Selling CBD, vapes or peptides on WooCommerce? Which payment gateways will take you.

WooCommerce doesn't have a banned products list. It's software you install on your own hosting, so nobody at the platform level can switch your store off for selling CBD, vapes or peptides. Shopify did exactly that to every vape store in July. WooCommerce has no switch like that to flip.

That doesn't mean you're free to sell anything. It means the whole question moves to the payment gateway you plug in. Each gateway brings its own rules, and the obvious choices are stricter than most merchants expect. Here's what each one says, and what to use when the answer is no.

WooPayments has its own list

WooPayments is WooCommerce's own payment gateway. It runs on Stripe, but it publishes its own list of prohibited businesses and products, and that list names several high-risk categories outright:

• "Tobacco products, including e-cigarettes and vapes"
• "Supplements supported by unsubstantiated claims"
• "Pseudo-pharmaceuticals"
• "Peptides and other research chemicals"
• "Drug paraphernalia"
• "Firearms and ammunition"

It then points to Stripe's restricted businesses page as the full list. So you have to clear both: Stripe's rules and the extra items WooPayments names. Peptides are the clearest example. Stripe doesn't name them, and WooPayments does.

On CBD, the same page says "Merchants selling CBD must use Square or Viva Wallet." Keep that line in mind. It's the one that's about to stop working in the US.

Stripe through the Stripe plugin

The free Stripe extension connects your store to your own Stripe account. Then only Stripe's restricted businesses list applies, without the WooPayments additions on top.

That's a real difference for some categories. Stripe permits "CBD products containing only negligible amounts of THC, per local limits". It also allows "Tobacco products, including e-cigarettes, cigars, and e-liquid sold in accordance with applicable law", but since 22 September 2026 US merchants may only sell FDA-authorized products, and that rules out most disposables.

For peptides, kratom and anything sold on health claims, Stripe reaches for its catch-all instead: "Pseudo-pharmaceuticals or nutraceuticals that are not safe or make harmful claims". We explain how Stripe's three states work in how to read Stripe's restricted list.

PayPal

The PayPal Payments extension brings PayPal's Acceptable Use Policy with it. That policy names "cigarettes" with no conditions, so it's no use to a vape store. Most other high-risk categories fall under its broad clause about "other products that present a risk to consumer safety". PayPal works as a second button for a supplement store with clean copy. It's not where a CBD or peptide store should keep its only checkout.

The CBD problem: Square is leaving

WooCommerce's CBD page names two partners: Square for the US, and Viva Wallet for Europe and select other countries. For a US store, that leaves Square.

In August, Square emailed its sellers that CBD and hemp-derived products "will no longer be permitted on Square's platform", online or in person. The email, published by Marijuana Moment, tells sellers to remove CBD and hemp items from their catalog by 15 October 2026. Square's spokesperson linked it to the federal hemp definition change. When we checked on 6 October, Square's old CBD program help page sent visitors back to the help center home page.

If you run a WooCommerce CBD store on Square, you have days, not months. Your Square account stays open for everything else you sell. Only the CBD products have to go.

That leaves two routes for US CBD on WooCommerce:

1. Stripe directly, if your THC really is negligible and your copy makes no health claims. Stripe's permission is written down, but it's tied to the law, and the hemp definition changes on 12 November and 11 December 2026. Check your catalogue against the new total-THC standard before you lean on it.
2. A hemp-specialist merchant account, connected through a gateway. That's the route for anything sold because it's intoxicating.

Gateway and merchant account aren't the same thing

This is where WooCommerce gets easier than Shopify. A gateway like Authorize.net is the plumbing between your checkout and a bank. The merchant account behind it is what decides whether your category is allowed. High-risk acquirers underwrite CBD, kratom, vapes and peptides on purpose and write the category into your agreement. Many of them deliver payments through a standard gateway that WooCommerce already supports.

On Shopify, a third-party provider also costs you an extra fee to Shopify on every order: 2% on the Basic plan. WooCommerce charges nothing like that. You pay your host, the gateway and the acquirer, and that's it.

What each one says, side by side

Our category checker has the full wording for 14 categories, with the date we last checked each one.

Your host has rules too

Self-hosted doesn't mean nobody can see your store. Your hosting company has an acceptable use policy, and some of them name the categories processors do. Read it before you migrate, not after. A store you can't host is as stuck as a store you can't take payment for.

Before you choose a gateway

1. Read the gateway's own list, not only its processor's. WooPayments is stricter than Stripe, and Shopify Payments is too. That pattern is common.
2. If you're on Square and sell CBD, act before 15 October. Remove the products or move them to a provider that takes them.
3. Strip health claims from product pages, FAQs and images. Every list above has a clause about claims, and a reviewer reads the page the way a customer does.
4. Get certificates of analysis that test total THC for every hemp product, so you're covered under the new standard.
5. Run two ways to take payment. WooCommerce lets you show a second gateway at checkout, so one review doesn't stop every order.
6. Tell an acquirer exactly what you sell. A general processor that finds out later holds your balance. A specialist that knows from day one doesn't need to.

---

We read WooPayments' prohibited products page, WooCommerce's CBD page, Stripe's restricted businesses list and PayPal's Acceptable Use Policy on 6 October 2026. Square's CBD notice comes from the seller email Marijuana Moment published on 7 August 2026, because Square hasn't put it on a public policy page. Gateway policies change, so check the linked pages before you act. This isn't legal advice. Whether a product is lawful where you ship it is a question for a qualified attorney.

We move high-risk stores onto WooCommerce with a primary and a backup way to get paid, so one gateway's decision can't stop your checkout. If you already have a store, the free store check reads it the way a reviewer would. It works on WooCommerce and Shopify.