PHP programmer for stripe recommendation needed

[C2Red]

Evening

I have a website for our little place in Orlando ; but recently it’s been used for some miscreant testing I presume stolen or created credit cards

One of the updates suggested was to implement Google’s captcha recognition, which I have done to ordinary web pages, but not php.

The second aspect is 3D card or SCA which stripe are introducing as part of the banking upgrades; due in September

My problem is, the person I originally bought my software from, is no longer providing updates, which gives me a huge problem.

I’ve removed the payment page, rolled my API keys, and done the appropriate updates to prevent the fraud going through in future, but I really need some help on the software updates.

Any pointers are most welcome

Website is http://www.encantada-vacation.com if it makes a difference

Thanks

[ging84]

Is this site for real?

You need to ditch your bespoke website an transition to a proper ecommerce platform.
It's woefully insecure, you seem to be able to submit credit card numbers on a plaintext booking page.

[akirk]

Difficult to know what you have done, and where it now stops in terms of your comments above - i.e. have you actually removed enough that what is left does nothing... however... I would agree with the above - it would appear that you have some serious security issues on there...

1 - no SSL - so the conversation between the computer of the person booking and your web server is not encrypted - this means that they would be sending their credit card details across the internet unencrypted - huge security risk

2 - they are entering credit card details in a plain text form - which I assume is either emailed to you (breach of security) or stored in a database (breach of security and a good reason why someone might wish to hack you)

3 - your form does no form of validation - you will be able to see from the test booking that I made that I was able to enter any form of payment info I want and your booking system thinks I have booked... (do remove the booking for March 8-12 2020 as I have temporarily blocked it by testing - no confidential data was sent though!)

4 - you should not be processing credit card details yourself - I wouldn't be surprised if you were in breach of PCI compliance in how you are taking credit card information - which could a) lose you the right to process credit cards and b) could leave you liable for any financial loss - which could be huge!

All transactional interaction should be passed to off your website and through SSL

All slightly surprising as you are also using Free to Book as a booking system - but presumably using them only as an additional link from the footer? You should be looking to integrate them and not run a separate booking option (which from a brief view appears to be what you are doing...)

there are also other things I would change on the website - it took me a while to discover which country the property was even in!

If you want to pm me / contact me via my website (in my profile) then I am sure we can sort it out for you - we run a number of booking systems for clients of ours and build from simple to complex websites incorporating them... e.g. https://fairfordairshowcamping.net/ - this uses another booking system - Planyo - but integrated into their website - but keeping the transactional process off the website - and all is handled securely...

We also have a few different PH folks as clients...

Edited by akirk on Monday 27th May 22:59

Edited by akirk on Monday 27th May 23:12

[C2Red]

Well that went south quickly

Credit card processing is via ssl , but the page in which we do that has been removed from the main page, the booking calendar is just to reserve, if it’s insecure then that’s a problem I will take up with the software developers as I paid good money for that.

I’ll be in touch shortly

Thanks

[C2Red]

ging84 said:

Is this site for real?

You need to ditch your bespoke website an transition to a proper ecommerce platform.
It's woefully insecure, you seem to be able to submit credit card numbers on a plaintext booking page.

Harsh.

Perhaps tell me the costs of doing this; a bespoke platform is not inexpensive

Thank you

[C2Red]

anonymous said:

[redacted]

Thanks, I’m not dismissing anything, but help is better than just criticism; I don’t take payment through the calendar; just reservations or requested bookings

The payments page is ssl, through stripe, we don’t have access to any cvc codes, as free to book and stripe handle these.

Not sure you know what my understanding is of property law, perhaps again you can enlighten me.

I’m looking for help, if you can help, please do so

Thanks

[anonymous-user]

I'd take up akirk on his offer of help.

That or get a decent wordpress template , a payment plugin, and a merchant account with the likes of sagepay.

I would link my ecommerce site as an example but this forum is so toxic I don't want to be readily linked with my real life!

[C2Red]

RogerDodger said:

I'd take up akirk on his offer of help.

That or get a decent wordpress template , a payment plugin, and a merchant account with the likes of sagepay.

I would link my ecommerce site as an example but this forum is so toxic I don't want to be readily linked with my real life!

Thanks, I have emailed akirk, stripe are merchant account and cc handling so all wrapped up into one, it works well, but as you can see I have some issues to iron out.... thanks for the positive input

[akirk]

The OP has emailed me - and I have replied
I think that in reality the OP is only guilty of not understanding web development

There is full SSL on the website - the error from the coders is simply that they have left http running as well - rather than a simple server or .htaccess file instruction to default to / switch to https - so the OP posted a link to http://www.encantada-vacation.com/ whereas had he posted a link to: https://www.encantada-vacation.com/ no-one would have commented on that however it is good he did as it highlighted an issue... So, there is an SSL certificate (from GoDaddy) correctly set up for the website - the website needs a simple tweak to ensure it is always in use...

Other than that, decisions on how to take data are down to the OP - taking it through a form on SSL is a different matter than http forms, and potentially not an issue - it simply depends on how it is then used - if passed to Stripe / PayPal, then they are PCI compliant, so no issue, if passed to the OP, then more of a PCI issue. However, the OP does have an account with Free to Book - so that is a possible way forward...

There are many tweaks the OP could make to the website, however it is responsive / fast to load / generally gives the information you want - so if it works, I wouldn't be spending money changing it! (despite the fact that I like people spending money with us, we tend to advise that you only spend money where you have to - security - or where it will bring a better commercial return)

What he does not need to do is start again - he doesn't need an eCommerce system, and he doesn't need to move to wordpress with plugins etc. (we spend a lot of time sorting out wordpress issues - while it is easy and attractive on the surface, it is not always the best solution). For the purposes of a property that is being rented out, a simple website is absolutely fine - the only complexity is booking / handling payments and that can all be outsourced by using a booking widget (such as Free to Book) - no need to over-complicate!

anyway, I have gone back to the OP with a more detailed response and some suggestions...

one thing left to mention - the real issue - no decent car photos on the website (despite the OP having a rather nice Porsche in his profile!)

[akirk]

anonymous said:

[redacted]

Don't tend to use Brave - but the same issue is there in Firefox - it is simply a matter of the browser blocking the loading of mixed active content - i.e. the calendar is being brought in as http - a simple tweak to the code will fix that

[C2Red]

I’d like to thank akirk, pleasure to read your email and advice.
Exactly what I’d hoped for, and now up to me to decide on a course for the future

Thank you so very much

K