Payment security

Level: Advanced | Reading time: 15 minutes

Implement WooCommerce e-commerce security standards for secure transactions and regulatory compliance.

In this chapter :

WooCommerce Guide - Payment security

Key statistic** - 75% of consumers abandon a purchase if the site doesn't seem secure. A site without HTTPS instantly loses 50% of trust.

SSL Certificate

SSL (Secure Sockets Layer) encrypts data between the client browser and your server. It's absolutely mandatory for e-commerce.

Why SSL is mandatory

Data encryption - Without SSL, information is transmitted in clear text. The credit card, address and e-mail are readable by anyone intercepting the traffic. With SSL, everything is encrypted (unreadable).

Browser confidence - Chrome and Firefox display "Not secure" on sites without HTTPS. This is terrifying for the visitor and kills conversions.

PCI-DSS compliance - The credit card security standard REQUIRES HTTPS. Without SSL, it's a violation and gateways refuse transactions.

SEO - Google penalizes HTTP sites in 2025. HTTPS is a positive ranking factor.

There's no excuse: SSL is free via Let's Encrypt and can be installed in 5 minutes.

SSL installation

Hosting - 99% of modern hosting providers (SiteGround, Kinsta, OVH, o2switch) include free Let's Encrypt SSL in 1 click.

cPanel - Go to the SSL/TLS section, click on "Let's Encrypt", select your domain and install. Renewal is automatic every 90 days.

WordPress - Once SSL has been installed on the server, force HTTPS on WordPress :

Really Simple SSL - This is a free plugin. It activates HTTPS automatically, redirects HTTP to HTTPS and corrects mixed content. Just install, activate and you're done.

Check: the URL should display https:// with a green padlock. Click on the padlock > "Secure connection" = OK.

Mixed content

A site in HTTPS but with resources (images, scripts) loaded via HTTP generates a "mixed content" error. Browsers block these resources, breaking the design and functionality.

Really Simple SSL automatically corrects this problem. Manually: search for http:// in the database (via Better Search Replace) and replace with https://.

The WooCommerce > Settings > Force SSL checkout setting is enabled by default. It checks that the checkout is always in HTTPS even if there is a configuration error elsewhere.

pci-dss compliance 🔺

The Payment Card Industry Data Security Standard (PCI-DSS) is a set of security rules imposed by Visa and Mastercard to protect card data.

pci-dss levels

Level 1 - More than 6 million transactions per year. An annual external audit is mandatory and costly (over €50,000).

Level 2-3 - 1 to 6 million transactions. An annual self-assessment questionnaire is required.

Level 4 - Less than 1 million transactions. A Self-Assessment Questionnaire (SAQ) is required.

Small stores are at level 4. Complete the SAQ-A (simple questionnaire) annually.

Saq-a: simpler thanks to gateways

If you use Stripe or PayPal, card data NEVER passes through your server. The payment form is a Stripe or PayPal iframe. This avoids 90% of PCI-DSS requirements.

The SAQ-A (10 questions vs. 300 for SAQ-D) is applicable because you do NOT store, process or transmit any card data.

Stripe and PayPal are Level 1 PCI-DSS certified. They handle the heavy lifting of compliance, and you inherit their security effortlessly.

Essential pci-dss rules

Even with an external gateway, observe these rules:

HTTPS mandatory - Already covered with SSL.

Firewall - Your host configures it. Block unused ports and allow only 80 (HTTP) and 443 (HTTPS).

Strong passwords - For WordPress admin, database, FTP and host. At least 12 characters with a mix of alphanumeric and symbols. Never "admin123".

Updates - WordPress, WooCommerce, theme and plugins must always be up to date. Loopholes are exploited if software is obsolete.

Restricted access - Limit the number of admin accounts. An employee who has left = delete his account immediately.

Logs - Activate access and error logs. They help detect post-mortem intrusions.

Document everything in the annual SAQ. Store documents for a minimum of 3 years (compliance).

Never store card data

It's forbidden: Store card numbers, CVVs and expiration dates in your database, emails or files.

Massive violations result in multi-million euro fines and prosecution.

WooCommerce with Stripe or PayPal means that NO card data touches your system. An opaque token is exchanged. You see "Card ending in 1234" but never the full number.

If you're doing custom development, don't log, store or transmit card data EVER. Let the gateway handle it 100%.

Strong authentication (3d secure) 🔺

The European PSD2 directive (September 2019) requires Strong Customer Authentication (SCA): 2-factor authentication for online payments.

3d secure 2.0

This is the evolution of the Verified by Visa and Mastercard SecureCode systems.

Flow :

  1. Customer enters card
  2. Bank requests additional authentication: SMS code, mobile app or biometrics
  3. Customer validates
  4. Payment authorized

Objective: Reduce fraud. This proves that the cardholder is the real customer.

Impact on conversions: 3DS 1.0 added friction (ugly popup, cumbersome process) which reduced conversions by -10 to -20%.

3DS 2.0 is frictionless for 95% of transactions (data is analyzed in the background with silent authentication). A popup only appears if a risk is detected.

3ds automatic with stripe/paypal

Stripe manages 3DS 2.0 automatically. SCA compliant without config. If customer bank requires auth, popup appears. Otherwise transparent.

PayPal ditto, automatic compliance.

You don't have to do a thing. Modern gateways = SCA compliance out-of-the-box.

Exemptions sca

Certain transactions exempted (Low Value <30€, Trusted Beneficiaries, Corporate Cards). Gateways apply exemptions intelligently to minimize friction while complying with regulations.

Don't tinker with exemptions manually. Let Stripe/PayPal optimize.

Fraud detection 🔺

Despite security, fraud happens. Limit it with proactive detection.

