What is Stripe? Installing Stripe on WordPress and Custom-Coded Websites

What Is Stripe?

Stripe is a financial technology platform that helps businesses accept and manage payments online. It provides payment infrastructure, APIs, hosted checkout pages, billing tools, fraud-prevention features, reporting, and other services for websites, mobile applications, subscription platforms, and online marketplaces.

Depending on the business location, customer location, currency, and account eligibility, Stripe may support payment methods such as:

• Credit and debit cards
• Apple Pay
• Google Pay
• Bank transfers and bank debits
• Buy now, pay later methods
• Regional payment methods

Stripe can be used for several business models, including:

• One-time online payments
• Recurring subscriptions
• Usage-based billing
• Online marketplaces
• Software-as-a-Service platforms
• Invoices and payment links
• In-person payments through supported hardware

Businesses should confirm that Stripe supports account registration in their country or region before planning the integration. Once a business operates through a supported Stripe account, it may be able to accept payments from customers in many other markets.

How Does Stripe Work?

Stripe connects the website or application with payment methods, banks, card networks, and other financial systems involved in processing a transaction.

A typical online payment flow includes the following steps:

1. The customer selects a product, service, or subscription.
2. The website creates a payment session or payment request on the server.
3. The customer securely enters payment information through a Stripe interface.
4. Stripe submits the payment for authorization.
5. The customer may be asked to complete additional authentication.
6. Stripe reports the payment status to the website.
7. The website confirms the order after receiving a verified payment event.

Modern Stripe integrations generally use Checkout Sessions or Payment Intents rather than directly creating a legacy card charge. A PaymentIntent tracks a payment through its lifecycle and supports status changes and additional authentication when required.

Main Stripe Products for Online Payments

1. Stripe Checkout

Stripe Checkout is a prebuilt payment page that can be hosted by Stripe or embedded into a website.

It can support:

• One-time payments
• Subscriptions
• Multiple payment methods
• Discount codes
• Tax collection
• Shipping information
• Customer information

Stripe Checkout uses the Checkout Sessions API and is usually the easiest integration method for businesses that want a secure and professionally maintained payment interface without building the entire form themselves.

2. Stripe Payment Element

The Payment Element is a secure, embeddable payment component for websites that require greater control over the checkout layout and customer experience.

It can display available payment methods dynamically according to factors such as:

• Currency
• Customer location
• Stripe account configuration
• Payment-method eligibility

The Payment Element can support more than 100 payment methods through a single UI integration, although the methods available to a particular business vary.

3. Stripe Payment Links

Stripe Payment Links allow a business to create a hosted payment page without building a custom checkout system.

This option may be suitable for:

• Simple service payments
• Event registrations
• Donation campaigns
• Product pre-orders
• Payment links sent through email or chat

4. Stripe Billing

Stripe Billing provides tools for recurring payments and subscription management.

Possible billing models include:

• Monthly subscriptions
• Annual subscriptions
• Tiered pricing
• Usage-based billing
• Free trials
• Subscription upgrades and downgrades

Stripe provides a Checkout-based quickstart for businesses implementing subscription payment pages.

5. Stripe Radar

Stripe Radar helps identify and manage potentially fraudulent transactions.

Fraud-prevention tools can reduce risk, but businesses still need appropriate internal processes for order verification, refunds, disputes, account security, and customer support.

Benefits of Using Stripe

1. Developer-Friendly Integration

Stripe provides official APIs and software libraries for languages and platforms such as:

• PHP
• Node.js
• Python
• Java
• .NET
• Ruby
• Go

Developers can choose between low-code hosted checkout pages and more advanced custom payment flows.

2. Secure Payment Components

Stripe Checkout and Stripe Elements allow sensitive payment information to be collected through Stripe-managed components rather than passing raw card data through the business’s own server.

Stripe is certified as a PCI Level 1 service provider. However, PCI compliance remains a shared responsibility, and every business must still follow the requirements applicable to its own integration and operations.

3. Support for Additional Authentication

Stripe supports payment flows that may require additional customer authentication, including 3D Secure.

