Version 2.6 of the Scotiabank eCom+ Payment Gateway for WooCommerce is now available. We skipped a formal announcement for 2.5, so this post covers both releases together. Between them you get the two features merchants have asked for most since launch, a free sandbox with every feature unlocked, and WooCommerce Subscriptions integration.
Modal Checkout: pay right on the checkout page
Until now, a customer who clicked Place Order was sent off to a separate order-pay page to enter their card details. It worked, but every extra page load is another moment where a customer can hesitate, and the handoff never quite felt like part of the store.
Modal Checkout keeps them where they are. The payment form opens in an overlay directly on the checkout page, the customer pays, and the order completes without ever leaving. Fewer page loads, a shorter path to payment, and a flow that looks like it belongs to your store rather than to a processor.
This is available on every plan, and the existing redirect flow is still there if you prefer it. You can switch between the two under Payment Behaviour in the plugin settings.
WooCommerce Subscriptions support (Premium)
If you sell memberships, subscription boxes, service retainers, or anything else on a recurring cycle, this is the release you have been waiting for.
The plugin now saves the customer’s payment method at checkout automatically if a subscription product is in the cart and uses it for every renewal after that. There is no checkbox for the customer to remember to tick, and no scramble to collect card details later because nothing was stored. The first payment goes through as normal, and renewals process on schedule in the background with no customer interaction at all.
Subscriptions support is a Premium plan feature and requires the WooCommerce Subscriptions extension, which is sold separately by WooCommerce. The groundwork for this shipped quietly in 2.5, when we added support for the Fiserv primary token payment API.
The free sandbox now has everything
If you are still evaluating the plugin, 2.5 changed how that works. Every feature is now available in sandbox mode without a paid plan. Saved cards, the REST API operations, the order ID prefix, all of it. You can build your checkout, run test transactions through the full flow, and confirm the plugin does what your store needs before you spend a cent. Buy a license when you are ready to go live, not before.
On the other side of that, 2.5 also added an admin notice that appears if a paid plan lapses while the plugin is running in production mode, so you are not left quietly missing updates and priority support without realising it.
Fixes worth knowing about
Duplicate order emails. Scotia occasionally returns an empty pre-response before the real approval comes through. That was being treated as a completed payment, and some customers received two order confirmation emails for a single purchase. Fixed in 2.5.
Saved card handling. Three separate issues in this area are resolved in 2.6. Cards were not being attached to a subscription when the customer left “Save card” unchecked at checkout. The save card preference was not carrying through in Block Checkout when using the order-pay page flow, or in Classic checkout when using the modal flow.
Cleaner settings, more readable logs
The admin settings screen has been reorganised into four labelled sections: Payment Credentials, Payment Behaviour, Scotia REST API, and Premium Features. Nothing was removed, but finding a specific setting no longer means scrolling through one long undifferentiated list.
Transaction logging also got some attention. Each transaction now opens and closes with a clear separator line, which makes a real difference when you are digging through a log file to work out what happened to one specific customer’s payment.
Security hardening
Four changes went into 2.6 on the security side, all on the payment callback and modal payment paths:
- Constant-time HMAC comparison on callback verification, which closes off timing attacks
- postMessage broadcasts restricted to same origin only
- Nonce verification added to the modal payment REST endpoint
- Order ownership verified before a payment callback is processed
None of these require any action on your part, but they are a good reason to update sooner rather than later.
Updating
Update from Plugins in your WordPress dashboard, or download the latest build from your account. If you run a heavily customised checkout, test on staging first as you normally would.
If you are not using the plugin yet, Scotiabank eCom+ is live in Trinidad and Tobago, Jamaica, Barbados, Guyana, the Cayman Islands, Turks and Caicos, and The Bahamas. Install the free version, switch it to sandbox mode, and try the whole thing before you commit.