GoUp Checkout Proof of Payment Upload

Plugin slug: goup-checkout-proof-of-payment-upload · Version: 1.0.5 · Author: GoUpWP · https://goupwp.com/plugins/checkout-proof-of-payment-upload

What it does

Lets customers upload a proof of payment (bank transfer receipt, payment screenshot, PDF) at checkout for the payment methods you choose — typically Direct bank transfer or another offline method. The upload can be required or optional per gateway, is validated and stored outside the public uploads path with randomised file names, and is attached to the order for staff to view or download from the order screen.

Works with the classic checkout and the Checkout Block, and with HPOS.

Installation

1. Download the plugin ZIP from your GoUpWP account (Account → Licenses → Download).
2. In WordPress go to Plugins → Add New → Upload Plugin, choose the ZIP and click Install Now, then Activate.
3. WooCommerce must be installed and active; the plugin shows a notice and stays idle until it is.
4. Open WooCommerce → License: Checkout Proof of Payment Upload and paste the license key from your account. Activation unlocks one-click updates and support for this site. A localhost, *.test, *.local or staging. site counts as a staging activation and does not use your production seat.

The plugin keeps working if the license expires: only updates and support pause until it is renewed.

Setup

Open WooCommerce → Proof of Payment.

• Enable the feature and tick the payment methods that should ask for a proof.
• Requirement: Required blocks "Place order" until a file is uploaded; Optional only offers the field.
• Label and description shown to the customer; allowed types (JPG, PNG, WEBP, PDF) and maximum size (capped by the server's upload limit).
• Per-gateway overrides let one method be required with a different label or size limit than another.
• Allow replacing an upload before the order is placed; show in My Account lets the customer see their own proof on the order page; notify admin adds a link to the proof in admin order emails.
• Temporary retention (hours) controls how long an abandoned upload is kept before hourly cleanup deletes it.
• Delete data on uninstall and also delete files control what uninstalling removes.

How it works

1. The file is uploaded immediately when chosen (AJAX for the classic checkout, REST for the Checkout Block), validated by extension, MIME type, authoritative on-disk size and image integrity, rate-limited per session, IP and store-wide temporary-storage use, and stored under wp-content/uploads/goup-proof-of-payment/temporary/ with a random name. Only an opaque token returns to the browser.
2. When the order is placed the token is verified (same session, same gateway, not expired) and the file moves to the orders/ folder; the order gets an order note and the file details as order meta.
3. Both folders are protected with index.php, .htaccess (Apache 2.2 and 2.4) and web.config. Files are only ever served through the plugin's authenticated download endpoint, with a sandboxed Content-Security-Policy.

Staff workflow

• The order screen shows the file name, type, size and gateway with View / Download and Delete buttons.
• Deleting the order (or trashing it under HPOS) deletes the proof as well.
• WooCommerce → Proof Diagnostics shows the storage location, server upload limit and table status.

Privacy

Personal-data export and erasure cover the customer's uploads. Files belonging to an erased order are removed.

Developer hooks

• goup_pop_enabled_gateways( array $ids ), goup_pop_is_required( bool, string $gateway_id )
• goup_pop_allowed_extensions( array, string $gateway_id ), goup_pop_allowed_mime_types( array, string $gateway_id ) can narrow the built-in JPG/JPEG/PNG/PDF/WEBP allowlist, but cannot add web-active or executable formats.
• goup_pop_max_file_size( int $bytes, string $gateway_id ), goup_pop_upload_attempt_limit( int )
• goup_pop_global_temp_byte_limit( int $bytes ) — active temporary-proof storage cap; defaults to 2 GiB.
• goup_pop_temp_expiration( int $hours ), goup_pop_cleanup_batch_size( int $rows ), goup_pop_delete_with_order( bool, int $order_id )
• goup_pop_download_authorized( bool, WC_Order $order ) — grant download access to other roles.
• Actions: goup_pop_upload_validated( array $file, string $gateway_id ), goup_pop_upload_finalized( WC_Order, int $upload_id ).

Troubleshooting

• "Upload failed" for every file — the uploads directory is not writable, or the server's upload_max_filesize is below the plugin limit (see Diagnostics).
• Field does not appear — the selected payment method is not ticked in the settings, or a caching plugin is serving a stale checkout page. Enable Debug logging and read WooCommerce → Status → Logs.
• Proof missing after checkout — the order note "could not be finalized" means the token expired; raise the temporary retention if customers take long to check out.

Updates and licensing

• Updates arrive through the normal Dashboard → Updates and Plugins screens. Every package is downloaded over a signed, time-limited link and verified against its SHA-256 checksum before WordPress installs it.
• View details on the Plugins screen shows the changelog for the new version.
• If the license is not active you still see that an update exists; the row explains that renewing restores one-click updates.
• The license page shows the installed version, the environment this site was classified as (production or staging), your activation counts and the renewal date, and has a Check for updates button.
• Deactivate on this site frees the seat so the key can be used on another site. Deleting the plugin from the Plugins screen also frees the seat automatically.
• Nothing is sent to goupwp.com except the license key, an installation ID, the site URL and the WordPress, PHP and plugin versions used for compatibility checks.

Support and maintenance

• Open a ticket from Account → Support on goupwp.com; include the output of the plugin's Diagnostics tab.
• Keep WordPress, WooCommerce and the plugin updated and test changes on a staging site first.
• The plugin declares compatibility with WooCommerce High-Performance Order Storage (HPOS) and the Cart and Checkout Blocks, and is translation-ready (languages/).
• Uninstalling removes the plugin's data only when the Delete data on uninstall option is enabled, so a reinstall keeps your configuration; license data is always removed.