What Is Stripe? WordPress and PHP Integration Guide

Stripe integration connects a customer payment with the work your business must do afterward. A payment screen is only one part of that system: the website must also recognize the order, update its status, deliver the purchase, and handle exceptions.

This guide covers WordPress and custom PHP integration with a practical focus on launch acceptance: what to configure, what to test, and what the business and developer should verify before enabling real payments.

Stripe integration costs: separate platform fees from development

There is no universal integration price or transaction rate for every business. Confirm the pricing applicable to your account country, payment methods, currencies, and selected Stripe products.

Request an itemized proposal. Supply the website platform, business registration country, currencies, products, delivery process, and subscription requirements so the scope can be assessed before development starts.

Four checks before approving the payment launch

What Is Stripe?

Stripe is a financial technology platform that helps businesses accept and manage payments online. It provides payment infrastructure, APIs, hosted checkout pages, billing tools, fraud-prevention features, reporting, and other services for websites, mobile applications, subscription platforms, and online marketplaces.

Depending on the business location, customer location, currency, and account eligibility, Stripe may support payment methods such as:

• Credit and debit cards
• Apple Pay
• Google Pay
• Bank transfers and bank debits
• Buy now, pay later methods
• Regional payment methods

Stripe can be used for several business models, including:

• One-time online payments
• Recurring subscriptions
• Usage-based billing
• Online marketplaces
• Software-as-a-Service platforms
• Invoices and payment links
• In-person payments through supported hardware

Businesses should confirm that Stripe supports account registration in their country or region before planning the integration. Once a business operates through a supported Stripe account, it may be able to accept payments from customers in many other markets.

How Does Stripe Work?

Stripe connects the website or application with payment methods, banks, card networks, and other financial systems involved in processing a transaction.

A typical online payment flow includes the following steps:

1. The customer selects a product, service, or subscription.
2. The website creates a payment session or payment request on the server.
3. The customer securely enters payment information through a Stripe interface.
4. Stripe submits the payment for authorization.
5. The customer may be asked to complete additional authentication.
6. Stripe reports the payment status to the website.
7. The website confirms the order after receiving a verified payment event.

Modern Stripe integrations generally use Checkout Sessions or Payment Intents rather than directly creating a legacy card charge. A PaymentIntent tracks a payment through its lifecycle and supports status changes and additional authentication when required.

Main Stripe Products for Online Payments

1. Stripe Checkout

Stripe Checkout is a prebuilt payment page that can be hosted by Stripe or embedded into a website.

It can support:

• One-time payments
• Subscriptions
• Multiple payment methods
• Discount codes
• Tax collection
• Shipping information
• Customer information

Stripe Checkout uses the Checkout Sessions API and is usually the easiest integration method for businesses that want a secure and professionally maintained payment interface without building the entire form themselves.

2. Stripe Payment Element

The Payment Element is a secure, embeddable payment component for websites that require greater control over the checkout layout and customer experience.

It can display available payment methods dynamically according to factors such as:

• Currency
• Customer location
• Stripe account configuration
• Payment-method eligibility

The methods shown depend on the integration and account eligibility. Select methods that your order workflow can handle, including delayed outcomes where relevant.

3. Stripe Payment Links

Stripe Payment Links allow a business to create a hosted payment page without building a custom checkout system.

This option may be suitable for:

• Simple service payments
• Event registrations
• Donation campaigns
• Product pre-orders
• Payment links sent through email or chat

4. Stripe Billing

Stripe Billing provides tools for recurring payments and subscription management.

Possible billing models include:

• Monthly subscriptions
• Annual subscriptions
• Tiered pricing
• Usage-based billing
• Free trials
• Subscription upgrades and downgrades

Stripe provides a Checkout-based quickstart for businesses implementing subscription payment pages.

5. Stripe Radar

Stripe Radar helps identify and manage potentially fraudulent transactions.

Fraud-prevention tools can reduce risk, but businesses still need appropriate internal processes for order verification, refunds, disputes, account security, and customer support.

Benefits of Using Stripe

1. Developer-Friendly Integration

Stripe provides official APIs and software libraries for languages and platforms such as:

• PHP
• Node.js
• Python
• Java
• .NET
• Ruby
• Go

Developers can choose between low-code hosted checkout pages and more advanced custom payment flows.

2. Secure Payment Components

Stripe Checkout and Stripe Elements allow sensitive payment information to be collected through Stripe-managed components rather than passing raw card data through the business’s own server.

