A payment gateway integration between WooCommerce and Lloyds Cardnet Payments.
Connect your WooCommerce store to Lloyds Bank Cardnet with this secure payment gateway plugin. Offer your customers a reliable and seamless way to pay using Visa, Mastercard, American Express, and digital wallets directly from your online store, with real-time processing and flexible configuration options to suit your business needs.
What is Lloyds Bank Cardnet?
Lloyds Bank Cardnet is a secure payment solution that enables businesses to accept a variety of payment methods, including credit and debit cards, Apple Pay, and Google Pay, through their WooCommerce store. This integration seamlessly enhances transaction efficiency and improves customer experience by offering a smooth, uninterrupted payment journey.
How the Plugin Works
The Lloyds Cardnet Gateway plugin for WooCommerce enables your customers to pay securely using their preferred payment method at checkout. Choose between an embedded payment form (Payment.JS) directly on your checkout page or a redirect to the secure Lloyds hosted payment page. Once the transaction is authorised, the payment is confirmed in real time through webhook integration, and order statuses are updated automatically.
From your WooCommerce admin panel, you have complete control over the payment experience. Configure payment methods, manage tokenised cards, process refunds, and monitor all transactions through the built-in reporting dashboard. The plugin supports recurring payments for subscription-based products, MOTO transactions for phone/email orders, and express checkout with Apple Pay and Google Pay on product, cart, and checkout pages.
When to Use This Plugin
This plugin is ideal for any WooCommerce merchant who needs to accept card payments through Lloyds Bank Cardnet. Whether you run an online retail store, offer subscription services, or need to process phone orders, the Lloyds Cardnet Gateway provides a secure, PCI-compliant payment solution that integrates directly into your WooCommerce checkout flow.
Features
- Embedded Payment (Payment.JS) — Seamless checkout with a secure payment form directly on your site using iframes. Card data is handled entirely by Lloyds — never touches your server.
- Hosted Payment Page (HPP) — Redirect customers to the secure Lloyds hosted payment page for PCI compliance with minimal integration effort.
- Apple Pay Support — Allow customers to pay quickly using Apple Pay on compatible devices and browsers for a fast, native payment experience.
- Google Pay Support — Accept payments via Google Pay for a frictionless checkout experience across Android and Chrome.
- Express Checkout — Display Apple Pay and Google Pay buttons on product, cart, and checkout pages, allowing customers to skip the standard checkout process.
- Card Tokenisation — Allow customers to securely save card details for faster future purchases. Card data is never stored on your server.
- Subscription Support — Set up recurring payments for subscription-based services with automatic renewal processing via card payments.
- MOTO Payments — Process Mail Order/Telephone Order payments securely from the WooCommerce admin panel.
- Refund Management — Process full or partial refunds directly from the WooCommerce order page with automatic gateway integration.
- 3D Secure 2 (3DS2) — Smart authentication with dynamic challenge requirements supporting Strong Customer Authentication (SCA) under PSD2 regulations.
- Transaction Reporting — Comprehensive reporting dashboard with advanced filtering, CSV export, and traffic light verification status indicators.
- Real-Time Processing — Instant payment confirmations and status updates via webhook integration.
- Sandbox/Test Mode — Test transactions without processing real payments using Lloyds sandbox credentials.
- Multi-Currency Support — Configure multiple currencies and selling locations based on your merchant account capabilities.
- WooCommerce Blocks — Support for both classic and block-based checkout.
- HPOS Compatible — Full support for WooCommerce High-Performance Order Storage.
- Dedicated Customer Support — Reliable installation and post-integration support from Autify Digital.
Security & Compliance
The Lloyds Cardnet Gateway plugin uses embedded payment forms and hosted payment pages to ensure the highest level of security for your business and your customers. All sensitive payment information, including credit and debit card details, is handled directly by Lloyds Bank Cardnet’s PCI DSS Level 1 certified infrastructure — never on your WordPress server.
This approach means that no customer payment data is entered into, processed by, or stored on your server at any point during the transaction. Your server only receives non-sensitive transaction confirmation data via secure webhook notifications, such as the payment status and reference number. As a result, this integration supports PCI DSS SAQ A compliance, significantly reducing your compliance obligations and security risks.
All API communications are encrypted via HTTPS/TLS. The plugin supports 3D Secure 2 authentication for Strong Customer Authentication (SCA) compliance under PSD2 regulations.
Businesses are responsible for ensuring they are compliant with any necessary financial regulations when using Lloyds Bank Cardnet.
Account & Pricing
A separate Lloyds Bank Cardnet merchant account is required to use this plugin. The account must be set up directly with Lloyds before installing and configuring the plugin — it is not created during the plugin installation process.
