💳 CCAvenue PayFlow — WordPress Plugin

A secure, lightweight, CCAvenue Non-Seamless Hosted Checkout (Billing Page) integration for WordPress. Built for simplicity, stability, and easy merchant onboarding.

---

📦 Features

✅ 3-step hosted checkout flow

✅ Dedicated Admin Payments Dashboard in WordPress backend

✅ CCAvenue encryption/decryption with AES-128-CBC

✅ Auto-creates ccavenue_orders database table

✅ Secure nonce-based AJAX for viewing order details

✅ Works with live or test credentials

✅ Clean, modern payment UI (form + confirmation + response)

✅ No dependency on WooCommerce

✅ Shortcode-based integration (works with any WordPress theme)

---

🧭 Flow Overview

Step	Page	Shortcode	Description
1️⃣	/pay/	[pay_form]	Collects Name, Email, and Amount; stores data in PHP session
2️⃣	/pay-confirm/	[pay_confirm]	Displays user details, encrypts and redirects securely to CCAvenue
3️⃣	/pay-response/	[pay_response]	Decrypts CCAvenue response, updates DB, and shows result

Note: There is no /pay-process/ step — encryption and redirection are handled inside pay_confirm.php.

---

🖥️ New in Version 1.1.0 — Admin Payments Dashboard

The plugin now includes a built-in backend dashboard under WordPress → CCAvenue Payments.

Features:

• Summary cards showing total revenue, success, pending, and failed counts
• Paginated transaction list with filters and order details modal
• “View” button for JSON transaction data (decrypted response view)
• Secure AJAX requests protected with WordPress nonces
• Accessible only to Admins (manage_options capability)
• Modern, responsive layout with badges for payment status

File: includes/admin-payments-page.php

Menu Icon: 🛒 dashicons-cart

---

⚙️ Installation

1️⃣ Upload Plugin

Upload the ccavenue-payflow folder to /wp-content/plugins/ —or— Install the .zip via WordPress → Plugins → Add New → Upload Plugin

2️⃣ Activate Plugin

Activate CCAvenue PayFlow from the WordPress dashboard.

3️⃣ Add Required Constants

In your wp-config.php file, define your merchant credentials:

define('CCA_MERCHANT_ID', 'YOUR_MERCHANT_ID');
define('CCA_ACCESS_CODE', 'YOUR_ACCESS_CODE');
define('CCA_WORKING_KEY', 'YOUR_WORKING_KEY');
define('CCA_TEST_MODE', false); // Set to true for sandbox mode

4️⃣ Create Required Pages

Page	Permalink	Shortcode
Payment Form	/pay/	[pay_form]
Confirmation	/pay-confirm/	[pay_confirm]
Response	/pay-response/	[pay_response]

Each shortcode automatically loads its matching template from includes/templates/.

---

🧩 Database Table

On activation, the plugin automatically creates:

wp_ccavenue_orders (
  id bigint(20) AUTO_INCREMENT,
  order_id varchar(50),
  name varchar(100),
  email varchar(100),
  amount decimal(10,2),
  status varchar(50),
  response_json text,
  created_at datetime DEFAULT CURRENT_TIMESTAMP,
  PRIMARY KEY (id)
)

This logs every initiated or completed payment.

---

🧠 Technical Workflow

1. User fills /pay/ form Data validated and stored in session → redirect to /pay-confirm/.

2. User confirms on /pay-confirm/ Generates order ID, logs in DB, encrypts payload, auto-submits to CCAvenue.

3. CCAvenue redirects back Response hits /pay-response/, gets decrypted, DB updated, result displayed.

---

⚙️ Session Handling (Hostinger-Safe)

Problem (originally): PHP-FPM mode couldn’t write to /opt/alt/php83/.../session, causing lost sessions. Fix (permanent): Plugin now defines its own session directory.

Add this snippet to ccavenue-payflow.php (already included in current version):

if (session_status() === PHP_SESSION_NONE) {
    $session_dir = WP_CONTENT_DIR . '/uploads/php_sessions';
    if (!is_dir($session_dir)) mkdir($session_dir, 0755, true);
    ini_set('session.save_path', $session_dir);
    session_start();
}

✅ Ensures consistent sessions even if LiteSpeed Cache is disabled.

---

🔐 Security & Stability

• All AJAX actions protected via check_ajax_referer()
• Admin access limited to users with manage_options
• Encrypted request/response handling via AES-128-CBC
• Escaped and sanitized output in all admin and frontend templates
• Database writes via $wpdb->prepare()

---

💼 Folder Structure

ccavenue-payflow.php
includes/
├── class-ccavenue-crypto.php
├── class-ccavenue-handler.php
├── admin-payments-page.php
└── templates/
    ├── pay_form.php
    ├── pay_confirm.php
    └── pay_response.php

---

🧾 Example Live Flow

1. Visit /pay/
2. Enter Name, Email, and Amount (e.g., ₹15)
3. Review and confirm on /pay-confirm/
4. Complete payment on CCAvenue’s hosted page
5. Get redirected to /pay-response/ with result displayed

✅ Order and payment details automatically logged in admin dashboard.

---

🚀 Current Stable State (v1.1.0)

✅ Full end-to-end payment flow ✅ Admin dashboard with live transaction log ✅ Works under both LiteSpeed and FPM (custom session path fix) ✅ Live CCAvenue integration verified ⚠️ Requires valid credentials and correct response URL configuration

---

🛠️ Upcoming Enhancements (v1.2.0)

• [ ] Generate ticket notes with predefined payment links
• [ ] Add email confirmation to admin and customer
• [ ] Add export options (CSV/Excel) in admin dashboard
• [ ] Add date & status filters
• [ ] Integrate reCAPTCHA on /pay/ form
• [ ] Move inline admin styles to assets/css/admin.css

---

🧑‍💻 Credits

Developed by Preetham Fernandes with technical architecture and debugging support by ChatGPT (OpenAI GPT-5).

---

🪪 License

GPL v2 or later © 2025 Preetham Fernandes Use freely, modify responsibly.