On this page
For years, nopCommerce shipped with a payment method called Manual, shown to customers as “Credit Card”. nopCommerce 5.00 removes it, and with it the store’s ability to handle card numbers at all. If your store still uses it, this guide covers what changes, what to use instead, and how to clean up the card data it left behind. It’s based on the 4.90 and 5.00 source code.
What the Manual payment method did
The Manual method added a card form to checkout: card type, name, number, expiry date and security code. It didn’t charge anything. It saved the details, encrypted, in the order, and staff read them in the admin area to charge the card on a terminal or by phone. The order could be marked pending, authorised or paid.
It could also be used for recurring products: each renewal reused the stored card. Some stores used it only for testing, because it lets an order through without a real payment.
What changed in nopCommerce 5.00
| What | 4.90 | 5.00 |
|---|---|---|
| Manual payment plugin | Included (“Credit Card”) | Not included; the 4.90 plugin won’t build for 5.00 |
| Card fields in checkout | Passed to the payment plugin | Removed from the payment request |
| Card details on the admin order page | Shown, decrypted, to staff | Not shown |
| Card data already in orders | Stored, encrypted | Still in the database, unused |
| Card columns on the Order table | In use | Marked obsolete; to be removed in 5.10 |
Why it was removed
Card data is covered by the card industry’s security standard, PCI DSS. A store that stores card numbers, even encrypted, has to meet its strictest requirements, with audits to match. Storing the security code after authorisation isn’t allowed at all, encrypted or not, and the Manual method stored it.
Modern payment plugins avoid the problem: the card form is hosted by the provider, the card number goes straight to the provider, and the store only receives a token or a transaction ID. Removing the card fields from nopCommerce makes that the only way.
What to use instead
| If you used it for | Use |
|---|---|
| Take cards online | PayPal Commerce card fields (included), or a Stripe, Adyen, Braintree or similar plugin with hosted fields. |
| Phone and mail orders | The provider’s virtual terminal: staff key the card into the provider’s dashboard, never into nopCommerce. |
| Charge later, when you ship | A plugin that authorises at checkout and captures from the order page. |
| Subscriptions | A plugin that saves the card with the provider (vaulting) and supports recurring payments. |
| Invoice or bank transfer | Check / money order (included), or a purchase order plugin for B2B customers. |
For testing, use the sandbox or test mode of your real payment plugin instead: it tests the checkout customers will see. Our payment methods guide covers choosing a plugin and a test plan.
Clearing stored card data from old orders
The upgrade doesn’t remove the card data already in your orders. It stays in the Order table, encrypted and unused, until nopCommerce 5.10 removes the columns. Until then it’s still card data on your server, and still in every database backup.
- Check how many orders hold card data. The free StorePulse plugin counts orders with a stored card number and with a stored security code, without reading either.
- Charge or cancel any open orders that still depend on a stored card.
- Back up the database, then clear the card columns.
- Replace older backups that still contain card data, following your retention rules.
SQL Server · clear stored card data
-- SQL Server. Back up first. Clears card data stored by the Manual method.
UPDATE [Order]
SET CardType = '', CardName = '', CardNumber = '',
MaskedCreditCardNumber = '', CardCvv2 = '',
CardExpirationMonth = '', CardExpirationYear = '',
AllowStoringCreditCardNumber = 0
WHERE AllowStoringCreditCardNumber = 1
OR CardNumber <> '' OR CardCvv2 <> '';On MySQL or PostgreSQL, quote the table name with backticks or double quotes instead of square brackets. Run it on a copy of the database first and check the order count it reports.
Other payment plugins that took card numbers
The change isn’t limited to the Manual method. In 5.00, checkout no longer passes the card number, expiry date or security code to any payment plugin. Older third-party plugins that posted card details to a gateway from the server won’t build for 5.00 without a rewrite to the provider’s hosted fields or payment page.
Before upgrading, ask each payment plugin’s vendor for a 5.00 version, and test it on a copy of the store. If you maintain the plugin yourself, see our plugin development tutorial for 5.0.
Frequently asked questions
Is the Manual payment method available in nopCommerce 5.0?
No. nopCommerce 5.00 doesn’t include the Manual (credit card) payment plugin, and the 4.90 version can’t be rebuilt for 5.00 because checkout no longer passes card numbers to payment plugins.
What happens to stores using Manual payments when they upgrade?
The Manual method disappears from checkout. If it was the only active payment method, customers have nothing to pay with, so set up a replacement before upgrading. Card data in old orders stays in the database but is no longer shown in the admin area.
Can I still see the card numbers in old orders after upgrading?
Not in the admin area. The encrypted values stay in the Order table until 5.10 removes the columns. Don’t build a way to read them: clear them instead.
Is storing encrypted card numbers PCI compliant?
Storing the card number encrypted is possible under PCI DSS but brings the heaviest requirements. Storing the security code (CVV) after authorisation is never allowed, encrypted or not, and the Manual method stored it.
How do I take phone orders without the Manual method?
Create the order in nopCommerce with an offline method such as Check / money order, and charge the card in your payment provider’s virtual terminal. Then mark the order as paid.
Next steps
Pick the replacement, test it on your 4.90 store, then clear the stored cards and upgrade. If you need a payment provider connected, or a phone-order flow built around a virtual terminal, send us your provider and nopCommerce version. The rest of the 5.0 changes are in our nopCommerce 5.0 overview.