To apply for a Lloyds account, visit: Lloyds Bank Cardnet
Additional fees apply for payment processing services provided by Lloyds. These fees are separate from the cost of this plugin and are determined by Lloyds based on your business requirements and transaction volumes. For detailed pricing information, please visit the Lloyds website or contact their sales team directly.
Support
For technical support, customization requests, or general inquiries:
Email: cardnet@autify.co.uk
Helpdesk: https://support.autify.co.uk/
Visit: https://www.autify.co.uk
If you find this plugin useful, please leave a review on WordPress.org — it helps us a lot!
Please note, Autify Digital cannot assist with the Lloyds account setup process or pricing enquiries. For account-related questions, please contact Lloyds directly through their website.
Additional requirements:
- For embedded payments (Payment.JS): REST API Key and API Secret from the Developer Portal, linked to your Store ID by Lloyds Bank.
- For Apple Pay: An Apple Developer account with a configured Apple Pay merchant identifier and certificates.
- For Google Pay: A Google Pay merchant account (for production use).
Customise Your Integration
Looking for something more specific? Get in touch to discuss any custom features or tailored configurations that might enhance your Lloyds Cardnet Gateway integration for WooCommerce. Contact us via cardnet@autify.co.uk.
Trademark
Lloyds and Lloyds Bank are trading names of Lloyds Bank plc. Registered Office: 25 Gresham Street, London EC2V 7HN. Registered in England and Wales no. 2065. Lloyds Bank plc is authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority under registration number 119278. All trademarks, service marks, and trade names referenced in this material are the property of their respective owners.= Support =
For technical support, customisation requests, or general inquiries:
External Services
This plugin relies on the following third-party/external services to function. By using this plugin, data may be transmitted to these services as described below. Please review the respective terms and privacy policies.
1. Lloyds Cardnet Payment Gateway
Used for processing card payments through the Lloyds Bank Cardnet merchant account.
Data sent: Order details, payment amounts, currency, customer billing/shipping address, and card transaction data. Sent when a customer initiates a payment.
– Service Link: Lloyds Cardnet
– Terms of Use: Lloyds Cardnet Terms of Service
– Privacy Policy: Lloyds Cardnet Privacy Policy
2. First Data / Fiserv Payment Processing (IPG Online)
Used for processing hosted payment page (redirect) transactions, Payment JS embedded payments, and refunds via the First Data API.
Data sent: Store ID, API credentials, payment amounts, currency, order reference, card tokens, and refund details. Sent when a customer makes a payment, when a session is initialized for embedded payments, or when a merchant processes a refund.
– API Endpoints:
– Hosted Payment Page (Sandbox): https://test.ipg-online.com/connect/gateway/processing
– Hosted Payment Page (Production): https://www.ipg-online.com/connect/gateway/processing
– API (Sandbox): https://cert.api.firstdata.com/
– API (Production): https://prod.api.firstdata.com/
– Terms of Use: Fiserv Terms of Use
– Privacy Policy: Fiserv Privacy Notice
3. First Data Payment JS Client Library
A JavaScript library loaded from First Data servers to render the secure embedded payment form (card number, expiry, CVV fields) on the checkout page. The library handles card data directly — no card details pass through your server.
Data sent: Card details are entered directly into the Payment JS iframe and transmitted to First Data. The plugin receives a payment token in return. The library is loaded when the checkout page renders with the embedded payment method enabled.
– JavaScript (Sandbox): https://lib.paymentjs.firstdata.com/uat/client-2.0.0.js
– JavaScript (Production): https://lib.paymentjs.firstdata.com/prod/client-2.0.0.js
– Documentation: Payment JS Documentation
– Terms of Use: Fiserv Terms of Use
– Privacy Policy: Fiserv Privacy Notice
4. Fiserv Checkout Solution
Used as an alternative checkout integration via the Fiserv eCommerce API for payment processing.
Data sent: Store ID, API credentials, order amounts, currency, and checkout configuration. Sent when a customer initiates a payment using the checkout solution method.
– API (Production): https://prod.emea.api.fiservapps.com/exp/v1/checkouts
– API (Sandbox): https://prod.emea.api.fiservapps.com/sandbox/exp/v1/checkouts
– Terms of Use: Fiserv Terms of Use
– Privacy Policy: Fiserv Privacy Notice
5. Apple Pay
Used to enable Apple Pay as an express payment method on product, cart, and checkout pages.
Data sent: The merchant identifier, site domain, and display name are sent to Apple during merchant validation when a customer initiates an Apple Pay payment. Payment and shipping data is then processed through the First Data / Fiserv API.
– Service: Apple Pay
– Terms of Use: Apple Pay Platform Web Merchant Terms
– Privacy Policy: Apple Privacy Policy
6. Google Pay
Used to enable Google Pay as an express payment method on product, cart, and checkout pages. A JavaScript library is loaded from Google servers to render the Google Pay button and handle the payment flow.
Data sent: Payment token data (encrypted by Google) and customer shipping/billing details are sent from the Google Pay interface to the plugin, then processed through the First Data / Fiserv API. The Google Pay JS library is loaded when the Google Pay payment method is enabled.
– JavaScript: https://pay.google.com/gp/p/js/pay.js
– Service: Google Pay
– Terms of Use: Google Pay Terms of Service
– Privacy Policy: Google Privacy Policy
7. Autify Digital License API
Used to validate and manage the plugin license. The plugin contacts Autify Digital’s license server to verify that the license key is valid and active.
Data sent: License key, plugin version, site domain, admin email, contact name, and activation status. Data is sent when the license is activated, deactivated, or periodically synced.
– Service: Autify Digital
– API Endpoint: https://plugin-licenses.autify.co.uk/wp-json/autifydigital/v1/plugin
– Terms of Use: Autify Digital Terms and Conditions
– Privacy Policy: Autify Digital Privacy Policy
Screenshots
Plugin Settings - Configure your Lloyds Bank Cardnet payment gateway with Store ID, API credentials, and payment mode selection.
Payment Failed Page - Clear error messaging when a payment is declined, allowing customers to retry with alternative payment methods.
Order Management - View and manage orders with complete transaction details including payment reference and customer information.
Refund Processing - Process full or partial refunds directly from the WooCommerce order page with automatic gateway integration.
Order Confirmation - Customer order received page showing successful transaction completion with order details.
Transaction Reports - Comprehensive transaction reporting dashboard showing payment status, order IDs, and transaction history.
Checkout Experience - Embedded payment form (Payment.JS) integrated directly into the WooCommerce checkout page with card details input and Google Pay option.
Do I need a Lloyds Bank Cardnet merchant account?
Yes. A separate Lloyds Bank Cardnet merchant account is required. You must apply directly with Lloyds before installing and configuring the plugin. To apply, visit: Lloyds Bank Cardnet
Is customer payment data stored on my server?
No. The plugin uses embedded payment forms and hosted payment pages. All sensitive payment information is handled directly by Lloyds Bank Cardnet’s PCI DSS compliant servers — never on your WordPress website. This supports PCI DSS SAQ A compliance.
What payment methods are supported?
The plugin supports all major credit and debit cards (Visa, Mastercard, American Express, etc.) via embedded Payment.JS or hosted payment page, plus Apple Pay and Google Pay digital wallets.
Can I offer both redirect and embedded payment options?
No, you need to choose one payment method — either the redirect to hosted payment page OR the embedded Payment.JS solution on your checkout page.
Can I process refunds?
Yes. Full or partial refunds can be processed directly from the WooCommerce order management interface.
Does the plugin support subscriptions?
Yes, the plugin supports recurring payments for subscription services. This feature is only available with card payments (not digital wallets).
What is MOTO payment functionality?
MOTO (Mail Order/Telephone Order) allows you to securely process payments taken over the phone or email directly from the WooCommerce admin area.
Can customers save their card details?
Yes, through tokenisation, customers can securely save their card details for faster checkout in future purchases. The actual card data is never stored on your server.
What credentials do I need from Lloyds Bank?
You will need your Store ID and Shared Secret (provided when setting up your merchant account). For embedded payments, you will also need a REST API Key and API Secret from the Developer Portal, linked to your Store ID by Lloyds Bank.
Is professional installation available?
Yes, Autify Digital offers a professional installation service where their technical team will configure the plugin to your requirements.
Can I test the plugin before going live?
Yes, Lloyds Bank Cardnet provides test credentials and a sandbox environment. Configure these in the plugin settings to test transactions without processing real payments.
How do I get support?
For technical support, customisation requests, or general inquiries, contact us at cardnet@autify.co.uk or visit autify.co.uk.
