Adding Stripe or PayPal Checkout to a WordPress Site: SSL, PCI Basics and Hosting Requirements
Adding a checkout to WordPress often looks like a ten-minute plugin install. The harder part is everything around it: a secure connection, a safe testing routine, and a clear idea of which card-security duties still sit with you.
This guide is written for small online sellers in the United States who run, or plan to run, a WordPress site. It explains what to prepare before you connect Stripe or PayPal, and what to check on your hosting plan. It is educational information, not legal or compliance advice.
Table of contents
- Executive Summary
- Quick Answer
- What to Prepare Before You Install Anything
- How Stripe and PayPal Handle the Card Form
- SSL and HTTPS: What Checkout Really Requires
- PCI Basics for a Small WordPress Store
- Hosting Features to Check Before You Go Live
- A Safe Setup Order
- Common Mistakes to Avoid
- Frequently Asked Questions
- Key Takeaways
- Check Your Hosting Before You Add Checkout
- Official References
Executive Summary
Stripe and PayPal both let you take card payments without handling card numbers on your own server, if you pick the right integration. Your site still needs HTTPS, regular updates and a tested setup. Your hosting plan should give you SSL, backups and a safe place to test before going live.
Quick Answer
To add Stripe or PayPal checkout to WordPress, you need a provider business account, HTTPS across the whole site, and a payment plugin or integration. WooCommerce is this guide's practical example, not a requirement for every WordPress site. With WooCommerce, the usual route is the WooCommerce Stripe extension or WooCommerce PayPal Payments: connect your account, test in test or sandbox mode, then follow the plugin's documented steps to go live. A hosted or provider-embedded payment form sends card details straight to the provider, which reduces your PCI scope. Your PCI responsibilities do not disappear.
What to Prepare Before You Install Anything
A few basics prevent most launch-day problems. Work through this list before you touch a payment plugin.
- A business account with Stripe or PayPal. Stripe's WooCommerce extension requires your business to be in a Stripe-supported country.
- An SSL certificate, with the whole site reachable over HTTPS.
- Recent versions of PHP, WordPress and your store plugin.
- A recent backup, and ideally a staging copy of your site where you can test changes.
- A domain you control, so the checkout runs on your own web address.
How Stripe and PayPal Handle the Card Form
The biggest decision is where customers type their card details. That choice affects your workload and your PCI obligations.
Stripe describes three payment pages built on its Checkout Sessions API: a full-page checkout, an embedded form and Elements. Stripe recommends the full-page option, which can be hosted by Stripe or embedded on your site. PayPal offers a PayPal-hosted checkout, plus Expanded Checkout, which places a payment form on your own site. This comparison covers the providers' own APIs, not which options a particular WordPress plugin supports, so check your plugin's documentation.
| Option | Where customers pay | Effort on your side |
|---|---|---|
| Stripe Checkout, full page | Stripe-hosted page, or embedded on your site | Low ongoing maintenance, per Stripe |
| Stripe embedded form | Form embedded on your site | Some maintenance |
| Stripe Elements | Custom page you build | Most maintenance |
| PayPal Checkout | PayPal-hosted page | Provider handles the payment flow |
| PayPal Expanded Checkout | Payment form on your site, using PayPal's APIs and JavaScript SDK | You handle compliance reporting yourself, per PayPal |
PayPal can offer guest checkout, which lets some buyers pay by card without logging in to a PayPal account. It is not guaranteed: the merchant must enable it in account settings, the payment flow must support it (some subscription, recurring and donation products do not), and PayPal decides whether to show it based on risk factors. Fees change over time, so compare current pricing on each provider's own pages before you decide.
SSL and HTTPS: What Checkout Really Requires
Stripe states that payment pages must use TLS 1.2 or above. People still say "SSL" in everyday speech, but TLS is the protocol that does the work.
Three practical points follow from Stripe's security guide:
- Serve scripts, stylesheets and images over HTTPS too. Otherwise visitors may see a mixed content warning.
- You can test your integration without HTTPS, but turn it on before accepting live charges.
- If you use webhooks, protect the endpoint with TLS and verify each webhook signature.
After installing a certificate, browse your product, cart and checkout pages and look for warnings. Stripe also suggests the Qualys SSL Labs server test to confirm your setup is sound.
PCI Basics for a Small WordPress Store
PCI DSS is the global security standard for anyone who stores, processes or transmits card data. The PCI Security Standards Council lists PCI DSS v4.0.1 as the current version in its document library.
Stripe explains that compliance is a shared responsibility. Stripe is certified as a PCI Level 1 service provider, but your business must still accept payments in a compliant way and attest to it each year.
The integration you choose matters. Stripe says that handling sensitive card data directly can mean meeting more than 300 security controls. Its lower-risk integrations send payment details straight to Stripe without passing through your servers.
