iyzico Checkout for WooCommerce — card payments in Turkey with instalments

iyzico Checkout for WooCommerce is a payment plugin for stores that sell in Turkey through iyzico. The customer pays by card on iyzico’s secure page with 3D Secure and instalments (taksit), and the order is confirmed only after your server has asked iyzico for the result itself and checked its signature, amount, currency and basket. Not the customer’s browser, not a URL parameter, but a signed response from iyzico.

Why another iyzico plugin. The official iyzico plugin for WooCommerce runs on 10,000 sites and is rated 1.7 out of 5: reviews complain about HPOS incompatibility, a white screen after updates and orders that get stuck without a status. We built the plugin around four things that must always work: server-side payment verification, a webhook for when the tab is closed, HPOS and the block checkout.

The base version is free. Taking payments, signature verification, webhooks, the fraud-review status and the sandbox work without a licence and with no time limit. Pro adds refunds from the order screen (and same-day cancellation), instalment control with the instalment fee on the order, and a payment journal.

Live demo

Our WooCommerce demo store shows the plugin in test mode: iyzico’s responses are simulated there and no money is taken from the card. In this mode we ran the classic and block checkout, a successful payment, instalments, a bank decline, a fraud review, a forged signature, an underpayment, a webhook without the customer returning, and partial and full refunds. The screenshots below come from there. Real iyzico payments are verified once you connect your own merchant account: first with iyzico sandbox keys, then with live ones.

What the buyer sees

What the admin gets

• iyzico sandbox — you test the integration on test keys before any real money moves.
• “Check keys” — one signed request to iyzico without creating a payment. You find out about wrong keys in the admin, not from a customer.
• iyzico fraud review: a payment under review puts the order On hold with a “do not ship” note. Once iyzico approves it, the webhook moves the order to paid.
• Pro refunds from the order screen: a full refund on the day of payment goes through as a cancellation (nothing shows on the customer’s statement), partial refunds are spread across basket items, keeping track of how much has already been refunded.
• Pro instalments: choose which options (tek çekim, 2, 3, 6, 9, 12 taksit) the payment page offers and, if you like, add the instalment fee to the order as a separate line.

How it works, step by step

1. At checkout the customer chooses card payment via iyzico and places the order.
2. The plugin creates a Checkout Form in iyzico: customer, addresses, basket. Basket items always add up to the order total to the cent (discounts, shipping and rounding are balanced), so iyzico never rejects the request over an amount mismatch. The request is signed with IYZWSv2 (HMAC-SHA256), and iyzico’s response is verified by its signature.
3. The customer pays on the iyzico page: 3D Secure, instalments, iyzico wallet.
4. iyzico sends the customer back with a token. The plugin does not trust that token: it finds the order by number and key, asks iyzico for the result with the stored token and checks the signature, token, basket ID, currency and amount.
5. The order moves to Processing (or Completed) with the Payment ID, instalments and card in a note.
6. If the customer closed the tab, iyzico sends a webhook signed with X-IYZ-SIGNATURE-V3. The plugin checks the signature and asks for the result the same way — the order won’t be left pending.
7. A callback and a webhook arriving together won’t record the payment twice: the result is applied under a database-level lock.

Pricing

890 UAH — a one-year licence. A year of updates, technical support and all Pro features.

• 1 year — 890 UAH
• 2 years — 1,690 UAH (−5%, 845 UAH per year)
• 3 years — 2,350 UAH (−12%, 783 UAH per year)
• 4 years — 2,920 UAH (−18%, 730 UAH per year)
• 5 years — 3,340 UAH (−25%, 668 UAH per year)

No auto-charges: renewal is manual and reminders arrive by email. A purchased licence keeps Pro features working after the term ends — the term pays for updates and support. One key, one domain.

Trial first, payment later. A free 7-day Pro trial is switched on with a button in the plugin settings, no card required. A fresh install is the clean Free version.

Technical requirements

• WooCommerce 6.0+ with the classic or block checkout, HPOS compatible
• WordPress 6.2+ · PHP 7.4+
• Store currency: TRY, USD, EUR, GBP, NOK, CHF, RUB or IRR. For any other currency the payment method hides itself.
• An iyzico merchant account for real payments. For the sandbox, free sign-up at sandbox-merchant.iyzipay.com.

Under the hood

• Server-side result verification: the HMAC-SHA256 signature of iyzico’s response (paymentStatus, paymentId, currency, basket, conversationId, amounts, token) is checked against your secret key.
• The token from the browser is never used for confirmation — only the one stored when the payment was created.
• V3 webhook with signature verification; an unsigned or forged request gets 401 and changes nothing.
• Idempotency: a paid or refunded order is never rolled back by a late response, and double confirmation is blocked at the database level.
• Refund accounting per item transaction: iyzico never receives a request for more than the remaining balance.
• T.C. Kimlik No is not stored on the order or written to the log — it is only passed on to iyzico.
• Secret keys are encrypted in the database and never reach the log.
• Translations: Turkish, Ukrainian, English.

How to install

1. Plugins → Add New → Upload Plugin: choose catcode-iyzico-checkout-for-woocommerce-1.0.0.zip and activate it.
2. WooCommerce → Settings → Payments → iyzico Checkout (CatCode).
3. Paste the API key and secret key from the iyzico dashboard → Settings → Merchant Settings (for testing, the sandbox keys with the sandbox- prefix).
4. Click “Check keys” and save.
5. Copy the webhook URL at the bottom of the settings into the iyzico dashboard → Merchant Notifications.
6. For Pro: paste your licence key or start the 7-day trial.

Version history

1.0.0 — September 2026

First release: iyzico Checkout Form with server-side signature verification, V3 webhooks, fraud-review status, balanced basket, T.C. Kimlik No field, classic and block checkout, HPOS, tr/uk translations. Pro: refunds and same-day cancellation, instalment and fee control, payment journal.