Payments are where a small mistake gets expensive. A builder can produce a very convincing checkout in minutes. Whether it is safe, and whether it actually records what was sold, is a different question.
The good news is that the safest option is also the simplest one for most sites.
Payment Links and Checkout
Stripe offers two hosted options that suit most small businesses and early products:
- Payment Links: a link to a Stripe-hosted payment page for a product or service. You create it in your Stripe dashboard and add it to a button. No code required.
- Checkout: a Stripe-hosted payment page your site creates on the fly, with the right items and quantities. It needs a small amount of server code, but the card details still never touch your site.
Both handle cards, many wallets, receipts and security for you. For a lot of sites, that is all you need.
If your site never sees card numbers, there is far less that can go wrong.
Never trust prices from the browser
Anything in a visitor’s browser can be changed by that visitor. If your site sends “charge $100” from the browser to your payment code, someone can change it to $1. Prices should come from Stripe itself, using price IDs you set up there, or from your server. Payment Links handle this automatically.
Secret keys stay secret
Stripe gives you two keys. The publishable key is meant for your frontend. The secret key can move money and read customer data. It must never appear in frontend code, a public repository or a builder’s client-side settings. It belongs on a server or in your host’s protected environment variables. The same rule applies to other powerful keys, like a Supabase service_role key.
Test mode and live mode
Stripe has two separate worlds. Test mode uses fake cards and moves no money. Live mode is real. They have different keys, and products, prices and webhooks set up in one usually need to be set up in the other too. A very common launch-day surprise is a site still running on test keys.
Webhooks
A webhook is a message Stripe sends to your site when something happens, like “this payment succeeded.” If your site needs to do something after payment, such as unlock an account, send a download or mark an order paid, it should rely on the webhook, not on the customer landing on a thank-you page. People close tabs. Webhooks still arrive. Your webhook code should also verify that each message genuinely came from Stripe.
Receipts, refunds and taxes
- Receipts: Stripe can email receipts automatically. Turn them on and add your business details.
- Refunds: issued from the Stripe dashboard. Have a clear refund policy on your site.
- Taxes: Stripe has tools to help calculate and collect sales tax. What you are required to collect depends on your business and location. This is not tax advice, so talk to an accountant.
What people miss
- A Stripe secret key sitting in frontend code.
- Prices sent from the browser.
- Live site still using test keys.
- Webhooks set up in test mode but not live.
- Orders only recorded when the thank-you page loads.
- No receipts turned on.
- Business name and support email missing from the payment page.
- Never running a real, small live purchase and refunding it.
How AftUp handles it
On Growth, we use your monthly fix hours to review your payment setup, move secret keys out of frontend code, switch improvised checkouts to Payment Links or Checkout, confirm webhooks work in live mode and turn on receipts. Fix responses come within 1 business day.
On Scale, with up to 6 hours a month and priority same-day response, we can build out new product or pricing pages and make sure each one is wired correctly. On every plan, uptime monitoring and monthly reports help you notice problems early. You keep full ownership of your Stripe account. See online stores for more.
Do it yourself
- If you only sell a few things, start with Stripe Payment Links.
- Search your site’s code for “sk_live” or “sk_test.” If you find either in frontend code, rotate the key in Stripe right away and move it to a server.
- Make sure prices come from Stripe price IDs, not values sent by the browser.
- Set up products, prices and webhooks in live mode, not just test mode.
- Turn on email receipts and add your support details.
- Make one small live purchase, confirm everything that should happen does, then refund it.
Not sure your checkout is as safe as it looks? A free site check is a calm place to start.