Stripe is certified as a PCI Level 1 service provider. However, PCI compliance remains a shared responsibility, and every business must still follow the requirements applicable to its own integration and operations.

3. Support for Additional Authentication

Stripe supports payment flows that may require additional customer authentication, including 3D Secure.

Using modern Checkout Sessions or Payment Intents helps the integration respond correctly when authentication is required.

4. Responsive Checkout Experience

Stripe’s prebuilt payment interfaces are designed to work across desktop and mobile devices.

This can reduce the design and development work required to maintain a secure payment form.

5. Payment and Business Reporting

The Stripe Dashboard can help businesses review:

• Payments
• Refunds
• Disputes
• Customers
• Subscriptions
• Payouts
• Revenue data
• Payment failures

6. Multiple Integration Options

A business can choose the implementation method that matches its technical capabilities:

• Payment Links for minimal development
• Hosted Stripe Checkout for a low-code integration
• Embedded Checkout
• Payment Element for greater customization
• Direct API integrations for specialized requirements

What Should You Check Before Using Stripe?

Before beginning an integration, confirm the following:

• Stripe supports businesses registered in your country or region.
• Your business activity is permitted under Stripe’s policies.
• The required payment methods are available for the account.
• Your website displays accurate business, product, refund, and contact information.
• You have an eligible bank account for payouts.
• The website uses HTTPS.
• You have a process for refunds, disputes, and customer service.
• The business understands the applicable Stripe fees and payout schedule.

Do not create an account using inaccurate company information or a business location that you cannot legitimately verify.

How to Install Stripe on WordPress with WooCommerce

WooCommerce websites can accept Stripe payments by installing a compatible Stripe payment extension.

The current WooCommerce Stripe extension supports account connection, webhook setup, payment-method configuration, and express checkout features.

Step 1: Install WooCommerce

1. Sign in to the WordPress administration area.
2. Go to Plugins > Add New Plugin.
3. Search for WooCommerce.
4. Install and activate the plugin.
5. Complete the initial store configuration.

During setup, check the following carefully:

• Business location
• Store currency
• Product type
• Tax settings
• Shipping settings

Step 2: Install the WooCommerce Stripe Extension

1. Open Plugins > Add New Plugin.
2. Search for the official or selected WooCommerce Stripe extension.
3. Confirm the plugin publisher and compatibility.
4. Install and activate the extension.

Before installing a third-party payment plugin, review:

• Publisher identity
• Recent updates
• Compatibility with the installed WooCommerce version
• Support documentation
• Security history

Step 3: Connect the Stripe Account

1. Go to WooCommerce > Settings > Payments.
2. Locate the Stripe payment method.
3. Select Complete setup or the corresponding connection option.
4. Sign in to Stripe.
5. Select an existing account or create an eligible account.
6. Approve the requested connection.

The official WooCommerce extension currently recommends connecting the Stripe account through its setup flow rather than requiring merchants to paste unrestricted secret keys manually.

Step 4: Configure Payment Methods

Open the Stripe payment settings and enable only the methods appropriate for your customers and account.

Depending on eligibility, these may include:

• Cards
• Apple Pay
• Google Pay
• Regional methods
• Installment or buy-now-pay-later options

WooCommerce provides a dedicated section for enabling additional Stripe payment methods.

Step 5: Configure Webhooks

Webhooks allow Stripe to notify WooCommerce about payment events, including asynchronous events that may happen after the customer leaves the checkout page.

Depending on the plugin and connection method, the webhook may be created automatically or require additional setup.

Check the plugin’s Stripe status or webhook page and confirm that:

• The endpoint is active.
• Recent events have been delivered successfully.
• The correct mode is being used.
• No signature or connection errors are reported.

Step 6: Enable Test Mode

Enable the testing or sandbox mode before accepting real payments.

Stripe provides test payment methods that allow developers and store administrators to simulate successful payments, authentication, declines, and other outcomes without moving real money.

A commonly used successful test card is:

Card number: 4242 4242 4242 4242
Expiry: Any valid future date
CVC: Any valid three-digit value
Postal code: Any valid test value when requested

The number above should be used only in Stripe’s testing environment.

Step 7: Test the Complete Order Flow

Do not test only whether the payment form opens.

Verify that:

• The correct product and amount appear.
• The correct currency is used.
• Successful payments create the expected WooCommerce order.
• Failed payments do not complete the order.
• Order emails are delivered correctly.
• Stock is updated correctly.
• Refunds work as expected.
• Webhook events are processed.
• Mobile checkout works correctly.

