About this plugin
Bitrequest is a non-custodial cryptocurrency payment gateway for WooCommerce. You configure your own wallet addresses (or an xpub for a fresh address per order), and payments arrive directly in your wallet. No middleman ever holds the money — not a processor, not Bitrequest.
Payment detection runs client-side through the open-source Bitrequest payment app. The plugin records the transaction against the order and links you straight to a block explorer so you can verify on-chain before fulfilling.
Supported currencies
Bitcoin, Lightning Network, Litecoin, Dogecoin, Dash, Bitcoin Cash, Kaspa, Monero, Nano, Nimiq, and Ethereum — plus any ERC-20 token (USDT, USDC, and others) on Ethereum, Arbitrum, Polygon, BNB Smart Chain, and Base.
Key features
- Non-custodial — funds go directly to your wallet, never through a third party.
- No fees charged by the plugin; you pay only standard network fees.
- No account, no sign-up, no KYC.
- HD wallet (xpub) support — a fresh receiving address for every order.
- Per-order payment verification with block-explorer links and confirmation guidance.
- Optional webhook (JSON POST, HMAC-signed) when a payment is reported.
- Compatible with WooCommerce HPOS and the Block Checkout, as well as classic checkout.
com/bitrequest/bitrequest-woocommerce
External services
This plugin relies on the following external services. No customer data is sent to any of them.
1. io)
What it is: the open-source Bitrequest payment application, which performs cryptographic address derivation and detects incoming payments by reading public blockchain data. It provides the checkout the customer interacts with.
What is sent and when: when a customer reaches the payment step, the plugin loads the app’s JavaScript and CSS from this origin and opens the app in a checkout window. The request URL carries the order number, the store name, the amount, the chosen cryptocurrency and the receiving address derived for that order. No customer name, email, address or other personal data is transmitted.
Loading the assets exposes the visitor’s IP address and user agent to the host, as with any externally hosted resource.
Why it is required: the app and its libraries must be served from the same origin the checkout window points at, because the plugin verifies the window’s origin before accepting a payment result from it. Splitting them would break that check.
Self-hosting: the “Bitrequest URL” setting accepts any host serving an unmodified build, so you can point the plugin at your own copy and remove this dependency entirely.
Provider: Bitrequest. io/privacy/
2. com)
What it is: a public CDN serving cryptocurrency logo images.
What is sent and when: coin and token icons are loaded in the WordPress admin only – on the gateway settings screen, the orders list, the order edit screen and the payments overview. Loading an image exposes the logged-in administrator’s IP address and user agent to CoinMarketCap. No order, store or customer data is sent, and no request is made from any customer-facing page.
Why it is required: the ERC-20 token picker covers roughly a thousand tokens, so their icons cannot practically be bundled with the plugin. Customer-facing pages use only icons bundled inside the plugin, so a shopper’s browser never contacts this service.
Provider: CoinMarketCap Mgmt Limited. com/privacy/
3. Lightning proxy (optional, merchant-configured)
Only used if you enable Lightning. The plugin sends invoice status lookups to the proxy URL you enter in the settings – a host you choose and control, such as your own node or a service you have an account with. Requests contain the Lightning payment identifier for the order and nothing else.
No proxy is contacted if Lightning is left disabled, and the plugin has no default proxy.
4. Webhook URL (optional, merchant-configured)
If you set a Webhook URL, the plugin POSTs order and transaction data to that address when the customer’s browser reports a payment (once per order). This is your own endpoint; leave the field empty and no request is made. With a Webhook secret set, each request carries an X-Bitrequest-Signature header your endpoint can verify.
The data is not verified on-chain; the order stays on hold until you check it.
Note on block explorers
Explorer links shown in the admin and in order emails are ordinary hyperlinks. Nothing is sent to a block explorer unless someone clicks one.