Who actually bans what: the platform is rarely the problem, your processor is

Merchants in restricted categories spend a lot of time asking which platform allows peptides. The better question is who decides, and the answer is almost never the platform.

We went through the published policies. Here's what they say, with links so you can check every line yourself.

The finding

Most store platforms don't publish a list of banned products at all.

Shopify's Acceptable Use Policy doesn't list product categories. It says you can't use Shopify to do anything illegal where you do business, and leaves it there. Squarespace's guidance on what you can't sell doesn't list categories either. It tells you to go and read your payment processor's rules.

Follow that instruction and the trail gets short fast. Shopify Payments' terms point at Stripe's list, and at PayPal's. Shopify's help center adds a short list of its own on top.

So for a very large share of online stores, the detailed rule that decides whether you can trade wasn't written by the company whose logo is on your dashboard. Stripe wrote it.

The exception is Wix, which does publish an explicit list and names categories directly.

Correction, 4 October 2026: we first wrote that Shopify Payments had no list of its own. Its help center publishes one, naming tobacco, firearms and ammunition, cannabis, CBD and hemp, cryptocurrency, credit repair, sexually explicit content and products making unverified health claims. Where it names your category, it's stricter than Stripe, so it decides first.

If you're on Shopify and sell CBD or peptides, we've written up what that list means for each.

What that means in practice

Spend a minute on that last row. WooCommerce is self-hosted, so no company can switch your store off for selling the wrong thing. Your exposure moves entirely to your host and your gateway, and you choose those and can change them. You still carry risk. It just sits in different places.

Category by category

Here's what the two platforms that publish real lists say. Stripe's terms govern Shopify Payments, after Shopify's own short list, and much of Squarespace. Wix Payments governs Wix.

Two things follow from that table, and they matter more than the table does.

Stripe is the more permissive of the two. CBD, vape and firearms are all "restricted" with Stripe, which means approval is possible with extra scrutiny. Wix Payments refuses them outright. If you'd assumed the big platform was the strict one, you had it backwards.

"Restricted" still needs a yes. It means a human will look at your business and decide. Merchants who build a store assuming restricted means yes end up with a finished site and no way to take money.

The trap: not listed doesn't mean allowed

Kratom isn't named in either policy. Merchants read that as permission, and they're wrong.

Every one of these policies carries a catch-all. Square's terms, for example, prohibit using the service "for any illegal activity or goods or in any way that exposes you, other Square users, our partners, or Square to harm." A category nobody thought to write down gets judged under a clause like that, by someone at the processor, after you've already been trading.

That's why enforcement in these categories almost always happens by discovery. Nothing stops you listing the product, and nothing filters your uploads. The stretch between listing it and getting found is borrowed time, and it has nothing to do with compliance.

We now keep a running, category-by-category version of this with the exact policy wording and the date we last read each source: can I sell this on Stripe, Shopify or PayPal. If nobody names your category, that's where you'll see which clause gets used on you instead. For a closer read of the one document that governs most of these decisions, see how to read Stripe's restricted businesses page.

What the platform can do when it finds you

We'll quote Wix directly here. It's the most specific, and the others aren't meaningfully gentler. Wix states it may "hide or delete prohibited products, suspend or close your Wix Payments account, withhold or block funds, and/or refund payments to the relevant customers."

Read the last clause again. On top of closing the account, Wix can refund your customers with your money after you've shipped the goods.

So what should you do

Work out which of two risks you're carrying. Payment risk is about whether you can take a card, and you can fix it by changing processor. Platform risk is about whether you get to keep the store at all, and changing processor does nothing for it. Most merchants only find out these are separate when both fail at once.

Read your processor's list and ignore your platform's marketing. If you're on Shopify, read Shopify Payments' short list first, then Stripe's. Bookmark both.

Get your data out before you need it. Export your catalogue and your customer list today, whatever you decide. With that export, a closure costs you a website. Without it, it can cost you the business.

Assume "not listed" means "not yet decided." If your category is missing from every list, you haven't been cleared. You've got an open question, and it'll get answered on the worst possible day.

---

We checked these policies against the published documents on 28 July 2026, and they're linked above. They change, and by their own admission none of them is exhaustive. Treat this as a starting point for your own reading. It isn't legal advice.

We now re-read all of them on a schedule and publish the result, including the checks where nothing moved, on the policy tracker.

We place merchants in these categories with processors that approve their specific category, and we set up a backup so one decision can't take the business offline. If you want to know what you're exposed to before you spend anything, tell us what you sell.