---
title: "Stripe Checkout for WooCommerce Without Saved Cards: When the Free Plugin Is Enough"
description: "Hosted Stripe Checkout moves the card form and most PCI scope to Stripe. When a free redirect gateway is enough for WooCommerce, and when it is not."
pubDate: 2026-09-03
source: https://pimipay.com/blog/stripe-checkout-woocommerce-without-saved-cards/
---

A small store sells a handful of one-off products. Someone installed the biggest Stripe plugin
in the search results, and it worked. Two years later the site carries
a card form that renders on the WooCommerce checkout page, a saved-payment-methods table the store
never uses, 3-D Secure handling in JavaScript, and a PCI questionnaire that asks about every script on
that page. Nobody buys a subscription. Nobody saves a card. The store sells mugs.

That is the failure this post is about. Not a bug. A mismatch between a plugin built for stores
that need card fields on their own page and a store that never did.

## What an on-page card form costs you

When the card fields render on your checkout, your page becomes part of the payment. Your theme
can break the fields. Every script on that page, analytics, chat widget, cookie banner, sits next
to the card input, and that is exactly what the PCI questionnaires ask about.

Stripe's compliance guide lists both its hosted Checkout and its embedded card fields under
SAQ A, the shortest questionnaire, because in both cases the card inputs live in a Stripe iframe.
The difference is where that iframe sits. With embedded fields it sits on your page, and the
script-integrity rules in PCI DSS 4.0 are about the page that hosts it: every analytics tag, chat
widget and cookie banner becomes something to inventory, which is a strange thing for a mug shop
to be responsible for. With hosted Checkout the payment page is not yours, so there is nothing on
it to inventory.

3-D Secure is the same story. With an embedded form, the challenge runs on your page. With hosted Checkout, Stripe lists SCA as built in. The
authentication happens on Stripe's page and your site only hears the result.

## The insight: move the form, not just the keys

Stripe hosted Checkout is a page on Stripe's domain. The plugin creates a Checkout Session with
the order's line items and a return URL, redirects the customer, and marks the order paid when Stripe's webhook arrives or when the customer
lands back on a session that checks out as paid, whichever comes first. The
card form, the wallet buttons and the authentication step all live on that page.

Two things follow.

**Payment methods are switched on in the Stripe Dashboard, not in WordPress.** When the session
is created without a list of payment method types, Stripe decides which methods are eligible for
that currency and customer. Adding Klarna or iDEAL is a Dashboard toggle, not a plugin update.

**The plugin can stay small.** PimiPay Stripe creates the session, verifies the webhook
signature, marks the order paid, and handles refunds in both directions. It stores no card data
because it never sees any. There is no Stripe SDK; the only bundled library is the plugin's own update checker.

## What the free plugin does not do

Say it plainly, so it does not end up on the wrong store.

**No subscriptions.** Every session is a one-time payment.

**No saved cards.** The plugin never creates a Stripe customer and never stores a payment method
for reuse.

**No card fields on your page.** The redirect is the design, not a setting you can switch off.

**No tax handling.** Stripe processes the payment; you remain the seller of record, so the VAT and
sales tax are yours to work out and remit.

If you sell memberships, or your customers reorder often enough that a stored card matters, you
need a tokenising gateway and this is not the plugin for you.

That last gap is the one a free gateway cannot close. [PimiPay Paddle for WooCommerce](/) sells
through Paddle as [merchant of record](/merchant-of-record/), so Paddle is the seller on the
invoice and handles the tax for every country you sell into — $59/year,
[buy it here](https://portal.w4dev.com/checkout/?add-to-cart=8746&utm_source=pimipay.com&utm_medium=referral&utm_content=blog).
[Paddle vs Stripe for WooCommerce](/blog/paddle-vs-stripe-woocommerce/) compares the two properly.

## One timer to check

A hosted page keeps the customer away from your site for as long as they need. WooCommerce,
meanwhile, cancels unpaid orders once they pass the Hold stock minutes, sixty by default, whenever
stock management is on. The plugin creates each session with a one-hour expiry and blocks the
cancellation while that session can still be paid. On any other hosted gateway, read
[WooCommerce cancels orders while the customer is still paying](/blog/woocommerce-cancels-unpaid-orders/)
before going live.

[PimiPay Stripe Checkout for WooCommerce](/stripe-checkout-for-woocommerce/) is free. If one-off
products and a payment page you never have to style describe your store, it is enough. If they do
not, the download page says so.