---
url: /cashfree-acellemail/features/security.md
description: >-
  How the Cashfree gateways for AcelleMail keep payments trustworthy —
  signature-verified webhooks, server-side outcome confirmation, admin-gated
  settings, an open-redirect guard, no error leakage, and license plus
  plugin-state gating.
---

# Security

The Cashfree plugin enforces server-side verification for all transactions. Payment outcomes are confirmed directly with Cashfree, incoming webhooks are cryptographically signed, and gateways enforce strict state gating.

## Signature-verified webhooks

Cashfree notifies AcelleMail by calling `https://YOUR_DOMAIN/cashier/cashfree/webhooks`. Every webhook is **signature-verified** before it is acted on:

* Verifies with the **endpoint-specific Webhook Secret** if set, otherwise **falls back to your Secret Key**.
* Verified events are **de-duplicated** — the plugin's idempotent, already-settled guard ensures a retry never double-processes an order or subscription.

A webhook whose signature doesn't check out is rejected. Set up your endpoint via [Configure webhooks](/cashfree-acellemail/guides/configure-webhooks).

## Server-side outcome only

The plugin **never trusts the browser** to determine payment outcomes:

* **Order re-fetch:** Queries Cashfree directly upon customer return to verify authoritative status.
* **Signed webhook:** Awaits background confirmation via verified webhook payloads (see [Direct Payment](/cashfree-acellemail/features/direct-payment)).
* **Tamper resistance:** Manipulated query parameters or forged return URLs cannot mark an invoice as paid.

## Admin-gated settings

The Plugin Settings page (which renders your Secret Key) **requires an admin login**. Your credentials are not exposed to non-admins or to customers at checkout.

## Open-redirect guard

The customer return URL is constrained to your **same host / relative paths only**, so a crafted return link cannot bounce a customer to an attacker-controlled site after payment.

## No error leakage

Internal errors are **logged for you, never shown to the customer**. Shoppers see a short, safe message; the diagnostic detail stays in the AcelleMail log. See [Errors](/cashfree-acellemail/errors).

## License and plugin-state gating

Two switches keep the gateways from running when they shouldn't:

| Switch | Effect |
| --- | --- |
| **License gating** | While the license is not **Active**, payment processing is disabled and the gateways don't appear. See [Licensing](/cashfree-acellemail/licensing) |
| **Plugin-state gating** | Deactivating the plugin removes both gateways from **Admin → Payment Gateways**; reactivating restores them. See [Uninstalling](/cashfree-acellemail/uninstalling) |

## Related pages

* [Configure webhooks](/cashfree-acellemail/guides/configure-webhooks) — endpoint, version and IPs
* [Direct Payment](/cashfree-acellemail/features/direct-payment) · [Subscriptions](/cashfree-acellemail/features/subscriptions)
* [Licensing](/cashfree-acellemail/licensing) — how gating works
* [Settings reference](/cashfree-acellemail/settings) · [Errors](/cashfree-acellemail/errors)
* [Troubleshooting](/cashfree-acellemail/troubleshooting)