HDWebmobile Checkout Fields

HDWebmobile Checkout Fields

Add your own text, dropdown, and checkbox fields to checkout — works on both classic and block-based Checkout, with no file-upload field type and no unauthenticated write path.

Overview

HDWebmobile Checkout Fields lets you add extra fields to WooCommerce checkout: a gift message, a delivery note, a “leave at the door” checkbox, a dropdown of preferences. Each field can be placed in the contact section, the address section, or the order-notes area, marked required or optional, and is validated on the server. Fields are registered through WooCommerce’s own native Checkout Fields API for block-based Checkout, and through a traditional hook-based implementation for classic checkout, so every value appears correctly in order emails and on the admin Edit Order screen regardless of which checkout your store uses.

Checkout-field plugins are a repeated source of the same two security bugs. A leading competitor, “Checkout Field Manager (Checkout Manager) for WooCommerce” (versions up to and including 7.8.1), shipped CVE-2025-12500 (CWE-434, CVSS 5.3): its ajax_checkout_attachment_upload AJAX handler ran with no authorization check at all, letting any unauthenticated visitor upload files to the server. This plugin has no “file” field type, no attachment handling, and no AJAX handler of any kind — a shopper’s checkout field can only ever be a line of text, a choice from a dropdown you defined, or a checkbox. Competing plugins have also repeatedly rendered an admin-defined label/option or a submitted value without escaping. Here, field definitions can only be changed through one form that verifies manage_woocommerce and a nonce, every submitted value is normalised to a plain scalar of a known type on save, and every value is displayed only through WooCommerce’s own escaping layer — never echoed raw.

Key Features

• Text, dropdown, and checkbox field types — the exact set WooCommerce’s block Checkout supports
• Place each field in the contact section, address section, or order-notes area
• Required or optional, with server-side validation on both checkout types
• Values appear automatically in order emails and on the admin Edit Order screen
• No custom JavaScript on the block-based Checkout
• Works for guests and logged-in shoppers alike

Limitations

Please read before installing:

• No file-upload field type — by design (see Overview)
• No conditional logic (show field B only if field A is set) in this version
• No per-field pricing — use HDWebmobile Product Options & Add-ons for paid options
• Text fields are capped at 255 characters

Quick Setup

1. Upload the plugin files to the /wp-content/plugins/hdwebmobile-checkout-fields directory, or install through the Plugins screen directly.
2. Activate the plugin through the ‘Plugins’ screen in WordPress. WooCommerce must already be installed and active.
3. Go to WooCommerce > Checkout Fields, add a field, choose its type, section, and whether it’s required.

Latest Version

Current stable version in readme: 1.0.0 (Initial release: text/dropdown/checkbox checkout fields on both classic and block Checkout, server-side validation, no file-upload surface.)

See our other WordPress plugins for more WooCommerce and site-utility tools.