The pattern shows up in our intake conversations regularly. A merchant sells a product that draws scrutiny: nicotine, CBD, supplements with aggressive claims, knives, collectible ammunition components. Shopify restricted the listing, or Shopify Payments held funds, or the Shop app quietly excluded the catalog. The merchant reads that WooCommerce is open-source software with no acceptable-use policy and concludes the category problem is solved.

It is not solved. It is relocated. Three sets of rules survive any platform change: the law itself (federal, state, and local rules on what can be sold, to whom, and how it ships), the card network rules that Visa and Mastercard impose on every transaction they carry, and the terms of whichever payment processor moves the money. A migration to WooCommerce removes exactly one rulebook, the platform’s own, and leaves the other three standing. That removal is genuinely valuable, but merchants who mistake it for the whole picture typically discover the remaining rules at the worst possible moment: after the build, at the first payout hold.

WooCommerce is a free, open-source plugin that turns a WordPress site into a store. It is software you install, not a service you enroll in. There is no WooCommerce account that can be suspended, no review team scanning catalogs, and no acceptable-use list governing what the software may sell. The code runs on hosting you choose, against a database you control, under a license that does not care what is in the product table.

This is a real structural difference, not a marketing distinction. On a hosted platform, the company operates your store and can therefore stop operating it. With WooCommerce, no single company occupies that position. Automattic, the company behind WooCommerce, publishes terms for its optional paid services, but the core software imposes none. A WooCommerce store selling a lawful but unpopular product cannot be deplatformed by its cart, because the cart is not a platform. What it can lose is its ability to take cards, which brings the conversation to the layer that actually carries the rules.

WooPayments is the payments product most WooCommerce stores reach for first, and it is built on Stripe’s infrastructure. That detail matters more than any feature comparison: a merchant using WooPayments is subject to a restricted-business list closely aligned with Stripe’s, and Stripe’s list overlaps heavily with the categories that cause trouble on Shopify. Tobacco and vaping products, cannabis-adjacent goods, certain weapons and weapon parts, and several supplement categories appear on processor restriction lists across the industry, because the restrictions flow down from card networks and acquiring banks rather than originating with any one company.

The practical consequence: a vape merchant who migrates from Shopify to WooCommerce and then activates WooPayments has traded one Stripe-shaped gate for another. The store itself is fine. The checkout is not. Processors enforce their lists through underwriting reviews, payout holds, and account terminations, and those actions land with the same force as a platform suspension: revenue stops. The lists also change on the processor’s schedule, not the merchant’s, so a category that clears review today may draw a termination notice later. Reading the restricted-business terms for any candidate processor before the build starts is the single cheapest risk check in the whole project.

On Shopify, payments and platform arrive fused. Shopify Payments is the default, alternatives carry additional transaction fees, and the platform’s product rules and the processor’s product rules reinforce each other. On WordPress, the two layers are genuinely independent. The store is one decision: hosting, theme, catalog, checkout flow. The gateway is a second decision, made separately, and it can be remade later without touching the first.

This separation is the actual payoff of the migration for a restricted-category merchant. WooCommerce supports dozens of gateway integrations: WooPayments and Stripe for standard-risk catalogs, Authorize.net and NMI in the middle tier, and specialist high-risk processors beyond that. If a processor tightens its terms or terminates the account, the merchant swaps the gateway plugin and reconnects checkout. The catalog, the customer accounts, the order history, the URLs, and the search rankings all stay put. On a hosted platform, losing the processor often means losing the store’s practical ability to operate. On WooCommerce, it means replacing one plugin. The blast radius of a payments decision shrinks from the whole business to a single integration.

The merchants who make this work run the decision in a specific order: category first, gateway second, build third. They identify how processors classify their products, then apply to a gateway whose published terms accept that classification, and only then commission the store around the approved gateway’s integration requirements.

That sequencing exists because underwriting is slow and construction is fast. A high-risk merchant account application can involve weeks of document review: business registration, bank statements, processing history, and a working website that matches the application. A store build on a known gateway is a shorter timeline. Merchants who build first and apply second often end up with a finished store that cannot take a payment, burning weeks of runway. Merchants in this position also tend to keep a second gateway approved and dormant, so a termination notice becomes a configuration change instead of an emergency. The gateway fees in restricted categories run higher than Stripe’s advertised rates, and contracts may include reserves that hold back a portion of revenue. Those costs are real, and they are the price of a processor that has actually agreed to the category rather than one that has merely not noticed it yet.

WooCommerce gives a restricted-category merchant something a hosted platform structurally cannot: a store that no single company can switch off, and a payments layer that can be replaced without rebuilding. It does not give anyone an exemption from law, card network rules, or processor terms, and any pitch claiming otherwise is selling the half of the picture that feels good.

What changes is who does the diligence. Shopify performs category screening for its merchants, abruptly and on its own terms, but it performs it. A WooCommerce merchant inherits that job: reading gateway terms, keeping the catalog inside the approved classification, and maintaining the store and its payment plugins. For merchants whose products sit comfortably inside every list, this trade may not be worth the effort. For merchants whose products keep tripping platform rules, it usually is, provided the payments question is answered before the first invoice for the build. Boston Web Group checks product categories against gateway terms as a standard part of scoping a store project; asking for that review before committing to a build costs a conversation and can save a rebuild.