Stripe Checkout for WooCommerce Without Saved Cards: When the Free Plugin Is Enough
A small store sells a handful of one-off products. Someone installed the biggest Stripe plugin in the search results, and it worked. Two years later the site carries a card form that renders on the WooCommerce checkout page, a saved-payment-methods table the store never uses, 3-D Secure handling in JavaScript, and a PCI questionnaire that asks about every script on that page. Nobody buys a subscription. Nobody saves a card. The store sells mugs.
That is the failure this post is about. Not a bug. A mismatch between a plugin built for stores that need card fields on their own page and a store that never did.
What an on-page card form costs you
When the card fields render on your checkout, your page becomes part of the payment. Your theme can break the fields. Every script on that page, analytics, chat widget, cookie banner, sits next to the card input, and that is exactly what the PCI questionnaires ask about.
Stripe’s compliance guide lists both its hosted Checkout and its embedded card fields under SAQ A, the shortest questionnaire, because in both cases the card inputs live in a Stripe iframe. The difference is where that iframe sits. With embedded fields it sits on your page, and the script-integrity rules in PCI DSS 4.0 are about the page that hosts it: every analytics tag, chat widget and cookie banner becomes something to inventory, which is a strange thing for a mug shop to be responsible for. With hosted Checkout the payment page is not yours, so there is nothing on it to inventory.
3-D Secure is the same story. With an embedded form, the challenge runs on your page. With hosted Checkout, Stripe lists SCA as built in. The authentication happens on Stripe’s page and your site only hears the result.
The insight: move the form, not just the keys
Stripe hosted Checkout is a page on Stripe’s domain. The plugin creates a Checkout Session with the order’s line items and a return URL, redirects the customer, and marks the order paid when Stripe’s webhook arrives or when the customer lands back on a session that checks out as paid, whichever comes first. The card form, the wallet buttons and the authentication step all live on that page.
Two things follow.
Payment methods are switched on in the Stripe Dashboard, not in WordPress. When the session is created without a list of payment method types, Stripe decides which methods are eligible for that currency and customer. Adding Klarna or iDEAL is a Dashboard toggle, not a plugin update.
The plugin can stay small. PimiPay Stripe creates the session, verifies the webhook signature, marks the order paid, and handles refunds in both directions. It stores no card data because it never sees any. There is no Stripe SDK; the only bundled library is the plugin’s own update checker.
What the free plugin does not do
Say it plainly, so it does not end up on the wrong store.
No subscriptions. Every session is a one-time payment.
No saved cards. The plugin never creates a Stripe customer and never stores a payment method for reuse.
No card fields on your page. The redirect is the design, not a setting you can switch off.
No tax handling. Stripe processes the payment; you remain the seller of record, so the VAT and sales tax are yours to work out and remit.
If you sell memberships, or your customers reorder often enough that a stored card matters, you need a tokenising gateway and this is not the plugin for you.
That last gap is the one a free gateway cannot close. PimiPay Paddle for WooCommerce sells through Paddle as merchant of record, so Paddle is the seller on the invoice and handles the tax for every country you sell into — $59/year, buy it here. Paddle vs Stripe for WooCommerce compares the two properly.
One timer to check
A hosted page keeps the customer away from your site for as long as they need. WooCommerce, meanwhile, cancels unpaid orders once they pass the Hold stock minutes, sixty by default, whenever stock management is on. The plugin creates each session with a one-hour expiry and blocks the cancellation while that session can still be paid. On any other hosted gateway, read WooCommerce cancels orders while the customer is still paying before going live.
PimiPay Stripe Checkout for WooCommerce is free. If one-off products and a payment page you never have to style describe your store, it is enough. If they do not, the download page says so.