Magento 1.x Security Patch Notice
For Magento Open Source 1.5 to 1.9, Magento is providing software security patches through June 2020 to ensure those sites remain secure and compliant. Visit our information page for more details about our software maintenance policy and other considerations for your business.
PayPal Express Checkout
PayPal Express Checkout helps boost sales by giving your customers the ability to pay by credit card or from the security of their personal PayPal accounts. During checkout, the customer is redirected to the secure PayPal site to complete the payment information. The customer is then returned to your store to complete the remainder of the checkout process. Choosing Express Checkout adds the familiar PayPal button to your store, which has been reported to increase sales.*
Customers with current PayPal accounts can make a purchase in a single step, by clicking the “Check out with PayPal” button. Express Checkout can be added as a standalone, or added to an existing PayPal solution. If you already accept credit cards online, you can offer Express Checkout as an additional option to attract new customers who prefer to pay with PayPal. PayPal Express Checkout can be used as a standalone, or in combination with one of PayPal’s All-In-One solutions.
With Express Checkout, the customer is redirected to the PayPal site to complete the transaction. Unlike other payment methods, PayPal Express Checkout allows the customer to check out at the beginning of the usual checkout flow. With the PayPal Express Checkout enabled, the “Check out with PayPal” button is available on the product page, in the shopping cart, and mini shopping cart. Clicking the button redirects the customer to the PayPal website to review the purchase information. Customers must log in to their PayPal accounts to complete the transaction. The payment system uses the customer’s billing and shipping information from the customer’s PayPal account. The customer is then redirected back to the Magento Review Order page. After the customer places the order in Magento, the payment information is submitted to PayPal and the payment transaction is settled.
If the customer uses the one-page checkout and selects the Express Checkout payment method, the customer is redirected to PayPal during the Payment Review process, just before the sales order is submitted.
Express Checkout method of payment is unavailable if the customer chooses to check out the products from the shopping cart to multiple addresses. The store administrator cannot place an order using the Express Checkout method of payment, because it is also unavailable from the Admin.
Requirements
-
Merchant: Personal PayPal Account
Customer: Personal PayPal Account
Setting Up PayPal Express Checkout
You can have two PayPal solutions active at the same time: Express Checkout, plus an All-In-One solution. If you enable a different solution, the one used previously is automatically deactivated.
-
Process Overview:
Step 1: Configure Your PayPal Account
Step 2: Complete the Required Settings
1. | Before you begin, you must configure your PayPal merchant account on the PayPal website. |
a. | Log in to your PayPal Advanced account at manager.paypal.com. |
b. | Go to Service Settings > Hosted Checkout Pages > Set Up, and make the following settings: |
-
AVS
No
CSC
No
Enable Secure Token
Yes
c. | Save the settings. |
2. | PayPal recommends that you set up an additional user on your account. To set up an additional user, do the following: |
a. | Go to manager.paypal.com and log in to your account. |
b. | Follow the instructions to set up an additional user. |
c. | Save the changes. |
1. | On the Admin menu, select System > Configuration. |
2. | In the Configuration panel on the left, under Sales, select Payment Methods. |
3. | If your Magento installation has multiple websites, stores or views, set the Current Configuration Scope box in the upper-left corner to the target configuration. |
4. | In the Merchant Location section, select the Merchant Country where your business is located. |
5. | If necessary, click to expand the PayPal Express Checkout section. Then, click the Configure button. |
6. | Under Required PayPal Settings, in the Express Checkout section, complete the following: |
a. | Enter the Email Address that is associated with your PayPal merchant account. |
Important! Email addresses are case sensitive. To receive payment, the email address you enter must match the email address specified in your PayPal merchant account.
b. | Set API Authentication Methods to one of the following: |
- API Signature
- API Certificate
c. | If necessary, click the Get Credentials from PayPal button. Then, complete the following: |
- API Username
- API Password
- API Signature
d. | If you are using credentials from your sandbox account, set Sandbox Mode to “Yes.” |
If necessary, click the Sandbox Credentials button and follow the instructions to set up your testing environment.
e. | If your system uses a proxy server to establish the connection between Magento and the PayPal payment system, set API Uses Proxy to “Yes.” Then,, complete the following: |
- Proxy Host
- Proxy Port
7. | When these sections are complete, set Enable this Solution to “Yes.” |
8. | To offer financing through PayPal to your customers, see PayPal Credit to learn more. |
You have now completed the Required PayPal Settings. At this point, you can either continue with the Basic and Advanced Settings, or click the Save Config button. You can return later fine-tune the configuration.