Using modern Checkout Sessions or Payment Intents helps the integration respond correctly when authentication is required.

4. Responsive Checkout Experience

Stripe’s prebuilt payment interfaces are designed to work across desktop and mobile devices.

This can reduce the design and development work required to maintain a secure payment form.

5. Payment and Business Reporting

The Stripe Dashboard can help businesses review:

• Payments
• Refunds
• Disputes
• Customers
• Subscriptions
• Payouts
• Revenue data
• Payment failures

6. Multiple Integration Options

A business can choose the implementation method that matches its technical capabilities:

• Payment Links for minimal development
• Hosted Stripe Checkout for a low-code integration
• Embedded Checkout
• Payment Element for greater customization
• Direct API integrations for specialized requirements

What Should You Check Before Using Stripe?

Before beginning an integration, confirm the following:

• Stripe supports businesses registered in your country or region.
• Your business activity is permitted under Stripe’s policies.
• The required payment methods are available for the account.
• Your website displays accurate business, product, refund, and contact information.
• You have an eligible bank account for payouts.
• The website uses HTTPS.
• You have a process for refunds, disputes, and customer service.
• The business understands the applicable Stripe fees and payout schedule.

Do not create an account using inaccurate company information or a business location that you cannot legitimately verify.

How to Install Stripe on WordPress with WooCommerce

WooCommerce websites can accept Stripe payments by installing a compatible Stripe payment extension.

The current WooCommerce Stripe extension supports account connection, webhook setup, payment-method configuration, and express checkout features.

Step 1: Install WooCommerce

1. Sign in to the WordPress administration area.
2. Go to Plugins > Add New Plugin.
3. Search for WooCommerce.
4. Install and activate the plugin.
5. Complete the initial store configuration.

During setup, check the following carefully:

• Business location
• Store currency
• Product type
• Tax settings
• Shipping settings

Step 2: Install the WooCommerce Stripe Extension

1. Open Plugins > Add New Plugin.
2. Search for the official or selected WooCommerce Stripe extension.
3. Confirm the plugin publisher and compatibility.
4. Install and activate the extension.

Before installing a third-party payment plugin, review:

• Publisher identity
• Recent updates
• Compatibility with the installed WooCommerce version
• Support documentation
• Security history

Step 3: Connect the Stripe Account

1. Go to WooCommerce > Settings > Payments.
2. Locate the Stripe payment method.
3. Select Complete setup or the corresponding connection option.
4. Sign in to Stripe.
5. Select an existing account or create an eligible account.
6. Approve the requested connection.

The official WooCommerce extension currently recommends connecting the Stripe account through its setup flow rather than requiring merchants to paste unrestricted secret keys manually.

Step 4: Configure Payment Methods

Open the Stripe payment settings and enable only the methods appropriate for your customers and account.

Depending on eligibility, these may include:

• Cards
• Apple Pay
• Google Pay
• Regional methods
• Installment or buy-now-pay-later options

WooCommerce provides a dedicated section for enabling additional Stripe payment methods.

Step 5: Configure Webhooks

Webhooks allow Stripe to notify WooCommerce about payment events, including asynchronous events that may happen after the customer leaves the checkout page.

Depending on the plugin and connection method, the webhook may be created automatically or require additional setup.

Check the plugin’s Stripe status or webhook page and confirm that:

• The endpoint is active.
• Recent events have been delivered successfully.
• The correct mode is being used.
• No signature or connection errors are reported.

Step 6: Enable Test Mode

Enable the testing or sandbox mode before accepting real payments.

Stripe provides test payment methods that allow developers and store administrators to simulate successful payments, authentication, declines, and other outcomes without moving real money.

A commonly used successful test card is:

Card number: 4242 4242 4242 4242
Expiry: Any valid future date
CVC: Any valid three-digit value
Postal code: Any valid test value when requested

The number above should be used only in Stripe’s testing environment.

Step 7: Test the Complete Order Flow

Do not test only whether the payment form opens.

