Security • integration hygiene • merchant best practices
Security is not a badge. It is how the merchant setup behaves under load.
EcomTrade24 Pay is designed for practical merchant operations: encrypted transport, clear callback and webhook handling, dashboard access controls, and a setup model that does not encourage sloppy shortcuts. This page explains the basics merchants should follow before going live.
HTTPS everywhere
Use HTTPS on your storefront, admin area, callback endpoints and webhook destinations.
Webhook verification
Verify signatures, process idempotently and store event IDs for reconciliation.
Access control
Strong passwords, limited admin access and 2FA wherever possible reduce avoidable incidents.
Data minimization
Store order references, session IDs and results. Do not store raw card data on your server.
What we expect from merchants
Security starts with merchant discipline. If your website is broken, your terms are missing, your support path is hidden, or your callback endpoints are careless, the checkout stack will not save you.
Merchants that perform well long-term usually do the simple things consistently: they keep their storefront clean, keep software updated, verify every webhook, and understand their own order flow.
Recommended merchant checklist
- • Enable HTTPS and redirect all HTTP traffic to HTTPS.
- • Verify webhook signatures before changing order status.
- • Log webhook delivery results and keep retry handling idempotent.
- • Keep WooCommerce, plugins, PHP and server dependencies up to date.
- • Use unique passwords and 2FA for dashboard users.
- • Store only operational data you actually need.
What we do not want merchants to misunderstand
does not mean security standards disappear.
does not mean no review can ever happen.
still depends on a real storefront and valid merchant data.
does not help if your backend ignores duplicates or signature checks.
Need a practical starting point?
Start with merchant signup, connect your shop, then use the go-live page to validate the basics before sending real traffic.