Extra Checkout Enhancements

A live payment fails overnight and nobody notices until a customer writes in. Your own test orders create customer accounts and land in your CRM. A coupon link does nothing when the visitor’s cart is still empty, and a bot can try a pile of stolen cards before you wake up.

Extra Enhancements closes those gaps, and two more at checkout, with six small fixes on one settings page. Each has its own switch.

Turn On Extra Enhancements

Switch on Extra Enhancements under Stackless → Dashboard, then open Stackless → Settings → Extra Enhancements. Most features start on: payment alerts, per-product checkout, hosted-only payment, coupon links, the throwaway email check and a limit of 10 orders per hour. Internal emails do nothing until you add an address.

Get an Email When a Live Payment Fails

Under Payment failure alerts:

• Alerts: Email me about failed live payments. On by default.
• Send alerts to: the address that gets the alerts. Empty by default, which uses the site admin email.
• Watch these gateways: Stripe, PayPal, Polar, Paddle and Dodo Payments, all selected by default. Copies made with Payment Gateway Tools count with their gateway. Clear the list to watch none.

An alert goes out when a live order paid through a watched gateway changes to Failed, or when a live API request Stackless makes to that gateway fails, such as a refund, a checkout or a renewal. Test and sandbox activity never alerts.

The plain-text email has a subject like “[Shop] Stripe failure on example.com” and lists the time in UTC, the order, the operation, the error code, the HTTP status, any provider debug ID and a link to the gateway settings. Keys, card and customer details are left out. The same order or API error alerts once per 30 minutes, and mail goes out through Action Scheduler, never during checkout.

To test delivery, run wp stackless payment-alert-test. It sends an alert marked [TEST].

Set Payment Methods and an After-Purchase Link per Product

With Per-product checkout on (the default), every product except grouped and external ones gets a Checkout tab under Product data. Variations follow their product.

• Payment methods: tick the methods that may sell this product. Leave all unticked to allow every method. A method you chose and later switched off shows “(off)”.
• After payment, send buyers to: a page on this site such as /welcome/, or a full https:// address on another site. Leave it empty to keep the order-received page.

When a cart holds products with different choices, buyers only see the methods they all allow, on the checkout and on the order payment page. The method is checked again when the order is placed, so a hidden method can’t be forced through.

The redirect only happens once the order is paid. An order still waiting for payment, such as a bank transfer, keeps the order-received page, and so does a hosted checkout that’s still confirming when the buyer comes back. Renewals always show the order-received page. If several products in one order have a link, the first one wins.

Share Coupon Links

With Coupon links on, any store link with ?coupon=CODE remembers the code for a day and applies it as soon as the visitor has something in the cart. WooCommerce checks the coupon’s own rules and shows its usual notice.

• A code WooCommerce refuses is dropped, not tried again.
• Buy Links and On-page Checkout apply their own coupons, so their links are left alone.
• Inside an On-page Checkout or Modal Checkout frame, the cart belongs to that frame, so a remembered code waits for the store cart instead.

Keep Test Orders Out of Accounts and Integrations

Under Internal and test emails, list the addresses you use for your own test purchases:

• Emails and domains: one per line. @example.com or example.com means the whole domain. Empty by default.
• Accounts: Don’t create a customer account. On by default.
• Integrations: Don’t run integrations. On by default.

Orders from a listed address are recorded as usual. Integrations means WooCommerce webhooks for orders, subscriptions and customers, and the Stackless FluentCRM sync. Each order gets an “Internal email” note saying what was skipped, and _stackless_internal_email set to yes.

Your own code can ask the same question before it syncs anything. This returns true for a listed address:

$skip = apply_filters( 'stackless_skip_integrations', false, $email );

Block Throwaway Emails and Card Testing

Under Checkout guard:

• Throwaway emails: refuses well-known throwaway inboxes such as Mailinator, Guerrilla Mail and YOPmail, about 60 services in all. On by default.
• Also refuse: more domains, one per line. Empty by default.
• Orders per hour: the most order attempts one connection can make in a rolling hour. Default 10. 0 turns the limit off.

Both checks run on the classic checkout and the Checkout block. A refused address sees “Please use an email address you keep. We send your receipt and downloads there.” Over the limit, the buyer sees “Too many order attempts from your connection. Please try again in an hour, or contact us for help.” Store managers are never limited or refused.

The count is keyed to the visitor’s IP address, but only a salted hash of it is stored, and it expires after an hour.

Hide the Payment Section for Hosted Checkouts

When the only payment method left is Polar, Paddle or Dodo Payments, or a copy of one, there’s nothing for the buyer to fill in on the page. With Hosted-only payment on (the default), the payment section is hidden and the method stays selected, so Place order goes straight to the hosted checkout. It follows address and currency changes on the classic checkout and the Checkout block. Developers can change the list of gateway IDs with the stackless_extra_enhancements_hosted_gateways filter.

Limits

• Alerts only watch the gateways Stackless adds. Card declines and lookups that find nothing aren’t API errors, so a decline alerts only when its order changes to Failed.
• An alert the mailer refuses is retried twice, five minutes apart, then logged under WooCommerce → Status → Logs (stackless-extra_enhancements).
• A cart whose products share no payment method can’t be paid.
• Coupon codes can use letters, numbers, dots, hyphens, underscores and @, up to 50 characters. A new coupon link replaces the remembered code.
• An internal domain matches that exact domain, not its subdomains. The guard’s domain lists do cover subdomains.
• Every order attempt counts toward the hourly limit, not only completed orders, and buyers on one shared connection, such as an office network, share the count.