What you need to set up online payments on your website

To accept payments on your website, you need three things: a payment processor (the company that handles the transaction), a payment gateway (the software that connects your website to the processor), and a merchant account (the bank account where money lands). Some providers bundle these together; others you source separately.

The processor moves money from your customer's bank or card to yours. The gateway is the form your customer sees and the code running behind it. The merchant account is where funds settle, usually within one to three business days. You do not need all three from the same company, but most small websites choose one provider that handles all three to keep setup straightforward.

The actual steps depend on what platform your website runs on. A WordPress site with WooCommerce works differently from a custom-built site or a Shopify store. But the underlying mechanics are the same: you connect your site to a payment processor, test the connection, and go live.

Key Takeaways

  • You need a payment processor, a gateway to display the payment form, and a merchant account to receive funds—many providers offer all three as one service.
  • Popular processors for small websites include Stripe, Square, PayPal, and Authorize.net, each with different fee structures and setup times.
  • Your website platform (WordPress, Shopify, custom code) determines which gateways and processors work with it, so check compatibility before signing up.
  • Testing in a sandbox environment before going live catches problems with your setup before real money moves.
  • PCI compliance—the security standard for handling card data—is required by law; most modern gateways handle it for you, but you must verify.

Choosing a payment processor and gateway

The most common processors for websites are Stripe, Square, PayPal, Authorize.net, and 2Checkout. Each has different fee structures, setup times, and the types of payments they accept. Stripe charges 2.9% plus $0.30 per transaction for card payments and settles funds daily. Square charges the same rate and also settles daily. PayPal charges 2.2% plus $0.30 for standard transactions. Authorize.net charges a monthly gateway fee (around $25) plus per-transaction fees, making it cheaper if you process high volume.

Your choice depends on your transaction volume, the types of payments you want to accept (cards only, or also PayPal, Apple Pay, bank transfers), and how fast you need funds. If you process fewer than 100 transactions a month, Stripe or Square's per-transaction model costs less than Authorize.net's monthly fee. If you process thousands monthly, Authorize.net's flat fee becomes cheaper.

Check whether your website platform has a built-in integration. WordPress sites using WooCommerce have plugins for most major processors. Shopify has native integrations with dozens of gateways. A custom-built site may require more manual setup or a developer to integrate the payment code.

Setting up the payment form on your website

Once you choose a processor, you install the gateway on your site. For WordPress, this usually means installing a plugin (like WooCommerce Payments, Stripe for WooCommerce, or PayPal for WooCommerce) and entering your processor credentials. The plugin generates the payment form automatically.

For a custom website, you embed code provided by your processor. Stripe, for example, provides JavaScript code you paste into your checkout page. This code creates the payment form and handles the find transmission of card data to Stripe's servers—your server never touches the card number itself.

You will need to enter your business information, bank account details for where funds should land, and tax information. Most processors verify your identity before you go live, which can take a few hours to a few days. Some require additional documentation if your business type is flagged as higher-risk (e.g., subscription services, nonprofits, or certain industries).

Testing before you accept real payments

Every payment processor provides a sandbox environment—a copy of the live system where you can test without real money changing hands. Use test card numbers provided by your processor (Stripe's test number is 4242 4242 4242 4242, for example) to run transactions through your form. Test successful payments, failed payments, and refunds.

Check that the payment form appears correctly on desktop and mobile. Verify that confirmation emails send to the customer. Confirm that the transaction shows up in your processor's dashboard. Test that refunds process correctly. Only after all tests pass should you switch to live mode and accept real payments.

If you use a plugin, the sandbox toggle is usually in the plugin settings. For custom code, your processor's documentation will show how to switch between test and live API keys.

Understanding fees and settlement timing

Payment processors charge in different ways. Most charge a percentage of the transaction plus a fixed amount per transaction. Some charge a monthly gateway fee instead. Some charge both. A few charge additional fees for refunds, chargebacks, or international transactions.

Settlement is the process of funds moving from the processor to your merchant account. Most processors settle daily, meaning money from today's transactions arrives in your bank account tomorrow or the next day. Some settle weekly or on a schedule you choose. A few hold funds for a period (called a rolling reserve) to cover potential refunds or chargebacks.

Read the fee schedule and settlement terms before you sign up. A processor that charges 3.5% per transaction costs significantly more than one charging 2.9% if you process $10,000 a month. Settlement timing matters if you need access to funds quickly.

PCI compliance and security

PCI DSS (Payment Card Industry Data Security Standard) is a set of security rules you must follow if you accept card payments. The core rule: your website must never store or transmit unencrypted card numbers. If you use a modern payment gateway like Stripe or Square, they handle PCI compliance for you—the gateway collects the card data, not your server.

If you build a custom payment form, use a hosted payment page or tokenization (where the gateway returns a token representing the card, and you store the token instead of the card number). Never write code that captures and stores raw card data yourself; this is illegal and exposes you to liability.

Your processor will ask you to confirm you are PCI compliant. Most gateways provide a compliance checklist. For a small website using a standard gateway, compliance is straightforward. For custom code, you may need a developer to review your setup or a security audit.

Handling refunds and disputes

When a customer requests a refund, you initiate it from your processor's dashboard. The refund goes back to the customer's original payment method (their card or PayPal account) within a few business days. You are charged a small fee for the refund by most processors (usually the same percentage as the original transaction).

A chargeback happens when a customer disputes the charge with their bank instead of asking you for a refund. The bank investigates and may reverse the transaction. You can dispute the chargeback by providing evidence (order confirmation, delivery proof, customer communication) through your processor's dashboard. If you lose the dispute, you lose the money and pay a chargeback fee (usually $15 to $100).

To reduce chargebacks, send order confirmations when ready, provide clear refund policies, and respond quickly to customer inquiries. Most processors show you chargeback rates and patterns in your dashboard so you can spot problems.

Frequently Asked Questions

How long does it take to set up online payments on my website?

For a WordPress site with a plugin, you can be accepting payments within an hour if your processor approves you when ready. For a custom site, setup depends on your developer's timeline. Most processors verify your identity within 24 to 48 hours, though some take longer if they need additional documentation.

What payment methods should I accept?

Credit and debit cards (Visa, Mastercard, American Express, Discover) cover most customers. PayPal, Apple Pay, and Google Pay add convenience for mobile shoppers. Bank transfers and digital wallets are less common for small websites but growing. Start with cards and PayPal, then add others if customers request them.

Can I accept international payments?

Most processors accept cards from many countries, but fees and settlement times vary. Some charge extra for international transactions. Currency conversion may happen at your processor's rate or your customer's bank's rate. Check your processor's documentation for the countries and currencies they support before signing up.

What happens if a payment fails?

Your gateway will show an error message to the customer (insufficient funds, expired card, etc.). The transaction does not complete, and no money moves. The customer can try again with a different card or payment method. You should see the failed attempt in your dashboard so you can follow up if needed.

Do I need a separate SSL certificate for payments?

Yes. Your entire website should use HTTPS (indicated by the padlock in the browser), which requires an SSL certificate. This encrypts data in transit between your customer's browser and your server. Most hosting providers offer free SSL certificates (Let's Encrypt), and many website builders include it automatically. Your processor will not go live with you without HTTPS.