WooCommerce for CBD, Kratom, and Botanical Brands
AssemblyWP builds and maintains WooCommerce stores for CBD, kratom, hemp, and other restricted botanical brands. We handle the parts that break when you sell a product most platforms won't touch: emergency processor migrations, state and county shipping rules, age verification, and lab report delivery. Senior engineers and AI agents on one team, month to month.
You're on WooCommerce for a Reason
Most botanical brands didn't choose WooCommerce off a feature comparison. They chose it because the hosted platforms said no.
Shopify's acceptable use policy rules out kratom outright. CBD is allowed under conditions, with a shorter list of payment options than everyone else gets. Stripe puts CBD on its restricted businesses list. PayPal prohibits it. Every hosted platform ties your checkout to a payment stack you don't control, so when a processor changes its mind about your category, you find out by watching orders stop.
Self-hosted WooCommerce is the thing that lets you swap a gateway in an afternoon instead of rebuilding a storefront. That's a structural advantage, and it's why you're here.
It also means nobody is managing it for you. There's no platform team patching your checkout at 2am. The tradeoff for owning the stack is that you own the stack.
What Actually Breaks on a Restricted Store
The problems are specific to the category, and generic WordPress shops have never seen most of them.
Processors drop you with little warning.
When it happens, a new gateway needs to be live in days, tested against real orders, with subscriptions and saved payment methods migrated. This is checkout surgery under time pressure, and it's the single most expensive thing to get wrong.
The legal map changes underneath you.
Kratom is banned in several states and in individual counties and cities inside states where it's otherwise legal. Those rules move. A store shipping to a banned jurisdiction is a compliance problem, so the restriction logic has to live at checkout and stay current.
Age gates and verification.
These have to work without wrecking conversion or breaking on mobile.
Lab reports get tied to lots, not products.
A COA belongs to a batch. When the batch changes, the document behind the product page changes with it, and customers scanning a QR code expect the current one.
Ad platforms won't take your money.
Meta and Google restrict most of this category, which pushes the entire acquisition load onto organic search, email, and repeat purchase. Your site isn't a brochure in that model. It's the whole funnel, and site speed and search visibility stop being nice-to-haves.
How We Work on Restricted Stores
Two ways in, and most brands use both.
Development
Covers the build work: checkout changes, gateway integrations, geo-restriction rules, subscription logic, custom COA handling. You get a named engineer who stays on your store, so the person wiring in your new processor already knows how your checkout is put together.
Store Care
Keeps it running. Updates get classified by risk and tested on staging before they touch production. Security scanning runs continuously. Backups run daily and get verified restorable. Uptime is checked around the clock.
The split we hold: agents run the routine work, engineers make the calls that carry risk. Anything touching checkout, payments, or authentication goes to a human before it ships. On a store where the payment stack is already fragile, letting an automated update run unattended at the checkout layer is how you lose a weekend of orders.
We also treat a processor migration as an incident, not a project. When your gateway drops you, the queue moves.
Most brands in this category are running autoship or subscriptions, which means failed payment recovery and dunning is doing quiet damage in the background. Card declines on a high-risk gateway run hotter than on a standard one, and the renewals that fail don't announce themselves. They show up as churn two months later.
You stop finding out about problems from customers.
Updates stop being the thing you postpone for six months and then do all at once with your fingers crossed. Your COAs match your current lots. Your restricted-state list matches the current law. When the processor conversation happens, you have somewhere to go that same week.
The honest version: we can't make your category easier to sell in. Payment costs stay higher, ad platforms stay closed, and the compliance surface doesn't shrink. What changes is that the operational side stops being the thing that takes you down, so you can spend your attention on the parts of the business that actually move.
Stores running cart and checkout incentives get more out of them here than most, because when paid acquisition is closed off, average order value and repeat purchase carry the whole model.
We tell you what to fix, and in what order.
Store audit
Start with a store audit. We go through the checkout, the payment stack, the restriction logic, the update backlog, and the security surface, then tell you what to fix and in what order.
Lead with the deadline
If something is actively broken, say so on the call and we'll start there instead.
Access and safety net
We'll need access to the store and the hosting. Before we ship any code we need working backups and a staging environment. If those don't exist, setting them up is the first thing we do.
Two ways to work with us. Store Care keeps the site running. Development builds what's in the queue. Either one stands on its own, and most brands add the second one later.
Month to month. No contracts, no setup fees, cancel anytime. See current pricing.
Common questions.
Talk to us.
Book 30 minutes. We'll look at your store and tell you what we'd fix first, what it costs, and what we'd leave alone. If there's nothing worth fixing, we'll tell you that too.
We only do WooCommerce. If you're on Shopify, we're the wrong shop.