Bitrequest for WooCommerce

Why it is required: the app and its libraries must be served from the same origin the checkout window points at, because the plugin verifies the window’s origin before accepting a payment result from it. Splitting them would break that check.

Self-hosting: the “Bitrequest URL” setting accepts any host serving an unmodified build, so you can point the plugin at your own copy and remove this dependency entirely.

Provider: Bitrequest. Terms and conditions: https://github.com/bitrequest/bitrequest.github.io/wiki/Terms-and-conditions – Privacy / disclaimer: https://www.bitrequest.io/privacy/

2. CoinMarketCap image CDN (s2.coinmarketcap.com)

What it is: a public CDN serving cryptocurrency logo images.

What is sent and when: coin and token icons are loaded in the WordPress admin only – on the gateway settings screen, the orders list, the order edit screen and the payments overview. Loading an image exposes the logged-in administrator’s IP address and user agent to CoinMarketCap. No order, store or customer data is sent, and no request is made from any customer-facing page.

Why it is required: the ERC-20 token picker covers roughly a thousand tokens, so their icons cannot practically be bundled with the plugin. Customer-facing pages use only icons bundled inside the plugin, so a shopper’s browser never contacts this service.

Provider: CoinMarketCap Mgmt Limited. Terms of use: https://coinmarketcap.com/terms/ – Privacy policy: https://coinmarketcap.com/privacy/

3. Lightning proxy (optional, merchant-configured)

Only used if you enable Lightning. The plugin sends invoice status lookups to the proxy URL you enter in the settings – a host you choose and control, such as your own node or a service you have an account with. Requests contain the Lightning payment identifier for the order and nothing else. No proxy is contacted if Lightning is left disabled, and the plugin has no default proxy.

4. Webhook URL (optional, merchant-configured)

If you set a Webhook URL, the plugin POSTs order and transaction data to that address when the customer’s browser reports a payment (once per order). This is your own endpoint; leave the field empty and no request is made. With a Webhook secret set, each request carries an X-Bitrequest-Signature header your endpoint can verify. The data is not verified on-chain; the order stays on hold until you check it.

Note on block explorers

Explorer links shown in the admin and in order emails are ordinary hyperlinks. Nothing is sent to a block explorer unless someone clicks one.