Move WooCommerce Coupon Code on the Checkout Page

For WooCommerce stores that offer coupons to their customers, there could be a problem with the location of the coupon code box on the checkout page. It’s hiding down the bottom of the page, and helpfully – it’s not visible by default. This can lead to lost orders, or customers emailing in for help – not an ideal situation!

When researching this problem, I couldn’t find any good (free) WordPress or WooCommerce plugins that provided a fix. There are a few code fixes that are out there, but they’re mostly quite complicated and prone to doing weird stuff in the UI. 🙁

The solution is very simple – it requires a bit of additional code in the current themes’ functions.php file. What the code below does is use a bit of simple JavaScript that moves the original coupon code section to a better location, then expands the box so it’s always displayed:

 * Move coupon block to before payment block on checkout page
 * Set coupon code box to display by default (needs a short delay)
add_action( 'woocommerce_before_checkout_form', 'move_checkout_coupon_form', 5 );
function move_checkout_coupon_form() {
  if ( is_checkout() && ! is_wc_endpoint_url() ) :
  <script type="text/javascript">
    document.addEventListener("DOMContentLoaded", function(event) {
      let coupon = document.querySelector('');
      let payment = document.querySelector('div#payment');
      let parent = document.querySelector('div#order_review');
      parent.insertBefore(coupon, payment);
      setTimeout(function () {
        document.querySelector('form.checkout_coupon.woocommerce-form-coupon').style.display = 'block';
        document.querySelector('form.checkout_coupon.woocommerce-form-coupon').style.width = '100%';
      }, 10);

For custom checkout pages, some of the JavaScript selectors may need a couple adjustments. Then again, if it’s custom – the coupon box is probably already in a better spot!

Padlock with Chain Header

Let’s Encrypt wildcard certificates with Hurricane Electric DNS

Renewing Let’s Encrypt wildcard certificates is generally a massive pain. You need to be able to automatically update DNS records for the domain – which is fine if you use a DNS provider that has an official Let’s Encrypt DNS plugin, but less so if you use a DNS provider that doesn’t – such as Hurricane Electric.

Side note – I’m not particularly interested in arguments for and against wildcard certs. If you’re reading this, you’ve obviously come to the conclusion that they’re probably fine and you just want them automated like the rest of your Let’s Encrypt certs!

This post assumes the following:

  • You are obtaining wildcard certificates from Let’s Encrypt
  • Your DNS is hosted with Hurricane Electric
  • Your ACME client for Let’s Encrypt is Certbot
  • You have shell access to your server

Obtain a new Let’s Encrypt wildcard certificate

Note: if you’ve already got a wildcard certificate, you can mostly skip this bit – but skim this section to make sure you’ve done everything you need to do!

1. Request wildcard certificate

Here’s the command-line incantation to request a new wildcard certificate:

sudo certbot certonly --cert-name -d '*' --manual --preferred-challenges dns 

Couple things to note here:

  • I’m not including the base domain in the certificate here – I wouldn’t be able to automate it if I did, as I’d end up needing two TXT records for the same hostname. My solution was to separate the base domain out into its own certificate, which works perfectly for me.
  • I’m specifying a certificate name. This is important, as otherwise it ends up trying to name it the same as the base domain – which is no good if you have a cert for the base domain as well.

Run the Certbot wizard – it will soon ask you to create a TXT record!

2. Create TXT record

The Certbot wizard will ask you to create a record, something like the following:

Please deploy a DNS TXT record under the name with the following value:


Log into the Hurricane Electric DNS console, select your domain and create a new TXT record with the following settings:
Text dataqwertyuiop-1234567890
TTL (Time to live)5 minutes (300)

Don’t check the Enable entry for dynamic dns box yet! Save the record and complete the Certbot wizard. Your certificate should now be issued, and you can configure your Apache / Nginx / etc server as appropriate.

Set up renewal scripts

1. Create DDNS TXT record key

As of current writing, the various Hurricane Electric DNS plugins for Certbot that I’ve seen all log into the actual account – which is horrendous from a security perspective. You don’t want a script to have full control over all of your domain records!

Thankfully, Hurricane Electric now allow TXT records to be updated with a key that only has control over just that one record.

Go back to the _acme-challenge TXT record for your domain, check the box to enable the entry for dynamic dns and Update. This enables the DDNS feature – you should now see an “arrow circle” symbol for that record:

Hurricane Electric DDNS record

Click the arrow circle symbol to generate a new DDNS key (save this key somewhere – this is the last time you’ll see it in the Hurricane Electric interface!)

For the purposes of this example, I’ll assume that the generated key looks something like ‘qwertyuiop123456’.

2. Add manual authentication script

Copy and paste the following into /etc/letsencrypt/


# Do we have everything we need?
if [[ -z "$CERTBOT_DOMAIN" ]] || [[ -z "$CERTBOT_VALIDATION" ]]; then
    echo '$CERTBOT_DOMAIN and $CERTBOT_VALIDATION environment variables required.'
    exit 1

# Add all HE TXT record DDNS keys to the txt_key object
# Remember to protect this script file - chmod 700!
declare -A txt_key

# Create a FQDN based on $CERTBOT_DOMAIN

# Update HE DNS record
curl -s -X POST "" -d "hostname=$HE_DOMAIN" -d "password=${txt_key[$HE_DOMAIN]}" -d "txt=$CERTBOT_VALIDATION"

# Sleep to make sure the change has time to propagate over to DNS
sleep 30

As the comment suggests – protect this file from prying eyes by using chmod 700. If you have multiple wildcard certificates, you can add in extra entries to the txt_key object.

