Does WooCommerce Allow Peptides? What WooPayments and Stripe Actually Say

You chose WooCommerce because it is self-hosted, open source, and nobody can take the software away from you the way a hosted platform could. That reasoning is sound as far as it goes. If you own the server, you own the files. The WooCommerce plugin page says: "The freedom of open-source means you retain full ownership of your store's content and data forever." What you do not own, and cannot own by choosing a particular software stack, is the payment infrastructure sitting underneath your checkout. That infrastructure has its own gatekeepers and its own restrictions, some of which come from card networks. The moment a customer clicks "pay now," your self-hosted independence runs directly into a financial system that does not care which CMS you chose.

The real gates for a peptide brand are three layers deep: the payment gateway and the merchant account behind it, the hosting provider's acceptable use policy, and the law governing how your products are labeled and sold. The short answer: the WooCommerce software does not review or approve your products (its plugin page describes open source software you own, with no approval step), but WooCommerce's own payment service does not allow peptides. The WooPayments policy lists "Peptides and other research chemicals" among the product types that "are not allowed to transact using WooPayments". WooCommerce the software clears none of the three gates for you. Founders who build a full store, configure shipping zones, write product descriptions, and set up tax rules before they have confirmed their payment stack is viable are building on a foundation they have not yet verified. This guide walks through each layer in the order you need to understand it, so you can make an informed decision before you write a single line of product copy.

What WooCommerce the Software Actually Controls

WooCommerce is a WordPress plugin. It manages product catalogs, cart logic, order management, and checkout flow. When you install WooCommerce on a server you control, you are installing PHP files and a database schema. Check WooCommerce's current terms yourself to see what they say about your product category.

The software is only half of the picture, and the other half starts the moment you connect a payment method. Every payment method you connect to WooCommerce comes with its own terms of service, and those terms can reflect restrictions from card networks and payment processors. The plugin is just a bridge between your store and that company's API.

This distinction matters enormously in practice. Swapping one WooCommerce payment plugin for another is a technical step, not a rebuild. Swapping plugins does not change the underwriting question at all. If the new plugin connects to the same merchant account, nothing has changed. If it connects to a different payment processor, you are now subject to that processor's terms, so the plugin choice does not settle the question. The plugin is a technical integration layer. The merchant account is the financial relationship. Conflating the two is a common mistake.

WooPayments and Peptides: What the Policy Actually Says

WooPayments is a payment option for WooCommerce stores. It has a prohibited and restricted products page, and that page names the category we are discussing.

We read the WooPayments prohibited and restricted products page on woocommerce.com on 2026-10-12. The page states, in its own words: "Due to restrictions put in place by card networks, our payment processors, and their financial service providers, some business types and product types are not allowed to transact using WooPayments." Among the categories listed on that page, the following appear word for word: "Peptides and other research chemicals," "Pseudo-pharmaceuticals," and "Supplements supported by unsubstantiated claims."

Read that carefully. "Peptides and other research chemicals" appears as a list item under the product types the page says are not allowed to transact using WooPayments. If you are building a research use only peptide brand and you plan to use WooPayments as your processor, read that page again before you build.

The same WooPayments page links to https://stripe.com/legal/restricted-businesses for the full list. Stripe's list includes "Pseudo-pharmaceuticals or nutraceuticals that are not safe or make harmful claims." The WooPayments page attributes its restrictions to card networks, payment processors, and their financial service providers, so check what the processor behind any plugin you choose says before you rely on it.

The Gateway Plugin Versus the Merchant Account: Why the Distinction Matters

A payment gateway plugin is software. It handles the technical handshake between your WooCommerce checkout and a payment processor's API. It encrypts card data, formats transaction requests, and passes responses back to your order management system. Many gateway plugins exist for WooCommerce, some maintained by processors and some by third party developers.

A merchant account is a financial relationship. It is the agreement between your business and an acquiring bank (or a payment facilitator acting in that role) that allows you to accept card payments and have funds settled into your business bank account. Ask any provider what it reviews before it approves you, and get the answer in writing.

