What you need to set up online payments on your website
To accept payments on your website, you need three things: a payment processor (the company that handles the transaction), a merchant account (where money lands after a sale), and payment gateway software (the tool that connects your website to the processor). Most payment processors bundle the merchant account and gateway together, so you sign up with one company rather than three.
The processor charges you a fee per transaction—usually 2.2% to 3.5% of the sale plus a flat fee of 20 to 30 cents. Some processors charge a monthly minimum or a flat monthly fee instead. You'll also need an SSL certificate (a security layer that encrypts customer data) and a website hosting plan that supports payment integration. Many hosting providers include SSL certificates free or for a small annual fee.
The payment methods you can accept depend on which processor you choose. Most major processors accept credit cards, debit cards, and digital wallets like PayPal, Apple Pay, and Google Pay. Some also support bank transfers (ACH), buy-now-pay-later services, or cryptocurrency, but this varies widely.
Key Takeaways
- You need a payment processor, merchant account, and payment gateway—most companies bundle these into one service you sign up for once.
- Transaction fees typically run 2.2% to 3.5% plus 20 to 30 cents per sale, though some processors charge a monthly flat fee instead.
- Your website hosting must support payment integration and have an SSL certificate to encrypt customer payment data.
- The payment methods you can offer (credit cards, digital wallets, bank transfers) depend on which processor you choose.
- Setup usually takes a few days to a week after you submit your business information and banking details.
Choosing a payment processor for your business type
Different processors work better for different businesses. Stripe and Square are popular for small businesses and online stores because they have low setup barriers and transparent pricing. PayPal is familiar to many customers and works well if you already have a PayPal business account. Shopify Payments integrates directly into Shopify stores. WooCommerce sites often use Stripe or Square. If you process high transaction volumes or sell internationally, Authorize.net or Worldpay may offer better rates.
Before you choose, check whether the processor supports the payment methods your customers expect. If you sell to international customers, confirm they can accept payments in the currencies you need. Also verify the processor's fraud protection tools—chargebacks and disputes happen, and you want a processor that helps you fight them with documentation tools and chargeback insurance.
Read the contract carefully for hidden fees. Some processors charge extra for refunds, monthly minimums if you don't hit a transaction threshold, PCI compliance fees, or gateway fees on top of processing fees. A processor advertising "no setup fee" might charge you in other ways.
How to integrate a payment gateway into your website
The integration method depends on your website platform. If you use Shopify, WooCommerce, or another e-commerce platform, payment processors usually have a plugin or app you install in a few clicks—no coding required. Search your platform's app store for the processor's name, install it, and follow the setup wizard to connect your merchant account.
If you have a custom-built website or a platform without a built-in payment app, you'll need to use the processor's API (application programming interface) or a hosted payment form. An API requires a developer to write code that connects your site to the processor. A hosted payment form is simpler: you add a button or link to your website that sends customers to a payment page hosted by the processor, then they return to your site after paying. Hosted forms are slower and less customizable but require no coding.
Most processors provide documentation and code samples for developers. If you don't have a developer on staff, you can hire a freelancer on Upwork or Fiverr, or ask your web host whether they offer integration services. Integration usually takes a few hours to a few days depending on complexity.
Testing payments before going live
Every payment processor provides a test mode that lets you process fake transactions without charging real money. Before you launch, switch to test mode and run several test payments using the processor's test card numbers. Test a successful payment, a declined payment, a refund, and a chargeback dispute if the processor's dashboard lets you simulate one.
Check that the payment confirmation email reaches customers, that your order confirmation page displays correctly after payment, and that the transaction shows up in your merchant account dashboard. Test on both desktop and mobile browsers because payment forms sometimes break on small screens. If you accept digital wallets like Apple Pay or Google Pay, test those too—they have different user flows than card payments.
After testing, switch to live mode and process a small real transaction to confirm everything works end-to-end. Keep that receipt for your records.
