASP CRS<\/strong> (Plesk, managed Apache, LiteSpeed in<br \/>\n ModSec mode). Drop the following stanza into a <code>.htaccess<\/code><br \/>\n override next to your WordPress root (or ask your host to add it<br \/>\n to the vhost config):<\/p>\n<pre><code> &lt;LocationMatch \"^\/(wc-api\/epay_paycenter\/?|?wc-api=epay_paycenter)\"&gt;\n     SecRuleRemoveById 942100 942110 942120 942150 942180 942200 942260 942330 942340 942360 942370 942410 942440 942450 942480\n     SecRuleRemoveById 920272 920273 920274\n     SecRuleRemoveById 932100 932105 932115\n     SecRuleRemoveById 921110 921120 921140 921150 921160\n &lt;\/LocationMatch&gt;\n<\/code><\/pre>\n<p>The IDs above are the SQLi, generic-protocol and command-injection<br \/>\n families most frequently triggered by payment-callback bodies.<\/p>\n<\/li>\n<li>\n<p><strong>Imunify360<\/strong>: disable the <code>owasp<\/code> ruleset for the callback URL<br \/>\n via the Imunify360 admin, or add to an <code>.htaccess<\/code> override:<\/p>\n<pre><code> &lt;LocationMatch \"wc-api\/?epay_paycenter\"&gt;\n     SecRuleEngine DetectionOnly\n &lt;\/LocationMatch&gt;\n<\/code><\/pre>\n<\/li>\n<li>\n<p><strong>BitNinja<\/strong>: whitelist the URL in the BitNinja panel under<br \/>\n <em>WAF 2.0 <span aria-hidden=\"true\" class=\"wp-exclude-emoji\">\u2192<\/span> Exceptions<\/em>. Match pattern:<br \/>\n     \/wc-api\/epay_paycenter\/ (and <code>\/?wc-api=epay_paycenter<\/code>).<\/p>\n<\/li>\n<li><strong>LiteSpeed WAF \/ QUIC.cloud<\/strong>: in <em>QUIC.cloud <span aria-hidden=\"true\" class=\"wp-exclude-emoji\">\u2192<\/span> WAF <span aria-hidden=\"true\" class=\"wp-exclude-emoji\">\u2192<\/span> Exception<br \/>\n Rules<\/em>, add both the path and query-string forms of the callback<br \/>\n URL.<\/li>\n<\/ul>\n<p>Important notes:<\/p>\n<ul>\n<li>Whitelisting must be <strong>scoped to the callback URL<\/strong>, not server-wide.<br \/>\nNever disable a WAF rule globally for this plugin.<\/li>\n<li>If you run Cloudflare \/ Sucuri \/ Akamai in front of your origin,<br \/>\nthose CDN-level WAFs must be tested separately &#8211; the in-admin<br \/>\nself-test loops back on your origin and will not exercise them.<br \/>\nCloudflare users can open a <em>Firewall Event<\/em> in the dashboard,<br \/>\nfind the blocked event matching the callback URL, and click<br \/>\n<em>Create rule skip<\/em> scoped to the URL.<\/li>\n<li>When using the plugin&#8217;s &#8220;Bank integration data&#8221; card, submit the<br \/>\ncanonical single-URL form (<code>https:\/\/your-site.tld\/?wc-api=epay_paycenter<\/code>)<br \/>\nto Euronet Merchant Services. Do not paste the URL into two portal<br \/>\nfields (base + path) &#8211; some merchant portals concatenate them, which<br \/>\nproduces a malformed callback URL that will be blocked regardless<br \/>\nof WAF configuration.<\/li>\n<\/ul>\n<p>Troubleshooting: customer sees only &#8220;-1&#8221; after the bank return<\/p>\n<p>A literal <code>-1<\/code> rendered in the browser after the shopper is<br \/>\nredirected back from the Paycenter page is almost always one of<br \/>\nthree things. Use <strong>WooCommerce -&gt; Status -&gt; Logs<\/strong> to disambiguate<br \/>\nby searching the <code>epay-paycenter-*<\/code> log file for the transaction<br \/>\ntimestamp:<\/p>\n<ol>\n<li><code>Callback envelope<\/code> line is present, <code>Paycenter callback received<\/code><br \/>\nis present, <code>Paycenter failure redirect issued<\/code> is present. The<br \/>\nplugin handled the callback end-to-end. The <code>-1<\/code> came from a<br \/>\ndownstream redirect target (most often a Blocks-based <code>\/checkout\/<\/code><br \/>\npage that does not render legacy <code>wc_add_notice()<\/code> errors). Since<br \/>\n1.0.12 the failure redirect targets the order&#8217;s Pay-for-order URL<br \/>\ninstead of <code>\/checkout\/<\/code>, which renders notices correctly; since<br \/>\n1.0.14 the decline message is also queued as an order-scoped<br \/>\ntransient so it is rendered on the pay-for-order page regardless<br \/>\nof whether the cross-origin POST from the bank carried the<br \/>\nWooCommerce session cookie (SameSite=Lax commonly strips it).