Home / Security

Where card data goes, and where it does not.

The plugin is built so that a compromised WordPress host does not become a card breach. This page explains exactly how, and what it means for your PCI obligations.

The data path

Three steps, and your server is only involved in the third.

step 1, browser

Buyer types the card

The inputs are iframes served by your gateway. Your theme styles them, your JavaScript cannot read them.

step 2, gateway

A token comes back

The card is exchanged for a single use token in the browser. The number is never posted to your site.

step 3, server

WordPress charges the token

Your server sends the token and the amount, then stores a transaction ID and the last four digits.

What is stored on your site. Transaction IDs, auth codes, AVS and CVV result letters, card brand, last four digits and expiry, and vault token references. Nothing in that list can be used to charge a card anywhere else.

Practices

How the code itself is written and released.

Redacted logging

Requests and responses are logged for support, with card numbers, CVV and the security key stripped before anything is written to disk.

Capability and nonce checks

Every admin action verifies a nonce and a capability. Refunds and captures cannot be triggered by a crafted request.

Static analysis on release

The codebase is analysed before every release and follows the WordPress coding standards for escaping and sanitisation.

Credentials at rest

The security key is stored in site options, never displayed after saving, and never included in logs, exports or support bundles.

PCI scope

Read this carefully rather than taking a marketing claim at face value.

Report a vulnerability

What we can and cannot tell you

Because card data does not reach your server, stores using hosted fields typically fall into the shortest self assessment questionnaire. We cannot confirm your scope for you. It depends on the rest of your checkout, your hosting, and your acquirer’s own assessment. Ask them, and show them this page.

Does using this plugin make me PCI compliant?

No plugin can. It removes card data from your server, which is the largest single factor in reducing scope. Compliance remains an assessment of your whole environment.

What happens if my site is hacked?

There are no card numbers to steal. An attacker with database access finds tokens, last four digits and transaction IDs. Your gateway credentials should be rotated immediately, which is why they are stored where they can be replaced in one step.

Do you have access to my transactions?

No. The plugin talks to your gateway using your credentials. Nothing is routed through us and we hold no data about your sales.

How are vulnerabilities handled?

Reported privately, fixed, and released with a security note in the changelog. See the reporting page for the process and expected timelines.

Start free, upgrade when the store needs it.

Install from WordPress.org, connect your gateway, take a real order today.

Download from WordPress.org See pricing