On December 18, 2024, the WooCommerce team published an unusual alert: bots were attacking stores by calling the API that handles the cart and checkout directly, even where the Checkout block was not in use. They were testing stolen card numbers, and the anti-bot plugins merchants thought they had installed saw nothing go by.
That affair, which we tell below, is a reminder of something often overlooked. Choosing a payment gateway is not just about a percentage per transaction. It also decides how long you wait for your money, how strong customer authentication is handled in Europe, compatibility with WooCommerce’s block-based checkout, and part of your exposure to fraud.
Here are the ten gateways that matter for a WooCommerce store in 2026, with their official fees for France and the United States, their payout delays and their limits.
How we ranked them
We used seven criteria. Fees, read on each provider’s official pricing page in October 2026, for France and for the United States. The delay before money reaches your bank account. The countries where a merchant can open an account.
Then come wallets (Apple Pay, Google Pay), handling of strong customer authentication and 3-D Secure, compatibility with WooCommerce Subscriptions for recurring payments, and compatibility with the Cart and Checkout blocks, the default for new stores since WooCommerce 8.3 in November 2023.
Fees change often and vary with volume, card type and the buyer’s country: treat them as reference points, and check the official page before signing.
Strong customer authentication and 3-D Secure in two minutes
What PSD2 requires
Since September 14, 2019, the second European Payment Services Directive has required strong customer authentication for most online payments: two elements among what the buyer knows, owns or is. For cards, this goes through 3-D Secure, the confirmation in the banking app. The European Banking Authority set December 31, 2020 as the end of the tolerance period for e-commerce.
Exemptions
The technical rules provide exemptions: low-value payments (up to €30, within a cumulative limit of €100 or five consecutive payments), transaction risk analysis, or recurring payments of the same amount to the same payee. The buyer’s bank has the final say, but your gateway must know how to request them.
Subscriptions
For a subscription, strong authentication applies when the mandate is set up. Renewals then triggered by the merchant, with no action from the buyer, fall outside its scope, according to a European Commission answer published by the European Banking Authority. A gateway compatible with WooCommerce Subscriptions handles that distinction. The upcoming reform (PSD3 and the Payment Services Regulation) reached political agreement in November 2025, but it had not yet been adopted in October 2026.
1. WooPayments: the built-in choice
What it does
WooPayments is WooCommerce’s own gateway, built in partnership with Stripe. The plugin is free and installed on more than 800,000 sites; you pay per transaction, with no setup fee or subscription. Everything is managed from the admin: payments, disputes, payouts.
Strengths
It offers five express methods (Apple Pay, Google Pay, Link, WooPay and Amazon Pay), multi-currency and in-person payments. 3-D Secure is handled at no extra cost, and compatibility with WooCommerce Subscriptions and the blocks is complete. The Checkout block documentation even recommends it for express payments.
Limits
It is only open to merchants in 38 countries. The first payout waits seven days after the first successful transaction, then money arrives in three business days in France, two in the United States. Instant payouts are reserved for US merchants, and express buttons do not show on some product types.
Price and audience
In France, cards are charged 1.50% + €0.25, with a surcharge for cards issued outside Europe; in the United States, 2.90% + $0.30. WooPayments suits merchants who want to manage everything without leaving WordPress.
2. Stripe for WooCommerce: the widest catalog
What it does
Stripe’s official extension, maintained by WooCommerce, connects the store to your own Stripe account. It has more than 700,000 installs and gives access to more than twenty payment methods: cards, Apple Pay, Google Pay, Link, SEPA direct debit, Klarna, iDEAL, BLIK.
Strengths
Your Stripe account belongs to you and follows you if you change platforms. You get the Radar anti-fraud tool and the widest catalog of payment methods on this list. Stripe charges neither setup nor monthly fees.
Limits
The extension has forced two migrations: in 2024, merchants had to reconnect through OAuth and enable the new payment form before October 29, with WooCommerce noting that connecting by API keys could expose stores to card testing; in 2025, the old form was removed for good. On August 6, 2026, WooCommerce released a security fix for versions 9.7.0 to 10.8.4, with no evidence of exploitation. Finally, WooCommerce support does not handle Stripe account questions (payouts, disputes, verification).
