Integration Guide

Table Of Contents
PayPal Payments Standard Integration Guide June 2012 337
8
Securing Your PayPal Payments
Standard Buttons
Unprotected and non-encrypted buttons that are not saved in your PayPal account are in plain
text in the source view of your webpages. The HTML button code for your payment buttons
can be viewed by anyone. A malicious third party could copy a page, change button HTML
variables such as price, and make fraudulent payments.
IMPORTANT: Merchants with significant payment volume are required to take precautions
on securing PayPal Payment Standard buttons.
PayPal provides the following strategies for securing PayPal Payments Standard buttons. Use
one or more of the following security strategies to prevent and/or detect tampering with your
buttons:
Strategy for Securing Buttons See
Create protected buttons by using button creation tools
on the PayPal website.
“Creating Protected Payment Buttons on the PayPal
Website” on page 338
Save payments buttons that you create on the PayPal
website in your PayPal account.
“Saving Payment Buttons in Your PayPal Account” on
page 340
Manually check the item amounts in each payment
through the transaction history in your PayPal account
before shipping.
NOTE: You are required to reconcile your payments,
especially if you have unprotected or non-
encrypted buttons.
“Reconciling Payments Manually Through Transaction
History” on page 341
Automatically check the item amounts in each payment
through Instant Payment Notification before shipping.
NOTE: You are required to reconcile your payments,
especially if you have unprotected or non-
encrypted buttons.
“Reconciling Payments Through Instant Payment
Notification” on page 342
Edit your PayPal account profile to enable Encrypted
Website Payments, and use a script and open-source
libraries from OpenSSL to encrypt your buttons
dynamically when rendering your webpages.
You must be comfortable programming in scripts like
PHP and ASP to use Encrypted Website Payments.
“Protecting Payment Buttons by Using Encrypted
Website Payments” on page 342
Edit your PayPal account profile to block unprotected
and non-encrypted buttons to add extra security to your
protected, saved, and encrypted buttons.
“Blocking Unprotected and Non-encrypted Website
Payments” on page 348