Lloyds E-Commerce Integration for WooCommerce

• Fixed – Incorrect call to an internal meta key
• Security – Hardened webhook and order-confirmation callback handling to reject requests with an invalid response signature before any order status change is applied
• Security – Added request-signature verification to the PaymentJS 3D Secure status and method-notification callback endpoints
• Security – Added stricter order-state validation before applying 3D Secure method-notification updates
• Security – Moved 3D Secure challenge parameters out of redirect URLs into server-side session storage
• Security – Replaced a non-cryptographic random number generator with a cryptographically secure generator for transaction reference IDs
• Security – Strengthened session validation on Checkout Solution payment callbacks

• Google Pay 3DS update
• ApplePay on-site wallets improvements across multiple browser

• WordPress security updates
• Plugin improvements

• * Compliance – Renamed all script, style, and AJAX action handles to use unique “autify-lloyds-” prefix to meet WordPress plugin directory naming standards
• * Compliance – Updated nonce names, transient keys, and lock keys with plugin-specific prefixes to prevent namespace collisions
• * Compliance – Renamed global JavaScript variables with “autifyLloyds” namespace to avoid global scope conflicts
• * Security – Added nonce verification for Apple Pay and Google Pay payment processing AJAX requests (CSRF protection)
• * Security – Added recursive sanitisation of webhook data using sanitize_text_field() across all webhook handlers
• * Security – Added input sanitisation for $_GET parameters in admin pages using sanitize_text_field() and wp_unslash()
• * Security – Added JSON validation and error checking in PaymentJS webhook handler
• * Security – Added header value sanitisation in PaymentJS webhook processing
• * Fixed – Added null-safety checks for wc_get_order() across all payment handlers to prevent fatal errors on missing orders
• * Fixed – Added isset() guards for AVS/CVV response fields, cart totals, and shipping address data to prevent undefined index notices
• * Fixed – Improved JSON decode error handling in Google Pay payment data processing
• * Fixed – Added proper validation for shipping methods array access and WP_Query availability checks
• * Improved – Order not found errors now display user-friendly notices and redirect to checkout instead of failing silently
• * Improved – Improved transaction notification URL validation for incomplete webhook data
• * Removed – Legacy deleteOldLogFiles() method from Gateway Helper
• * Updated – CSS file references to use prefixed filenames

• * Compliance – Removed hard-coded “Powered by” credit link from public-facing payment form to comply with WordPress plugin directory attribution guidelines
• * Compliance – Updated External Services section with full disclosure of all third-party services including Terms of Use and Privacy Policy links
• * Compliance – Added disclosure for Fiserv Checkout Solution, Apple Pay, Google Pay, and Autify Digital License API external services
• * Compliance – Added Fiserv Terms of Use and Privacy Notice links for First Data / IPG Online and Payment JS services
• * Fix – Google Pay (on-site) shipment issues

• Performance – Removed flush_rewrite_rules from every page load, now only runs on plugin activation/deactivation
• Fixed – WordPress PHPCS compliance improvements
• Improved – 3Ds Flow improvements

• Added – Configuration to enable or disable subscription
• Fixed – Double Subscription Request
• Fixed – WordPress PHPCS compliance improvements

🛠️ Code Quality

• WordPress PHPCS compliance improvements
• Bug Fixes related to the WP curl call

🚀 New Features

• Transaction Reports table with advanced filtering (status, payment method, date range)
• CSV export functionality for transaction reports with all filters applied
• Full-text search across all transaction columns (Order ID, Amount, Status, Card Details, IPs, etc.)
• Transaction summary statistics showing total transactions, amounts, and refunds
• Traffic light verification status indicators (CVV, Street, Postcode checks) in reports
• Transaction details meta box on WooCommerce order view page with payment and fraud details
• Cardnet Status column in WooCommerce order grid with payment status, verification indicators, and card info