The confusion between these two things leads founders to believe that switching plugins solves a payment problem. It does not. If a payment provider will not take your product type, installing a different plugin that connects to a provider with a similar restriction can lead to the same outcome. Ask each provider whether it reports terminated merchants to a shared industry list such as the MATCH list (see the FAQ), and ask counsel how a listing could affect you.

What you actually need, if you are building a peptide brand on WooCommerce, is a payment provider that has approved your product category in writing. Ask that provider which gateway integrations it supports. The gateway plugin you install in WooCommerce is then configured to connect to that approved merchant account. The sequence matters: get the merchant account approved first, then configure the plugin.

How to Evaluate a High-Risk Merchant Account Without Naming Names

We do not recommend specific processors in this guide, because the right fit depends on your volume, your average order value, your chargeback history, and your specific product formulations. What we can give you is a framework for evaluating any processor you are considering.

What to look for in a high-risk processor for peptide brands:

First, ask the processor directly whether they have active peptide or research chemical merchants in their portfolio. The answer tells you whether anyone there has handled your product type before.

Second, read their terms of service before you submit an application. Look specifically for language around research chemicals, nutraceuticals, pseudo-pharmaceuticals, and any category that could encompass peptides. If the terms prohibit those categories and the sales rep tells you it is fine, believe the terms, not the rep. The written terms are what you can hold them to.

Third, ask about their chargeback threshold and their response to a threshold breach. Ask what threshold applies to your account and what remediation they require when you approach it. Understand those requirements before you sign.

Fourth, ask about reserve requirements. Ask whether the processor holds any reserve from your settlements. Understand the reserve percentage, the hold period, and the conditions under which the reserve is released. This affects your cash flow planning.

Fifth, ask about their gateway compatibility. If they require a proprietary gateway, confirm that gateway has a WooCommerce plugin that is actively maintained. An unmaintained plugin is a technical liability.

For a detailed underwriting checklist you can bring into those conversations, see our guide at Peptide Merchant Account Underwriting Checklist.

Example: this is hypothetical, not a real case. A founder applies to three processors. Processor A has no peptide merchants and declines after two weeks. Processor B has a terms of service that lists research chemicals as prohibited but a sales rep who says "we handle that all the time." The founder signs with Processor B, builds the store, and is terminated at month four when the risk team reviews the account. Processor C required a detailed application with product documentation, asked for a sample product page, and approved the account with a rolling reserve. The founder who chose Processor C had approval in writing before building.

Reading a Managed WordPress Host's Acceptable Use Policy

WooCommerce runs on WordPress, and WordPress runs on a server. If you use a managed WordPress host rather than a raw VPS or dedicated server, that host has an acceptable use policy (AUP) that governs what you can run on their infrastructure. Managed hosts set their own rules for what you can run. Read the policy of any host you consider to see whether it restricts pharmaceutical-adjacent products, research chemicals, or any product that could be construed as a drug.

A host termination is different from a payment termination but equally disruptive. If your host suspends your account, your store goes offline entirely. You can migrate to a new host, but migration takes time, and downtime during a migration costs you orders and potentially search ranking. The right time to read a host's AUP is before you build, not after you receive a suspension notice.

Numbered Procedure: Reading a Host's AUP Before Launch

Follow these steps for every hosting provider you are evaluating. Run the pass or fail check at each step before moving to the next.

Step 1: Locate the AUP document.

Go to the host's website and search for "acceptable use policy" or "terms of service." Most hosts publish this in their legal or terms section. If you cannot find an AUP quickly, contact their support and ask for the document directly.

Pass: You have a URL or a PDF of the current AUP with a visible last-updated date.

Fail: The host has no published AUP, or the document has no date. Treat an undated AUP as a risk flag and ask support to confirm the current version.

Step 2: Search the document for relevant terms.

Use your browser's find function (Ctrl+F or Command+F) to search for each of the following strings: "pharmaceutical," "drug," "supplement," "research chemical," "nutraceutical," "controlled substance," "health," "medical." Read every sentence that contains any of these terms in full context.