Types of fraud

Stolen cards - Fraudster uses stolen card numbers. Your store = money laundering. You ship, real victim disputes (chargeback), you lose product + money.

Friendly fraud - Customer buys, receives, disputes payment unfairly ("I didn't order"). Keeps product + gets money back. Fraud in disguise.

Bots - Test thousands of stolen card numbers on your checkout. Multiplies fraudulent transactions.

Different billing/delivery address - Often legitimate (gift) but also a fraud indicator (buys with stolen card, ships to safe house).

Warning signs

Disposable email - @tempmail.com, @guerrillamail. Fraudsters avoid traceable emails.

Fast multiple orders - 5 orders in 10 minutes, same IP, different cards = stolen card test.

Round amounts - Order exactly 100€, 200€. Fraudsters test limits.

Inconsistent geography - IP Nigeria, card USA, delivery France = suspicious.

New large-value customers - First order €2000 iPhone = risk. Legitimate customers start small, progressive trust.

Anti-fraud tools

Stripe Radar - Included free of charge. Machine learning analyzes transactions in real time. Automatically blocks obvious frauds, suspicious flags for manual review.

Stripe Dashboard > Radar: customizable rules. "Block if IP country X" or "Require verification if order >500€".

PayPal Fraud Protection - Behavior analysis, PayPal account history. PayPal absorbs certified fraud losses (if Seller Protection program active).

WooCommerce Anti-Fraud (Extension $79/year) - Risk score for each order (0-100). >75 = probable fraud. Blocks or holds for manual verification.

Manual verification - Suspicious order? Contact customer by phone (order number supplied). Fraudster hangs up or invalid number. Real customer answers.

Chargeback management

Chargeback = customer disputes payment with bank. Bank cancels transaction, recovers funds from you + €15-25 fee.

Prevention :

  • Clear product descriptions (no misunderstandings)
  • Tracking delivery (proof of receipt)
  • Confirmation/shipping emails (communication trail)
  • Reactive support (solve problems before complaints)

Defense: If unjustified chargeback, dispute via Stripe/PayPal. Provide proof: signed delivery tracking, exchange emails, screenshots. 30-50% chargebacks won with solid proof.

Chargeback rate >1% = red flag payment processors. Beyond that = increased fees, risk of account suspension. Aim for <0.5%.

GDPR and bank data 🔺

Payment data = sensitive personal data. Maximum GDPR protection.

Data minimization

Collect strictly necessary. Bank card for payment = legitimate. Bank card stored for no reason = violation.

Stripe/PayPal = tokenization. You store token ("tok_1J3kF...") not card number. Token unusable out of context, GDPR compliant.

Retention time

Transactions archived for accounting purposes (10 years France). BUT card data ≠ transactions.

Card data - Deleted immediately post-transaction. Token retained only if recurring subscription (customer consent).

Payment logs - Anonymize personal data after 3 years. Keep amounts/dates for analysis but remove names/emails.

Subscription with recurring direct debit requires clear explicit consent: "I authorize monthly direct debits of €9.99 until cancelled". Checkbox not pre-checked.

Without consent = illegal direct debits, GDPR fines.

Customer rights

Right of access - Customer requests copy of payment data? Provide: transaction history (amounts, dates). NOT card numbers (you don't have them).

Deletion right - Customer requests deletion ? Anonymize transactions (replace name/email with "Anonymous customer #123"). Keep amounts for accounting.

Opposition right - Customer refuses marketing? Respect. Never spam.

Document GDPR process. Auditors/CNIL control.

Security audits 🔺

Regular security testing to detect flaws before hackers do.

Automatic scans

Wordfence (Free plugin) - Scans WordPress/WooCommerce daily. Detects malware, backdoors, plugin vulnerabilities. Firewall blocks common attacks.

Suguri SiteCheck (Free online) - Scan your URL on sitecheck.sucuri.net. Detects malware, blacklists, SSL issues.

WPScan - WordPress vulnerability database. Scan plugins/themes for known vulnerabilities.

Configure automatic weekly scans. Email notifications if problem detected.

Penetration testing

Annual professional audit (500-2000€) if sales >100k€/year. Tester simulates real-life attacks: SQL injection, XSS, brute force, etc.

Reveals invisible flaws automatic scans. Detailed report + corrective recommendations.

Real-time monitoring

Uptime monitoring - Pingdom (free 50 checks) or UptimeRobot. Alert if site down. Hacker crash site = immediate detection.

Server logs - Check Apache/Nginx logs weekly. Suspicious patterns: massive login attempts, 404 on weird URLs (vulnerability scan).

Change monitoring - Plugin WP Security Audit Log track all WordPress changes: files, users, settings. Unauthorized changes = potential intrusion.

Incident plan

If hacked :

  1. Isolate - Offline site immediately (maintenance mode)
  2. Analyze - Full scan, identify infected files
  3. Clean - Remove malware, backdoors
  4. Restore - From clean backup (pre-infection)
  5. Secure - Change ALL passwords, fix exploited vulnerability
  6. Monitor - Reinforced 30-day monitoring

Test plan quarterly (drill). Real stress = panic reaction. Drill = pro reaction.

In a nutshell

Payment security protects your customers and your reputation. SSL certificates (HTTPS) are mandatory to encrypt sensitive data and reassure visitors. Comply with PCI-DSS by using certified gateways (Stripe, PayPal) that manage banking data on your behalf. Activate 3D Secure to authenticate card payments and reduce fraud by 70%. Install a firewall (Wordfence, Sucuri) to block brute-force attacks. Monitor suspicious transactions (unusual amounts, inconsistent addresses) and block them quickly. Train your team in good security practices and document your procedures.

Next steps 🔺

Navigation: ← Payment Methods | Payment Security | Next: Shipping Zones →