<\/li>\n<li><code>Callback envelope<\/code> line is present but the other two are<br \/>\nmissing. The callback reached PHP but the handler aborted early<br \/>\n(missing MerchantReference, mismatched order, HashKey mismatch,<br \/>\nalready-paid order). The log entry that immediately follows<br \/>\nthe envelope tells you which branch fired.<\/li>\n<li>None of the three lines are present. The callback POST never<br \/>\nreached PHP. Either a host WAF dropped it (see the exclusion<br \/>\nsnippets above) or the URL registered in the Euronet portal does<br \/>\nnot match this WordPress site&#8217;s WC-API URL. Confirm with the<br \/>\nin-admin &#8220;Test callback URL&#8221; diagnostic.<\/li>\n<li>A <code>Paycenter callback received on a malformed URL<\/code> line appears<br \/>\n(ERROR severity), with <code>received_wc_api<\/code> showing a composite<br \/>\nvalue such as <code>epay_paycenter\/wc-api\/epay_paycenter\/<\/code>. This<br \/>\nmeans the Euronet portal has been configured with a <em>doubled<\/em><br \/>\ncallback URL &#8211; usually because the merchant pasted the full URL<br \/>\ninto a portal field while the portal&#8217;s own base URL already<br \/>\ncontained the <code>\/wc-api\/epay_paycenter\/<\/code> path, or pasted a<br \/>\nrelative path where an absolute URL was expected. Since 1.0.13<br \/>\nthe plugin re-maps such malformed requests to the canonical<br \/>\nhandler so the payment still completes, but the ERROR entry<br \/>\nwill keep firing on every transaction until the merchant<br \/>\ncorrects the URL in the Euronet Merchant Services portal. Set<br \/>\nSuccess \/ Failure URL to exactly<br \/>\n   https:\/\/\/?wc-api=epay_paycenter (no trailing<br \/>\nslash, no extra path) and the ERROR entries stop.<\/li>\n<\/ol>\n<p>The &#8220;-1&#8221; itself comes from WooCommerce core: <code>WC_API::handle_api_requests()<\/code><br \/>\nends every WC-API request with an unconditional <code>die( '-1' )<\/code>. Two<br \/>\nclasses of request used to trigger it and both are now fixed:<\/p>\n<ul>\n<li><strong>Listener-not-registered race<\/strong> (solved in 1.0.12): the plugin<br \/>\nnow registers its callback listener at <code>plugins_loaded<\/code> through a<br \/>\ndedicated dispatcher so the listener is always present before the<br \/>\ndispatch fires, even when a conflicting plugin delays gateway<br \/>\ninstantiation.<\/li>\n<li><strong>Malformed <code>wc-api<\/code> query var<\/strong> (solved in 1.0.13): doubled \/<br \/>\npath-suffixed callback URLs configured in the Euronet portal are<br \/>\nnow transparently normalised at <code>parse_request<\/code> priority -10, so<br \/>\nthe dispatcher receives the canonical gateway id and never falls<br \/>\nthrough to the <code>die( '-1' )<\/code> tail.<\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"<p>Independent WooCommerce gateway by WebHosting4U for the ePay Paycenter (Piraeus Bank \/ Euronet Merchant Services) Redirection service.<\/p>","protected":false},"author":1,"featured_media":9317,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[252],"tags":[1342,1551,813,1552,569,555],"class_list":["post-10827","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-trends","tag-credit-card","tag-greece","tag-payment-gateway","tag-piraeus-bank","tag-woocommerce","tag-wordpress-plugin"],"_links":{"self":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts\/10827","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/comments?post=10827"}],"version-history":[{"count":0,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts\/10827\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/media\/9317"}],"wp:attachment":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/media?parent=10827"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/categories?post=10827"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/tags?post=10827"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}