Pass: None of the relevant terms appear in a way that would prohibit a research use only peptide brand.

Fail: Any of the relevant terms appear in a prohibition that could reasonably cover your product category. Do not assume you are an exception. Contact the host's legal or compliance team and ask for written confirmation that your specific product category is permitted.

Step 3: Check the AUP for a "catch-all" clause.

Look for any clause that lets the host decide, in its sole discretion, what is not allowed. Treat it as possible grounds for termination even if your product category is not named.

Pass: The catch-all clause exists but the host has provided written confirmation (email is sufficient) that your product category is permitted.

Fail: The catch-all clause exists and you have no written confirmation. Proceed with caution and prioritize hosts that will give you written confirmation.

Step 4: Check the AUP's governing law and dispute resolution clause.

Note where the host is incorporated and which law governs the agreement, and ask counsel whether that matters for your product category.

Pass: You have written down the governing law and the dispute resolution process, and counsel has confirmed they are acceptable to you.

Fail: The governing law is a foreign jurisdiction you are not familiar with. Consult a business attorney before committing to that host.

Step 5: Document your review.

Save a PDF of the AUP with the date you read it. Save any written confirmation from the host. Store these in your compliance folder alongside your gateway terms and your merchant account agreement.

Pass: You have a dated PDF of the AUP and any relevant correspondence in a named folder.

Fail: You reviewed the AUP but did not save a copy. Go back and save it now. Policies change, and you need a record of what was in effect when you launched.

For a broader look at platform choices and their respective risk profiles, see our comparison guide at Best Ecommerce Platform for Peptides: Policy Comparison.

Why "Research Use Only" Is Not a Legal Safe Harbor

One of the most persistent misconceptions in this space is that labeling a product "research use only" or "not for human consumption" settles the question of intended use. A label is one signal of intent, and 21 CFR 201.128 says the intent of the persons legally responsible for the labeling may be shown by "such persons' expressions, the design or composition of the article, or by the circumstances surrounding the distribution of the article."

21 CFR 201.128, published at ecfr.gov, addresses the concept of intended use directly. The regulation states: "The words intended uses or words of similar import ... refer to the objective intent of the persons legally responsible for the labeling of an article (or their representatives)." The regulation goes on to explain that objective intent can be shown by labeling claims, advertising matter, or oral or written statements by the responsible persons. It also addresses resellers: "If, for example, a packer, distributor, or seller intends an article for different uses than those intended by the person from whom he or she received the article, such packer, distributor, or seller is required to supply adequate labeling in accordance with the new intended uses." For a store reselling a supplier's product, that sentence is worth reading twice.

What this means in practice for a peptide brand is that the words "research use only" on your product page are not the only thing that can show intent. The regulation says objective intent may be shown by "labeling claims, advertising matter, or oral or written statements by such persons or their representatives." Treat your product descriptions, blog content, email marketing, social media, and customer service scripts as material that can speak to intent, and ask counsel how a label would be weighed against them.

This is not a reason to avoid the research use only designation. It is a reason to treat it as one element of a coherent compliance posture rather than a magic phrase that resolves all regulatory questions. Your product pages, your marketing copy, and your customer communications all need to be consistent with a genuine research use only positioning. That means no health claims, no efficacy claims, no dosage guidance, and no content that implies your customers are using these products on themselves.

For a detailed treatment of what research use only actually means and how to build a brand around it correctly, see our guide at Research Use Only Peptides Meaning and Limits.

Pre-Launch Compliance Checklist for WooCommerce Peptide Stores

Use this checklist before you accept your first order. Each item has a pass or fail check. Do not launch until every item is a pass.

Step 1: Read and date your gateway's terms of service.

Pull the current terms of service for every payment method you plan to offer at launch. This includes your primary processor, any backup processor, and any buy-now-pay-later or alternative payment method. Read the prohibited and restricted products sections in full. Record the date you read each document.

