Security

The Razorpay integration enforces a multi-layer security model to protect payment integrity, API credentials, and gateway availability.

Every event is signature-verified

Razorpay signs the messages it sends back; the plugin verifies each with HMAC-SHA256 before acting:

Message	What it is
Payment callbacks	The one-time result after checkout.
Subscription callbacks	Recurring-charge results.
Webhooks	The events Razorpay posts to your site.

Unsigned or altered messages fail verification immediately. Forged webhooks and replayed callback URLs are rejected before invoice state can change.

HMAC signature verification

HMAC signatures create cryptographic digests combining payload contents and your shared secret. A verified signature guarantees origin authenticity and payload integrity.

Outcomes are confirmed server-side

The plugin queries Razorpay's API server-to-server to confirm payment status before marking invoices paid. Client-side browser payloads are never trusted in isolation.

The settings page is admin-gated

Plugin settings are restricted to authenticated administrators. The API Key Secret is masked as a password field and is never transmitted to customer-facing client code.

License and plugin-state gating

Gate	Effect
License gating	Processing is disabled while the license is inactive. Until the key is Active, neither gateway appears in Admin → Payment Gateways. The check is a local background check against relyweb.co — brief outages tolerated, re-saving Settings restores it.
Plugin-state gating	Deactivating the plugin removes both gateways; reactivating restores them. When off, there is no live payment path.

Lapsed licenses or deactivated plugins immediately halt payment processing.

Related pages

• Direct Payment — one-time payment verification
• Subscriptions — mandate and renewal verification
• Configure webhooks — set the Webhook Secret to verify events
• Licensing — how license gating works
• Settings — where the Key Secret and Webhook Secret live