✨ Enhancements

• License sync cron job for automatic license validation
• Unified refund processing across all payment methods (Card, Apple Pay, Google Pay)
• Centralized table name management in gateway helper
• External CSS file for admin styles instead of inline styles
• Support for both legacy post-based orders and HPOS (High-Performance Order Storage)

🛠️ Code Quality

• WordPress PHPCS compliance improvements
• Added translator comments for i18n strings with placeholders
• Proper variable prefixing for WordPress coding standards
• Added phpcs:ignore comments for WooCommerce core hooks usage

👨‍💻 Developer & Internal Changes

• Comprehensive unit test coverage for new features
• Refactored verification status methods to camelCase naming convention

✨ Enhancements

• Block cart and checkout support for the iFrame, GooglePay and ApplePay
• Full tokenization support for HPP/Redirect payment gateway – customers can now save cards for future use
• Complete WooCommerce address line 2 support across all payment methods (Payment JS, Apple Pay, Google Pay, and HPP)
• Smart 3D Secure handling with dynamic challenge indicators based on transaction type
• Enhanced security with comprehensive sanitization of $_GET, $_POST, $_REQUEST data
• Improved payment token handling and form processing security with proper validation
• Enhanced AJAX security with proper nonce verification for all requests
• Improved code organization with dedicated helper methods for payment data building
• Subscription support improvements with proper token handling for recurring payments
• Dynamic shipping option updates when address changes in wallet payments
• Proper tax and shipping recalculation based on selected address
• PO number building logic refactored for better maintainability

🛠️ Fixes

• WordPress Plugin Check compliance – plugin now passes all validation checks
• Debug logging made conditional – error_log() only runs when WP_DEBUG is enabled
• Duplicate token saving issue between webhook and order confirmation resolved
• Session dependency removed from webhook – now uses order meta for reliable server-to-server communication
• Improved shipping method calculation for wallet payments (Apple Pay and Google Pay)
• Shipping options now properly update based on customer location
• Shipping methods now respect WooCommerce zone restrictions and conditions
• Total calculation now uses backend-calculated values for accuracy
• Improved address data handling in redirect payment forms
• Enhanced error handling and validation across all gateway methods

👨‍💻 Developer & Internal Changes

• 3DS Request Update
• Enhanced token storage with duplicate prevention mechanism
• All payment gateway classes updated with secure data handling practices
• License manager enhanced with improved AJAX security
• Enhanced payment processing with comprehensive data sanitization throughout
• WooCommerce tested up to version 10.3.5

✨ Enhancements

• Block cart and checkout support for the iFrame, GooglePay and ApplePay
• Full tokenization support for HPP/Redirect payment gateway – customers can now save cards for future use
• Smart 3D Secure handling with dynamic challenge indicators based on transaction type
• Improved code organization with dedicated helper methods for payment data building
• Subscription support improvements with proper token handling for recurring payments
• Dynamic shipping option updates when address changes in wallet payments
• Proper tax and shipping recalculation based on selected address
• PO number building logic refactored for better maintainability

🛠️ Fixes

• Duplicate token saving issue between webhook and order confirmation resolved
• Session dependency removed from webhook – now uses order meta for reliable server-to-server communication
• Improved shipping method calculation for wallet payments (Apple Pay and Google Pay)
• Shipping options now properly update based on customer location
• Shipping methods now respect WooCommerce zone restrictions and conditions
• Total calculation now uses backend-calculated values for accuracy

👨‍💻 Developer & Internal Changes

• 3DS Request Update
• Enhanced token storage with duplicate prevention mechanism

HPOS declaration in the plugin Read more here

Releases:

• On-site Wallets: We can process on-site payments via Google Pay or Apple Pay directly from the product, cart, and checkout pages.
• Tokenisation: The customer can save their cards for future transactions.
• Subscription: The merchant can accept the subscription of the order via Card payments. The Wallets will not show up if there are subscription products in the cart.
• MOTO: The merchant can make a MOTO transaction by logging into the Administrator account.

• Plugin release with WordPress standards and Plugin check