3. Add post deployment script

As much as you can manually restart services after the new certificate has been issued, you can automate that as well. Copy and paste the following into /etc/letsencrypt/renewal-hooks/deploy/


set -e

for domain in $RENEWED_DOMAINS; do
  case $domain in
      systemctl restart apache2
      systemctl restart nginx
      systemctl restart postfix

Update the script to restart specific services for particular domains as required. I recommend chmod’ing this file to 755 – unlike the previous script, there’s nothing sensitive here!

Request Let’s Encrypt wildcard renewal

We’re going to force a renewal of the certificate here – this will test the two scripts above, plus update the renewal config so that the certificate will automatically renew in the future. If your certificate is due for renewal already, you don’t need to include the –force-renewal flag. Run the following command:

sudo certbot renew --cert-name --manual --manual-auth-hook /etc/letsencrypt/ --preferred-challenges dns --force-renewal

Check that:

  • There are no errors in the Certbot logs,
  • The certificate renewed successfully, and
  • All services restarted appropriately

If everything worked – your Let’s Encrypt wildcard certificates should now renew automagically!

Fibre Optics Header

Access your modem’s status page behind a UniFi USG router

With a full UniFi network setup (a UniFi USG router, switches, access points and so on), the UniFi router is separate from any modem needed to connect to the Internet. Your setup might look a little like this:

Because your computer isn’t directly connected to the modem, the modem is effectively “hidden” by the UniFi USG. You can still get online, but you can’t see your connection statistics and logs.

Here’s how to fix it:


First thing’s first, you need to know the IP address of your modem, and the network range for the UniFi network. The IP address of the modem must also be different to the UniFi network range. In my case, the modem IP address is and the UniFi network range is

So the instructions below will work, enter your modem IP address, the network mask in CIDR notation (without the /), enter an unused firewall rule index (the example is probably fine for a USG, but may not be for other Ubiquiti devices), and finally choose the port your modem is connected to.

Once complete, click Update:


The remaining steps assume you have a UniFi Network Controller online somewhere, and in that controller you have Advanced Features turned on.

Log into the controller, navigate to the site where your UniFi USG is configured and go to Settings. At the bottom of the screen is the Device Authentication section – copy the SSH authentication details, then SSH into the IP address of the UniFi USG.

Enter the following commands, one line at a time:

set interfaces pseudo-ethernet pREPLACEME4 link REPLACEME4
set interfaces pseudo-ethernet pREPLACEME4 address REPLACEME1/REPLACEME2
set interfaces pseudo-ethernet pREPLACEME4 description "Access to modem"
set service nat rule REPLACEME3 type masquerade
set service nat rule REPLACEME3 destination address REPLACEME0
set service nat rule REPLACEME3 outbound-interface pREPLACEME4

You should now be able to access your modem’s status page at http://REPLACEME0/.

Assuming that worked, you need to make the changes permanent with a configuration file for your UniFi Network Controller. Save the following into a text file called config.gateway.json:

    "interfaces": {
        "pseudo-ethernet": {
            "pREPLACEME4": {
                "address": ["REPLACEME1/REPLACEME2"],
                "description": "Access to modem",
                "link": ["REPLACEME4"]
    "service": {
        "nat": {
            "rule": {
                "REPLACEME3": {
                    "destination": {
                        "address": ["REPLACEME0"]
                    "outbound-interface": ["pREPLACEME4"],
                    "type": "masquerade"

Upload this file into the UniFi Network Controller. The directory you need to upload to will depend on which site you’re configuring; the UI support article for this topic is quite detailed and I’d recommend reading it.

TL;DR: I uploaded mine to /unifi/data/sites/default/ – but read the support article for yourself; don’t assume this is the correct directory for your Network Controller!

Extra: NBN modems

For readers from Australia – there are a few things to know about the modems (or NCD / NTDs) supplied by NBNCo. Some you can access, some you can’t:

NBN Connection TypeAccess to modem?

The two other connection types (Fixed Wireless and Satellite) I have no idea about, so I haven’t included them in this table.


For HFC, the modem makes it difficult to access the connection statistics page. Thankfully, it’s fairly easy to get in – follow the instructions above (the modem IP is, then hard reset the modem by inserting a pin in the reset hole for around 10 seconds.

The reset is complete when the green lights go out and a blue light flashes a couple times – once you see that, release the pin and load in a browser. Chances are very good you’ll need to refresh several times before the status page displays.

If the modem restarts for any reason (power outage, NBN outage etc), you’ll need to do another hard reset to get back in.


For these connection types, you supply your own modem – no special instructions required. 🙂 Refer to your modem’s documentation to understand what the default IP address and access details are.


I found the following sites helpful in writing this post: