vikasTYAGI87

It fixed by Payfast support.

@frankremmy Please let us know if any update.

hi @frankremmy

Please let me know if you have any update.

Thanks

Hi @frankremmy,

Thanks for your response. Yes, we do see the payments as COMPLETE in PayFast and but the validation step keeps failing.

Here’s a full example log from 26 Aug 2025

2025-08-26T14:26:42 Notice 
----------
PayFast ITN call received
----------

Payfast Data:
[m_payment_id] => 647718
[pf_payment_id] => 12333333
[payment_status] => COMPLETE
[item_name] => ExampleSite - 647718
[amount_gross] => 4619.75
[amount_fee] => -132.46
[amount_net] => 4487.29
[custom_str1] => wc_order_xxxxxx
[custom_str2] => WooCommerce/10.1.1; https%3A%2F%2Fwww.examplesite.co.za
[email_address] => [email protected]
[merchant_id] => 11467261
[signature] => 12333333333333333

Signature = valid  
IP = valid  

Host = https://www.payfast.co.za/eng/query/validate  
Params sent successfully  

2025-08-26T14:26:42+00:00 Notice Response:
Array
(
    [<!doctype_html><meta_charset] => "utf-8"><meta name=viewport content="width=device-width, initial-scale=1"><title>403</title>403 Forbidden
)
CONTEXT: {"_legacy":true}

2025-08-26T14:26:42+00:00 Notice Error occurred: Bad access of page  
Additional context
{
    "_legacy": true
}

----------
End ITN call
----------
---------- CONTEXT: {"_legacy":true}

As you can see:

• ✅ Signature validation works
• ✅ IP validation works
• ❌ Validation endpoint is returning 403 Forbidden instead of [VALID]

This issue only started after 23 Aug 2025 — previously the same endpoint returned [VALID].

Thanks

Vikas

• This reply was modified 9 months ago by vikasTYAGI87.

Hi @frankremmy ,

Thanks for your reply. Just to clarify – this isn’t only when using our merchant email. Regular customers are also affected.

Example from our logs:

[m_payment_id] => 123456
[payment_status] => COMPLETE
[email_address] => [email protected]
Signature = valid
IP = valid
Host = https://www.payfast.co.za/eng/query/validate
Response = 403 Forbidden

As you can see, signature and IP checks pass, but the validation endpoint always returns 403. Could you confirm if we should now be using https://api.payfast.co.za/eng/query/validate instead?

Thanks,
Vikas

Untill support dont reply – Use the following code snippet in your theme’s functions.php file

add_action('admin_init', function () {
$user_id = get_current_user_id();
if ($user_id) {
// Simulate dismissing the notice for the current user
$meta_key = '_dismissed_notice_jwt_auth_welcome';
if (!get_user_meta($user_id, $meta_key, true)) {
update_user_meta($user_id, $meta_key, true);
}
}
});

• This reply was modified 10 months, 1 week ago by vikasTYAGI87.

@topps it fixed Now.