HikaShop 6.7.1 – VIES VAT validation fails due to HTTP WSDL URL

-- Browser(s) name and version -- : Firefox 159.0

Hello,

We discovered an issue with the online VAT number validation in HikaShop 6.7.1.

Although the PHP SOAP extension is installed and enabled, the VIES validation failed with the following error: The error occurred in:
The problem:
HikaShop accepted fictitious VAT numbers such as and because the online validation failed and only the number format was checked.
This is particularly problematic because customers could receive VAT exemptions using invalid VAT numbers.

Our solution:
We changed the WSDL URL in the vat.php from: to:
After this modification, the validation works correctly:

• Code:

  ATU00000000
  → Rejected
• Code:

  ATU12345678
  → Rejected
• Genuine, valid Austrian VAT number → Accepted

Could you please include this HTTPS correction in an upcoming HikaShop update?

It would also be helpful to review the fallback behavior when the VIES service is unavailable, as accepting unverified VAT numbers may result in incorrect tax exemptions.

Thank you for your support.
Best regards,

Hi,

Thank you for the detailed report, you are right. The European Commission no longer serves the VIES WSDL over http (it now answers with a 403 error), so the online check could not reach the service and only the format of the number was verified.

This is fixed in the latest build of HikaShop 6.7.1: HikaShop now calls VIES over https, both for the WSDL and for the check itself (the WSDL still declares an http address for the service, so changing only the WSDL address, as you did, leaves the calls themselves on http). Download HikaShop 6.7.1 again from your account on our website and install it over your current installation: your settings are kept. As the version number is the same, the Joomla updater will not offer it, so the install has to be done manually. This also replaces your modification of vat.php.

We tested it with the "Online check" option: ATU00000000 and ATU12345678 are now refused and genuine Austrian VAT numbers are accepted.

About the fallback: when VIES itself cannot be reached (it is regularly unavailable, as a whole or for one member state), HikaShop accepts a number with a valid format and writes the failure in the HikaShop log. This is deliberate, as refusing the number in that case would block every company customer at checkout during each VIES outage. The failure being logged, you can check the numbers recorded during such periods. If you prefer to refuse them, a small plugin can take over the check through the onBeforeVATOnlineCheck event.