Poth Checkout for WooCommerce

Poth (pronounced POTH, Bengali for “path”) is the checkout funnel builder your WooCommerce store deserves. Multi-step checkout, order bumps, one-click post-purchase upsells, and a custom thank-you page — self-hosted, block-native, at half the price of CartFlows.

Why Poth?

WooCommerce checkout conversion averages 45–55%. Shopify’s averages 75%. The gap isn’t the platform — it’s the checkout experience.

CartFlows dominates the WooCommerce funnel-builder market at $299/year and locks you into their template ecosystem. Poth ships the same core features for $99/year, is built block-first (works with WooCommerce Cart/Checkout Blocks natively), and integrates deeply with the rest of the Nishchoy family.

By the makers of Nishchoy Reviews, Uttor AEO, and Chala Subscriptions.

Features (free)

• Multi-step checkout — split default one-page checkout into 2 or 3 pages (Contact → Shipping → Payment)

• Visual field editor — add, remove, and reorder checkout fields

• Order bump — offer a related product above the payment button (“Add this too?”)

• Custom thank-you page — replace default order-received with a Gutenberg-built page

• 5 pre-built templates — Minimal, Split, Sidebar, Wide, Classic

• Distraction-free checkout mode — hide header, footer, sidebar

• Trust badges section — upload up to 5 badges

• Basic conversion analytics — checkout starts, completions, bump take rate

• Blocks + shortcodes — works with classic and block themes

• HPOS-native

• REST API — headless-friendly

• WP-CLI — wp poth funnel list, wp poth stats

• Import from CartFlows Free — one-click migration

• Own your data — everything in your WordPress database

Pro version

Poth Pro adds full sales funnel builder (landing → checkout → upsell → downsell → thank-you), one-click post-purchase upsells, multiple order bumps with A/B testing, cart abandonment recovery via your own SMTP, 20+ premium templates, exit-intent popups, countdown timers, advanced field logic, and full funnel analytics with drop-off visualization.

Better with Chala Subscriptions

Poth’s one-click post-purchase upsells work with any payment gateway when Chala Subscriptions is installed — Stripe, PayPal, Razorpay, Mollie, Paystack, Square. Without Chala, upsells work only with Stripe and PayPal (via WooCommerce’s native saved-card flows).

You can also offer subscription upsells at checkout: convert a one-time buyer into a subscriber with one click.

Better with Nishchoy Reviews

Show top product reviews on the checkout page for social proof. Show review count and average rating on order bump offers.

Better with Uttor AEO

Correct Order, Offer, and CheckoutPage schema output for AI search visibility.

Nishchoy family bundle

Get all four plugins — Reviews + Uttor + Chala + Poth — for $329/year (vs $476 separately). com.

Developer-friendly

Every checkout event fires an action. Every computed value has a filter. Full REST API.

Overridable templates. See the developer docs.

External services

Poth Checkout does not contact any external service for its free features.

Multi-step checkout, order bumps, the thank-you page and the analytics reports

all run entirely on your own server. There is no telemetry, no usage tracking,

no phone-home, no external CDN asset and no remotely loaded font.

One optional feature does contact an external service: the post-purchase

upsell. If a merchant configures an upsell and a customer accepts the offer,

the plugin has to charge the payment method that customer used moments earlier.

It does that by calling the payment provider the store is already using, with

the API credentials the merchant already entered into that provider’s own

WooCommerce gateway plugin.

If no upsell is configured, or no customer accepts one, no request is ever made.

Stripe

What it is: Stripe is a payment provider. It is contacted only to charge a

customer who has just accepted a post-purchase upsell, by creating one

off-session PaymentIntent against the payment method already stored against

that customer by the official Stripe gateway plugin.

When data is sent: once per accepted upsell offer, at the moment the customer

accepts it. Never on any other page load, and never in the admin.