Price and audience
In France, Stripe charges 1.5% + €0.25 for standard European cards, 2.8% + €0.25 for premium cards and 3.15% + €0.25 for international cards. The first payout comes seven days after the first payment, then in three business days. Stripe suits stores that want the most payment methods and a portable account.
3. WooCommerce PayPal Payments: the button buyers expect
What it does
PayPal’s official integration, installed on more than 800,000 sites, brings together the PayPal button, Pay Later (available in France among other countries), Venmo in the United States, card payments, Apple Pay, Google Pay and Fastlane, PayPal’s accelerated checkout.
Strengths
Many buyers look for the PayPal button, and money lands immediately in the PayPal balance, with a free bank transfer in one to three business days. Advanced card processing supports strong customer authentication, and vaulting payment methods allows automatic subscription renewals.
Limits
Apple Pay and Google Pay depend on the merchant’s country and on approval for advanced card processing. Above all, in autumn 2025, the extension was a card-testing target through its own order-creation endpoint; native reCAPTCHA protection arrived with version 3.3.0, on November 4, 2025. It is also the lowest rated of the three big gateways in the directory.
Price and audience
In France, a payment from a PayPal account is charged 2.90% + €0.35, and a card payment through advanced card processing 1.20% + €0.35; in the United States, PayPal Checkout costs 3.49% + $0.49. PayPal Payments suits stores whose customers expect the PayPal button, alongside a card gateway.
4. Square: one stock for the shop and the website
What it does
Square’s official integration, with more than 80,000 installs, syncs the catalog from whichever platform you choose as the system of record, and stock both ways, between WooCommerce and the Square point of sale. It accepts cards, Apple Pay, Google Pay, Cash App Pay (US only) and gift cards.
Strengths
For a business that also sells over the counter, it is the simplest way to have a single catalog and stock. In the United States, payments taken before 5 PM Pacific time arrive the next business day. 3-D Secure is supported.
Limits
Square is only available in eight countries, with France, Spain and Ireland the only ones in the EU. Its rating in the directory is low, and the latest version requires WordPress 6.9 and a recent version of WooCommerce.
Price and audience
In France, online payments with European cards cost 1.4% + €0.25; in the United States, API transactions are listed at 2.9% + $0.30. Square suits businesses already using its point of sale.
5. Mollie: European payment methods in one contract
What it does
Mollie, an Amsterdam-based provider with more than 100,000 installs, brings European local payment methods into a single plugin: Cartes Bancaires, Bancontact, iDEAL, SEPA direct debit, Przelewy24, TWINT, BLIK, Apple Pay, PayPal and several buy-now-pay-later options.
Strengths
For a store selling in France, Belgium and the Netherlands, it is the shortest path to the payment methods customers know. The base offer has no subscription or setup fee, and recurring payments go through WooCommerce Subscriptions.
Limits
Mollie is reserved for European merchants, including the UK and Switzerland. Card payments reach the Mollie balance four business days after the transaction (nine for SEPA direct debit), then are paid out at the frequency you choose. The plugin page does not detail how 3-D Secure is handled.
Price and audience
European consumer cards cost 1.80% + €0.25, consumer Cartes Bancaires 1.20% + €0.25, business cards 2.90% + €0.25. Mollie suits European stores that want local payment methods without multiplying contracts.
6. Klarna for WooCommerce: buy now, pay later next to the card
What it does
Klarna’s official plugin, with more than 20,000 installs, adds installments, pay later and financing. The merchant is paid in full and upfront; Klarna carries the credit.
Strengths and limits
For high-value baskets (furniture, fashion, electronics), installments can remove a barrier to purchase. But Klarna is not a full card gateway, and it publishes no merchant price list for France or the United States: rates are set by contract. The plugin requires PHP 8.0.
Price and audience
As a reference point, WooPayments charges 4.99% + €0.40 for Klarna in France and 5.99% + $0.30 in the United States, and Stripe lists it in France “from” 4.99% + €0.40. Enabling Klarna inside your main gateway often avoids a second contract. Klarna directly suits high-basket stores that want its marketing tools.
7. Amazon Pay: Amazon’s checkout on your store
What it does
Amazon Pay lets buyers pay with the address and card saved in their Amazon account. The plugin has more than 10,000 installs, and Amazon Pay is also available as an express method inside WooPayments.
