WPScan.org
Setup Guide

PayPal Integration Guide

Follow these steps exactly to go live with real payments.

1
🏢

Create a PayPal Business Account

Go to paypal.com/business and sign up for a Business account (free). Verify your email and complete identity verification.

If testing, also create a sandbox account at developer.paypal.com → Sandbox → Accounts.

2
📧

Get Your PayPal Seller Email

This is the email address you use to log in to your PayPal Business account.

For sandbox testing, use the seller sandbox email shown in developer.paypal.com → Sandbox → Accounts.

3
⚙️

Update inc/config.php

'paypal_email'   => 'your-real-paypal@email.com',
'paypal_sandbox' => false,  // Change to false for LIVE

Keep paypal_sandbox => true while testing. Only set to false when ready to go live.

4
🔔

Enable IPN in PayPal

  1. Log in to PayPal → Account Settings
  2. Find NotificationsInstant Payment Notifications
  3. Click UpdateChoose IPN Settings
  4. Set Notification URL to: https://yoursite.com/wp-security-scanner.php?action=ipn
  5. Select Receive IPN messages (Enabled) then Save
For sandbox, do this in developer.paypal.com → Sandbox → your seller account → Profile → IPN.
5
📬

Verify Your Server Can Send Emails

The license key is sent via PHP mail(). Test it works on your host. If emails go to spam:

  • Set up SPF/DKIM DNS records for your domain
  • Or update inc/email.php to use PHPMailer with SMTP credentials
6
🧪

Test End-to-End (Sandbox)

  1. Keep paypal_sandbox => true
  2. Register a new user → you'll be redirected to PayPal Sandbox
  3. Log in with a buyer sandbox account
  4. Complete the payment — IPN fires → license key emailed
  5. Check DB: wps_payments status=completed, wps_licenses has new row
7
🟢

Go Live

  1. Set 'paypal_sandbox' => false in inc/config.php
  2. Update 'paypal_email' to your real PayPal business email
  3. Enable IPN in your live PayPal account (same steps as Step 4)
  4. Make a real test purchase to confirm everything works end-to-end
⚠ Never push live credentials to a public git repo. Keep inc/config.php out of version control.

🛠️ Troubleshooting IPN

  • IPN must be reachable over HTTPS (self-signed certs will fail)
  • Your server must have curl enabled to verify IPN with PayPal
  • Check PayPal IPN History: Account Settings → Notifications → IPN
  • PayPal retries IPN up to 16 times if your server returns a non-200 response