Available now · Version 2.0.0

MMJ eCommerce Card Payments.

Take card orders online and charge them on the card terminal you already have. The card is encrypted in your customer's browser, unlocked only with your passphrase, and deleted once you charge it.

$49a year, one store

Buy now Try the demo

Cancel any timeWooCommerce 7 to 10Not a payment processor

The card form at WooCommerce checkout: card number, expiry and security code, with the note that the card is encrypted on the page

The card form your customers see at checkout. Screenshot from our test store.

The facts

What it is: A WooCommerce payment method that captures card details at checkout for you to charge later on your own terminal. It is not a payment processor and does not charge cards.
Made by: MMJ eCommerce, a QWEBMASTER product. First released in 2016 as Canna-Commerce. Version 2.0.0 released October 12, 2026.
Price: $49 per year for one store. Renews yearly; cancel any time from your account. Updates and support included while active. The plugin keeps working if you stop renewing; it just stops getting updates.
Works with: WordPress 6.0 or later, WooCommerce 7.0 or later (tested to 10.5), PHP 7.4 to 8.5. Checkout block, classic checkout, the Pay for order page and High-Performance Order Storage.
You need: A card terminal and merchant account that cover what you sell and allow keyed (card-not-present) entry, and a checkout on HTTPS.
Encryption: In the customer's browser: ECDH P-256 key agreement and AES-256-GCM. The plain card number is never posted to your server.
Who can unlock: Only someone with your passphrase. The passphrase is never stored on the site.
Deleted: When you mark the order charged or declined, when it is completed, cancelled, refunded or trashed, and automatically after 7 days (1 to 30, your choice).

Is it right for your store?

Built for stores that can charge cards, just not online.

A good fit if

You run a dispensary, CBD, hemp, smoke or vape shop on WooCommerce.
Online processors turned you down or closed your account, but you have a card terminal or virtual terminal.
Your merchant account covers what you sell and allows keyed entry.
You already take card orders by phone and want the same thing from your website.

Not the right tool if

You have no card terminal or merchant account. The plugin does not charge cards.
Your processor does not allow keyed (card-not-present) entry.
You need the card approved the moment the customer checks out. Here you charge it when you prepare the order.
Your checkout does not run on HTTPS. Browsers only encrypt on secure pages.

How it works

Four steps from checkout to charged.

The card box on a WooCommerce order: passphrase field, Show card button, the unlocked test card, and Mark as charged

The card box on the order screen, with a test card unlocked.

Customer checks out.They choose card payment and type their card. It is encrypted in their browser to your store's key.
You get the order.The email names the order and the last 4 digits. Card numbers are never emailed.
You unlock the card.Open the order and enter your passphrase. Every view is written to the order notes.
You charge and close.Key it into your terminal and click Mark as charged. The card is deleted.

Declined? Mark it declined and the customer can get a link to pay with another card.

Live demo

Try it: this is what your store receives.

Type a test card into the form. It is encrypted the same way the plugin does it, then unlock it with the store passphrase.

Runs in your browser. Nothing is sent.

Test card 4242 4242 4242 4242

Passphrase counter-terminal-42

Checkout card formWaiting for a card

Card number

Expiry Security code

Encrypted on this page before it is sent.

What your website stores

Shown on the order and in your emailnothing yet

No card handy?

What you get

Simple to run, careful with card details.

Set it up in a few minutes: upload, create your passphrase, switch it on. No developer needed.

Encrypted in the browserThe card is locked before it leaves your customer's device. Your site only ever holds the encrypted form.
Only your passphrase opens itOnly administrators and shop managers can unlock. Five wrong tries lock unlocking for 15 minutes.
No card numbers by emailYour order email names the order and the last 4 digits. That is all.
Deleted after chargingCharged, declined, cancelled or left alone for 7 days: the card is gone either way.
Works with today's WooCommerceCheckout block, classic checkout, Pay for order and High-Performance Order Storage.
Cards waiting, at a glanceAn overview screen lists every card still to charge, with a Charge button and the auto-delete date.

Straight answers

What it does not do.

We would rather you know before you buy.

Requirements

WordPress: 6.0 or later, tested to 7.0
WooCommerce: 7.0 or later, tested to 10.5
PHP: 7.4 to 8.5
Checkout: On HTTPS
Payments: Your own card terminal or virtual terminal

It does not process or authorize payments. Your own terminal and merchant account do that.
It does not decide whether you may accept cards for what you sell. That depends on your merchant account terms and the rules where you operate. Check with your processor before you switch it on.
It does not replace your own security. Keep WordPress, WooCommerce and your passwords up to date.
It cannot recover a lost passphrase. Nobody can, including us. You create a new key and those customers pay again.

What changed in version 2.0.0

Rebuilt from the ground up. Cards are encrypted in the customer's browser.
Card digits and security codes are no longer emailed.
New card box on the order screen: unlock, mark as charged, mark as declined with a pay-again link, or delete.
Checkout block, High-Performance Order Storage, Pay for order and PHP 8 support.
Signed automatic updates for licensed sites.

FAQ

Questions about Card Payments.

Something else? Ask us directly. A person who builds the plugin answers.

Sealed green pickup bag next to a jar of cannabis flower

Is it safe to take card details this way?

Version 2 encrypts the card in the customer's browser, stores it only in encrypted form, needs your passphrase to unlock it, logs every view and deletes the card once you have charged it. Card numbers are never emailed.

Is this a payment processor?

No. It collects the card so you can key it into the terminal you already have. You need a terminal and merchant account that cover what you sell and allow keyed entry.

Can I use it if Stripe or Square closed my account?

Yes, if you have a terminal or virtual terminal from a processor that accepts your products. The plugin does not need an online processor.

When is the customer charged?

When you charge the card on your terminal, usually as you prepare the order. The checkout tells the customer that, so nobody expects an instant charge.

What if the card is declined?

Click Mark as declined. You can email the customer a link to pay with another card, and the declined card is deleted.

Does it work with the WooCommerce checkout block?

Yes, plus the classic checkout, the Pay for order page and High-Performance Order Storage.

How long are cards kept?

Until the order is charged, declined, completed, cancelled, refunded or trashed. A card nobody processed is deleted after 7 days. You can set that anywhere from 1 to 30 days. Uninstalling deletes every stored card.

What if I lose my passphrase?

Nobody can recover it, including us. You create a new key, cards stored with the old key are deleted, and those customers pay again.

I use version 1. How do I upgrade?

Upload version 2 over version 1. Settings and orders stay. Card payments stay hidden at checkout until you set a passphrase. Then delete the old card emails version 1 sent, from your inbox and any email log plugin.

I bought version 1. Do I have to pay again?

No. Your license stays lifetime. Use Forgot password on the log in page with the email from your order to reach your account, your license key and the 2.0 download.

What does the $49 a year include?

The plugin for one store, signed automatic updates and support from the people who build it, for as long as the subscription is active. It renews yearly and you can cancel any time from your account. If you stop renewing, the plugin keeps taking card orders; it just stops getting updates.

More plugins