Strengths and limits
For customers used to Amazon, it is a reassuring shortcut. But new merchants have 100% of their receipts held in reserve for seven days, and the plugin was only tested up to WordPress 7.0.6 in October 2026.
Price and audience
In France, a 2.7% processing fee plus €0.25 per authorization, for a monthly volume under €10,000; in the United States, 2.9% plus $0.30. Amazon Pay suits stores whose customers already shop on Amazon.
8. Authorize.net: US merchant accounts, no 3-D Secure
What it does
The Authorize.net extension, paid and developed by SkyVerge, connects WooCommerce to Visa’s gateway. It handles saved cards, US electronic checks and subscriptions.
Deal-breaking limits
WooCommerce’s documentation is clear: this extension does not support 3-D Secure, since the Authorize.net API does not accept the data required. WooCommerce lists it for Australia, Canada, New Zealand and the United States. It is therefore unsuitable for a European store.
Price and audience
The extension costs $79 per year, and Authorize.net’s all-in-one offer $25 per month plus 2.9% + $0.30 per transaction. It suits US merchants who already have a merchant account or an established banking relationship.
9. GoCardless: bank debit for recurring revenue
What it does
GoCardless is a bank-debit specialist: SEPA in Europe, ACH in the United States, Bacs in the United Kingdom. Its plugin, recent in the directory, has 1,000+ installs and supports WooCommerce Subscriptions.
Strengths
For a subscription, a membership or a large business invoice, a direct debit costs far less than a card, thanks to a cap per transaction. Expired or replaced cards no longer make renewals fail. Merchant-initiated debits fall outside strong authentication.
Limits
No cards, no wallets, and a delay: in the euro area, the customer is debited one business day after the payment is created, then funds are paid out two business days later.
Price and audience
In France, 1% + €0.20 per transaction, capped at €2; in the United States, 0.5% + $0.05, capped at $5. GoCardless suits recurring revenue and large baskets.
10. PayPal Enterprise Payments: the former Braintree for large stores
What it does
Braintree, PayPal’s processor for large businesses, was renamed PayPal Enterprise Payments; the WooCommerce plugin followed in June 2026, with version 3.11.0. It combines cards, PayPal, Venmo, Apple Pay, Google Pay, ACH and several European local payment methods.
Strengths
One contract for PayPal and cards, multi-currency routing to several merchant accounts, and since version 3.12.0 in September 2026, the option to stop forcing 3-D Secure on one-off card payments so the processor can apply the exemptions the regulation allows.
Limits and alternative
Funds usually arrive two to five business days after settlement. Apple Pay is not compatible with subscriptions according to WooCommerce’s documentation. For very large volumes, Adyen is the other enterprise option, but it has no free official plugin in the directory: the extension it points to is sold by a third-party developer.
Price and audience
In France, 1.9% + €0.30 for cards and wallets; in the United States, 2.89% + $0.29. It suits high-volume stores that want PayPal and cards under a single contract.
The real case: the card-testing wave on the Store API
Card testing is a simple form of fraud: bots try stolen card numbers on your store, with small amounts, to find out which ones work. Even when they fail, they cost you money. The story from 2024 to 2026 shows how the Store API, shipped in core for block-based checkout, shifted the problem.
The 2022 prologue
In November 2022, WP Tavern reported the case of a developer hit on five sites, four of them WooCommerce stores; the fifth, running Leaky Paywall with Stripe, took about 1,200 successful fraudulent $2.99 charges, among roughly 100,000 blocked attempts. After refunding them, he put the loss in fees at $1,940: dispute and transaction fees are not returned. The advice at the time came down to three things: CAPTCHA, rate limiting, and the provider’s anti-fraud tools.
December 2024: the attack skips the checkout page
In late 2024, WooCommerce noticed attacks targeting the Store API alone, even on stores that did not use the Checkout block. Bots called the API addresses directly to add a product to the cart and place an order, without ever loading the page.
WooCommerce then reviewed the CAPTCHA plugins merchants relied on, and found that they did not protect the Checkout block or the Store API: their checks were simply bypassed. WooCommerce’s own team patched four of the most common ones on December 13 and 17, 2024. On December 18, WooCommerce documented the problem and noted that rate limiting existed but was off by default.
