---
url: /cashfree-acellemail/features/security.md
description: >-
  How the Cashfree gateways for AcelleMail keep payments trustworthy —
  signature-verified webhooks, server-side outcome confirmation, admin-gated
  settings, an open-redirect guard, no error leakage, and license plus
  plugin-state gating.
---

# Security

Payments have to be trustworthy, so the Cashfree plugin never takes a customer's — or a browser's —
word for whether money moved. Every outcome is confirmed on your server against Cashfree, every
incoming webhook is verified, and the gateways switch off cleanly when they shouldn't be running.
This page explains the protections so you know what you're relying on.

## Signature-verified webhooks

Cashfree notifies AcelleMail of payment and subscription events by calling your endpoint at
`https://YOUR_DOMAIN/cashier/cashfree/webhooks`. Every webhook is **signature-verified** before it is
acted on:

* The plugin verifies with the **endpoint-specific Webhook Secret** if you set one, and otherwise
  **falls back to your Secret Key**.
* Verified events are **de-duplicated** — Cashfree may retry a delivery, and the plugin's idempotent,
  already-settled guard ensures a retry never double-processes an order or subscription.

A webhook whose signature doesn't check out is rejected. Set up your endpoint using
[Configure webhooks](/cashfree-acellemail/guides/configure-webhooks).

## Server-side outcome only

The plugin **never trusts the browser** to report a payment result. When a customer returns from
Cashfree, success is confirmed by **re-fetching the order from Cashfree and waiting for the signed
webhook** — see [Direct Payment](/cashfree-acellemail/features/direct-payment). A manipulated return
URL cannot mark an unpaid invoice as paid.

## Admin-gated settings

The Plugin Settings page (which renders your Secret Key) **requires an admin login**. Your
credentials are not exposed to non-admins or to customers at checkout.

## Open-redirect guard

The customer return URL is constrained to your **same host / relative paths only**, so a crafted
return link cannot bounce a customer to an attacker-controlled site after payment.

## No error leakage

Internal errors are **logged for you, never shown to the customer**. Shoppers see a short, safe
message; the diagnostic detail stays in the AcelleMail log where you can read it. See
[Errors](/cashfree-acellemail/errors) for the customer-facing strings.

## License and plugin-state gating

Two switches keep the gateways from running when they shouldn't:

* **License gating** — while the license is not **Active**, payment processing is disabled and the
  gateways don't appear. See [Licensing](/cashfree-acellemail/licensing).
* **Plugin-state gating** — deactivating the plugin removes both Cashfree gateways from
  **Admin → Payment Gateways**; reactivating restores them. See
  [Uninstalling](/cashfree-acellemail/uninstalling).

## Related pages

* [Configure webhooks](/cashfree-acellemail/guides/configure-webhooks) — endpoint, version and IPs
* [Direct Payment](/cashfree-acellemail/features/direct-payment) · [Subscriptions](/cashfree-acellemail/features/subscriptions)
* [Licensing](/cashfree-acellemail/licensing) — how gating works
* [Settings reference](/cashfree-acellemail/settings) · [Errors](/cashfree-acellemail/errors)
* [Troubleshooting](/cashfree-acellemail/troubleshooting)