Pass: You have read the terms for every payment method, confirmed that your product category is not explicitly prohibited, and documented the date of your review.

Fail: You have not read the terms, or you have read them and found a prohibition that covers your product category. Do not launch with a processor whose terms prohibit your products.

Step 2: Confirm your product category was disclosed during underwriting.

Your merchant account application should have included explicit disclosure of your product category. "Supplements" or "health products" may be too vague, so ask your processor what category name it needs.

Pass: Your underwriting application named your product category explicitly, and your approval letter or merchant account agreement does not contradict that disclosure.

Fail: You described your products vaguely during underwriting, or you have not yet applied. Reapply with explicit disclosure before processing any transactions.

Step 3: Audit every product page for health claims.

Read every product description, every product title, and every image alt tag on your store. Look for any language that describes a health outcome, implies efficacy for a human condition, or provides dosage guidance. Remove or rewrite any such language before launch.

Pass: No product page contains a health claim, an efficacy claim, a dosage reference, or any language that implies human use.

Fail: Any product page contains any of the above. Fix it before launch, not after.

Step 4: Read and date your host's acceptable use policy.

Follow the five-step procedure described in the previous section. Save a dated PDF.

Pass: You have a dated PDF of your host's AUP and confirmation that your product category is permitted.

Fail: You have not read the AUP, or you have read it and found a prohibition that may cover your products. Resolve this before launch.

Step 5: Establish a second processor plan.

Your primary processor may terminate your account without warning. If that happens on a Friday afternoon, you need to be able to route transactions through a backup processor by Monday morning. Identify a second high-risk processor, complete their application, and have their gateway plugin installed and configured in WooCommerce in a disabled state, ready to activate.

Pass: A second processor application is approved, the gateway plugin is installed, and you have tested it in sandbox mode.

Fail: You have no backup processor. Treat this as a launch requirement. Complete this step before launch.

Step 6: Confirm your legal structure and business documentation are in order.

Before launch, confirm that every document your processor asks for is current, including your business bank account in the business name, your state business registration status, and a business address on file with your processor.

Pass: All business documentation is current and matches the information on your merchant account application.

Fail: Any document is missing or mismatched. Resolve the discrepancy before processing transactions.

For a deeper treatment of the payment processing landscape specific to this product category, see our guide at What Payment Processor Can I Use to Sell Peptides?.

Building the WooCommerce Store Itself: What to Get Right Before You Configure Payments

Assuming you have worked through the payment and hosting questions, the WooCommerce build itself has several considerations specific to peptide brands that are worth addressing before you go live.

Product Page Architecture

Your product pages need to carry the research use only designation clearly and consistently. This means the designation should appear in the product title, in the product description, and in any structured data you output for search engines. Consistency matters because 21 CFR 201.128 says intent may be shown by expressions, the design or composition of the article, or the circumstances surrounding its distribution. If "research use only" appears on some pages and not others, or appears in fine print while the main copy reads like a consumer health product, the inconsistency undermines the designation.

Your product descriptions should describe the compound: its chemical name, its CAS number if applicable, its purity specification, its storage requirements, and its form factor (lyophilized powder, solution, and so on). They should not describe what the compound does in a human body, what conditions it addresses, or how a researcher should use it. The description is a technical specification, not a use guide.

Certificate of Analysis Display

Displaying a certificate of analysis (COA) from a third-party laboratory is a common way to share test results for a product. Ask the lab what accreditation it holds, and check the accrediting body's own page before you describe the lab as accredited.

Display the COA as a downloadable PDF linked from the product page. Do not embed COA language in your product description in a way that could be read as a health claim. "Third-party tested for purity" is a factual statement about your quality control process. "Clinically proven to increase X" is a health claim. The line between them is clear if you are thinking about it carefully.

Site Architecture and Internal Linking

WooCommerce gives you full control over your URL structure, your category taxonomy, and your internal linking. Use that control deliberately. Your category pages should be named for the compound class rather than for a health outcome. Your blog content, if you publish any, should be aimed at researchers and should not contain health claims.