2025 and 2026: a step-by-step response
On January 20, 2025, WooCommerce 9.6 added configurable rate limiting for the Store API and the Checkout block, to be turned on in the advanced settings: three order attempts per minute. In April, version 9.8 made it possible to identify attackers by more than their IP address, since bots kept switching. In December 2025, version 10.4 fixed the counting, which was penalizing legitimate requests.
On the gateway side, a new wave hit stores running PayPal Payments, from version 3.1.2, in autumn 2025: advanced card processing allowed direct payments through the API, bypassing reCAPTCHA and the usual page checks. The vendor confirmed in September that its own order-creation endpoint was being targeted, then shipped native reCAPTCHA with version 3.3.0, on November 4, 2025.
In March 2026, WooPayments fixed a flaw in its card-saving flow on the server side: according to WooCommerce, the new limit blocked thousands of attempts within ten days. Yet in June 2026, a still-open feature request reported around 340 different IP addresses in 24 hours hitting the API directly.
What it changes when choosing a gateway
The gateway carries part of your exposure. Stripe documents its own card-testing controls (rate limits, AI models, CAPTCHA triggers) for its recommended integrations, whereas a gateway that adds its own endpoint has to protect it itself. Prefer an OAuth connection over API keys, turn on WooCommerce’s rate limiting, check that your CAPTCHA really covers the Checkout block, and apply the basic WordPress security measures, firewall first.
How to choose
By situation
- A French or European store starting out: WooPayments or Stripe, plus PayPal Payments if customers ask for it.
- Belgian, Dutch or multi-country European customers: Mollie, for Bancontact, iDEAL and Cartes Bancaires.
- Physical and online sales: Square, for a single stock.
- Subscriptions and memberships: WooPayments or Stripe for cards, GoCardless for direct debit.
- High-value baskets: add Klarna, ideally inside your main gateway.
- Large volumes: PayPal Enterprise Payments, or Adyen through a third-party developer.
Work out the real cost
Take 100 orders of €50, paid with standard European cards, and apply only the published fees. With Stripe or WooPayments, at 1.5% + €0.25, each order costs €1.00 in fees, so €100 in total. With PayPal, a card taken through advanced card processing is listed at 1.20% + €0.35, or €0.95 per order (€95); if the buyer pays with a PayPal account, the rate rises to 2.90% + €0.35, or €1.80 per order (€180).
With a GoCardless direct debit, at 1% + €0.20, it is €0.70 per order, or €70, below the €2 cap. These amounts exclude VAT: WooPayments charges 20% VAT on its fees to merchants without a valid VAT number. Premium cards (at Stripe, not at WooPayments), cards from outside Europe, disputes and currency conversion then add to them.
Check block compatibility
A gateway that has not declared its block integration does not show in the Checkout block: WooCommerce then flags the incompatibility. Before migrating, read our guide to the WooCommerce Cart and Checkout blocks.
Summary table
| Gateway | Card fee, US (Oct. 2026) | Card fee, France | 3-D Secure | Best for |
|---|---|---|---|---|
| WooPayments | 2.90% + $0.30 | 1.50% + €0.25 | Yes, no extra cost | Built-in management |
| Stripe | Not quoted | 1.5% + €0.25 | Yes | Widest catalog |
| PayPal Payments | 2.89% + $0.49 (card); 3.49% + $0.49 (PayPal account) | 1.20% + €0.35 (card); 2.90% + €0.35 (PayPal account) | Yes (advanced cards) | PayPal customers |
| Square | 2.9% + $0.30 (API) | 1.4% + €0.25 | Yes | Shop and website |
| Mollie | No US offer | 1.20% + €0.25 (CB); 1.80% + €0.25 (other cards) | Not detailed | European local methods |
| Klarna | By contract | By contract | Handled by Klarna | High baskets |
| Amazon Pay | 2.9% + $0.30 | 2.7% + €0.25 | Yes (EEA) | Amazon customers |
| Authorize.net | $25/month + 2.9% + $0.30 | Not available | No | US merchants |
| GoCardless | Debit: 0.5% + $0.05, cap $5 | Debit: 1% + €0.20, cap €2 | Not applicable | Recurring, B2B |
| PayPal Enterprise Payments | 2.89% + $0.29 | 1.9% + €0.30 | Yes, exemptions configurable | Large volumes |
Frequently asked questions
Do I need 3-D Secure if I only sell in the United States?
