09 Settings – Payment Gateways from Teach Me WordPress on Vimeo.

Blue Pay

Getting the right account details from BluePay

Authorize.Net AIM / CIM

This is the newest Authorize.net gateway to be integrated into our Gold Cart. The new API supports the customer information manager (CIM) see here for more information (you must have CIM supported with your Authorize.net account before you can use this service)

Setting up your Gateway:

There are two things from authorize.net you will need before you can set this up, an API Login ID and a Transaction key follow the direction below to obtain these then your ready to set up this gateway in wp-e-commerce!

To obtain your API Login ID:

• Log into the Merchant Interface at https://secure.authorize.net
• Select Settings under Account in the main menu on the left
• Click API Login ID and Transaction Key in the Security Settings section
• If you have not already obtained an API Login ID and Transaction Key for your account, you will need to enter the secret answer to the secret question you configured at account activation.
• Click Submit.
• The API Login ID for your account is displayed on the API Login ID and Transaction Key page.

To obtain a Transaction Key:

• Log on to the Merchant Interface at https://secure.authorize.net
• Select Settings under Account in the main menu on the left
• Click API Login ID and Transaction Key in the Security Settings section
• Enter the secret answer to the secret question you configured when you activated your user account
• Click Submit
• The Transaction Key for your account is displayed on a confirmation page.

IMPORTANT: Be sure to record your Transaction Key immediately in a secure manner or copy it immediately to a file in a secure location because it is not always visible in the Merchant Interface like the API Login ID. Once you navigate away from the confirmation page there will be no other way to access the Transaction Key in the Merchant Interface. You would have to generate a new Transaction Key.

• Go to the payments section in your WP-e-Commerce store settings (Settings > store >payments)
• Select the Authorize.net AIM/CIM gateway – if you have previously been using Authorize.net 2.0 you will want to deselect that gateway and use this new one.
• Click the edit link and fill in your gateway details
  
• Display Name – This is the name that will appear on your checkout page if you’re using more than one payment gateway
• API Login ID – The API Login ID is a complex value that is at least eight characters in length, includes uppercase and lowercase letters, numbers, and/or symbols and identifies your account to the payment gateway. It is not the same as your login ID for logging into the Merchant Interface
  You can obtain this from within your Authorize.net account (see directions above)
• Transaction Key – The Transaction Key is a 16-character alphanumeric value that is randomly generated in the Merchant Interface and works in conjunction with your API Login ID to authenticate you as an authorized user of the Authorize.Net Payment Gateway when submitting transactions from your Web site.
  You can obtain this from within your Authorize.net account (see directions above)
• Test Mode – Only select this option if your account is in test mode, if your account is not in test mode with Authorize.net and you have this option select the checkout page will fail. At the same time if your account with Authorize.net is in test mode and you don’t select this option then its going to fail
  See here for a good explanation of how the test accounts work
• Enable CIM – CIM allows you to store your customers’ sensitive payment information on Authorize.nets secure servers, simplifying payments for returning customers and recurring transactions. It can also help you comply with the Payment Card Industry (PCI) Data Security Standard, since customer data is no longer stored locally.If you want to enable the Customer Management System then select this box -you must have this feature enabled on your account click here for more information.
  If you select this option then a new menu will be added to the “my Account” page it would also be a good idea to make sure your users are registered to your site before they buy from your shop. You can enable this option in the checkout settings.
  Users can also choose to have their credit card numbers remembered – next time they are logged into your store they can checkout using and existing card number. This provides a quicker checkout process for your buyers – without taking the risk of storing their credit card numbers on your site!
• Verify First, Capture Later - By enabling this option you are not charging the buyers credit card right away at checkout, instead the buyers details are captured and you must go into your authorize.net account to charge the transaction. The biggest benefit of this is if your shop is out of stock on a product the buyer wont be charged for the products until it has been shipped to them. The downside of this is all payment will return to spec as “order received” until the merchant approves the sale – this is not advised for downloadable products.
• Save these details your gateway is now set up.