1. | If your store has multiple views, make sure to set the Current Configuration Scope box in the upper-left corner to the view where these settings apply. |
2. | In the Basic Settings - PayPal Express Checkout section, complete the following: |
a. | Enter a Title to identify this payment method during checkout. It is recommended to set the title to “PayPal” for each store view. |
b. | If you offer multiple payment methods, enter a number in the Sort Order field to determine the sequence in which PayPal Payments Standard is listed with the other methods. Payment methods appear in ascending order based on the Sort Order value. |
c. | Set Payment Action to one of the following: |
-
Authorization Approves the purchase, but puts a hold on the funds. The amount is not withdrawn until it is “captured” by the merchant. Sale The amount of the purchase is authorized and immediately withdrawn from the customer’s account. Order The amount of the order is neither captured nor authorized in the customer’s balance, bank account, or credit card at PayPal. The Order payment action represents an agreement between the PayPal payment system and the merchant, which enables the merchant to capture one or more amounts up to the “ordered” total from the customer’s buyer account, over a maximum of 29 days. After the funds are “ordered,” the merchant can capture them at any time during the following 29 days. Capturing of the order amount can be done only from the Magento backend, by creating one or more invoices.
d. | If Payment Action is set to “Order,” complete the following fields: |
-
Authorization Honor Period (days)
Defines how long the primary authorization stays valid. The value should be equal to the corresponding value in your PayPal merchant account. The default value in your PayPal merchant account is 3. To increase this number you need to contact PayPal. The authorization becomes invalid at 11:49 p.m., U.S. Pacific Time, of the last day.
Order Valid Period (days)
Defines how long the order remains valid. When the order becomes invalid, you can no longer create invoices for it. Specify the value equal to the Order Valid Period value in your PayPal merchant account. The default value in your PayPal merchant account is 29. To change this number, you need to contact PayPal.
Number of Child Authorizations
Defines the maximum number of authorizations for one order; that is, the maximum number of the online partial invoices you can create for one order. The number in this field should be equal to the corresponding setting in your PayPal merchant account. The default number of child authorizations in your PayPal account is 1. To increase this number, you need to contact PayPal.
e. | To display the “Check out with PayPal” button on the product page, set Display on Product Details Page to “Yes.” |
1. | At the bottom of the Basic Settings section, click to expand Advanced Settings. Then, complete the following: |
a. | Set Payment Applicable From to one of the following: |
-
All Allowed Countries
Accepts payment from the countries already specified in your configuration.
Specific Countries
Accepts payments from only the countries you specify. Hold the Ctrl key down and in the Payment Applicable From list, click each country where you accept payment.
b. | Set Debug Mode to “Yes” to write communications with the payment system into the log file. The log file for PayPal Payments Advanced is payments_payflow_advanced.log. |
In accordance with PCI Data Security Standards, credit card information is not recorded in the log file.
c. | To enable host authenticity verification, set Enable SSL Verification to “Yes.” |
d. | To display a full summary of the customer’s order by line item from the PayPal site, set Transfer Cart Line Items to “Yes.” |
To include up to ten shipping options in the summary, set Transfer Shipping Options to “Yes.” (This option appears only if line items are set to transfer.)
e. | To determine the type of image used for the PayPal acceptance button, set Shortcut Button Flavor to one of the following: |
-
Dynamic
(Recommended) Displays an image that can be dynamically changed from the PayPal server.
Static
Displays a specific image that cannot be dynamically changed.
f. | To allow customers without PayPal accounts to make a purchases with this method, set Enable PayPal Guest Checkout to “Yes.” |
g. | Set Require Customer’s Billing Address to one of the following: |
-
Yes
Requires the customer’s billing address for all purchases.
No
Does not require the customer’s billing address for any purchases.
For Virtual Quotes Only
Requires the customer’s billing address for virtual quotes only.
h. | To specify whether the customer can sign a billing agreement with your store in the PayPal payment system when there are no active billing agreements available in the customer account, set Billing Agreement Signup to one of the following: |
-
Auto
The customer can either sign a billing agreement during the Express Checkout flow or use another method of payment.
Ask Customer
The customer can decide whether to sign a billing agreement during the Express Checkout flow.
Never
The customer cannot sign a billing agreement during the Express Checkout flow.
