A WooCommerce iFrame checkout is a technique that embeds an external payment page inside your own domain so customers never see a URL change during checkout. This approach is the cornerstone of checkout cloaking strategies used by high-risk merchants to protect their payment processor accounts while delivering a seamless buying experience. In this guide you will discover exactly how a WooCommerce iFrame checkout works, when to use it, and which tools make it reliable in 2026.
- A WooCommerce iFrame checkout embeds a second site’s payment page inside your high-risk store without changing the visible URL.
- This protects PayPal, Stripe, and other processor accounts from flagging your domain as high-risk.
- CODARAB Redirect is the dedicated plugin that automates iFrame embedding, order sync, and email notifications.
- Orders are synchronized in real time between the high-risk site and the low-risk checkout site.
- Customers receive all status emails only from your main store, preserving a professional experience.
- The strategy works alongside CODARAB Payments for merchants who also need card processing via PayPal API.
- An iFrame checkout keeps your brand URL visible while the actual payment is processed on a clean domain.
- Payment processors scan your domain via webhooks — an iFrame hides high-risk product names from those scans.
- You need two WordPress/WooCommerce sites: one high-risk (Site A) and one low-risk (Site B).
- CODARAB Redirect supports three redirect triggers: Add to Cart, Proceed to Checkout, and custom payment method selection.
- Product names can be replaced with order numbers on PayPal receipts to prevent keyword-based account flags.
- The iFrame method is complementary to, not a replacement for, a solid payment gateway like CODARAB Payments.
- What Is a WooCommerce iFrame Checkout?
- Why High-Risk Merchants Need an iFrame Checkout
- How the WooCommerce iFrame Checkout Works Step by Step
- The Two-Site Architecture: Site A vs Site B
- CODARAB Redirect: The Plugin Built for iFrame Checkout
- Three Redirect Trigger Options Explained
- Order Sync and Customer Notifications
- Comparing iFrame Checkout vs Standard Redirect
- Common Mistakes to Avoid with iFrame Checkout
- Combining iFrame Checkout with CODARAB Payments
- Frequently Asked Questions
What Is a WooCommerce iFrame Checkout?
A WooCommerce iFrame checkout is a method where the checkout page of a second, low-risk WooCommerce store is displayed inside an HTML <iframe> element on your primary store. The customer sees your domain in the browser address bar the entire time, but the payment form itself is served from a different domain entirely.
This is different from a simple redirect. With a redirect, the customer is sent to another URL. With an iFrame, the customer stays on your URL while the external page loads invisibly inside a frame. The distinction matters enormously for user trust and for payment processor detection.
Why High-Risk Merchants Need an iFrame Checkout
A WooCommerce iFrame checkout solves a specific and critical problem: payment processors like PayPal and Stripe use webhook callbacks and domain scanning to assess the risk level of a merchant’s website. If your domain is associated with products in categories they consider high-risk — IPTV subscriptions, peptides, high-copy goods, digital services — they can suspend your account without warning.
The iFrame technique works because the payment processor’s webhook sees the low-risk Site B domain, not your high-risk Site A domain. Your products, branding, and customer relationships live on Site A. The payment infrastructure lives on Site B, which carries a clean history.
This is not about deceiving customers. Customers complete a legitimate payment on a legitimate checkout page. The iFrame simply prevents your product catalog from being visible to automated risk-scoring systems that read merchant URLs and receipt metadata.
For merchants whose domain name is already on a payment processor blacklist, the iFrame approach is often the only viable path to continued operation. Even a freshly created PayPal account can be flagged instantly if the webhook registers a known high-risk domain — the CODARAB Redirect plugin was built specifically to solve this scenario.
How the WooCommerce iFrame Checkout Works Step by Step
Understanding the WooCommerce iFrame checkout flow helps you configure it correctly and troubleshoot issues when they arise. The process involves several coordinated events between two sites and a payment processor.
The key technical detail is that the iFrame loads Site B’s checkout with the cart data already pre-populated. CODARAB Redirect transfers the cart total, product references (masked as order numbers), and customer details to Site B before the iFrame renders, so the customer never has to re-enter information.
The Two-Site Architecture: Site A vs Site B
The WooCommerce iFrame checkout strategy requires two separate WordPress installations. Getting this architecture right is the foundation of the entire system.
