WooCommerce development, past the scale wall.

Most WooCommerce stores are running on invisible debt.

We audit WooCommerce stores every week. The debt shows up the same way almost always: an admin order screen that takes eight seconds to load because orders still live in the legacy wp_posts table instead of HPOS.

Checkout pages pay a 400 ms cart-fragments AJAX tax on every non-cart visit. A payment stack with exactly one gateway means when Stripe has an outage, Saturday revenue goes to zero. Subscription plugins conflict with overlapping hooks. The wp_options table swells with six megabytes of autoloaded rows no one has ever pruned.

Each problem made sense at install time. Together they explain why a $3M brand feels slower on checkout than a $300K brand. The result: the engineering team has stopped shipping new features.

Legacy orders lived in wp_posts. That era is over.

High-Performance Order Storage shipped with WooCommerce 8.2 in late 2023 and became default in 8.3. It moves orders out of the shared wp_posts table into dedicated tables: wp_wc_orders, wp_wc_order_addresses, and wp_wc_order_operational_data.

The schema is faster to query and cleaner to index. It stops the wp_posts table from bloating on stores with hundreds of thousands of orders. Most stores we audit in 2026 have not migrated yet. The cost shows up first in slow admin order screens, then at checkout.

Every checkout is a waterfall of waiting. Most stores pay for it.

A WooCommerce checkout request drops through eight layers before the customer sees the pay button: the CDN, nginx and TLS, PHP-FPM boot, WordPress core, the WooCommerce plugin, the cart-fragments AJAX call, the third-party script stack, and the payment-gateway iframe. Most stores have never measured where the milliseconds actually go. The animation below is an illustrative profile of a typical un-tuned store. The bleed is real; the fix is mostly about naming it.

One gateway is one outage away from zero revenue.

Most WooCommerce stores run a single payment gateway. The gateway has a regional outage, Saturday revenue goes to zero, the engineering team hears about it on Sunday from a support email. A gateway mesh is three or four processors routed by region, average order value, and card type, with a tested failover path. The stack below is what we wire for mid-market brands; the matrix names where each gateway earns its place.

Subscriptions break differently at every scale. Pick the stack that fits the revenue shape.

Three stacks handle 95 percent of WooCommerce subscription work: the first-party WooCommerce Subscriptions extension, ReCharge with a Woo-compatible bridge, and SureCart as the newer entrant. The wrong choice is rarely catastrophic, but it compounds over 18 months into dunning gaps, proration bugs, and retention-tooling you cannot build yourself.

WooCommerce does B2B well. The plugin stack decides how well.

B2B on WooCommerce breaks into three shapes: company accounts and quote-to-order, tiered wholesale pricing, and NET-30 offline payment. Three plugin stacks compete: B2BKing, Wholesale Suite, and the native WooCommerce B2B extension. Each wins a different trade-off. We run all three; the pick comes from how many price tiers you have, how approval-heavy the buyer is, and whether your accounting stack is QuickBooks, Xero, or NetSuite.

Headless Woo is the answer to one question, not a default.

Headless WooCommerce on Next.js with WPGraphQL plus the WooGraphQL extension (or Faust.js) is the right answer when a specific question comes up in the brief. It is a wrong answer by default. We turn away more headless briefs than we accept.

Core Web Vitals by template, not by homepage.

Most agencies publish a homepage Lighthouse score. WooCommerce revenue does not happen on the homepage. It happens on the product page, the cart, and the checkout. The SLA below is what we hold ourselves to on mid-tier Android over throttled 4G, measured in web.dev field-data alignment. Numbers below are the build-complete targets, not "best case".

Keep PCI scope at SAQ-A. Harden the rest of the surface.

WooCommerce sites fall into one of two PCI self-assessment categories. SAQ-A: card data never touches your server because the gateway hosts the payment fields (Stripe Elements, Payment Element, hosted checkout). SAQ-A-EP: your site controls the payment page and card data passes through your server even if it is not stored. The second category is the stricter audit and expands your compliance work by roughly 10x. We default every build to SAQ-A and use the hardening checklist below on everything else.

Two archetype postmortems. Not logos.

Patterns we have shipped for mid-market WooCommerce brands. Metrics are the shape of the work, not a single client's figures. When we run your build, we publish our own before-and-after numbers in the same format.

The right engagement shape usually names itself.

Most briefs land in one of four shapes. The scorecard audit comes first for every new client because we refuse to quote a build before we have read the store. Beyond that, the shape fits the debt.

We are the right fit when.

Direct honesty beats pitch honesty. Here is the shape of the brand our WooCommerce practice ships well for, and the shape we tell to go elsewhere.

Nine years inside WooCommerce. Verified.

A WooCommerce rebuild touches the database, the checkout, the payment mesh, and the PCI boundary at once, so it is a high-trust hire. These are the proofs that come before the brief.