Which self-assessment applies to you?
The PCI Council's guidance on SAQ A has a script-related criterion. It applies if your page embeds a payment form, such as an iframe, from a payment provider. It does not apply if your site redirects customers to the provider's site. Confirm with your acquirer or payment brands which questionnaire you must complete.
What you can store
Stripe says details such as the card type, the last four digits and the expiry date are not subject to PCI compliance. Do not collect or store full card numbers in WordPress or in custom form plugins.
Hosting Features to Check Before You Go Live
Your hosting plan carries your checkout, so confirm these features on the plan page before buying:
- SSL included, and renewal handled for you.
- Automated backups, and a simple way to restore them.
- A staging site for testing plugin updates.
- A way to switch PHP versions as your plugins require.
- Enough resources: storage, databases and memory for your product catalog.
On its US storefront, Z.com lists a free SSL certificate on all WordPress Hosting plans. The page also states daily backups, and its FAQ says all plans include a staging site. It recommends the Pro plan for online stores. The page does not mention WooCommerce, so ask support to confirm compatibility with your setup before you build a store there.
Plan details can change, so confirm memory, storage, database and website limits on the current plan page and at checkout.
Z.com's US money-back guarantee page covers Web Hosting plans: 30 days, for subscriptions of one year or more, with the free .com domain value and applicable fees possibly deducted. It does not mention WordPress Hosting, so confirm with Z.com whether it applies before you buy.
A Safe Setup Order
- Back up your site and make a staging copy.
- Confirm HTTPS works on every page.
- Create your Stripe or PayPal business account.
- Install the plugin for your store. With WooCommerce, that is the WooCommerce Stripe extension or WooCommerce PayPal Payments.
- Connect in test or sandbox mode first (steps below).
- Set up webhooks if the provider requires them.
- Place test orders with the provider's test details. Stripe documents test cards such as 4242 4242 4242 4242.
- Go live using your selected plugin's documented live connection process, not a generic key swap.
- Watch your first real orders in the provider dashboard.
Stripe with WooCommerce. Go to WooCommerce > Settings > Payments, click Complete setup next to Stripe, then choose Create or connect an account. WooCommerce says Create or connect a test account is for a test-only Stripe account. After the redirect to connect.stripe.com and back, confirm that Payment, Payout, Webhook and Sync show Enabled under Account details. For live payments, connect your live Stripe account the same way and recheck those statuses. Confirm live steps in WooCommerce's current documentation.
PayPal with WooCommerce. WooCommerce PayPal Payments needs a PayPal Business account. In WooCommerce > Settings > Payments, click Enable or Complete setup next to PayPal, choose Activate PayPal Payments, then Connect to PayPal and log in. To test, create a seller and a buyer account in the PayPal developer dashboard, open See advanced options on the Welcome page, turn on Sandbox Mode and connect with the sandbox seller account. WooCommerce says you can switch back to live mode when ready; confirm live steps in its current guide.
Stripe says its Services Agreement prohibits live-mode testing with real payment details, so never test live mode with a real card.
Custom development only. If a developer builds a custom Stripe API integration instead of using a plugin, Stripe's documentation says to replace test API keys with live ones when going live. Store live keys in a secrets vault or environment variables, not source code.
Common Mistakes to Avoid
Going live with mixed content
A single HTTP script or image on the checkout page can trigger browser warnings and erode trust.
Putting secret keys in code
In a custom integration, Stripe advises storing live keys in a secrets vault or environment variables, not in source code.
Assuming the plugin handles PCI for you
Plugins reduce what you handle, but you still have responsibilities, such as annual attestation with Stripe.
Updating payment plugins without a backup
Try updates on staging first, then apply them to the live site.
Frequently Asked Questions
Do I still need PCI compliance if I use Stripe?
Yes. Stripe states that PCI compliance is a shared responsibility and that businesses must attest to it annually.
Can I test Stripe without HTTPS?
Stripe says you can test your integration without HTTPS, but you should enable it before accepting live charges.
Should I choose a hosted or an embedded payment form?
A hosted page keeps card entry off your site and needs less upkeep. An embedded form keeps customers on your pages but adds responsibilities. Check your acquirer's guidance for the exact questionnaire.
Is a free SSL certificate enough for a store?
It enables HTTPS, which checkout needs. It does not cover PCI duties, updates or secure key handling.
Key Takeaways
- Choose a hosted or provider-embedded payment form to keep card details off your server.
- HTTPS is required for live checkout, and it must cover every resource on the page.
- PCI compliance is shared with your provider, and you still attest each year.
- Test in test or sandbox mode. Stripe prohibits testing live mode with a real card.
Check Your Hosting Before You Add Checkout
Review the current plan details, backups, staging and SSL terms on Z.com's WordPress Hosting page before you build your store.