BuildsByLuke Checkout Brasil – CPF & CNPJ Fields for WooCommerce

Brazilian checkout fields for WooCommerce — on BOTH the classic and the block checkout, with CPF/CNPJ validation ready for the alphanumeric CNPJ format Brazil issues from July 31, 2026.

From July 31, 2026, Brazil’s Receita Federal issues CNPJs with letters in the first 12 positions. Any digits-only validator silently rejects those new companies at checkout. This plugin validates BOTH the classic numeric format and the new alphanumeric format, check digits included.

What the free version does (complete — no locked features)

• CPF and CNPJ fields with real check-digit validation — including the alphanumeric CNPJ (check digits computed over ASCII−48 character values, per the official SERPRO specification) — with clear error messages at checkout.
• Individual/company selector (Pessoa Física / Pessoa Jurídica) on the classic checkout — or run in individuals-only, companies-only, or no-document mode. Optional RG and State Registration (Inscrição Estadual) fields, and a company legal-name (Razão Social) field added when your WooCommerce install lacks one.
• Street number and neighborhood address fields (billing and shipping) plus an optional cell phone field — and Brazilian address formatting (“street, number / neighborhood”) everywhere WooCommerce prints an address.
• Native block checkout (Gutenberg) support — a combined “CPF or CNPJ” contact field plus street number/neighborhood fields via WooCommerce’s official Additional Checkout Fields API (WooCommerce 8.9+), validated server-side.
• Input masks on the classic checkout (CPF, alphanumeric-aware CNPJ, CEP, phone) — lightweight vanilla JavaScript, no dependencies.
• Compatible with Brazilian Market on WooCommerce data: fields are stored under the exact same meta keys (_billing_cpf, _billing_cnpj, _billing_persontype, _billing_number, _billing_neighborhood, …). Migrating from that plugin, existing customer and order data keeps working — and so do integrations that read those keys (NF-e issuers, payment gateways), including for orders placed on the block checkout (values are mirrored into the legacy keys).
• CPF/CNPJ shown on the admin order screen and in order emails; Site Health checks; WP-CLI (wp cbfw validate 12.ABC.345/01DE-35).
• English source strings with a complete Brazilian Portuguese (pt_BR) translation bundled — stores running in Portuguese see every field, message and setting in Portuguese.

Honest scope

This plugin adds and validates checkout fields. It is not fiscal or tax software, it does not issue NF-e invoices, and it cannot by itself make a store compliant with any regulation — invoicing and tax obligations remain with your ERP/issuer, which will keep finding the data under the usual meta keys.

Pro (in-dashboard upgrade, 14-day trial, no card required): address autofill from the CEP (your own server queries ViaCEP, with caching), an alphanumeric-CNPJ transition report (scans your orders and flags documents with invalid check digits that will break ERP/NF-e integrations), fiscal CSV export (CPF/CNPJ/IE by period) for your accountant, and custom labels for this plugin’s fields. Pro is a separate, paid build; its code is not part of this plugin. It is sold and licensed through Freemius (see “External services”).

External services

The free plugin’s own features run entirely on your server — field rendering, validation, masks and data mirroring make no external requests at all.

Freemius (freemius.com), who sell and license the Pro version
Freemius is contacted in four situations. Every one of them is something you click. It is never contacted in the background.

1. If you opt in on the activation screen (or start a trial / activate a licence). Sent to api.freemius.com: your site URL, your WordPress and PHP versions, and the email address of the account you activate with. Skipping the opt-in is a first-class choice and the plugin is fully functional without it.
2. If you open the “Upgrade” page under the plugin’s menu. Your own server (not your browser) asks api.freemius.com for current plan prices, sending your site URL. The page itself loads no third-party scripts — everything it renders is served from this plugin’s own folder. The payment SDK’s bundled pricing script used to inject Google Analytics and a remote checkout script into wp-admin on that page; this build removes both, along with the SDK’s remaining remote references (all modifications are listed under “Source code” below).
3. If you open the “Contact Us” page, which is Freemius’s hosted support form (wp.freemius.com). The link carries your site URL and your WordPress login URL so the form knows which site you are writing about.
4. If you click a plan to buy, you go to Freemius’s hosted checkout (checkout.freemius.com). It receives your site URL, site name, WordPress and PHP versions, and your WordPress administrator email address (pre-filled, sent whether or not you complete the purchase). Freemius is the merchant of record. Their checkout page loads its own third-party scripts (at the time of writing: Stripe, PayPal, Google Tag Manager, and Freemius’s own assets); we do not control that list. If you never click a plan, none of it loads.

Terms: https://freemius.com/terms/ — Privacy: https://freemius.com/privacy/

Installing, activating, skipping the opt-in, using every screen, deactivating (the SDK’s deactivation-feedback dialog is switched off in this build, so deactivation is one click and sends nothing), WordPress’s update cycle and all scheduled tasks complete without contacting Freemius at all. Free updates come from WordPress.org like any other plugin.

ViaCEP (viacep.com.br) — Pro only, and only if you enable it
The Pro version’s CEP address autofill queries ViaCEP from your own server (never from the shopper’s browser), sending only the postcode the customer typed, with a 12-hour cache and a per-IP rate limit. The free plugin contains no ViaCEP code. Service: https://viacep.com.br/

Source code

This plugin’s own PHP and JavaScript are unminified and readable in the plugin folder.

The one exception is the third-party payment SDK in vendor/freemius/, which ships pre-minified. Those files are the Freemius WordPress SDK, published under the GPL, and their unminified source and build tooling are public:

• Freemius WordPress SDK: https://github.com/Freemius/wordpress-sdk
• The pricing screen bundled at vendor/freemius/assets/js/pricing/freemius-pricing.js: https://github.com/Freemius/pricing-page

The minified files under vendor/freemius/ are: assets/js/pricing/freemius-pricing.js, assets/js/postmessage.js, assets/js/nojquery.ba-postmessage.js, assets/js/jquery.form.js, and thirteen stylesheets under assets/css/.

This plugin ships four deliberate modifications to that SDK, all in assets/js/pricing/freemius-pricing.js, all removing remote references from wp-admin:

1. The appendScripts() method is emptied. Upstream it injects https://www.google-analytics.com/analytics.js and https://checkout.freemius.com/checkout.js into wp-admin when the pricing screen renders.
2. The Google Analytics pageview tracker is stubbed out. Upstream it reports pricing-page views to Freemius’s Analytics property whenever a GA object is already present in wp-admin, stamping them with the Freemius user id.
3. The remote loading spinner (img.freemius.com/blue-loader.gif) is replaced with an inline data-URI equivalent.
4. Testimonial photos (Gravatar/remote) are forced to the bundled placeholder image, so the pricing page renders without any remote image requests.