What is sent: the amount, the currency, the Stripe customer and payment-method

identifiers that Stripe itself issued and the Stripe gateway plugin already

stored, a short order description, and an idempotency key. No card details pass

through this plugin — it never renders a card field and never receives one.

com

com/legal

com/privacy

PayPal

What it is: PayPal is a payment provider. It is contacted only to charge a

customer who has just accepted a post-purchase upsell, by obtaining an OAuth

token and then creating one order against the payment method that customer

already vaulted with PayPal through the official PayPal gateway plugin.

When data is sent: once per accepted upsell offer, at the moment the customer

accepts it. Never on any other page load, and never in the admin.

What is sent: the amount, the currency, the PayPal vault identifier PayPal

itself issued, a short order description, and a request id used for

idempotency. No card details pass through this plugin.

com when

the PayPal gateway is in sandbox mode.

Terms of service (PayPal Legal Agreements, including the User Agreement):

com/legalhub/home

com/legalhub/privacy-full

If Chala Subscriptions is installed

When the Chala Subscriptions plugin is active, Poth hands the charge to Chala’s

gateway layer instead of calling a provider itself, and makes no external

request of its own at all. Whether Chala then contacts a provider, and which

one, is governed by Chala and disclosed in that plugin’s own readme.

Why the credentials are read from another plugin

The Stripe and PayPal credentials are read from the “woocommerce_stripe_settings”

and “woocommerce-ppcp-settings” options that those official gateway plugins

already store, rather than asking the merchant to paste a second copy of a live

secret key into another plugin. They can be overridden with the filters

poth_stripe_secret_key, poth_paypal_client_id and poth_paypal_client_secret for

stores that keep credentials in environment variables.

Source code and build process

Every compiled file in this plugin is built from source that ships inside the

plugin itself, in the assets-src/ directory. Nothing is minified without its

source being included, and no code is obfuscated.

• build/checkout-steps.js is built from assets-src/checkout/checkout-steps.js

• build/checkout-steps-blocks.js is built from assets-src/blocks/checkout-steps-blocks.js

• build/order-bump.js is built from assets-src/blocks/order-bump.js

• build/order-bump-checkout.js is built from assets-src/blocks/order-bump-checkout.js

• build/trust-badges.js is built from assets-src/blocks/trust-badges.js

• build/thank-you-summary.js is built from assets-src/blocks/thank-you-summary.js

• build/upsell.js is built from assets-src/upsell/upsell.js

• build/funnel-builder.js is built from assets-src/admin/funnel-builder.js

How to rebuild them

js ship in the plugin as well, so build/ can be

regenerated from the plugin directory alone, with no other download:

npm install npm run build

The build tool is @wordpress/scripts (webpack), the standard WordPress build

toolchain. json.

Bundled third-party library

One third-party library is compiled into a build file:

• preact, version 10 (MIT licence) – https://github.com/preactjs/preact

js only, which is the admin funnel

builder screen, and is used in place of React to keep that admin bundle small.

It is not used anywhere on the front end.

* globals that

WordPress and WooCommerce already enqueue. Those are declared in the generated

php dependency files rather than bundled, so no other third-party

code is included in this plugin.

There is no vendored PHP library, no bundled font, and no minified PHP. The two

payment integrations above are plain wp_remote_post() calls to documented

endpoints.

Privacy

Poth stores its analytics in your own database, in four tables prefixed

{$wpdb->prefix}poth_. Nothing is sent anywhere.

Visitors are recognised across the steps of one checkout with a single

first-party cookie, poth_sid, holding a random 32-character token. Only a

salted SHA-256 hash of that token is ever written to the database, so the

stored analytics contain no personal data; a customer is linked to a row only

by order id, and only once the order exists. The cookie is HttpOnly,

SameSite=Lax, Secure over HTTPS, and expires after two days. No third-party

cookie is set and no cross-site identifier is used.

Nothing is deleted when the plugin is uninstalled unless the merchant

explicitly enables “Delete everything when the plugin is deleted” in the

settings, which is off by default.