The store owner needs to apply to PayPal Merchant Technical Support to enable billing agreements. The Billing Agreement Signup parameter must be enabled only after PayPal confirms that billing agreements are enabled for your merchant account.
i. | To allow the customer to complete the transaction from the PayPal site without returning to your Magento store for Order Review, set Skip Order Review Step to “Yes.” |
2. | Complete the following sections as needed for your store: |
A billing agreement is a sales agreement between the merchant and customer that has been authorized by PayPal for use with multiple orders. During the checkout process, the Billing Agreement payment option appears only for customers who have already entered into a billing agreement with your company. After PayPal authorizes the agreement, the payment system issues a unique reference ID to identify each order that is associated with the agreement. Similar to a purchase order, there is no limit to the number of billing agreements a customer can set up with your company.
1. | To make billing agreements available to your customers, click to expand the PayPal Billing Agreement Settings section. |
2. | Set Enabled to “Yes.” Then, do the following: |
a. | Enter a Title to identify the PayPal Billing Agreement method during checkout. |
b. | If you offer multiple payment methods, enter a number in the Sort Order field to determine the sequence in which Billing Agreement appears when listed with other payment methods during checkout. |
c. | Set Payment Action to one of the following: |
-
Authorization Approves the purchase, but puts a hold on the funds. The amount is not withdrawn until it is “captured” by the merchant. Sale The amount of the purchase is authorized and immediately withdrawn from the customer’s account.
d. | Set Payment Applicable From to one of the following: |
-
All Allowed Countries
Accepts payment from the countries already specified in your configuration.
Specific Countries
Accepts payments from only the countries you specify. Hold the Ctrl key down and in the Payment Applicable From list, click each country where you accept payment.
e. | To record communications with the payment system in the log file, set Debug Mode to “Yes.” |
The log file is stored on the server and is accessible only to developers. In accordance with PCI Data Security Standards, credit card information is not recorded in the log file.
f. | To enable SSL verification, set Enable SSL verification to “Yes.” |
g. | To display a summary of each line item in the customer’s order on your PayPal payments page, set Transfer Cart Line Items to “Yes.” |
h. | To allow customers to initiate a billing agreement from the dashboard of their customer account, set Allow in Billing Agreement Wizard to “Yes.” |
1. | Click to expand the Settlement Report Settings section. |
2. | If you have signed up for PayPal’s Secure FTP Server, enter the following SFTP login credentials: |
- Login
- Password
3. | To run test reports before “going live” with Express Checkout on your site, set Sandbox Mode to “Yes.” |
4. | Enter the Custom Endpoint Hostname or IP Address. By default, the value is: reports.paypal.com |
5. | Enter the Custom Path where reports are saved. By default, the value is: /ppreports/outgoing |
6. | To generate reports according to a schedule, under Scheduled Fetching, make the following settings: |
a. | Set Enable Automatic Fetching to “Yes.” |
b. | Set Schedule to one of the following: |
- Daily
- Every 3 Days
- Every 7 Days
- Every 10 Days
- Every 14 Days
- Every 30 Days
- Every 40 Days
PayPal retains each report for forty-five days.
c. | Set Time of Day to the hour, minute, and second when you want the reports to be generated. |
The frontend experience settings give you the opportunity to choose which PayPal logos appear on your site, and to customize the appearance of your PayPal merchant pages.
1. | Click to expand the Frontend Experience Settings section. |
2. | Select the PayPal Product Logo that you want to appear in the PayPal block in your store. The PayPal logos are available in four styles and two sizes. Options include: |
- No Logo
- We Prefer PayPal (150 x 60 or 150 x 40)
- Now Accepting PayPal (150 x 60 or 150 x 40)
- Payments by PayPal (150 x 60 or 150 x 40)
- Shop Now Using PayPal (150 x 60 or 150 x 40)
3. | To customize the appearance of your PayPal merchant pages, do the following: |
a. | Enter the name of the Page Style that you want to apply to your PayPal merchant pages. Options include: |
-
paypal
Uses the PayPal page style.
primary
Uses the page style that you identified as the “primary” style in your account profile.
your_custom_value
Uses a custom payment page style, which is specified in your account profile.
b. | In the Header Image URL field, enter the URL of the image that you want to appear in the upper-left corner of the payment page. The maximum file size is 750 pixels wide by 90 pixels high. |
PayPal recommends that the image be located on a secure (https) server. Otherwise, the customer’s browser may warn that “the page contains both secure and nonsecure items.”
c. | Enter the six-character hexadecimal code, without the “#” symbol, for each of the following: |
-
Header Background Color Background color for the checkout page header
Header Border Color 2-pixel border around the header.
Page Background Color Background color for the checkout page and around the header and payment form.
3. | When complete, click the Save Config button. |