Accept payments from Bangladeshi customers directly in your WooCommerce store.
Supports bKash and SSLCommerz with a clean hosted payment flow.
Author: Md. Rashedul Islam
Plugin Site: bpgw.rifatxtra.com
GitHub: BPGW on GitHub
License: GPL v2 or later
- Security: Callbacks now verify the returned payment/transaction against the originating order (bKash
merchantInvoiceNumber, SSLCommerztran_id) so a transaction from one order can no longer complete a different order. - Security: Enabled strict TLS certificate verification on all bKash and SSLCommerz API calls (previously disabled), using the CA bundle shipped with WordPress.
- Security: The settings AJAX handler now requires the
manage_optionscapability and sanitizes the nonce. - Security: Stopped writing sensitive data (bKash access token, callback signature) to the logs.
- Fix: bKash access token is now cached separately per mode (sandbox/live) and per app key, so switching mode or credentials no longer reuses a stale token.
- New: Hourly reconciliation job that re-validates recent unpaid orders whose gateway callback never arrived (e.g. the customer closed the browser after paying) and completes them automatically.
- Initial release with bKash and SSLCommerz hosted payment support, WooCommerce Blocks checkout, and admin settings.
| Gateway | Status | Type |
|---|---|---|
| bKash | ✅ Live | Hosted Payment Flow |
| SSLCommerz | ✅ Live | Hosted Payment Flow |
| Manual Payment | 🔜 Coming Soon | Personal Account Payment |
| Nagad | 🔜 Coming Soon | — |
| Rocket | 🔜 Coming Soon | — |
| Upay | 🔜 Coming Soon | — |
- PHP 8.0 or higher
- WordPress 6.0 or higher
- WooCommerce 7.0 or higher
- SSL certificate (required by bKash and SSLCommerz for live mode)
- Download the latest release ZIP from GitHub Releases
- Go to WordPress Admin → Plugins → Add New → Upload Plugin
- Upload the ZIP file and click Install Now
- Click Activate Plugin
- Download and extract the ZIP file
- Upload the
bangladesh-payment-gateways-woocommercefolder to/wp-content/plugins/ - Go to WordPress Admin → Plugins
- Find BPGW and click Activate
Go to WordPress Admin → BPGW
| Setting | Description |
|---|---|
| Sandbox Mode | Enable this during development/testing. Disables for all gateways at once. |
Go to WooCommerce → Settings → Payments → bKash → Manage
| Field | Description |
|---|---|
| Enable/Disable | Turn bKash on or off at checkout |
| Title | Label shown to customers at checkout |
| App Key | From your bKash merchant account |
| App Secret | From your bKash merchant account |
| Username | From your bKash merchant account |
| Password | From your bKash merchant account |
- Apply for a bKash merchant account at pgw.bkash.com
- Once approved, log in to your merchant portal
- Navigate to API Credentials
- Copy your App Key, App Secret, Username, and Password
- For sandbox testing, use credentials from developer.bka.sh
Register this URL in your bKash merchant portal:
https://yoursite.com/?wc-api=bpgw_bkash_callback
Replace yoursite.com with your actual domain.
After payment, bKash returns to this URL with query parameters like:
?wc-api=bpgw_bkash_callback&order_id=16&paymentID=TR0011...&status=success&signature=...&apiVersion=1.2.0-beta/
The plugin does not trust this redirect alone — it verifies payment server-to-server before marking the order paid.
Go to WooCommerce → Settings → Payments → SSLCommerz → Manage
| Field | Description |
|---|---|
| Enable/Disable | Turn SSLCommerz on or off at checkout |
| Title | Label shown to customers at checkout |
| Store ID | From your SSLCommerz merchant account |
| Store Password | From your SSLCommerz merchant account |
- Register at sslcommerz.com
- Once approved, log in to your merchant panel
- Go to Store Settings
- Copy your Store ID and Store Password
- For sandbox, register at sandbox.sslcommerz.com
Register these in your SSLCommerz merchant panel:
Success URL: https://yoursite.com/?wc-api=bpgw_sslcommerz_callback
Fail URL: https://yoursite.com/?wc-api=bpgw_sslcommerz_callback
Cancel URL: https://yoursite.com/?wc-api=bpgw_sslcommerz_callback
IPN URL: https://yoursite.com/?wc-api=bpgw_sslcommerz_ipn
On callback, the plugin validates order ownership and gateway match, ignores already-paid orders, handles explicit failed/cancelled statuses, and then verifies the transaction server-to-server before marking the order paid.
Enable Sandbox Mode in WordPress Admin → BPGW to switch all gateways to test mode.
Get sandbox credentials from developer.bka.sh
Use your sandbox Store ID and Password from sandbox.sslcommerz.com
Customer selects gateway at checkout
↓
Clicks Place Order
↓
Plugin creates payment request via API
↓
Customer redirected to gateway hosted page
↓
Customer completes payment
↓
Gateway redirects back to your store
↓
Plugin verifies payment via API
↓
WooCommerce order marked as paid
↓
Customer sees Order Received page
Does this plugin store card numbers or sensitive payment data?
No. All payments happen on the gateway's hosted page. No payment data touches your server.
Does this work with WooCommerce Blocks checkout?
Yes. Both classic shortcode checkout and the new block-based checkout are supported.
Can I use both gateways at the same time?
Yes. Enable both and customers can choose at checkout.
If both are enabled, both methods are shown in block checkout as separate options.
What currency does this support?
BDT (Bangladeshi Taka) only.
Is this plugin free?
Yes. Free forever. GPL licensed. No premium version.
A PHP documentation website and landing site are included under site/.
- Docs app entry:
site/docs/index.php - Local run instructions:
site/docs/README.md - Landing site entry:
site/index.php
- 🐛 Bug Reports: GitHub Issues
- 💬 Discussion: GitHub Discussions
- 🌐 Website: bpgw.rifatxtra.com
Contributions are welcome. Please read CONTRIBUTING.md before submitting a pull request.
Areas where help is needed:
- Nagad gateway integration
- Rocket gateway integration
- Upay gateway integration
- Unit tests
- Documentation improvements
- Fixed WooCommerce Blocks registration conflict so bKash and SSLCommerz can appear together when both are enabled
- Improved bKash callback handling for subdomain/public return URLs
- Added stronger callback validation and logging for
order_id,paymentID,status,signature, andapiVersion - Updated bKash verification flow to fetch token safely during callback verification
- Initial release
- bKash hosted payment flow
- SSLCommerz hosted payment flow
- Sandbox mode
- WooCommerce Blocks support
- PHP 8.0+ compatibility