Verify that:

• The correct product and amount appear.
• The correct currency is used.
• Successful payments create the expected WooCommerce order.
• Failed payments do not complete the order.
• Order emails are delivered correctly.
• Stock is updated correctly.
• Refunds work as expected.
• Webhook events are processed.
• Mobile checkout works correctly.

Step 8: Switch to Live Mode

Before enabling live payments:

• Complete Stripe account verification.
• Confirm the payout bank account.
• Disable testing mode.
• Confirm that live mode is connected.
• Place a small real transaction.
• Verify the payment, WooCommerce order, webhook, email, refund, and payout records.

Other WordPress Stripe Integration Options

WooCommerce is not required for every website.

A standalone Stripe plugin may be more appropriate when the website only needs to:

• Collect service payments
• Sell a small number of items
• Accept donations
• Offer subscriptions
• Create payment forms without a complete shopping cart

Before choosing a plugin, compare:

• One-time and recurring payment support
• Webhook handling
• Supported payment methods
• Form customization
• Tax and invoice requirements
• Refund management
• Plugin maintenance and support

How to Integrate Stripe with a Custom PHP Website

For a custom PHP website, the recommended starting point for many simple payment flows is Stripe Checkout.

The original implementation using:

https://checkout.stripe.com/checkout.js
stripeToken
StripeCharge::create()

should not be used for a new integration. Modern implementations should use Checkout Sessions or Payment Intents so they can support current payment flows and additional authentication.

Step 1: Create and Configure a Stripe Account

Create an eligible Stripe account and complete the required business verification.

Before accepting live payments, configure:

• Business information
• Bank account
• Customer support details
• Statement descriptor
• Branding
• Team access and authentication

Step 2: Install the Stripe PHP Library

Install the official Stripe PHP library through Composer:

composer require stripe/stripe-php

Composer is generally preferable to copying library files manually because it makes dependencies and updates easier to manage.

Step 3: Store the Secret Key Securely

Do not write a live secret key directly into a public PHP file.

Store sensitive configuration in an environment variable or another secure server-side configuration system.

Example environment variables:

STRIPE_SECRET_KEY=sk_test_replace_with_your_key
STRIPE_WEBHOOK_SECRET=whsec_replace_with_your_secret
APP_URL=https://example.com

Stripe states that publishable keys can be used in client-side applications, while secret keys must remain protected in the server environment. A leaked secret key should be rotated immediately.

Step 4: Create a Checkout Button

Create a form that sends a request to a server-side script.

<form action="/create-checkout-session.php" method="post">
    <input type="hidden" name="product_id" value="consulting-package">
    <button type="submit">Pay securely</button>
</form>

Do not allow the browser to submit the final price as a trusted value. The server should determine the product and price from a trusted database or configuration.

Step 5: Create a Checkout Session in PHP

<?php

declare(strict_types=1);

require __DIR__ . '/vendor/autoload.php';

use StripeStripeClient;

session_start();

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    exit('Method not allowed');
}

$productId = $_POST['product_id'] ?? '';

$products = [
    'consulting-package' => [
        'name' => 'SEO Consulting Package',
        'amount' => 5000,
        'currency' => 'usd',
    ],
];

if (!isset($products[$productId])) {
    http_response_code(400);
    exit('Invalid product');
}

$secretKey = getenv('STRIPE_SECRET_KEY');
$appUrl = rtrim((string) getenv('APP_URL'), '/');

if (!$secretKey || !$appUrl) {
    error_log('Stripe environment variables are missing.');
    http_response_code(500);
    exit('Payment configuration error');
}

$stripe = new StripeClient($secretKey);
$product = $products[$productId];

try {
    $session = $stripe->checkout->sessions->create([
        'mode' => 'payment',

        'line_items' => [[
            'price_data' => [
                'currency' => $product['currency'],
                'product_data' => [
                    'name' => $product['name'],
                ],
                'unit_amount' => $product['amount'],
            ],
            'quantity' => 1,
        ]],

        'success_url' => $appUrl
            . '/payment-success.php?session_id={CHECKOUT_SESSION_ID}',