Site A — The High-Risk Front Store
Site A is the store your customers interact with. It carries your brand, your product catalog, your blog, and your marketing pages. This is the domain you promote on social media and in ads. It can sell IPTV plans, peptides, digital downloads, or any other product category.
Site A does not process payments directly. It collects the customer’s intent and passes it to Site B through the CODARAB Redirect plugin. All customer-facing communications — order confirmations, shipping updates, cancellations — are sent from Site A.
Site B — The Low-Risk Checkout Site
Site B is a clean WooCommerce installation on a separate domain with a neutral, low-risk identity. It contains no product catalog visible to the public. Its sole purpose is to host the payment form and process transactions through your chosen payment gateway.
Site B should have a professional but generic appearance. It should never display product names that could trigger risk-scoring. CODARAB Redirect replaces all product names with the WooCommerce order number on Site B’s receipts, so PayPal or Stripe sees only Order #1234 rather than a product name that could flag the account. For more background on this subject, see WooCommerce official platform.
For a deep dive into setting up this dual-store architecture, see the guide on WooCommerce Dual Store Strategy: How to Protect Your Business from Shutdowns.
CODARAB Redirect: The Plugin Built for iFrame Checkout
The WooCommerce iFrame checkout functionality described in this article is delivered by the CODARAB Redirect plugin, developed by CODARAB — a web development service specializing in payment gateway solutions for WordPress and WooCommerce stores.
CODARAB Redirect is not a generic iFrame plugin. It was engineered specifically for the high-risk merchant use case and includes several features that generic solutions cannot offer.
Core Features of CODARAB Redirect
- iFrame embedding: Displays Site B’s checkout inside Site A without changing the browser URL.
- Three redirect trigger modes: Add to Cart, Proceed to Checkout, or custom payment method selection.
- Real-time order synchronization: Orders created on Site B are immediately mirrored to Site A.
- Single-source customer notifications: All emails go out from Site A only, so customers are never confused by communications from an unknown domain.
- Product name masking: Replaces item names with order numbers on PayPal and Stripe receipts.
- Compatibility: Works with CODARAB Payments, Stripe, PayPal, and other major gateways on Site B.
A live demonstration of CODARAB Redirect is available at dev.wpchatbox.com. Pricing is available on the CODARAB website. You can also see how CODARAB uses its own solution on its checkout page at codarab.com/checkout.
To understand the full scope of what this plugin handles, read CODARAB Redirect Plugin: The All-in-One WooCommerce Cloaking and Sync Solution.
Three Redirect Trigger Options Explained
The WooCommerce iFrame checkout can be activated at three different points in the customer journey. Choosing the right trigger depends on your store layout and conversion goals.
Trigger Option A: Add to Cart / Buy Now / Order Now
When the customer clicks any of these buttons on a product page, they are immediately taken to the iFrame checkout on Site A. This is the most aggressive trigger and produces the shortest path to payment. It is ideal for single-product stores or stores where browsing multiple products before checkout is uncommon.
The trade-off is that customers skip the cart review step entirely. If your average order contains multiple products, this may reduce order value.
Trigger Option B: Proceed to Checkout
The customer adds items to the cart normally and reviews the cart page. When they click Proceed to Checkout, the iFrame loads. This preserves the multi-product cart experience while still cloaking the payment step. It is the most balanced option for general e-commerce stores.
Trigger Option C: Custom Payment Method Selection
The customer reaches Site A’s own checkout page and selects a specific payment method. When they choose the designated method, the iFrame appears. This is the most granular option — you can offer multiple payment methods on Site A, with only one of them triggering the iFrame redirect to Site B.
This is useful when you want to keep some payment methods (such as cryptocurrency or bank transfer) processed directly on Site A, while routing card payments through the protected Site B environment.
For a complete walkthrough of each option, see WooCommerce Custom Checkout Redirect: Add to Cart, Buy Now and Proceed to Checkout.
Order Sync and Customer Notifications
One of the most technically complex aspects of a WooCommerce iFrame checkout setup is keeping orders synchronized between two independent WooCommerce databases. CODARAB Redirect handles this automatically and in real time.
How Order Synchronization Works
When a customer completes payment on Site B, CODARAB Redirect immediately creates a corresponding order on Site A with the same order details, customer information, and payment status. The synchronization is bidirectional for status updates: if you mark an order as Completed or Cancelled on Site A, that status is reflected on Site B as well.