Introduction

Now that you are an actual business man/woman, you really can’t afford to have your site get hacked. After all, it’s not just you they’re screwing with anymore, you are actually responsible for protecting other people’s information (sucks being a adult doesn’t it?). If your site gets hacked, your e-commerce reputation can be seriously damaged, and people won’t buy from you any more! Your store will go out of business. You will be destitute, thrown out on the streets, an outcast to all… ok maybe we are exaggerating a wee bit. But seriously, you do not want your store to be hacked.

Luckily, there are steps you can take to prevent this!

Get an SSL Certificate

Depending on your payment gateway, you may not technically need an SSL Certificate, but we STRONGLY recommend you get one from your hosting company anyway. An SSL Certificate is a digital certificate that authenticates the identity of a Web site to visiting browsers and encrypts information for the server via Secure Sockets Layer (SSL) technology. In other words, it pretty much builds an impenetrable fortress around your website. Depending on your hosting company, a Standard SSL Certificate (which is all you need) will probably run you around $30 a year.

Once you get an SSL certificate, you will want to make sure your site knows it’s now secure. To do this, go to Store > Settings > Admin and change all of the URL settings to display “https” instead of “http”.

Be Password Savvy

Some vulnerabilities can be avoided by good security habits. An important element of this are passwords: do not use your own name for your password, do not use a dictionary word (from any language) for your password, do not use a 4 character string of numbers as your password. Your goal with your password is to make the search space as large as possible, so using numbers and varying capitalization all make it more difficult, statistically, to brute force a password. This is particularly important if you do not rename the administrator account. In that case half the puzzle is already solved for malicious users as they know what username will give them significant privileges to edit files and databases. The Automatic Password Generator can be helpful in generating reasonably complex passwords.

Hide Your Plugins

Be sure to hide anything that will give away what WordPress plugins you’re using and what version they are. It is easy for evil-doers to track down known vulnerabilities in older plugin versions, and if they can see what plugins are running on your site. Add blank index.html files to directories you want to protect, or add this to your .htaccess file: Options All -Indexes

Note: Before making ANY CHANGES to your .htaccess file, make sure you save a copy of it, in case you screw things up. The .htaccess file is very mysterious and powerful, and can easily kill your site if you don’t know what you are doing.

Install Security Plugins

WP Security Scan Plugin – helps tremendously when it comes to protecting your WordPress installation. However, you still need to maintain good passwords, check plugins and themes before installing them, and keep good backups of your files and database in the event that you do get hacked.

Admin-SSL plugin – If you have an SSL certificate (which we STRONGLY recommend) you can secure and encrypt all of your communication and important WordPress cookies using this plugin. It works with both Private and Shared SSL.

Security Through Obscurity

Rename the WordPress administrative account: You can do this in the MySQL command-line client with a command like

update tableprefix_users set user_login=’newuser’ where user_login=’admin’;,

Or you can do it using a MySQL frontend like phpMyAdmin.

Updates, Updates, Updates

Keep your WordPress install and all of your other plugins updated as much as possible. Staying on the leading edge of updates keeps your store from becoming vulnerable to known security vulnerabilities.

Restrict Admin Access

If you’re a single person shop, you should consider restricting your wp-admin directory to your IP address. Make sure your IP address doesn’t change before doing this. Edit your .htaccess file in your wp-admin directory and add:

Order deny,allow
Allow from 111.111.111.111 # Replace with your IP address
Deny from all

Step #6 – Logging

It is possible to log all $POST variables sent to WordPress. Standard Apache logs do not offer much help with dealing with security forensics.

Mod_Security – Logs and Prevents using Apache

Postlogger is a plugin that logs using WordPress

Step #7 – Read the Following Articles

Security and Hacking: Protect Thyself and Thy WordPress Blog

10 Steps To Protect The Admin Area In WordPress

Hardening WordPress

For Goodness’ Sake BACKUP EVERYTHING

Backup your data regularly, including your MySQL databases. Data integrity is critical for trusted backups. Encrypting the backup, keeping an independent record of MD5 hashes for each backup file, and/or placing backups on read-only media (such as CD-R) increases your confidence that your data has not been tampered with.