Strong customer authentication is a European rule. A US store whose acquiring bank is in the United States is not legally required to use it, and 3-D Secure remains optional there. But a European customer’s bank may decline an unauthenticated payment: a gateway able to trigger 3-D Secure is the safer choice.
Which gateways accept Apple Pay for subscriptions?
According to WooCommerce’s documentation, Stripe and WooPayments accept Apple Pay with WooCommerce Subscriptions. The table on the same page also ticks PayPal Payments: check with the gateway before promising this payment method on a recurring offer.
Can I use WooPayments and Stripe at the same time?
Technically yes, but it is rarely useful, since WooPayments already runs on Stripe. Common combinations pair a card gateway (WooPayments or Stripe) with PayPal Payments, and possibly a local payment method or direct debit.
How do I turn on WooCommerce’s rate limiting?
In WooCommerce, open Settings, then Advanced, then Features, and turn on rate limiting for the Checkout block and Store API. It allows three order attempts per minute. Behind a CDN, you also need to enable proxy support, through a filter, so that real IP addresses are read.
Are Klarna’s fees public?
No. Klarna sets its rates by contract. The only public prices are those of gateways that resell Klarna, such as WooPayments, Stripe or Mollie.
Verdict
For most European stores, WooPayments or Stripe form the base, PayPal Payments is added if customers ask for it, and Mollie becomes the obvious pick as soon as European local payment methods matter. GoCardless changes the equation for recurring revenue.
But the card-testing story is a reminder that price is only part of the choice. A gateway well integrated with the blocks, connected through OAuth and protected by rate limiting will cost you less, in the end, than a gateway 0.1% cheaper that lets the bots through. For the rest of the store, our selection of WooCommerce plugins completes this choice.
Sources
- WooCommerce Developer Blog (December 18, 2024). Card Testing Attacks and the Store API
- WooCommerce Developer Blog (January 20, 2025). WooCommerce 9.6
- WooCommerce Developer Blog (April 2, 2025). Store API Updates Coming in WooCommerce 9.8
- WooCommerce Developer Docs. Rate Limiting for Store API endpoints
- WooCommerce (March 31, 2026). Security improvements for payments
- WooCommerce Developer Blog (August 6, 2026). Security update for Stripe for WooCommerce
- WP Tavern (November 8, 2022). WooCommerce Store Owners Combat Fraudulent Stripe Charges
- GitHub (November 4, 2025). WooCommerce PayPal Payments 3.3.0
- WooCommerce (October 2026). WooPayments: Fees
- WooCommerce. WooPayments payout schedule
- Stripe (October 2026). Pricing, France
- Stripe Docs. Protect yourself from card testing
- PayPal (October 2026). Merchant fees, United States
- PayPal (July 2026). Merchant fees, France
- Square. What are Square’s fees
- Mollie (October 2026). Pricing
- Amazon Pay. Fees
- WooCommerce. Authorize.Net documentation
- GoCardless (October 2026). Pricing
- PayPal (May 2026). PayPal Braintree Fees and Pricing
- European Banking Authority (October 16, 2019). Opinion on the deadline for the migration to SCA
- European Banking Authority (March 2019). Q&A 2018_4031
- European Parliament (November 27, 2025). Payment services deal
- WooCommerce. Accepting Apple Pay
- Amazon Pay. Fees, France
- Square (October 2026). Pricing, France
- GoCardless (October 2026). Pricing, France
- PayPal (June 2026). PayPal Braintree fees, France
- Authorize.net. Pricing
- WooCommerce. Anti-Fraud: velocity attack documentation
- WordPress.org Support (September to November 2025). wc-ajax=ppc-create-order
- WooCommerce (June 2026). Native rate limiting and bot screening for Store API checkout endpoints
- WooCommerce. Updated requirements for the Stripe plugin, mid-2024
LaFactory designs, builds and maintains WordPress sites and WooCommerce stores, payments included, and develops its own plugins. Talk to us about your WordPress project.