What an open source payment gateway is
An open source payment gateway is software you can download, inspect, and modify yourself instead of renting it from a company. The source code—the instructions that make it run—is publicly available. You host it on your own server, connect it to your bank or payment processor, and handle transactions through your own infrastructure rather than through someone else's platform.
The trade-off is straightforward: you pay less in monthly fees, but you become responsible for security updates, server maintenance, and technical support. A company-run gateway like Stripe or Square handles all of that for you and charges a percentage of each transaction. An open source gateway like WooCommerce Payments or Magento puts the work on you.
Open source does not mean free. You still pay to host the software on a server, you still pay transaction fees to your payment processor, and you pay for any custom development or security audits you need. What you avoid is paying a middleman to run the platform itself.
Key Takeaways
- Open source payment gateways let you host and control the software yourself, which lowers platform fees but requires technical staff to maintain security and updates.
- You still pay transaction fees to your bank or processor, plus server hosting costs, so the total cost depends on your transaction volume and technical capacity.
- Popular open source options include WooCommerce, Magento, and Drupal Commerce, each designed for different business sizes and technical skill levels.
- Security is your responsibility: you must apply patches, monitor for vulnerabilities, and maintain PCI DSS compliance on your own infrastructure.
- Open source gateways work best for businesses with in-house technical teams or the budget to hire developers; small businesses usually save money with a hosted solution.
How open source gateways connect to your bank
An open source gateway does not process payments itself. It collects payment information from your customer, encrypts it, and sends it to a payment processor—usually your bank, Stripe, Square, or another intermediary. The processor handles the actual transfer of money and returns a confirmation to your gateway.
You choose which processor to connect to. Some open source gateways come with built-in connectors for popular processors; others require custom integration. WooCommerce, for example, has direct integrations with Stripe, PayPal, and Square. Magento requires more configuration but supports a wider range of processors.
The processor still charges you per transaction—typically 2.2% to 3.5% plus $0.30 per card payment, depending on the processor and your volume. The open source gateway does not eliminate this cost. What it eliminates is the platform fee you would pay to a company like Shopify (which charges 2.9% + $0.30 plus a monthly subscription) or Square Online (which charges 2.6% + $0.30 plus a monthly fee).
Popular open source payment gateway platforms
WooCommerce is the most common choice for small to medium online stores. It runs on WordPress, which most hosting providers support cheaply. Setup takes hours rather than days if you already know WordPress. Transaction fees go to your processor, not to WooCommerce. You pay for hosting (usually $5 to $20 per month) and any plugins you add.
Magento is built for larger stores with higher transaction volume and more complex needs. It handles multiple currencies, multiple storefronts, and advanced inventory management. Setup requires a developer and takes weeks. Hosting costs more because Magento demands more server resources. Magento is open source, but Adobe also sells a paid version (Magento Commerce) with additional features and support.
Drupal Commerce is built on Drupal, a content management system used by larger organizations. It is less common than WooCommerce or Magento but offers deep customization for businesses that already use Drupal. Setup requires developer time.
OpenCart is lightweight and easier to set up than Magento but less flexible. It works well for stores with 100 to 10,000 products and moderate customization needs.
Security and compliance are your job
When you use a hosted gateway like Stripe, the company handles PCI DSS compliance—the security standard that protects payment card data. They apply security patches, monitor for breaches, and maintain certifications. You pay them to carry that burden.
With an open source gateway, you become responsible for PCI DSS compliance. You must install security updates the moment they are released, monitor your server for unauthorized access, encrypt data in transit and at rest, and pass a security audit or self-assessment questionnaire. If your server is breached and card data is stolen, you are liable.
This is not theoretical. Open source software is only as secure as the person maintaining it. A small business with one part-time developer cannot realistically maintain PCI DSS compliance on its own. A larger business with a dedicated security team can.
Many businesses hire a third-party security firm to audit their open source gateway and maintain compliance. That cost—typically $2,000 to $10,000 per year—often erases the savings from avoiding platform fees.
When open source saves money and when it does not
Open source gateways save money for businesses that already have technical staff. If you employ a developer who maintains your website anyway, adding payment gateway maintenance to their job costs little. If you process $100,000 per month in transactions, avoiding a 2% platform fee saves $2,000 per month—enough to justify hiring a developer.
Open source gateways do not save money for small businesses without technical staff. A solo entrepreneur or a three-person shop that uses Shopify or WooCommerce.com (the hosted version) pays $29 to $299 per month but gets security, updates, and support included. Building and maintaining an open source gateway costs more than that in developer time alone.
The break-even point is roughly $50,000 to $100,000 in monthly transaction volume, depending on your processor's fees and your developer's salary. Below that, a hosted solution is cheaper. Above that, open source may be cheaper—but only if you have the technical capacity to maintain it.
Hosting and infrastructure costs
An open source gateway runs on a server you rent or own. Shared hosting (the cheapest option) costs $5 to $20 per month but is slow and unreliable for payment processing. Virtual private servers (VPS) cost $20 to $100 per month and give you more control and speed. Dedicated servers cost $100 to $500 per month and are necessary only for very high transaction volumes.
You also pay for backups, SSL certificates (which encrypt data in transit), and monitoring software. A basic setup costs $50 to $150 per month in infrastructure. A secure, redundant setup costs $200 to $500 per month.
If your open source gateway goes down, your store is offline until you fix it. A hosted gateway has uptime guarantees (usually 99.9%) and automatic failover. You are trading convenience and reliability for lower fees.
Integration with your existing systems
An open source gateway must connect to your accounting software, inventory system, and customer database. WooCommerce integrates easily with QuickBooks and other common tools through plugins. Magento requires custom development for most integrations.
If you use a hosted gateway like Stripe, integration is usually simpler because Stripe publishes detailed documentation and maintains official plugins for popular platforms. Open source gateways vary: WooCommerce has good documentation; Magento requires a developer.
Budget extra time and money for integration. A simple setup takes a few hours. A complex one with multiple systems can take weeks and cost $5,000 to $20,000 in developer time.
Frequently Asked Questions
Is open source payment gateway software actually free?
The software itself is free to download and use. You pay for hosting, domain registration, SSL certificates, security audits, developer time, and transaction fees to your processor. Total cost is usually $100 to $500 per month plus developer salary, making it cheaper than a hosted platform only if you have high transaction volume or existing technical staff.
Can I switch from open source to a hosted gateway later?
Yes, but it takes work. You must export your transaction history, customer data, and product catalog, then import them into the new platform. Some data may not transfer cleanly. Plan for a few days of downtime or run both systems in parallel during the transition. Hosted gateways usually have migration tools to make this easier.
What happens if the open source project stops being maintained?
If the developers stop updating the software, security vulnerabilities will accumulate and your gateway will become unsafe. WooCommerce and Magento are actively maintained by large communities and companies, so this is unlikely. Smaller projects carry more risk. Check the project's GitHub page to see when the last update was released and how many developers are active.
Do I need PCI DSS compliance if I use an open source gateway?
Yes. PCI DSS is a requirement from credit card networks, not from the gateway vendor. If you store, process, or transmit card data, you must comply regardless of whether you use open source or hosted software. Compliance is your responsibility with open source; the hosted provider handles it for you.
Can I accept payments without hosting my own server?
Some open source gateways like WooCommerce.com offer managed hosting where you use open source software but the company handles servers and security. You pay monthly fees similar to Shopify but get more customization than Shopify allows. This is a middle ground between fully open source and fully hosted.