This means your fulfillment team only needs to work in Site A’s dashboard. They never need to log into Site B to manage orders. The entire operational workflow remains centralized.
Customer Email Strategy
A common mistake in dual-store setups is allowing both sites to send emails. A customer who receives a confirmation from an unfamiliar domain will feel confused or suspicious, increasing the risk of disputes and chargebacks.
CODARAB Redirect suppresses all outgoing emails from Site B. The customer receives order confirmation, processing updates, and completion notices exclusively from Site A. This preserves your brand identity and reduces support inquiries caused by confusing communications.
Learn more about this in WooCommerce Order Status Sync: Keep Customers Informed from One Store.
Comparing iFrame Checkout vs Standard Redirect
Merchants evaluating a WooCommerce iFrame checkout often ask how it differs from a standard checkout redirect. The table below clarifies the key differences.
| Feature | iFrame Checkout | Standard Redirect |
|---|---|---|
| Browser URL changes | No — stays on Site A | Yes — customer sees Site B URL |
| Customer awareness of second site | None | Visible in address bar |
| Payment processor domain exposure | Site B only | Site B only |
| User experience quality | Seamless | Minor friction (URL change) |
| Setup complexity | Moderate (requires iFrame config) | Low (simple URL redirect) |
| Order sync required | Yes | Yes |
| Email suppression on Site B | Required | Required |
| Best use case | High-risk stores, blacklisted domains | Moderate-risk stores |
Both approaches are supported by CODARAB Redirect. The iFrame method is recommended when your domain has already been flagged or when you want the highest possible level of checkout cloaking. The standard redirect is sufficient for stores that are proactively protecting a clean account before any flags occur.
For a detailed comparison of both approaches, read WooCommerce Checkout Redirect vs. Standard Checkout: Pros, Cons and Best Use Cases.
Common Mistakes to Avoid with iFrame Checkout
Implementing a WooCommerce iFrame checkout incorrectly can undermine the entire protection strategy. These are the most frequent errors merchants make and how to avoid each one.
Mistake 1: Using the Same PayPal or Stripe Account on Both Sites
The entire purpose of the two-site architecture is to separate the high-risk domain from the payment processor account. If Site B uses the same PayPal account that was previously connected to Site A, the processor already associates that account with your high-risk domain history. Create a fresh payment processor account for Site B.
Mistake 2: Leaving Product Names Visible on Receipts
PayPal’s automated systems scan receipt metadata for high-risk keywords. If Site B sends a receipt that says Item: IPTV Monthly Plan, the account can be flagged even though the domain is clean. Always enable the product name masking feature in CODARAB Redirect so receipts show only the order number.
Mistake 3: Allowing Site B to Send Customer Emails
As noted in the order sync section, dual emails destroy the customer experience. Disable all WooCommerce transactional emails on Site B immediately after installation. CODARAB Redirect handles this suppression automatically, but verify the setting is active.
Mistake 4: Hosting Both Sites on the Same Server IP
Some payment processors and fraud detection systems look beyond the domain name and check the hosting IP. If both sites share the same IP address, the association between them may still be detectable. Use separate hosting providers or at minimum separate hosting accounts with different IP ranges for Site A and Site B.
Mistake 5: Skipping the Clean Checkout Design on Site B
Site B’s checkout page is what customers see inside the iFrame. A poorly designed or incomplete checkout creates distrust and increases cart abandonment. Invest time in building a clean, professional, minimal checkout on Site B. CODARAB provides guidance on this in their clean checkout setup documentation.
Combining iFrame Checkout with CODARAB Payments
The WooCommerce iFrame checkout strategy reaches its full potential when combined with CODARAB Payments as the gateway on Site B. CODARAB Payments is a WooCommerce payment processor built on the PayPal API, designed specifically for high-risk merchant categories.
What CODARAB Payments Adds to the Setup
CODARAB Payments allows Site B to accept international credit and debit cards without displaying the yellow PayPal button. This matters because the yellow PayPal button enables one-click dispute filing by customers, which is a major source of account limitations for digital product and IPTV sellers.
By disabling the yellow button and accepting cards only through the PayPal API, disputes require a more complex process from the customer’s side, significantly reducing the dispute rate. Combined with the iFrame cloaking on Site A, this creates a layered protection system.
