The common ways
- Payment links and invoices from your processor: quick, no website changes, fine for occasional payments.
- Hosted or embedded checkout: the processor’s payment form appears on or from your site. The card details go straight to the processor.
- Built-in checkout on a store builder: handled by the platform, with its fees.
Keep card data off your server
Card security is governed by a standard called PCI DSS. When card details are entered into a form hosted by a reputable processor and never pass through your own server, your part of the job is much smaller: for many small online merchants, the shortest self-assessment questionnaire, SAQ A. A form on your own site that collects card numbers and emails them, or stores them, is a serious risk and a much bigger compliance burden.
Never take card numbers through a contact form, by email or by text.
Other things to get right
- HTTPS on every page, with security headers on.
- Clear prices, taxes and fees before the customer pays.
- A refund and cancellation policy on the site.
- Receipts sent automatically, and a record of every payment matched to the order or booking.
- Two-step sign-in on your payment processor account.
Written by Nikita Huttenlocher, founder and lead engineer at Huttenlocher Technologies, a web design and software company in Myrtle Beach, South Carolina.