ChangeLog
3.0.13
- Fixed – Fatal error when WooPayments is active alongside the plugin, caused by wc_get_checkout_url() being called before WordPress rewrite rules are initialised
- Fixed – Failed card payments incorrectly displaying as “PayPal” in WooCommerce order details when a previous PayPal attempt was made on the same order
- Fixed – Fatal error in updateWcOrderStatus() when order lookup returns false due to reversed condition check
- Fixed – Fatal error in Checkout Solution when store ID validation fails due to referencing undefined paymentJsHelper property
- Fixed – Fatal error in PaymentJS gateway when an invalid or deleted saved card token is used for payment
- Fixed – Fatal error in PaymentJS 3DS status controller when order does not exist, added null check with redirect
- Fixed – Fatal error in redirect payment controller when order does not exist, added null check with redirect
- Fixed – Redirect payment gateway admin settings were never saved due to missing parent::process_admin_options() call
- Fixed – Sensitive data (orderId, purchaseOrderNumber) not being redacted in logs due to case-sensitive key comparison
- Fixed – DateTime::setTimestamp() receiving ISO 8601 string instead of integer in 3DS status response, causing TypeError on PHP 8
- Fixed – Checkout Solution API signature using incorrect timestamp multiplier (100000 instead of 1000 for milliseconds)
- Fixed – 3DS challenge always required for saved card tokens due to $requireChallenge being overwritten unconditionally
- Fixed – Missing die() after wp_safe_redirect() in PaymentJS 3DS status controller allowing continued execution
- Fixed – Undefined array key warning in 3DS response code lookup when response code is not in the lookup array
- Fixed – Session null access fatal error in clear_session_and_delete_client_token() when triggered via admin/cron/REST context
- Fixed – Null safety checks for WC()->cart in Apple Pay and Google Pay wallet enqueue scripts
- Fixed – Null safety checks for wc_get_product() in Apple Pay and Google Pay product page scripts
- Fixed – Missing isset() guards on Google Pay product page merchant_name and merchant_id config values
- Fixed – Undefined array key warnings from getAllConfig() and getAllPaymentjsConfig() when plugin settings are not yet configured
- Fixed – Missing is_wp_error() check on wp_remote_post() in Checkout Solution payment processing
- Fixed – Potential infinite recursion from current_user_can() inside user_has_cap filter callback
- Fixed – Product added to cart before validation in wallet express add-to-cart handler
- Fixed – License manager class not loaded before calling clear_license_sync_cron() during plugin deactivation
- Fixed – Replaced deprecated current_time(‘timestamp’) with time() in unpaid orders cron
- Fixed – Inconsistent use of raw $order_number instead of prefixed $autify_lloyds_order_number in redirect form
- Fixed – Uncaught exception in PaymentJS authorize session AJAX handler causing 500 error, now returns clean JSON error response
- Fixed – Session null access in PaymentJS authorize session when WC()->session is not initialised
- Fixed – Missing isset() guard on live_api_secret in getAllPaymentjsConfig() live mode branch
- Fixed – Undefined property access on iframe_received in method notification URL when database has not been migrated
- Fixed – Added isset() guards on all getAllConfig() and getAllPaymentjsConfig() array key accesses across the plugin to prevent PHP 8 undefined array key warnings
- Fixed – Session null access in saveCard() and save card preference AJAX handler when WC()->session is not initialised
3.0.12
- Compliance – Renamed all script, style, and AJAX action handles to use unique “autify-lloyds-” prefix to meet WordPress plugin directory naming standards
- Compliance – Updated nonce names, transient keys, and lock keys with plugin-specific prefixes to prevent namespace collisions
- Compliance – Renamed global JavaScript variables with “autifyLloyds” namespace to avoid global scope conflicts
- Security – Added nonce verification for Apple Pay and Google Pay payment processing AJAX requests (CSRF protection)
- Security – Added recursive sanitisation of webhook data using sanitize_text_field() across all webhook handlers
- Security – Added input sanitisation for $_GET parameters in admin pages using sanitize_text_field() and wp_unslash()
- Security – Added JSON validation and error checking in PaymentJS webhook handler
- Security – Added header value sanitisation in PaymentJS webhook processing
- Fixed – Added null-safety checks for wc_get_order() across all payment handlers to prevent fatal errors on missing orders
- Fixed – Added isset() guards for AVS/CVV response fields, cart totals, and shipping address data to prevent undefined index notices
- Fixed – Improved JSON decode error handling in Google Pay payment data processing
- Fixed – Added proper validation for shipping methods array access and WP_Query availability checks
- Improved – Order not found errors now display user-friendly notices and redirect to checkout instead of failing silently
- Improved – Improved transaction notification URL validation for incomplete webhook data
- Removed – Legacy deleteOldLogFiles() method from Gateway Helper
- Updated – CSS file references to use prefixed filenames
3.0.11
- Compliance – Removed hard-coded “Powered by” credit link from public-facing payment form to comply with WordPress plugin directory attribution guidelines
- Compliance – Updated External Services section with full disclosure of all third-party services including Terms of Use and Privacy Policy links
- Compliance – Added disclosure for Fiserv Checkout Solution, Apple Pay, Google Pay, and Autify Digital License API external services
- Compliance – Added Fiserv Terms of Use and Privacy Notice links for First Data / IPG Online and Payment JS services
- Fixed – Google Pay shipment issues
3.0.10
- Performance – Removed flush_rewrite_rules from every page load, now only runs on plugin activation/deactivation
- Fixed – WordPress PHPCS compliance improvements
- Improved – 3DS flow improvements
3.0.9
- Added – Configuration to enable or disable subscription
- Fixed – Double Subscription Request
- Fixed – WordPress PHPCS compliance improvements
3.0.8
- Fixed – WordPress PHPCS compliance improvements
- Fixed – GET method call curl issue for the decline transaction
3.0.7
- Added – Transaction Reports table with advanced filtering (status, payment method, date range)
- Added – CSV export functionality for transaction reports with all filters applied
- Added – Full-text search across all transaction columns (Order ID, Amount, Status, Card Details, IPs, etc.)
