PayFast Gateway Validation Endpoint 403 Error Since Aug 24

Hi, We are experiencing a critical issue with the PayFast Gateway plugin (v1.7.3) that started on August 24, 2025. Issue: PayFast validation endpoint returning “403 Forbidden” Endpoint: https://www.payfast.co.za/eng/query/validate Error started suddenly on Aug 24 (worked fine until Aug 23) Tested both v1.7.2 and v1.7.3 – same issue Error Response: HTTP 403 Forbidden 403403 Forbidden What’s Working: ✅ Signature validation ✅ IP validation ✅ Payment data integrity What’s Failing: ❌ External validation via PayFast endpoint Impact: Payment processing failures affecting customer transactions. Questions: Is this a known issue affecting other users? Did PayFast change their validation endpoint requirements? Any recommended workarounds or plugin updates planned? This appears to be a PayFast-side change rather than a plugin issue, but hoping you have guidance or an update planned. Thanks Hi Vikas, Thanks for reaching out, and I know how disruptive payment gateway issues can be. I’ve checked on my end and was able to reproduce the same problem. Here’s a screenshot of what I’m seeing: https://share.zight.com/llulNBno . This issue has already been raised on GitHub here: woocommerce/woocommerce-gateway-payfast#204 , but it doesn’t look like it has been worked on yet. As a workaround in the meantime, I’d recommend trying alternative extensions that support ZAR, so you can continue processing orders without interruption. I hope that helps. Let us know if you need anything else. Hi @frankremmy , Thanks for confirming and sharing the GitHub link. The plugin has always used https://www.payfast.co.za/eng/query/validate , which worked fine until Aug 23, but since Aug 24 it only returns 403. You mentioned trying alternative extensions — can you confirm if this simply means switching the validation URL to https://api.payfast.co.za/eng/query/validate ? If so, please let us know officially so we can patch our sites while waiting for the plugin update. Also, do you have an ETA for a permanent fix? This is urgent since payments are currently blocked on live stores. Thanks & Regards Vikas Hi @vikastyagi87 , I checked again and was able to successfully complete a purchase: https://snipboard.io/ZGUuHx.jpg . It looks like the error happens when you try to checkout using your merchant account email. That means you cannot pay yourself. Could you try checking out using another email address? That should do the trick. I hope that helps. Let us know if you need anything else. Hi @frankremmy , Thanks for your reply. Just to clarify – this isn’t only when using our merchant email. Regular customers are also affected. Example from our logs: [m_payment_id] => 123456 [payment_status] => COMPLETE [email_address] => customer@gmail.com Signature = valid IP = valid Host = https://www.payfast.co.za/eng/query/validate Response = 403 Forbidden As you can see, signature and IP checks pass, but the validation endpoint always returns 403. Could you confirm if we should now be using https://api.payfast.co.za/eng/query/validate instead? Thanks, Vikas @frankremmy any update? Hi @vikastyagi87 , Thanks for sharing. From what I see, the payment status was completed. The order is also showing both on PayFast and in the order details from my side. Could you please share screenshots of your order notes and transaction section on PayFast (be sure to blur out sensitive information). Do you see them there? Also share the full log in WooCommerce → Status → Logs. While we don’t support customization , you can try switching the validation URL to https://api.payfast.co.za/eng/query/validate and see if that helps. I hope that helps. Let us know if you need anything else. Hi @frankremmy , Thanks for your response. Yes, we do see the payments as COMPLETE in PayFast and but the validation step keeps failing. Here’s a full example log from 26 Aug 2025 2025-08-26T14:26:42 Notice ---------- PayFast ITN call received ---------- Payfast Data: [m_payment_id] => 647718 [pf_payment_id] => 12333333 [payment_status] => COMPLETE [item_name] => ExampleSite - 647718 [amount_gross] => 4619.75 [amount_fee] => -132.46 [amount_net] => 4487.29 [custom_str1] => wc_order_xxxxxx [custom_str2] => WooCommerce/10.1.1; https%3A%2F%2Fwww.examplesite.co.za [email_address] => customer@test.com [merchant_id] => 11467261 [signature] => 12333333333333333 Signature = valid IP = valid Host = https://www.payfast.co.za/eng/query/validate Params sent successfully 2025-08-26T14:26:42+00:00 Notice Response: Array ( [<!doctype_html><meta_charset] => "utf-8"><meta name=viewport content="width=device-width, initial-scale=1"><title>403</title>403 Forbidden ) CONTEXT: {"_legacy":true} 2025-08-26T14:26:42+00:00 Notice Error occurred: Bad access of page Additional context { "_legacy": true } ---------- End ITN call ---------- ---------- CONTEXT: {"_legacy":true} As you can see: ✅ Signature validation works ✅ IP validation works ❌ Validation endpoint is returning 403 Forbidden instead of [VALID] This issue only started after 23 Aug 2025 — previously the same endpoint returned [VALID] . Thanks Vikas This reply was modified 9 months ago by vikasTYAGI87 . Hi @frankremmy , Sandbox payments are validating correctly – the issue occurs only with the live payment method . I’ve already shared the live payment logs with you above reply. Please review and advise. Thanks hi @frankremmy Please let me know if you have any update. Thanks Issue is also raised on Github, we are experiencing EXACTLY the same problem since evening of 23 Aug / morning 24 Aug. Nothing has worked since. Github issue: https://github.com/woocommerce/woocommerce-gateway-payfast/issues/320 PS, it is NOT the same as the github issue quoted earlier by the plugin author. This is something else. I’m interested in the suggestions to change the validation API endpoint to: https://api.payfast.co.za/eng/query/validate – I was not aware of the possibility of changing. Please devs, these are live sites (many times not run by knowledgable owners) mostly from small business that are suffering because of some change to the API’s auth. @vikastyagi87 If you find ANY work-around please post it here. We are desperate for a solution as we’re going to the end of day 4 here. Hi @ernst1234 Yes, I’m the one who created the GitHub ticket https://github.com/woocommerce/woocommerce-gateway-payfast/issues/320 , I will update you if i found any solution. @frankremmy Any update on this? It’s already been 5 days since the issue started. Thanks This reply was modified 9 months ago by vikasTYAGI87 . @frankremmy Please let us know if any update. @frankremmy any idea when your team able to fix it? Thanks Hi @vikastyagi87 , Thank you for getting back to us. I completely understand your concern about wanting to know when this issue will be resolved. I’ve reviewed the reported case here: https://github.com/woocommerce/woocommerce-gateway-payfast/issues/320 , but it looks like the development team hasn’t yet revisited it. At this time, we don’t have a confirmed timeline for a fix until the dev team provides an update. You’re welcome to track progress directly through the GitHub thread. I realize this may not be the response you were hoping for, and I know how frustrating this can be. We truly appreciate your patience while the team continues to investigate the issue. It fixed by Payfast support. Hi there, Thank you for the update — glad to hear it’s been fixed with Payfast support! 🎉 If you don’t mind, could you please share what the issue was and how they resolved it? That way, it can also help other users who may run into a similar problem. Out of curiosity, have you found the PayFast Gateway plugin useful for your store overall? If it’s been helpful, we’d really appreciate it if you could consider leaving a ★★★★★ review here: https://wordpress.org/support/plugin/woocommerce-payfast-gateway/reviews/#new-post It helps us and also lets other store owners know it’s a reliable solution.