        'cancel_url' => $appUrl . '/payment-cancelled.php',

        'metadata' => [
            'product_id' => $productId,
        ],
    ]);

    if (!$session->url) {
        throw new RuntimeException('Stripe did not return a Checkout URL.');
    }

    header('Location: ' . $session->url, true, 303);
    exit;
} catch (Throwable $exception) {
    error_log('Stripe Checkout error: ' . $exception->getMessage());

    http_response_code(500);
    exit('Unable to start the payment. Please try again.');
}

The server creates the Checkout Session and redirects the customer to the URL returned by Stripe. This follows Stripe’s current hosted Checkout model.

Step 6: Create a Webhook Endpoint

Do not mark an order as paid only because the customer reaches the success page.

The customer can close the browser, lose the connection, modify a URL, or return to the website before every asynchronous process is complete.

Use a verified webhook event to update the order.

<?php

declare(strict_types=1);

require __DIR__ . '/vendor/autoload.php';

use StripeExceptionSignatureVerificationException;
use StripeWebhook;

$webhookSecret = getenv('STRIPE_WEBHOOK_SECRET');

if (!$webhookSecret) {
    error_log('Stripe webhook secret is missing.');
    http_response_code(500);
    exit;
}

$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_STRIPE_SIGNATURE'] ?? '';

if ($payload === false || $signature === '') {
    http_response_code(400);
    exit;
}

try {
    $event = Webhook::constructEvent(
        $payload,
        $signature,
        $webhookSecret
    );
} catch (UnexpectedValueException $exception) {
    http_response_code(400);
    exit;
} catch (SignatureVerificationException $exception) {
    http_response_code(400);
    exit;
}

switch ($event->type) {
    case 'checkout.session.completed':
        $session = $event->data->object;

        /*
         * Locate the internal order using metadata,
         * client_reference_id, or another trusted identifier.
         *
         * Confirm that:
         * - the event has not been processed before;
         * - the expected currency matches;
         * - the expected amount matches;
         * - the payment status is acceptable.
         *
         * Then update the order in an idempotent transaction.
         */

        break;

    case 'checkout.session.async_payment_succeeded':
        // Handle delayed payment methods if they are enabled.
        break;

    case 'checkout.session.async_payment_failed':
        // Mark the pending order as unpaid or request another method.
        break;

    default:
        // Ignore events that this endpoint does not use.
        break;
}

http_response_code(200);

Stripe recommends verifying the webhook by using the raw request body, the `Stripe-Signature` header, and the endpoint signing secret.

Step 7: Make Webhook Processing Idempotent

A webhook endpoint should be able to receive the same event more than once without duplicating an order, sending duplicate email, or providing the purchased service twice.

Store the Stripe event ID or payment-session ID and check whether it has already been processed.

Step 8: Build the Success Page

The success page may retrieve the Checkout Session by its ID and display a confirmation message.

However, it should not be the only component responsible for fulfilling the order.

A suitable success page may display:

• Order reference
• Payment status
• Customer email
• Next steps
• Support information

When Should You Use the Payment Element Instead?

Use the Payment Element when you need a payment form embedded inside your own checkout page and require more control over the surrounding interface.

It may be suitable when:

• The payment form must remain inside a custom application.
• The checkout includes custom steps or live calculations.
• The user experience requires deeper visual integration.
• The application has an advanced order workflow.

The Payment Element securely collects payment information using Stripe.js and can be combined with Checkout Sessions or Payment Intents depending on the integration design.

How to Test a Stripe Integration

A payment integration should be tested for more than successful card payments.

Successful Payment Tests

• Correct product
• Correct amount
• Correct currency
• Successful payment
• Order confirmation
• Webhook processing
• Confirmation email

Failure and Edge-Case Tests

• Declined payment
• Incorrect card information
• Additional authentication
• Customer closes Checkout
• Duplicate webhook event
• Delayed payment method
• Refund
• Partial refund where applicable
• Webhook endpoint unavailable temporarily
• Wrong amount or currency rejected by server checks

Stripe provides test payment methods for simulating different outcomes. Use the official testing documentation instead of using real card information in test mode.

