PCI Compliance with Paid Memberships Pro and Stripe - wordpress

I'm posting this on multiple platforms because I understand that there may be multiple options. I just want to get as much feedback as possible.
So I have a website up with WordPress through Hostgator. My WordPress site has an option where people can sign up for paid subscriptions filling out payment forms generated by the plugin: Paid Memberships Pro. I have PMPro integrated with my Stripe account, and the payment page is protected by the SSL: Let's Encrypt. The page is also TSL 1.3. So I am almost 100 percent confident that I'm PCI compliant.
The reason I'm posting on here, however, is that a colleague is concerned that my payment forms are on my site, not Stripe. So there's concern over security in that respect. So my question: Is there a way to have the payment forms on the Stripe site instead of my site in a way to still be able to use Paid Memberships Pro? If not, am I safe as is or do I have to forget about Paid Memberships Pro and try to do everything through Stripe? If I have to do everything through Stripe, how do I get Stripe to have my website let my user generate a username and password for my site after paying?
If I'm asking anything that could be answered easily through a tutorial of some sorts, forgive me and give me a reference to that sort. I just want to make sure I'm doing everything correctly. So thanks everybody in advance.

You should review the PCI Compliance guide and reach out for support from the plugin provider to understand how their plugin works. All card information should be collected securely with Stripe.js & Elements. While this appears to the customer as though it is "on your site" it is actually inside a Stripe-hosted iframe for exactly this reason.
You can also use redirect-based products like Checkout to set up subscriptions, but I don't know if this is supported by your plugin.

Related

Read and Write to Firebase Realtime Database / Auth from WordPress?

I have developed a tool with Angular for which I would like to offer a free and a paid premium model. Accordingly, a login is possible there. The authentication and the database runs via Firebase.
I present this tool on a separate WordPress website based on Elementor. There you can also find other areas like FAQ, Demos etc. On this site I also listed the prices and offer with WooCommerce the possibility of purchase (subscription model / Paypal).
Now to my question: How do I link both platforms most elegantly? If someone subscribes to the premium model via WooCommerce, the user (at this moment registered...or not...) must get premium access via the Angular app. Is there a best practice here?
My approach: after the purchase, I send a token by e-mail, which the user can enter in his profile on the platform. There I check the validity.
How would you rate this procedure?
You can read the official doc from here that may help you get it done.
https://firebase.google.com/docs/web/setup

Different Paypal accounts depending on product

I'm currently testing Woocommerce on my Wordpress site, and I'd like to know if it is possible to have two Paypal accounts linked to your shop. The idea would be to dedicate one account for a type of product and the other one for another type.
I've tried to look into the extensions available, but couldn't find a way to do this.
If you want to use Paypal, you can use Paypal Adaptive payments.
You can link each products to a Vendor as a marketplace website will do. ie : for woocommerce WC-Vendors, Dokkan...
Depending on which e-commerce plugin you have embed into your website, you can create a dedicated payment gateway that will switch the producct owner email, but this will a time wasting and maybe a untrustly method.
Hope it helps

Express checkout is not returning to website (currently in sandbox)

I don't use paypal all the time but I have a wordpress plugin I built to handle some basic payments. I have started to implement this plugin on a new site and new paypal account and am running into some issues. I am using a technique very similar to the selected answer in this post: Easier way to integrate PayPal express checkout? (that's me, actually).
I'm not sure if there was a change with Paypal that is affecting the redirect after payment but I am setting the return, notify, etc url's in the form before passing it off to Paypal. I have tried to match up the settings with the other paypal accounts I use this plugin with but the "Profile" page on Paypal seems much different on this new account (? did it change, maybe I signed up for the wrong type of account or have a settings misaligned). I know one obvious solution would be to enable the auto return url within the profile page but my other Paypal accounts do not have this option enabled and also when I attempt this it does not help.
I am also having trouble locating the proper settings for changing the shop name (currently showing my email address) on the Paypal checkout page.
Any help would be appreciated.
Sandbox settings are not tied to account settings at all, I just needed to make the changes when logged into sandbox.paypal.com when I was making them on paypal.com only.. Maybe this will help someone else in the future. Feel free to delete.

Transparent PayPal transfer to end user

We’re currently working on a ASP.NET web project using Visual Studio 2010, and as a requirement we have to implement a mechanism that will transfer some amount of money from our business account to end-user PayPal account.
The authorized user should provide the PayPal email address only.
The precondition is to do all that staff without redirecting to PayPal web site, everything should be done in background.
Is there any solution to solve this?
Any information would be greatly appreciated.
PS
I’ve read a lot of official documentation, but still disappointed. There are too many APIs and services, can’t identify what exactly should be used.
Please help…
If you use the Advanced PayPal Payment solution, you can do transparent payments from your website without redirecting to PayPal. This solution uses a web service to send payment. When I used it some time ago it was really simple to set up and you get a sandbox environment where you can experiment with it. You'll likely need a business account to be able to use this particular API.
Here's an article that describes how to use it.

Drupal: Ubecart.. starting to use it

What kind of things do I need to know before to start to use Drupal Ubecart ?
I'm already experienced with Drupal.
I was wondering if I need to setup secure https connection, or doing additional work for my webshop.
Or can I just install ubecart and configure it ?
thanks
One thing I found about using ubercart was that it was a pain to override theme. It wants to make all these horrendous looking tables, making it fit in with the rest of the site was pretty horrible.
Also, if you want to get the most out of it, install it on a local machine and take some time to explore the interface - there are a LOT of options there and it can take a while to get your head around how it fits together.
To get a sense of how to use Ubercart, you can certainly install it on a development server and start going through the customization settings. For production, though, definitely consider installing a SSL certificate and using this module to secure the appropriate pages. And you'll need to determine which payment gateways to employ (credit cards, Paypal, Authorize.net, etc.), and set up the appropriate accounts so that when you configure Ubercart payment gateways, you can provide the needed information.
If you have some time after getting to know basic Ubercart, you might check out the Ubercart contributions page for more ideas of what you can do.
If you are looking for a quick payment solution for payments and can't really be bothered with ssl and all the payment issues, Paypal IPN is a godsend. This is the paypal option where the customer goes to the Paypal site to complete checkout. This is quite a bit simpler to implement than the other payment options and gets around the most important security issues, by not collecting any financial info on your site.

Resources