The Full Payment Flow with Both Solutions
The combined flow works as follows: the customer on Site A triggers the iFrame, which loads Site B’s checkout inside the frame. Site B presents the CODARAB Payments card form. The customer enters card details. CODARAB Payments processes the card via PayPal API. Funds land in the merchant’s PayPal Business account. The merchant can then withdraw those funds as USDT via a RedoPay Visa card if desired.
This end-to-end system — from card payment on a cloaked checkout to crypto withdrawal — is one of the most complete solutions available for high-risk WooCommerce merchants in 2026.
For the technical prerequisites: CODARAB Payments requires a WordPress site and a PayPal Business account. CODARAB Redirect requires two WordPress sites. Both can be set up quickly, and CODARAB offers professional web development services if you need assistance building either site.
Frequently Asked Questions
What exactly is a WooCommerce iFrame checkout?
A WooCommerce iFrame checkout is a setup where the payment page of a second WooCommerce store is embedded inside an HTML iFrame on your primary store. Customers see your domain in the address bar throughout checkout, while the actual payment is processed on a separate, clean domain that is not associated with high-risk products.
Is the WooCommerce iFrame checkout legal?
Yes. Displaying a legitimate payment page inside an iFrame is a standard web development technique. The customer completes a real transaction on a real checkout page. The method is used to protect merchant accounts from automated risk-scoring systems, not to deceive customers. All transactions are fully documented and synchronized between both stores.
Does the customer know they are paying through a second site?
No. The browser address bar continues to show your primary domain throughout the entire checkout process. The iFrame is invisible to the customer. They interact with a payment form that appears to be part of your main store, and they receive all communications from your main store’s email address.
Which payment gateways work with the iFrame checkout on Site B?
CODARAB Redirect is compatible with CODARAB Payments, Stripe, PayPal standard, and most other WooCommerce-compatible payment gateways. The choice of gateway on Site B is independent of the iFrame setup. CODARAB Payments is the recommended option for high-risk merchants because of its dispute reduction features and card-only mode.
How does order synchronization work between the two sites?
When a customer completes payment on Site B, CODARAB Redirect creates a matching order on Site A automatically and in real time. Status updates — processing, completed, cancelled — are synced bidirectionally. Your team manages everything from Site A’s dashboard and never needs to log into Site B for order management.
Can I use the same PayPal account on both Site A and Site B?
No. Using the same account defeats the purpose of the two-site architecture. The payment processor would still associate the account with your high-risk Site A domain through webhook history. Create a new, separate PayPal Business account for Site B and keep it exclusively connected to that clean domain.
What happens if my Site B domain also gets flagged eventually?
This is a known risk. If Site B’s domain becomes flagged — typically through webhook data exposure or receipt keyword scanning — you would need to create a new Site B on a fresh domain. CODARAB Redirect’s product name masking feature significantly delays this outcome by ensuring PayPal receipts show only order numbers, not product names that could trigger automated flags.
Do I need technical skills to set up a WooCommerce iFrame checkout?
Basic WordPress familiarity is sufficient. CODARAB Redirect is a plugin that installs through the standard WordPress dashboard. The configuration involves connecting the two sites via API keys and selecting your preferred redirect trigger. CODARAB also offers professional setup services for merchants who prefer a fully managed installation.
What is the difference between iFrame checkout and checkout cloaking?
Checkout cloaking is the broader concept of hiding the true payment processing domain from customers and payment processors. An iFrame checkout is one specific implementation of checkout cloaking. Other implementations include server-side redirects and proxy-based solutions. The iFrame method is preferred because it maintains the customer’s URL experience without any visible page transition.
Can I use the WooCommerce iFrame checkout for subscription products?
Yes, with some configuration. CODARAB Redirect supports recurring order scenarios. However, subscription renewal payments typically occur without a customer-facing checkout session, so the iFrame is only relevant for the initial subscription purchase. Renewal charges are handled directly by the payment gateway on Site B according to its own subscription logic.
A WooCommerce iFrame checkout is one of the most effective tools available to high-risk merchants who need to accept card payments without exposing their domain to payment processor risk-scoring systems. By combining a clean two-site architecture with real-time order sync, product name masking, and single-source customer notifications, you can protect your merchant accounts while delivering a seamless checkout experience. To get started with the plugin that makes all of this possible, visit the CODARAB Redirect Plugin page and explore the setup documentation today.