- Added – Transaction summary statistics showing total transactions, amounts, and refunds
- Added – Traffic light verification status indicators (CVV, Street, Postcode checks) in reports
- Added – Transaction details meta box on WooCommerce order view page with payment and fraud details
- Added – Cardnet Status column in WooCommerce order grid with payment status, verification indicators, and card info
- Added – License sync cron job for automatic license validation
- Improved – Unified refund processing across all payment methods (Card, Apple Pay, Google Pay)
- Improved – Centralised table name management in gateway helper
- Improved – External CSS file for admin styles instead of inline styles
- Improved – Support for both legacy post-based orders and HPOS (High-Performance Order Storage)
- Fixed – WordPress PHPCS compliance improvements
- Fixed – Added translator comments for i18n strings with placeholders
- Fixed – Proper variable prefixing for WordPress coding standards
3.0.6
- Security – Fixed security vulnerabilities with proper sanitisation of $_GET, $_POST, $_REQUEST data
- Security – Added proper validation and sanitisation using sanitize_text_field() and wp_unslash()
- Improved – Made debug logging conditional – error_log() now only runs when WP_DEBUG is enabled
- Improved – Complete WooCommerce address line 2 support across all payment methods (Payment JS, Apple Pay, Google Pay, HPP)
- Fixed – Enhanced security for payment token handling and form processing
- Fixed – Improved address data handling in redirect payment forms and wallet payments
3.0.5
- Improved – Full tokenisation support for HPP/Redirect payment gateway – customers can now save cards for future use
- Improved – Smart 3D Secure handling with dynamic challenge indicators based on transaction type
- Improved – Subscription support improvements with proper token handling for recurring payments
- Fixed – Duplicate token saving issue between webhook and order confirmation resolved
- Fixed – Session dependency removed from webhook – now uses order meta for reliable server-to-server communication
- Fixed – Improved shipping method calculation for wallet payments (Apple Pay and Google Pay)
- Fixed – Shipping options now properly update based on customer location
- Fixed – Shipping methods now respect WooCommerce zone restrictions and conditions
- Fixed – Total calculation now uses backend-calculated values for accuracy
- Improved – Dynamic shipping option updates when address changes in wallet payments
- Improved – Proper tax and shipping recalculation based on selected address
- Removed – Deprecated class-autify-lloyds-shop-page-handler.php file
3.0.4
- Added – WooCommerce HPOS (High Performance Order Storage) compatibility
3.0.3
- Fixed – Domain issue, as WooCommerce covers it already
- Fixed – Apple Pay removal of EMV, as this is not supported
- Improved – Code improvements
3.0.2
- Added – Dynamic Order Data configuration and Clear Cookies for My account
3.0.1
- Added – Fallback to Hosted Payment Method support
- Added – Configuration option in Payment JS to enable or disable logging
- Improved – Logger standardised to use the WooCommerce logging system
3.0.0
- Added – On-site Wallets for Google Pay and Apple Pay directly from the product, cart, and checkout pages
- Added – Tokenisation allowing customers to save their cards for future transactions
- Added – Subscription support for card payments
- Added – MOTO transaction support from the Administrator account
2.0.14
- Fixed – Column addition issue and removed sleep() function
2.0.13
- Fixed – Load Domain translation issue
2.0.12
- Added – Configuration for the Order ID suffix as timestamp
2.0.11
- Fixed – Country restriction for Embedded Payment and GooglePay Wallet issue
2.0.10
- Added – Configuration to pass the order ID or not
