內容簡介
此外掛為 WooCommerce 商店提供 Moka United 虛擬 POS 整合，專為在土耳其進行付款的商家設計。透過 Moka United 的托管付款頁面，商家無需處理任何卡片資料，確保安全性與合規性。
【主要功能】
• 托管付款頁面，無需收集卡片資料
• 支援 3D Secure 認證
• 顯示分期付款計畫及利率
• 產品頁面顯示分期付款表格
• 實時讀取卡片品牌標誌及分期總額
• 測試模式以便於上線前演練
外掛標籤
開發者團隊
② 後台搜尋「Optimist Hub Payment Gateway with Moka United for WooCommerce」→ 直接安裝（推薦）
原文外掛簡介
This plugin adds a Moka United virtual POS integration to your WooCommerce store, for merchants taking payments in Turkey.
It uses Moka United’s hosted payment page (Ortak Ödeme Sayfası / WebPos): the customer is redirected to Moka United to pay, so you can start taking cards without ever handling card data yourself.
The card number, expiry date and CVC code are therefore never entered on your site, never pass through your server and are never stored in your database. Your PCI-DSS scope stays at SAQ A.
How it works
The customer selects “Moka United” at checkout. The plugin renders no card fields at all (has_fields = false) — only your description text.
The plugin creates a payment session on Moka United’s WebPos service and redirects the customer to Moka United’s hosted payment page.
The customer enters their card details, chooses an installment plan and completes 3D Secure entirely on Moka United’s page.
Moka United returns the customer to your store with a signed result. The plugin verifies the signature, re-checks the amount and confirms the transaction server-to-server with Moka United before marking the order as paid.
Features
Redirect (hosted payment page) flow — no card data is ever collected by the store (PCI scope SAQ A)
3D Secure authentication
Installments, including the interest/commission rates of the customer’s own card, shown on Moka United’s payment page
An installment table on the product page, so shoppers can see the monthly cost before they reach checkout
The card brand logos and per-installment totals are read live from your Moka United dealer account
Compatible with both the classic (shortcode) and the block-based checkout
High-Performance Order Storage (HPOS) compatible
Test mode, which points every request at the Moka United test environment so you can rehearse the full flow before going live
Transaction log screen
English source with a bundled Turkish (tr_TR) translation; the interface follows the site language
Requirements
WordPress 6.4 or higher
WooCommerce 8.0 or higher
PHP 7.4 or higher
A Moka United merchant account (dealer code, API username and password)
TLS 1.2 or higher
External services
This plugin connects to Moka United services in order to process payments. This section describes exactly what data is sent, to which service, for what purpose and when.
1. Moka United — Hosted Payment Page (payment session creation)
Service address: https://clientwebpos.mokaunited.com (test environment: https://clientwebpos.refmokaunited.com)
Endpoint: POST /Api/WebPos/CreateWebPosRequest
Data sent: payment amount and currency, order number, order description, buyer full name, buyer email address, buyer phone number (optional), buyer address, basket line items (product name, quantity, unit price), dealer code and API username
Purpose: to create a payment session and redirect the customer to Moka United’s secure hosted payment page
When: when the customer places the order and the payment is initiated
No card number, expiry date or CVC code is sent in this request. Those details are entered by the customer directly on Moka United’s own page, in the customer’s own browser.
Provider policies (Moka United) — terms of use: https://www.mokaunited.com/legal-documents-and-representatives/terms-of-use ; privacy policy: https://www.mokaunited.com/legal-documents-and-representatives/privacy-policy
2. Moka United — PaymentDealer services (transaction verification)
Service address: https://service.mokaunited.com (test environment: https://service.refmokaunited.com)
Endpoints: POST /PaymentDealer/GetDealerPaymentTrxDetailList (transaction verification)
Data sent: transaction code and order number for verification; dealer code, API username and password for authentication
Purpose: to confirm server-to-server that the payment actually succeeded
When: on the payment return (callback)
Provider policies (Moka United) — terms of use: https://www.mokaunited.com/legal-documents-and-representatives/terms-of-use ; privacy policy: https://www.mokaunited.com/legal-documents-and-representatives/privacy-policy
3. Moka United — dealer information
Service address: https://service.mokaunited.com (test environment: https://service.refmokaunited.com)
Endpoint: POST /Dealer/GetDealer
Data sent: dealer code and API username
Purpose: to validate the connection credentials
When: when the settings are saved
Provider policies (Moka United) — terms of use: https://www.mokaunited.com/legal-documents-and-representatives/terms-of-use ; privacy policy: https://www.mokaunited.com/legal-documents-and-representatives/privacy-policy
4. Moka United — card logo CDN
Service address: https://cdn.moka.com/Content/BankLogo/
Data sent: nothing by the plugin. The customer’s browser requests one PNG image per card family shown in the installment table (for example https://cdn.moka.com/Content/BankLogo/AXESS.png). As with any other image on a web page, that request carries the image URL, the visitor’s IP address and the browser’s referrer and user agent.
Purpose: to display the card family logo (Axess, Bonus, Maximum, …) beside that family’s rows in the installment table.
When: when a product page, or a page containing the [moka_taksit_tablosu] shortcode, renders the installment table. The image is fetched by the visitor’s browser, never by the store’s server.
This is a static asset host. No payment data, no personal data and no credentials are sent to it, and the table works without it: a card family whose logo is unavailable is shown with its name only.
Provider policies (Moka United) — terms of use: https://www.mokaunited.com/legal-documents-and-representatives/terms-of-use ; privacy policy: https://www.mokaunited.com/legal-documents-and-representatives/privacy-policy
When Test Mode is enabled, requests 2 and 3 are sent to the Moka United test environment (service.refmokaunited.com) instead, and request 1 is sent to the test WebPos address (clientwebpos.refmokaunited.com). The card logo CDN has no test counterpart; it is a static asset host. No request is made to Moka United at all while the gateway is disabled.
No card data is ever sent to any Moka United service by this plugin, and no card data is ever collected on your site. Card details travel from the customer’s browser directly to Moka United’s payment page. The plugin neither collects, nor transmits, nor stores them (PCI scope SAQ A).
The service provider is Moka United (Moka Ödeme Kuruluşu A.Ş.), not Optimist Hub. The terms of use and privacy policy of that provider are linked under each service above. Because this plugin uses Moka United’s payment service, the following also applies:
Moka United terms and conditions of payment services: https://www.mokaunited.com/legal-documents-and-representatives/terms-and-conditions-of-payment-services
This plugin contacts no other external service. It does not use its own update server; updates are delivered through WordPress.org.
Some further domains appear in the plugin’s code but are never contacted. They are listed here so the list above is exhaustive:
moka.com — the host allow-list used when validating a logo URL that the Moka API returned. It is a validation rule, not a connection; the only logo requests actually made are the cdn.moka.com images described in 4.
service.moka.com — the bundled Moka PHP client’s built-in default address. The plugin always sets the PaymentDealer address explicitly (see 2 and 3 above), so this default is never used.
service.refmoka.com — a retired test address. It appears only in a code comment recording that it no longer works; nothing calls it.
github.com — appears only in the file headers that the Strauss build tool writes into the bundled library, crediting itself. No request is made.