Your checkout flow should include a terms of service acknowledgment that the buyer confirms they are a researcher purchasing for laboratory use only, that the products are not for human consumption, and that they are of legal age in their jurisdiction. Ask counsel what weight, if any, this acknowledgment carries for you.

For a full walkthrough of building a compliant peptide website from the ground up, see our guide at How to build a peptide website.

The Shopify Comparison: Why Platform Choice Is Not the Core Question

Founders sometimes frame the WooCommerce versus Shopify question as a question about which platform is more permissive for peptide brands. That framing misses the point. Check each platform's current terms for yourself. The question in both cases is the same: can you get a payment processor approved for your product category, and does the platform's ecosystem support the gateway integration you need?

Shopify has its own payment terms for Shopify Payments; check Shopify's current terms and prohibited products list yourself. WooCommerce is self-hosted, but that does not resolve the payment processing question, which is the same question regardless of platform.

The self-hosted nature of WooCommerce does give you one meaningful advantage: if your payment processor terminates your account, your store software and hosting are not affected by that decision. You can continue to take orders, communicate with customers, and process payments through a backup processor without any platform-level intervention. On WooCommerce, the store and the payment method are genuinely separate systems.

For a direct comparison of how Shopify handles this product category, see our guide at Does Shopify Allow Peptides? What the Policies Say.

What Happens When a Processor Terminates Your Account

Understanding the termination sequence helps you prepare for it rather than react to it in a panic. Here are three ways a termination could play out, so you know what to ask your processor.

The first pattern is a policy-driven termination during a periodic account review. Ask your processor whether it reviews accounts, whether a termination notice comes with a wind-down period, and how long that period lasts. If it does, keep processing only as the terms allow and move to a new processor. This is the most manageable scenario.

The second pattern is a chargeback-driven termination. Ask your processor what chargeback threshold applies, what it can do if you exceed it, and whether it reports terminations to the MATCH list. Preventing chargebacks through clear product descriptions, accurate shipping timelines, responsive customer service, and a clear refund policy is not just good customer experience; it is risk management.

The third pattern is a sudden hold or freeze without advance notice. Ask your processor whether it can hold funds or suspend processing without advance notice. This is the most disruptive scenario. Having a backup processor already approved and configured is the only effective mitigation.

In all three scenarios, the response is the same: activate your backup processor, communicate with your customers about any order delays, and begin the process of finding a replacement primary processor. The founders who navigate terminations without significant business disruption are the ones who treated the backup processor as a launch requirement rather than a future task.

Example: this is hypothetical, not a real case. A store processes orders for several months without incident. The processor reviews its accounts, decides the store's product category is not allowed under its terms, and sends a notice. Because the founder had a backup processor already approved and configured, they switch quickly and customers see no disruption. A founder without a backup processor spends the notice period scrambling to get approved, submitting documentation, and waiting for underwriting decisions, and goes dark if the primary processor ends service first.

Ongoing Compliance: This Is Not a One-Time Setup

Compliance for a peptide brand is not a checklist you complete at launch and then file away. It is an ongoing operational practice. Processor terms, hosting policies, regulatory guidance, and card network rules can change, so check each current source on a regular schedule. A policy that permitted your product category when you launched may prohibit it later.

Build a compliance calendar into your operating rhythm. Review your processor's terms and your host's AUP on a regular schedule you set and write down. Monitor FDA guidance documents and warning letters relevant to your category. Subscribe to updates from the FTC (ftc.gov) and FDA (fda.gov) for relevant guidance.

Keep your compliance documentation folder current. Every time you review a policy document, save a new dated PDF. Every time you receive written confirmation from a processor or host, save it. If you are ever in a dispute with a processor or a regulator, your documentation is your evidence.

Train anyone who touches your product pages, your marketing copy, or your customer service scripts on the health claims prohibition. A single written statement from a customer service representative can be among the "oral or written statements by such persons or their representatives" that 21 CFR 201.128 says may show intent. The compliance posture has to be consistent across every channel.

