Integration Guide

Table Of Contents
Website Payments Standard Integration Guide September 2008 253
6
Securing Your Website Payments
Standard Buttons
Unprotected and non-encrypted buttons that are not saved in your PayPal account are in clear
text in the source view of your webpages. The HTML button code for your payment buttons
can be viewed by anyone. A malicious third party could copy a page, change button HTML
variables such as price, and make fraudulent payments.
IMPORTANT: Merchants with significant payment volume are required to take precautions
on securing Website Payment Standard buttons.
PayPal provides the following strategies for securing Website Payments Standard buttons. Use
one or more of the following security strategies to prevent and/or detect tampering with your
buttons:
Strategy for Securing Buttons See
Create protected buttons by using button creation tools on
the PayPal website.
“Creating Protected Payment Buttons
on the PayPal Website” on page 254
Save payments button that you create on the PayPal website
in your PayPal account.
“Saving Payment Buttons in Your
PayPal Account” on page 256
Manually check the item amounts in each payment through
the transaction history in your PayPal account before
shipping.
N OTE: You are required to reconcile your payments,
especially if you have unprotected or non-encrypted
buttons.
“Reconciling Payments Manually
Through Transaction History” on
page 257
Automatically check the item amounts in each payment
through Instant Payment Notification before shipping.
N OTE: You are required to reconcile your payments,
especially if you have unprotected or non-encrypted
buttons.
“Reconciling Payments Through
Instant Payment Notification” on
page 258
Edit your PayPal account profile to enable Encrypted
Website Payments, and use a script and open-source
libraries from OpenSSL to encrypt your buttons
dynamically when rendering your webpages.
You must be comfortable programming in scripts like PHP
and ASP to use Encrypted Website Payments.
“Protecting Payment Buttons by
Using Encrypted Website Payments”
on page 258
Edit your PayPal account profile to block unprotected and
non-encrypted buttons to add extra security to your
protected, saved, and encrypted buttons.
“Blocking Unprotected and Non-
encrypted Website Payments” on
page 264