You are handling other people’s money. You are entitled to know exactly what protects it.
This is not a marketing page. Everything below is in the plugin, and much of it you can verify on your own site in about ten seconds.
Where to read it yourself
Go to Mollie Payments, then the Security tab.
It lists every measure in plain language. The ones that can be checked live against your specific site are marked, and there is a button that takes you straight to the Status page to confirm them.
We would rather show you than tell you.
Your keys and your data
Your API keys and license are encrypted at rest. The plugin uses AES-256-GCM, keyed to your WordPress security keys. If someone steals your database, or walks off with a backup, your keys are unreadable. Tampering is detected.
Your keys are only ever shown masked. The full secret never reaches the page at all. That means it cannot be read from the page source, from developer tools, from a browser extension, or by a script running on the page.
You can lock the API keys to a single administrator, so nobody else with admin access can view or change them.
Keys and tokens are never written to log files. They are redacted automatically, before anything is written.
Payments through Mollie
All traffic to Mollie goes over an encrypted HTTPS connection.
Every payment result is confirmed with Mollie itself. When a webhook arrives saying a payment succeeded, the plugin does not simply believe it. It asks Mollie directly.
This matters more than it sounds. A plugin that trusts an incoming webhook can be told, by anyone who can guess the address, that a payment succeeded when it did not.
A payment can never be processed twice, and a membership can never be activated twice.
The webhook is protected by a secret token, compared in a way that does not leak information through timing, and rate-limited against abuse.
WordPress and the plugin itself
Admin settings and actions are limited to administrators, and protected with WordPress nonces and capability checks.
There is exactly one public request in the whole plugin: the QR image for a payment link. It has its own signed key.
All input is sanitised, all output is escaped, and every database query uses prepared statements. These are the basics, and the basics are where most plugins fail.
Plugin files cannot be run directly. The few bundled components, a QR generator and the official updater, are minimal and vetted.
What we will not claim
Here is where we are going to be straight with you, because a security page that promises everything is a security page you should not trust.
Encryption at rest protects your keys against a stolen database and a stolen backup. It cannot protect against a complete compromise of the server itself.
That is not a weakness in our plugin. Any software that has to use a key to talk to Mollie must be able to read that key, which means anyone who fully owns your server can read it too. This is true of every payment plugin ever written, and anyone who tells you otherwise is selling something.
What you do about it is the next article.