Brent Wilson

Hello Philippe,

I am not seeing a ticket on our end regarding this. Were you able to use https://pastebin.com/ to copy the contents of the log and share with us?

Hello Erwin,

Apologies for the slow turnaround here. We had issues with a notification system that was supposed to be set up but never was. We have spent a lot of time over the last month doing a thorough audit and StellarPay is definitely on the top of our list!

Having other payment gateways active is not the problem – StellarPay works alongside other payment methods without conflict.

The most likely issue: You need to connect your Stripe account

Simply installing and activating StellarPay isn’t enough. The payment gateway only appears at checkout after you’ve completed the Stripe account connection through the StellarPay dashboard.

Steps to get StellarPay working:

1. Go to your WordPress admin → StellarPay dashboard
2. Complete the Stripe Connect onboarding process to link your Stripe account
3. Important: You must connect a Live Mode Stripe account (the gateway registration requires this, even if you plan to test first)
4. Once connected, the StellarPay payment option will automatically appear at checkout Technical detail: The plugin checks isLiveModeConnected() before registering the payment gateway with WooCommerce (src/Integrations/WooCommerce/ServiceProvider.php:145). If no Stripe account is connected, the gateway simply doesn’t register – which is why you’re not
   seeing it. After connecting:

• You can enable Test Mode in settings to test transactions
• StellarPay will appear alongside your other payment methods
• For subscription products specifically, StellarPay becomes the only payment option shown (this is intentional)

Let me know if that helps!

Hello Jason,

Apologies for the slow turnaround here. We discovered an issue where we were not being alerted to new topics here.

Thanks for reaching out! You’re correct that this works differently from the official Stripe plugin.

How StellarPay handles payment methods:

StellarPay uses Stripe’s Payment Element with automatic_payment_methods enabled, which means Stripe automatically determines which payment methods to display based on:

• Your Stripe Dashboard payment method settings
• The customer’s location/region
• The transaction type (one-time vs subscription) This is by design – StellarPay intentionally delegates payment method availability to Stripe’s intelligent routing rather than providing individual toggles in WordPress. To control which payment methods appear: Go to your Stripe Dashboard → Settings → Payment Methods (https://dashboard.stripe.com/settings/payment_methods) and enable/disable specific methods there. StellarPay will automatically respect those settings.
• What StellarPay does let you control in the WordPress backend:
  • Payment Element theme (Stripe or Flat)
  • Payment Element layout (Tabs, Stacked, Minimal)
  • Custom appearance/colors
  • Gateway title and statement descriptor

Let me know if I understood your question correctly. If I missed something, happy to clarify!

Hello,

Glad you reached out here about this!

When you go through the set up process again, do you see any errors in the browser console?

Hello,

Apologies for the slow turnaround here.

The Hide Backend feature is known to conflict with plugins, so the first thing I would do here is to ensure all other plugins are deactivated and see if the issue persists.

If the issue still remains, ensure that the .htaccess file is being properly written to, as this can cause issues as well.

Let me know what you find!

Hello,

Glad you reached out about this!

The possibility of false positives is something we are aware of and are looking at ways to better mitigate this going forward. As you mentioned, we do allow you to “mute” the warning, which is the current workaround that we suggest until refinements can be done to better handle potential false positives going forward.

Thanks so much for letting us know about this one, and I will do some further testing to see what I can hand off to our development team in order to improve our site scan in a future update!

Hello,

Apologies for the delay here!

This code is untested so please try this on a staging/development site before pushing it live. This should help get you pointed in the right direction:

<?php
/**
 * WooCommerce: show Solid Security "attempts remaining" after a real failed login.
 * Place in wp-content/mu-plugins/attempts-remaining.php (preferred) or your theme’s functions.php
 */

add_action( 'wp_login_failed', function ( $username, $error ) {
	// Only show on WooCommerce flows where notices are displayed.
	if ( ! function_exists( 'wc_add_notice' ) ) {
		return;
	}

	// Solid Security classes must be available.
	if ( ! class_exists( 'ITSEC_Modules' ) || ! class_exists( 'ITSEC_Lib' ) ) {
		return;
	}

	$settings    = ITSEC_Modules::get_settings( 'brute-force' );
	$host_limit  = isset( $settings['max_attempts_host'] ) ? (int) $settings['max_attempts_host'] : 0;
	$user_limit  = isset( $settings['max_attempts_user'] ) ? (int) $settings['max_attempts_user'] : 0;
	$period_min  = isset( $settings['check_period'] ) ? (int) $settings['check_period'] : 0;

	// If both limits are effectively disabled, skip.
	if ( $host_limit <= 0 && $user_limit <= 0 ) {
		return;
	}

	global $wpdb;
	$table = $wpdb->base_prefix . 'itsec_logs';
	$since = gmdate( 'Y-m-d H:i:s', time() - ( $period_min * 60 ) );

	// Use Solid Security’s IP helper so proxies/CDN are respected (configure Proxy Detection in Security > Settings > Global).
	$ip = ITSEC_Lib::get_ip();

	// Count failures for this host (IP) in the window.
	$host_used = 0;
	if ( $host_limit > 0 ) {
		$host_used = (int) $wpdb->get_var(
			$wpdb->prepare(
				"SELECT COUNT(*) 
				 FROM {$table}
				 WHERE module = %s
				   AND code LIKE 'invalid-login%%'
				   AND remote_ip = %s
				   AND init_timestamp > %s",
				'brute_force', $ip, $since
			)
		);
	}
	$host_remaining = ( $host_limit > 0 ) ? max( 0, $host_limit - $host_used ) : PHP_INT_MAX;

	// Count failures for this specific user (if it exists) in the window.
	$user_remaining = PHP_INT_MAX;
	if ( $user_limit > 0 ) {
		$user = get_user_by( is_email( $username ) ? 'email' : 'login', $username );
		if ( $user instanceof WP_User ) {
			$user_used = (int) $wpdb->get_var(
				$wpdb->prepare(
					"SELECT COUNT(*)
					 FROM {$table}
					 WHERE module = %s
					   AND code = %s
					   AND init_timestamp > %s",
					'brute_force',
					'invalid-login::user-' . $user->ID,
					$since
				)
			);
			$user_remaining = max( 0, $user_limit - $user_used );
		}
	}

	$remaining = min( $host_remaining, $user_remaining );

	// If at least one limit is active, show a notice.
	if ( PHP_INT_MAX !== $remaining ) {
		/* translators: 1: number remaining, 2: "s" plural suffix (or empty), 3: minutes in window */
		$message = sprintf(
			__( 'Heads up: You have %1$d login attempt%2$s remaining before a temporary lockout (resets after %3$d minutes).', 'your-textdomain' ),
			$remaining,
			( 1 === (int) $remaining ) ? '' : 's',
			$period_min
		);

		// Use a neutral notice; switch to 'error' if you want it red.
		wc_add_notice( $message, 'notice' );
	}
}, 10, 2 );

Let me know if you run into any issues!

Hello,

Glad you reached out here about this!

This issue is likely caused by the following setting(s):

Security > Settings > Advanced > System Tweaks.

Specifically the PHP Execution section.

I would disable all options within that section, then enable one by one until you see the issue popup again. This will let you know which option you should keep disabled.

Let me know if this helps!