Step 8: Switch to Live Mode

Before enabling live payments:

• Complete Stripe account verification.
• Confirm the payout bank account.
• Disable testing mode.
• Confirm that live mode is connected.
• Complete simulated scenarios in the testing environment; do not use real payment details in live mode for testing.
• Verify the payment, WooCommerce order, webhook, email, refund, and payout records.

Other WordPress Stripe Integration Options

WooCommerce is not required for every website.

A standalone Stripe plugin may be more appropriate when the website only needs to:

• Collect service payments
• Sell a small number of items
• Accept donations
• Offer subscriptions
• Create payment forms without a complete shopping cart

Before choosing a plugin, compare:

• One-time and recurring payment support
• Webhook handling
• Supported payment methods
• Form customization
• Tax and invoice requirements
• Refund management
• Plugin maintenance and support

How to Integrate Stripe with a Custom PHP Website

Hosted Checkout can be a practical starting point for a custom PHP website. The example below demonstrates a test-only Session request, not a complete order-management implementation.

It requires PHP 8 or later and a compatible Stripe SDK. Configure the web root and Composer path for your deployment; keep secrets and private application files outside public access. Before production, add persistent orders, authorized checkout requests, suitable CSRF protection, and stored payment attempts.

The original implementation using:

https://checkout.stripe.com/checkout.js
stripeToken
StripeCharge::create()

should not be used for a new integration. Modern implementations should use Checkout Sessions or Payment Intents so they can support current payment flows and additional authentication.

Step 1: Create and Configure a Stripe Account

Create an eligible Stripe account and complete the required business verification.

Before accepting live payments, configure:

• Business information
• Bank account
• Customer support details
• Statement descriptor
• Branding
• Team access and authentication

Step 2: Install the Stripe PHP Library

Install the official Stripe PHP library through Composer:

composer require stripe/stripe-php

Composer is generally preferable to copying library files manually because it makes dependencies and updates easier to manage.

Step 3: Store the Secret Key Securely

Do not write a live secret key directly into a public PHP file.

Store sensitive configuration in an environment variable or another secure server-side configuration system.

Example environment variables:

STRIPE_SECRET_KEY=sk_test_replace_with_your_key
STRIPE_WEBHOOK_SECRET=whsec_replace_with_your_secret
APP_URL=https://example.com

Stripe states that publishable keys can be used in client-side applications, while secret keys must remain protected in the server environment. A leaked secret key should be rotated immediately.

Step 4: Create a Checkout Button

Create a form that sends a request to a server-side script.

<form action="/create-checkout-session.php" method="post">
    <input type="hidden" name="product_id" value="consulting-package">
    <button type="submit">Pay securely</button>
</form>

Do not allow the browser to submit the final price as a trusted value. The server should determine the product and price from a trusted database or configuration.

Step 5: Create a Checkout Session in PHP

<?php

declare(strict_types=1);

require __DIR__ . '/vendor/autoload.php';

use StripeStripeClient;

// Test-only demonstration; no production order storage is implemented here.

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    exit('Method not allowed');
}

$productId = $_POST['product_id'] ?? '';

$products = [
    'consulting-package' => [
        'name' => 'SEO Consulting Package',
        'amount' => 5000,
        'currency' => 'usd',
    ],
];

if (!isset($products[$productId])) {
    http_response_code(400);
    exit('Invalid product');
}

$secretKey = getenv('STRIPE_SECRET_KEY');
$appUrl = rtrim((string) getenv('APP_URL'), '/');

if (!$secretKey || !$appUrl) {
    error_log('Stripe environment variables are missing.');
    http_response_code(500);
    exit('Payment configuration error');
}

// Restrict this demonstration to test keys.
if (!str_starts_with($secretKey, 'sk_test_')) {
    http_response_code(500);
    exit('This example requires a test key.');
}

$stripe = new StripeClient($secretKey);
$product = $products[$productId];

try {
    $session = $stripe->checkout->sessions->create([
        'mode' => 'payment',

        'line_items' => [[
            'price_data' => [
                'currency' => $product['currency'],
                'product_data' => [
                    'name' => $product['name'],
                ],
                'unit_amount' => $product['amount'],
            ],
            'quantity' => 1,
        ]],

        'success_url' => $appUrl
            . '/payment-success.php?session_id={CHECKOUT_SESSION_ID}',

        'cancel_url' => $appUrl . '/payment-cancelled.php',

        'metadata' => [
            'product_id' => $productId,
        ],
    ]);

    if (!$session->url) {
        throw new RuntimeException('Stripe did not return a Checkout URL.');
    }

    header('Location: ' . $session->url, true, 303);
    exit;
} catch (Throwable $exception) {
    error_log('Stripe Checkout error: ' . $exception->getMessage());

    http_response_code(500);
    exit('Unable to start the payment. Please try again.');
}

This example uses a server-controlled USD demo amount: 5000 represents USD 50.00, not a quoted service price. It creates a test Session but does not record an order, reserve stock, or fulfill a purchase.