Stripe Security Best Practices

1. Never Expose Secret Keys

Do not place a Stripe secret key in:

• HTML
• JavaScript
• A public Git repository
• A screenshot
• A downloadable configuration file
• A mobile application binary

2. Use HTTPS

The production website, webhook endpoints, success pages, and customer account pages should use valid HTTPS connections.

3. Verify Webhook Signatures

Do not trust a webhook body without verifying that Stripe generated the request.

4. Calculate Prices on the Server

Never trust the final amount submitted by the browser.

The server should retrieve or calculate:

• Product price
• Quantity limits
• Discount eligibility
• Tax
• Shipping
• Currency

5. Prevent Duplicate Processing

Protect order creation, webhook processing, refunds, and email delivery against duplicate requests.

6. Restrict Dashboard Access

• Give every team member a separate account.
• Use the minimum required permission level.
• Enable multi-factor authentication.
• Remove access when staff or vendors leave.

7. Do Not Log Sensitive Payment Data

Application logs should not contain full card details, secret keys, webhook secrets, or unnecessary personal information.

8. Validate Order Data

Before fulfilling an order, confirm:

• Expected product
• Expected amount
• Expected currency
• Payment status
• Customer and order reference
• Whether the event was already processed

Stripe Subscriptions and Recurring Payments

Stripe can support recurring billing for businesses such as:

• Software platforms
• Membership websites
• Online education
• Maintenance services
• Digital publications
• Managed hosting

A subscription integration should consider:

• Plan and price management
• Free trials
• Failed-payment recovery
• Subscription cancellation
• Upgrades and downgrades
• Prorations
• Invoices
• Tax
• Customer self-service
• Webhook events

Do not create subscriptions by repeatedly charging a card through a scheduled PHP script. Use Stripe Billing and subscription objects designed for recurring payment lifecycles.

Common Stripe Integration Mistakes

• Using deprecated `checkout.js` examples
• Creating direct legacy charges for a new integration
• Exposing secret API keys
• Trusting prices submitted by the browser
• Confirming orders only from the success page
• Not verifying webhook signatures
• Processing duplicate webhook events more than once
• Using test keys in production
• Using live keys in a development environment
• Not testing failed payments or authentication
• Ignoring refund and dispute processes
• Assuming every payment method is available in every country
• Installing an abandoned or unofficial WordPress payment plugin
• Giving developers unrestricted permanent Stripe access

Frequently Asked Questions About Stripe

Professional Stripe Integration for WordPress and Custom Websites

Stripe provides flexible options for online stores, service websites, SaaS platforms, membership systems, mobile applications, and custom digital products.

The appropriate integration depends on:

• Business location
• Payment methods
• One-time or recurring billing
• Website platform
• Checkout customization
• Tax and invoice requirements
• Order-management workflow
• Available development resources

For many new custom websites, Stripe Checkout provides a strong starting point. Businesses requiring a deeply customized payment interface may use the Payment Element and a suitable server-side payment flow.

For WordPress, a maintained WooCommerce Stripe extension or another reputable payment plugin can reduce custom development work.

Businesses seeking professional web design services in Vietnam should plan the payment workflow before development begins. Early planning helps ensure that products, prices, orders, webhooks, customer emails, refunds, subscriptions, and security requirements are implemented consistently.

Conclusion

Stripe is a flexible payment platform, but a reliable integration requires more than placing a payment button on a page.

A production-ready Stripe system should:

• Use a current integration such as Checkout Sessions or Payment Intents.
• Keep secret keys on the server.
• Calculate prices from trusted server-side data.
• Verify webhook signatures.
• Prevent duplicate order fulfillment.
• Test successful and unsuccessful payment scenarios.
• Separate test and live environments.
• Protect account access.
• Include processes for refunds, disputes, and customer support.

Choosing the correct integration method from the beginning helps create a payment system that is easier to maintain, safer for customers, and more suitable for future business growth.