Check Payment and Shipping Plugins Before a VirtueMart Upgrade

A shop can lose its design and still take orders. It can't take orders without payment. Payment and shipping plugins are the part of a VirtueMart upgrade that deserves the most care – and the part most often left to the last day.

1. List what the shop really uses

In VirtueMart, open Shop » Payment Methods and Shop » Shipment Methods. For each published method, note:

• the plugin behind it (Joomla Extensions » Plugins, groups vmpayment and vmshipment),
• its version and vendor,
• where its settings point: merchant account, API keys, IPN or webhook URLs.

Unpublished methods can be removed before the upgrade – less to check.

2. Check each one with its vendor

For every plugin, find out whether there is a version for:

• your target Joomla version (5.4 now; 6 later),
• your target VirtueMart version (4.8 now; 5 later),
• your target PHP version (8.3+ for Joomla 6).

Plugins bundled with VirtueMart's AIO package update with VirtueMart. Third-party gateways depend on their vendor. If the vendor is silent, treat it as "no".

3. Pay attention to security notices

VirtueMart 4.8.0 fixed a security issue in the Skrill payment plugin – the advice was to update or remove the plugin entirely. More in the 4.8.0 security release.

4. Decide: update, replace or drop

5. Test with real transactions

• Use the gateway's sandbox on staging, with the staging URL registered for callbacks.
• Check that the order status changes after payment – this proves IPN/webhook callbacks reach the shop.
• Test refunds and cancelled payments if the plugin supports them.
• On live, after the switch, make one real small payment per method and refund it.

Callback URLs are the classic trap: they often point at the old site, an old path, or http:// instead of https://. Payments go through, but orders stay "pending".

6. Shipping: compare rates, not just "it works"

For shipping plugins, place test orders to a few typical destinations and weights and compare the rates with the old shop. A changed zone or tax setting won't throw an error – it will just charge the wrong amount.

Full test list: VirtueMart test-order checklist.

For developers: the inventory from SQL

Payment and shipment methods are rows in VirtueMart's own tables, each pointing at a Joomla plugin. One query gives the full picture, with plugin versions:

# terminal – published methods, their plugin and its version (adjust prefix)
mysql -e "SELECT 'payment' AS kind, m.virtuemart_paymentmethod_id AS id, m.payment_element AS plugin, m.published,
                 JSON_UNQUOTE(JSON_EXTRACT(e.manifest_cache, '$.version')) AS version, e.enabled AS plugin_enabled
          FROM jos_virtuemart_paymentmethods m LEFT JOIN jos_extensions e ON e.extension_id = m.payment_jplugin_id
          UNION ALL
          SELECT 'shipment', s.virtuemart_shipmentmethod_id, s.shipment_element, s.published,
                 JSON_UNQUOTE(JSON_EXTRACT(e.manifest_cache, '$.version')), e.enabled
          FROM jos_virtuemart_shipmentmethods s LEFT JOIN jos_extensions e ON e.extension_id = s.shipment_jplugin_id
          ORDER BY kind, published DESC;" shop_db

Then check which methods were actually used recently. A published method nobody chose in a year is a candidate to drop:

# terminal – orders per payment method in the last 12 months
mysql -e "SELECT virtuemart_paymentmethod_id, COUNT(*) FROM jos_virtuemart_orders
          WHERE created_on > NOW() - INTERVAL 12 MONTH GROUP BY 1 ORDER BY 2 DESC;" shop_db

For callbacks: request the notification URL from outside (curl -I https://shop.example.com/index.php?option=com_virtuemart&view=vmplg&task=notify… with the path your gateway uses). It should return 200 over HTTPS, not a redirect or a login page.