For production, create the internal order and a stable payment-attempt identifier first. Store the returned Session ID and use an idempotency key for retries of that same operation with unchanged parameters. A newly generated key on every retry does not prevent duplicate Session creation.

Step 6: Create a Webhook Endpoint

The success URL is not payment evidence. Use verified server-side information for order updates. The following is pseudocode describing application responsibilities, not a runnable PHP endpoint:

Receive the request without changing the raw body
Verify its Stripe signature using the endpoint signing secret
Reject invalid requests
Persist accepted events or place them in a durable queue
Acknowledge receipt only after durable acceptance
Process the event with retry and duplicate protection
Retrieve the relevant payment Session when needed
Match the order, Session, environment, amount and currency
Update eligible orders transactionally
Schedule fulfillment with an order-level duplicate guard

With the PHP SDK, signature verification can use StripeWebhook::constructEvent($payload, $signature, $webhookSecret). Configure the event format and API version to match the handler; CLI and Dashboard endpoints can have different signing secrets.

For one-time Checkout payments, account for completion and delayed-payment outcomes. Check payment status before releasing goods: a completed Session is not always a paid purchase. Subscription entitlements require their own invoice and subscription workflow.

A handler containing only comments followed by HTTP 200 does not implement order processing. It can acknowledge an event without preserving the work the business needs to perform.

Step 7: Make Webhook Processing Idempotent

Record event IDs to recognize repeated deliveries. Also enforce a business-level guard on the order or Checkout Session, since different events can lead to the same fulfillment action.

Use database constraints and transactions, or equivalent concurrency controls, so simultaneous workers cannot deliver twice. Events may arrive out of order; reconcile current state instead of assuming delivery order reflects the latest payment state.

Keep email delivery separate from the paid-order update. A failed email should be retried without collecting payment or granting the product again.

Step 8: Build the Success Page

The return page can ask the server for verified order status and show the appropriate next step. It must not accept a URL parameter as proof of payment.

Check that the visitor is entitled to view the order before displaying personal information. A Session ID alone should not be treated as account authorization.

Show an order reference, a pending or confirmed message based on verified data, and support information. Fulfillment must remain reliable when the customer never returns to this page.

When Should You Use the Payment Element Instead?

Use the Payment Element when you need a payment form embedded inside your own checkout page and require more control over the surrounding interface.

It may be suitable when:

• The payment form must remain inside a custom application.
• The checkout includes custom steps or live calculations.
• The user experience requires deeper visual integration.
• The application has an advanced order workflow.

The Payment Element securely collects payment information using Stripe.js and can be combined with Checkout Sessions or Payment Intents depending on the integration design.

Payment status is not delivery or payout status

Keep payment, fulfillment, refunds, and payouts distinguishable in the system. A paid order may still await delivery; an email failure does not make the payment unsuccessful; a payout groups funds moving to the bank rather than representing one customer order.

Example: a customer pays for a downloadable product and closes the browser immediately. The verified payment workflow should still make the purchase available through the authorized delivery process. Reopening the return page must not create a second entitlement.

Ask the developer to demonstrate that scenario in the testing environment and show the order record, payment reference, and delivery result.

Keep an acceptance record and a usable handover

• List the tested scenarios, expected outcomes, actual results, and unresolved issues.
• Record environment settings, endpoint ownership, required events, and compatible SDK or plugin versions without exposing secrets.
• Document how to investigate a paid-but-pending order, retry failed processing, and prevent duplicate delivery.
• Confirm refund permissions, account administration, monitoring responsibilities, and support contacts.

When changing credentials or payment configuration, verify that the live account, endpoint, and application settings match. Keep test data and live records clearly separated.

How to Test a Stripe Integration

A payment integration should be tested for more than successful card payments.

