Security

Money changing hands deserves more than a trusting browser. This plugin is built so a payment is only credited when it can be proven genuine, so your settings can't leak, and so the gateways simply aren't available unless they should be. Here's how each layer works and why it matters to you.

Every event is signature-verified

Razorpay signs the messages it sends back — the payment callback after checkout, the subscription callbacks for recurring charges, and the webhooks that report events. The plugin verifies each one with HMAC-SHA256 before acting on it:

• Payment callbacks — the one-time result after checkout.
• Subscription callbacks — recurring-charge results.
• Webhooks — the events Razorpay posts to your site.

If a message is unsigned or tampered with, it is rejected. A replayed success URL or a forged webhook simply doesn't pass, so no invoice is marked paid on a fake signal.

What HMAC verification is

An HMAC signature is a fingerprint computed from the message and a shared secret. Only Razorpay and your server know the secret, so a matching signature proves the message really came from Razorpay and wasn't altered on the way.

Outcomes are confirmed server-side

Even a correctly signed browser callback isn't the final word. The plugin confirms the outcome server-side with Razorpay before crediting anything — client callbacks are never trusted on their own. This closes the gap between "the browser says it succeeded" and "the payment truly settled."

The settings page is admin-gated

The settings page renders your API Key Secret, so it is admin-gated — it requires an admin login to open. Your Key Secret is entered as a password field and never exposed in client-side code, so day-to-day users and customers can't reach your credentials.

License and plugin-state gating

Two more gates decide whether the gateways run at all:

• License gating. Payment processing is disabled while the license is inactive. Until the key is Active, neither Razorpay gateway appears in Admin → Payment Gateways. The check is a local background check against relyweb.co — brief outages are tolerated, and re-saving Settings restores it.
• Plugin-state gating. Deactivating the plugin removes both gateways from Payment Gateways; reactivating restores them. When the plugin is off, there is no live payment path at all.

Together these mean a lapsed license or a deactivated plugin can never quietly keep taking payments.

Related pages

• Direct Payment — one-time payment verification
• Subscriptions — mandate and renewal verification
• Configure webhooks — set the Webhook Secret to verify events
• Licensing — how license gating works
• Settings — where the Key Secret and Webhook Secret live