WooCommerce stores selling CBD, hemp products, vaping/e-cigarettes, adult products, firearms accessories, tobacco, kratom, or other restricted categories face a critical challenge when migrating to Shopify: Shopify Payments may not accept their business. This guide covers how to migrate these stores successfully and which payment processors to use when Shopify Payments isn't available.

Shopify Payments eligibility: prohibited and restricted businesses

Shopify Payments (powered by Stripe) has an explicit list of prohibited and restricted businesses. As of 2026, the following categories are either prohibited or require special review:

Prohibited by Shopify Payments (cannot use at all)

Cannabis (THC products) — in most jurisdictions, even where cannabis is legal
Drug paraphernalia explicitly designed for cannabis
Tobacco — cigarettes, cigars, smokeless tobacco
Firearms, ammunition, and firearm parts that don't require an FFL
Prescription-only medications
Certain counterfeit goods and IP-infringing products

Restricted (may be allowed with Shopify review)

CBD products: Hemp-derived CBD (non-psychoactive, <0.3% THC) — allowed in some markets after review. Eligibility depends on jurisdiction and product claims.
Vaping / e-cigarettes: Restricted — Shopify Payments available in some regions, not others. Nicotine products are categorically restricted in many markets.
Kratom: Legal in most US states but highly restricted by processors. Shopify Payments likely not available.
Dietary supplements with health claims: Depends on the specific claims made. Aggressive health claims → restricted.
Adult content/products: Restricted — requires age verification and specific compliance. Not prohibited, but requires review.
Alcohol: Allowed in some markets with compliance (UK, parts of US) — see WooCommerce to Shopify wine/spirits guide.
Firearms accessories (legal): Items that don't require an FFL (holsters, magazines, optics) — review required.

CBD and hemp: the current state (2026)

Hemp-derived CBD in the US (Farm Bill 2018 compliant — <0.3% THC dry weight) is the most common "high-risk" category attempting to migrate to Shopify:

Shopify platform: Shopify allows CBD merchants to use the platform. They will not shut down your store for selling compliant CBD.
Shopify Payments: Not available for CBD in most jurisdictions, regardless of Farm Bill compliance. Shopify has stated this is due to card network (Visa/MC) restrictions, not their own policy.
Shopify Pay (Shop Pay): Not available without Shopify Payments
Other channels: Google Shopping, Facebook/Meta ads, and TikTok all have restrictions on CBD advertising. Organic traffic and email remain primary channels.

Alternative payment processors for high-risk Shopify stores

CBD-specific processors (US market)

DigiPay: Specialist high-risk processor with CBD experience. Shopify integration available.
Paay / Payoneer: High-risk processing options.
Bankful: CBD-focused processor, works with Shopify via gateway integration.
iPayTotal: European high-risk processor for CBD brands operating in EU.
Processing rates: expect 3.5–6% per transaction vs Shopify Payments' 2.4–2.9%. This is a real cost of being in a restricted category.

General high-risk processors (multiple categories)

PaymentCloud: Specializes in hard-to-place merchants including CBD, vaping, supplements.
Soar Payments: High-risk merchant accounts for multiple categories.
Durango Merchant Services: Long-established high-risk processor.
Chargebacks911: Dispute management for high-chargeback categories.

Connecting third-party processors to Shopify

Shopify allows third-party payment gateways for stores not using Shopify Payments
Transaction fee: Shopify charges an additional transaction fee (0.5–2% depending on plan) for third-party processors when not using Shopify Payments
Shopify Advanced ($299/mo): 0.5% third-party transaction fee — viable for high-volume CBD stores
Shopify Plus: 0% transaction fees (including third-party processors)
WooCommerce advantage: WooCommerce had no platform-level transaction fee — factor this into migration cost analysis

Age verification for restricted products

Many high-risk categories (vaping, CBD, adult, alcohol) require age verification:

Shopify doesn't have built-in age verification — use an app
AgeChecker.Net: Real-time age verification using public records. Required for tobacco and vaping in many US states.
Age Verification Popup: Simple self-declaration popup (DOB entry). Not legal compliance but reduces casual access.
Veriff / Onfido: Government ID verification — required for high-compliance situations.
UK: for vaping, alcohol, knives, and some supplements — self-declaration popup is minimum; hard verification is better practice
Display age gate on store entry (not just product page) for full compliance

Compliance pages required for high-risk stores

Terms of Service: Include restricted product disclaimer, age requirements, legal markets
Privacy Policy: Standard + any additional data collection for age verification
Lab Reports / CoA page: For CBD — Certificate of Analysis from third-party lab is industry standard. Link from product pages and a central lab reports page.
Compliance / Legal page: State which states/countries you ship to (and explicitly which you do not)
Disclaimer page: "Our products are not intended to diagnose, treat, cure, or prevent any disease" (FDA required for CBD food/supplements)

Migrating from WooCommerce with a high-risk payment processor

If your WooCommerce store uses a high-risk payment gateway (not Stripe/PayPal standard), you need to check if the same gateway offers a Shopify integration:

Many WooCommerce high-risk gateways provide a Shopify integration via the gateway's custom app in the Shopify App Store or a direct payment gateway URL
Process: contact your current processor, ask if they offer Shopify gateway integration — most established processors do
NMI gateway: widely used for high-risk WooCommerce; has Shopify integration
Authorize.Net: widely used, Shopify native integration available

High-risk store migration checklist

Check Shopify Payments eligibility for your specific product category before starting migration
Contact your current payment processor: ask about Shopify gateway integration
If processor doesn't support Shopify: research and apply to a CBD/high-risk processor that does (allow 2–4 weeks for merchant account approval)
Calculate the additional cost: Shopify plan transaction fee + high-risk processor rate vs current WooCommerce processing cost
Install age verification app appropriate for your category and jurisdiction
Create compliance pages: lab reports, disclaimer, restricted markets, ToS
Disable Google Shopping and Meta catalog sync (restricted category ad policies)
Build email/SMS as primary acquisition channel (Klaviyo — no ad restrictions)
Set up Shopify Markets to restrict shipping to approved states/countries only
Review all product descriptions: remove health claims that violate FDA/MHRA guidelines

The payment processor timeline is the most common cause of delayed CBD and vaping store migrations. Merchant account applications for high-risk processors can take 2–4 weeks and may be declined on first attempt. Start the payment processor application 4–6 weeks before planned migration date — this is the critical path item. Everything else (store design, product migration, redirects) can proceed in parallel while awaiting payment processor approval. Launching on Shopify with no payment processor is a site that can't take money.

Shopify for high-risk merchants: cbd, hemp & restricted products (2026)