Security and compliance requirements
Your website must have an SSL certificate to accept payments. This encrypts the data customers enter into your payment form so it can't be intercepted. Most hosting providers include SSL free or charge $10 to $20 per year. Check your hosting control panel (cPanel, Plesk, or your host's dashboard) for an SSL option—many hosts install it automatically.
You must also comply with PCI DSS (Payment Card Industry Data Security Standard), a set of rules that protect payment data. The core rule: never store customer credit card numbers on your own servers. Use a payment processor or hosted payment form instead—they handle storage and encryption. If you use a hosted form or API, the processor takes on most PCI compliance responsibility. If you store any payment data yourself, you'll need to pass a PCI audit, which costs hundreds to thousands of dollars annually.
Display a privacy policy and terms of service on your website that explain how you handle customer data. Link to them near your payment form. Most payment processors provide sample language you can adapt.
What happens after a customer pays
When a customer submits payment, the processor sends the transaction to the customer's bank for approval. This takes a few seconds to a few minutes. If approved, the processor confirms the payment to your website, and you can show the customer a receipt and order confirmation page.
The money doesn't land in your merchant account immediately. Most processors deposit funds 1 to 3 business days after the transaction, though some offer next-day or same-day deposits for a higher fee. The processor deducts their fees from the deposit, so if a customer pays $100 and your fee is 2.9% plus 30 cents, you receive $96.41.
Customers can dispute or chargeback a payment within 60 to 180 days depending on their bank. If this happens, the processor notifies you and gives you a window (usually 7 to 10 days) to submit evidence that the transaction was legitimate—an order confirmation, shipping receipt, or customer communication. If you don't respond or your evidence is weak, the processor refunds the customer and charges you a chargeback fee, usually $15 to $100.
Handling refunds and payment problems
Most payment processors let you issue refunds directly from your merchant dashboard. Log in, find the transaction, and click "refund." The money returns to the customer's card or account within 1 to 5 business days. Some processors charge a small refund fee or don't refund the original processing fee you paid.
If a customer reports that a payment failed but they were charged anyway, check your merchant dashboard to see whether the transaction actually went through. If it did, issue a refund. If it didn't, the charge may be pending and will drop off in a few days. Advise the customer to check their bank statement in 3 to 5 business days and contact you if the charge persists.
If a customer's card is declined, the processor usually shows you the decline code—"insufficient funds," "card expired," "fraud check," etc. You can't override a decline, but you can ask the customer to try a different card or payment method. Some processors offer retry logic that automatically retries declined payments after a few days, which can recover some failed transactions.
Frequently Asked Questions
Do I need a business license or tax ID to accept online payments?
Most payment processors require you to provide a business name and tax ID (EIN or SSN depending on your business structure) during signup. You don't need a license to process payments, but you do need to report payment income to the IRS. Processors that process over $20,000 and 200 transactions in a year may send you a 1099-K form for tax reporting.
What's the difference between a payment gateway and a payment processor?
A payment gateway is the software that encrypts and transmits payment data from your website to the processor. A payment processor is the company that actually handles the transaction with the customer's bank. Most companies bundle both services together, so you don't need to think about them separately—you sign up with one processor and get both.
Can I accept payments without a merchant account?
No, you need a merchant account to receive money from card payments. However, some processors like PayPal and Square let you open a merchant account instantly during signup without a lengthy approval process. Traditional banks require more documentation and take longer to approve.
How much does it cost to set up online payments?
Most payment processors charge no setup fee. You pay only per transaction (2.2% to 3.5% plus 20 to 30 cents) or a monthly flat fee. Your only other cost is an SSL certificate if your host doesn't include one free, which runs $10 to $20 per year. Total startup cost is usually under $50.
What if my website gets hacked and customer payment data is stolen?
If you use a hosted payment form or API and never store card data on your own servers, the processor bears responsibility for a breach. If you store payment data yourself, you're liable. This is why using a processor's payment form or API is critical—it shifts security responsibility to a company with the resources to protect it.