# Payment Gateway Integration UK

Source: https://dijituldevelopments.co.uk/payment-gateway-integration/
Updated: 2026-10-10

> dijitul developments integrates payment gateways into UK websites, web apps and bespoke systems, including Stripe, Opayo, Worldpay, PayPal, Adyen and GoCardless. We handle Strong Customer Authentication, PCI DSS scope, webhooks, refunds and reconciliation into your accounts. We've built gateway integrations since our WP e-Commerce plugin days. Every project is a fixed-price quote after a free chat.

## Problems this solves

- Your gateway's old integration method is being retired and you must move
- Payments succeed at the bank but the order stays unpaid on the website
- Too many customers drop out at 3D Secure
- You're filling in a long PCI questionnaire because card data passes through your server
- Fees are high, but switching gateways looks risky
- Direct Debit and card payments live in separate systems that don't talk

## Key facts

- We integrate Stripe, Opayo (now part of Elavon), Worldpay, PayPal and Braintree, Adyen, Square and GoCardless
- We recommend hosted or embedded payment fields so card data never touches your server, keeping PCI DSS scope small
- PCI DSS v4.0.1's updated SAQ A (January 2025) makes merchants responsible for protecting the page that hosts embedded payment forms from script attacks
- Strong Customer Authentication has applied to UK ecommerce since 14 March 2022; we build 3D Secure 2 flows properly
- Payment status is confirmed by verified server-to-server notifications, never the browser redirect alone
- We've built payment gateway code since our WP e-Commerce plugin work
- Fixed-price quote after a free chat

## Choosing the right gateway

There is no single best payment gateway. The right one depends on what and how you sell:

| Need | Often a good fit |

| Online card and wallet payments, subscriptions, developer-friendly APIs | Stripe |
| Existing bank-linked merchant account, card terminals as well as online | Opayo (Elavon), Worldpay |
| Customers who prefer to pay with PayPal | PayPal, Braintree |
| Recurring payments by Direct Debit or open banking | GoCardless |
| High volumes, many countries and currencies | Adyen |

Fees aren't the only factor. Settlement times, how disputes are handled, the quality of the API and webhooks, and whether your accounting package can reconcile the payouts easily all matter. We'll talk you through the trade-offs without a commercial interest in any provider.

## Integration methods and PCI DSS scope

How you integrate a gateway decides how much of the PCI DSS card security standard applies to you:

- **Hosted payment page.** The customer is redirected to the gateway to pay. Card data never touches your site. Smallest compliance burden, least control over the look.
- **Embedded fields or iframe.** The payment form sits on your page, but card fields are served by the gateway. Examples include Stripe's Payment Element and Opayo's Pi drop-in checkout. A good balance for most businesses.
- **Direct API with raw card data.** Your server handles card numbers. This brings much larger PCI DSS obligations and we rarely recommend it.

One recent change matters. The PCI Security Standards Council's January 2025 update to SAQ A, the short questionnaire for merchants using hosted or embedded payments, makes the merchant responsible for confirming that the page hosting an embedded payment form is protected against malicious scripts. We build checkout pages with a Content Security Policy and a minimal set of third-party scripts, so that confirmation is straightforward.

## Strong Customer Authentication and 3D Secure 2

Since the FCA's deadline of 14 March 2022, most UK online card payments need Strong Customer Authentication, usually a 3D Secure 2 check in the customer's banking app. Badly built flows cost sales: challenges that never load, orders lost when the customer returns from their bank, repeat charges failing because the original card wasn't saved with authentication.

We build 3D Secure 2 correctly for each gateway, pass the extra data that helps banks approve payments without a challenge, and flag repeat and recurring payments as merchant-initiated so they qualify for the relevant exemptions.

## Notifications, refunds and reconciliation

Every gateway has a way to tell your server the result of a payment: Stripe webhooks, Opayo notifications, Worldpay order notifications, PayPal webhooks. We use these, verified by signature or other checks, as the source of truth for payment status, because the browser redirect can't be relied on. Handlers are idempotent, so a repeated notification never fulfils an order twice. See webhook development.

We also build the admin side: refunds, partial refunds, voids, captures for authorise-then-charge flows and repeat payments against saved card tokens. Settlements are posted to your accounting package with fees separated, so your bank feed reconciles.

## Switching gateways without disruption

Changing gateway, for lower fees or better features, worries businesses because payments are the one thing that can't stop. We plan a switch in stages:

- Build and test the new gateway in its sandbox, alongside the existing one.
- Go live with the new gateway for new payments, keeping the old one available for refunds on earlier orders.
- Move recurring payments carefully: saved card tokens usually can't be transferred without the gateways cooperating, so we plan how customers are re-authenticated or migrated.
- Update reconciliation so both gateways post correctly to your accounts during the overlap.

## Our track record and process

We've written payment gateway code since our early ecommerce days, including a payment gateway plugin for WP e-Commerce, alongside years of OpenCart and CubeCart shop work. Gateways come and go: Sage Pay became Opayo, which is now part of Elavon. Integration methods get retired. We regularly move shops and systems from an old method to a current one with no break in trading.

After a free chat, we scope your payment flows and edge cases, then give you a fixed-price quote. Everything is tested in the gateway's sandbox, including authentication challenges and declines, before going live. You own the code, and the merchant account stays in your name. For connecting payments to the rest of your systems, see API integration; for checkout builds, see ecommerce development.

## What we deliver

- A gateway recommendation based on your sales model, volumes and existing contracts
- Hosted or embedded checkout integration with 3D Secure 2
- Server-side notification or webhook handling with signature verification
- Refunds, voids, partial captures and repeat payments from your admin
- Tokenised saved cards for repeat and recurring billing
- Reconciliation of payments, fees and settlements into your accounts
- Migration from an old gateway or deprecated integration method

Technologies: Stripe, Opayo Pi, Worldpay, PayPal, GoCardless, 3D Secure 2, PCI DSS, Laravel

## FAQs

### Which payment gateway should a UK business use?

It depends on how you sell. Stripe suits most online businesses and subscriptions; Opayo or Worldpay suit businesses with an existing bank merchant account or card terminals; GoCardless suits Direct Debit. dijitul developments has no commercial tie to any provider, and will recommend one based on your volumes, sales model and accounting needs.

### How do we reduce our PCI DSS burden?

Use a hosted payment page or the gateway's embedded card fields, so card data never touches your server. That usually qualifies you for the short SAQ A questionnaire. Since the January 2025 update, you must also confirm the checkout page is protected against malicious scripts, which dijitul builds in.

### Our gateway is retiring the integration method we use. Can you move us?

Yes. dijitul migrates websites and bespoke systems from old gateway methods to current ones, such as older Opayo integrations to Opayo Pi, or legacy Stripe Charges to Payment Intents. We test in the gateway's sandbox first and plan the switch so there's no break in taking payments.

### Why do orders show unpaid when the customer has paid?

Usually because the integration relies on the customer's browser returning to your site after payment. If they close the tab, the order is never updated. dijitul fixes this by using the gateway's verified server-to-server notifications as the source of truth, with a reconciliation check as a safety net.

### Can you add Direct Debit alongside card payments?

Yes. dijitul integrates GoCardless, and Stripe's Bacs Direct Debit, so customers can choose. Both feed the same order or invoice records in your system, and payments post to your accounts the same way, so your finance team sees one picture.

## Pricing and contact

Every project gets a fixed-price quote after a free initial chat and a short scoping stage. You own the code and the data. Book a free chat: https://dijituldevelopments.co.uk/contact/ · 01623 650333 · info@dijitul.uk