Frequently Asked Questions

Does WooCommerce itself ban peptides?

We have not verified WooCommerce's own terms for this guide, so read them yourself. The restrictions you need to plan for most directly come from the payment provider you connect, your hosting provider's policy, and applicable law, which you should ask counsel about.

Can I just use WooPayments for my peptide store?

No. WooPayments lists "Peptides and other research chemicals" among the product types that are not allowed to transact using WooPayments, on the page we read on 2026-10-12. A peptide store should not plan to use WooPayments, because the product type is on that list. You need a payment provider that has approved your product category in writing.

If I switch from WooPayments to another plugin, does that fix the problem?

Switching plugins does not fix the problem if the new plugin connects to a processor that also prohibits your product category. The plugin is a technical integration layer. The terms that apply are those of the processor behind the plugin. You need to find a processor that has approved your product category, and then install whatever plugin connects to that processor's API.

What is the MATCH list and should I be worried about it?

MATCH is a term you will meet in processor paperwork. We have not verified its rules for this guide, so do not rely on a summary here. Ask any processor you are considering whether it reports terminations to the MATCH list, and ask counsel how a listing could affect you. The practical step is to choose processors that have approved your product category in writing and to keep chargebacks low.

Does a "research use only" label mean I am not selling a drug?

Not automatically. 21 CFR 201.128 says intended uses "refer to the objective intent of the persons legally responsible for the labeling of an article (or their representatives)," and that this objective intent "may, for example, be shown by labeling claims, advertising matter, or oral or written statements by such persons or their representatives." A "research use only" label is one possible signal of intent, and you should ask counsel how it would be weighed against other signals. Your entire brand communication, including product descriptions, blog content, email marketing, and customer service scripts, needs to be consistent with a genuine research use only positioning.

My host has never complained about my store. Do I still need to read their AUP?

Yes. The absence of a complaint does not mean your store is permitted under the AUP. Ask the host how it enforces its policy and whether it gives notice before it suspends an account. Reading the AUP before launch, and getting written confirmation if there is any ambiguity, is the only way to know where you stand.

Can I run WooCommerce on a VPS or dedicated server to avoid host AUP issues?

Running on a VPS or dedicated server from a bare-metal provider lets you choose the provider and read its terms before you commit. However, you still need to read the provider's terms of service, and you take on more technical responsibility for server security, uptime, and maintenance. The payment processing question is entirely unchanged by your hosting architecture. You still need a payment provider that has approved your product category regardless of where your server lives.

How do I know if a high-risk processor has actually approved peptide brands before?

Ask them directly, and ask for specifics. A processor with genuine experience in this category will be able to describe their underwriting process for research chemical merchants, their documentation requirements, and their reserve policies without hesitation. A processor without that experience will give vague answers or will tell you that supplements are fine without distinguishing between supplement categories. You can also ask whether they have merchants currently processing in the research chemical category, and what their average approval timeline looks like for that category. The quality of their answers tells you a great deal about their actual experience.

If you are at the stage of evaluating your platform and payment stack and want to talk through your specific situation before you build, we are available for a fit call. Book it at peptideecommerce.com and bring your questions about your product category, your current processor situation, or your compliance posture.

Sources

• WordPress.org, WooCommerce plugin page: https://wordpress.org/plugins/woocommerce/
• WooCommerce, WooPayments prohibited and restricted products (read 2026-10-12): https://woocommerce.com/document/woopayments/our-policies/prohibited-and-restricted-products/
• Stripe Restricted Businesses List: https://stripe.com/legal/restricted-businesses
• 21 CFR 201.128 (Intended Uses), eCFR: https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-201/subpart-B/section-201.128
• FDA: https://www.fda.gov
• FTC, Health Products Compliance Guidance: https://www.ftc.gov/business-guidance/resources/health-products-compliance-guidance

This article is not legal advice. It is an operational guide for founders building research use only peptide ecommerce brands. Consult a qualified attorney for advice specific to your business and jurisdiction.