AlkaPay Changelog

v1.2.2 Latest

Fixed On some themes the checkout could hide the "Place Order" button, or the order-received page could lose its summary — our payment-page styling was loading on pages it shouldn't. It now loads only on the M-Pesa payment page.
Fixed The free version no longer shows a stray "Test mode" label on the WooCommerce Payments screen — that only ever applied to Pro's STK Push.
Improved If Pro is installed without an active licence, checkout now shows manual Paybill/Till payment instead of offering automatic STK Push and then failing, with a clear prompt to activate a licence.
Added In Sandbox mode, the payment page and settings now note clearly that manual payments are still real money — only the automatic STK prompt is simulated.

Changed Renamed to "AlkaPay Payment Gateway with M-Pesa for WooCommerce", making clear that AlkaPay is an independent product and not affiliated with Safaricom. Your settings and the checkout are unchanged.
Security The secret in your M-Pesa callback URL is now a stored random value rather than being derived from your site's WordPress security keys. Your callback URL does not change and nothing needs re-registering with Safaricom.
Fixed A payment confirmation that arrived without a result code could mark an order as paid — those are now rejected.

Changed The free version is now built purely around manual M-Pesa payments. Automated STK Push — including trying it in Sandbox — is part of Pro; you can see it on our live demo.
Free "Order Status After Manual Payment" is now yours to set — On Hold, Pending or Processing.
Fixed Admin dates and times now show your store's timezone instead of UTC, so they line up with the M-Pesa SMS.
Security A full pass against the WordPress.org coding standards — output escaping, input sanitisation and translations. Payment behaviour is unchanged.

Added Support for the block-based Cart & Checkout, alongside the classic checkout.
Improved Underpayment recovery, callback-setup guidance, and a refreshed settings experience.
Security Security hardening and a full WordPress.org coding-standards compliance pass.
Fixed Various compatibility and reliability fixes, plus an updated licensing SDK.

Fixed License deactivation now reports honestly — if the license was already removed on the licensing server, the account page no longer shows a false "deactivated" success and instead points you to Sync License.
Fixed Removed a duplicate/stale "plan upgraded" notice that could appear on the account screens.
Improved Account page adds a clear "Reactivate License" action and explains when a site is still linked to a license.
Improved Help & Rate guide now documents manual-payment setup for both Free and Pro.
Improved Larger analytics preview area on the free dashboard.

Free Accept live M-Pesa payments via Paybill or Buy Goods (Till) — your number is shown at checkout and customers confirm with their M-Pesa transaction code.
Free A clean admin dashboard, guided onboarding, and automatic updates.
Pro Live STK Push — the payment prompt is sent straight to the customer's phone and the order completes automatically the moment they enter their PIN.
Pro Automatic payment verification — background C2B matching (checkout, webhook, and a periodic safety-net sweep) plus 1-click verification from the dashboard.
Pro Advanced analytics — revenue trends, success rates, transaction volume, and payment-method breakdown.
Pro Transaction logs with configurable retention and automatic pruning of old files.
Pro Configurable order statuses.
Security AES-256 encryption of API credentials at rest, server-side amount validation (under/over-payment handling), and order-ownership checks on every payment request.
Security A secret, per-site callback URL with a per-shortcode "Secured" indicator; spoofed and replayed callbacks are rejected; phone numbers masked in logs; log files stored outside the web root.
Compatibility WooCommerce HPOS (High-Performance Order Storage). Requires WordPress 5.0+, WooCommerce 6.0+, PHP 7.4+.