Successful Payment Tests

• Correct product
• Correct amount
• Correct currency
• Successful payment
• Order confirmation
• Webhook processing
• Confirmation email

Failure and Edge-Case Tests

• Declined payment
• Incorrect card information
• Additional authentication
• Customer closes Checkout
• Duplicate webhook event
• Delayed payment method
• Refund
• Partial refund where applicable
• Webhook endpoint unavailable temporarily
• Wrong amount or currency rejected by server checks

Stripe provides test payment methods for simulating different outcomes. Use the official testing documentation instead of using real card information in test mode.

Stripe Security Best Practices

1. Never Expose Secret Keys

Do not place a Stripe secret key in:

• HTML
• JavaScript
• A public Git repository
• A screenshot
• A downloadable configuration file
• A mobile application binary

2. Use HTTPS

The production website, webhook endpoints, success pages, and customer account pages should use valid HTTPS connections.

3. Verify Webhook Signatures

Do not trust a webhook body without verifying that Stripe generated the request.

4. Calculate Prices on the Server

Never trust the final amount submitted by the browser.

The server should retrieve or calculate:

• Product price
• Quantity limits
• Discount eligibility
• Tax
• Shipping
• Currency

5. Prevent Duplicate Processing

Protect order creation, webhook processing, refunds, and email delivery against duplicate requests.

6. Restrict Dashboard Access

• Give every team member a separate account.
• Use the minimum required permission level.
• Enable multi-factor authentication.
• Remove access when staff or vendors leave.

7. Do Not Log Sensitive Payment Data

Application logs should not contain full card details, secret keys, webhook secrets, or unnecessary personal information.

8. Validate Order Data

Before fulfilling an order, confirm:

• Expected product
• Expected amount
• Expected currency
• Payment status
• Customer and order reference
• Whether the event was already processed

Stripe Subscriptions and Recurring Payments

Stripe can support recurring billing for businesses such as:

• Software platforms
• Membership websites
• Online education
• Maintenance services
• Digital publications
• Managed hosting

A subscription integration should consider:

• Plan and price management
• Free trials
• Failed-payment recovery
• Subscription cancellation
• Upgrades and downgrades
• Prorations
• Invoices
• Tax
• Customer self-service
• Webhook events

Do not create subscriptions by repeatedly charging a card through a scheduled PHP script. Use Stripe Billing and subscription objects designed for recurring payment lifecycles.

Common Stripe Integration Mistakes

• Using legacy checkout.js examples
• Creating direct legacy charges for a new integration
• Exposing secret API keys
• Trusting prices submitted by the browser
• Confirming orders only from the success page
• Not verifying webhook signatures
• Processing duplicate webhook events more than once
• Using test keys in production
• Using live keys in a development environment
• Not testing failed payments or authentication
• Ignoring refund and dispute processes
• Assuming every payment method is available in every country
• Installing an abandoned or unofficial WordPress payment plugin
• Giving developers unrestricted permanent Stripe access

Frequently Asked Questions About Stripe

Professional Stripe Integration for WordPress and Custom Websites

Stripe provides flexible options for online stores, service websites, SaaS platforms, membership systems, mobile applications, and custom digital products.

The appropriate integration depends on:

• Business location
• Payment methods
• One-time or recurring billing
• Website platform
• Checkout customization
• Tax and invoice requirements
• Order-management workflow
• Available development resources

For many new custom websites, Stripe Checkout provides a strong starting point. Businesses requiring a deeply customized payment interface may use the Payment Element and a suitable server-side payment flow.

For WordPress, a maintained WooCommerce Stripe extension or another reputable payment plugin can reduce custom development work.

Businesses seeking professional web design services in Vietnam should plan the payment workflow before development begins. Early planning helps ensure that products, prices, orders, webhooks, customer emails, refunds, subscriptions, and security requirements are implemented consistently.

Conclusion

Stripe is a flexible payment platform, but a reliable integration requires more than placing a payment button on a page.

A production-ready Stripe system should:

• Use a current integration such as Checkout Sessions or Payment Intents.
• Keep secret keys on the server.
• Calculate prices from trusted server-side data.
• Verify webhook signatures.
• Prevent duplicate order fulfillment.
• Test successful and unsuccessful payment scenarios.
• Separate test and live environments.
• Protect account access.
• Include processes for refunds, disputes, and customer support.

Choosing the correct integration method from the beginning helps create a payment system that is easier to maintain, safer for customers, and more suitable for future business growth.

Official implementation references

• Stripe account availability
• Checkout fulfillment
• Webhook handling
• Stripe testing
• WooCommerce Stripe setup and configuration