How to Accept Payments on Your Website: Gateways, Processors, Wallets and PCI Basics

You’ve built the website. People are visiting. Now you need a way for them to pay you, and suddenly you’re reading about gateways, processors, merchant accounts, tokens and something called an SAQ. It’s enough to make a small business owner stick with “email us to order.”

It doesn’t have to be that complicated. For most small sites, accepting payments online comes down to 3 decisions: which provider to use, how the checkout is built and how to stay secure. This guide explains the moving parts in plain English, shows what each option costs and walks you through setup step by step.

How online payments actually work

When a customer pays on your site, several parties are involved in a few seconds:

• Payment gateway: the technology that securely captures payment details at checkout and sends them for approval. Think of it as the online equivalent of a card terminal.
• Payment processor: the company that moves the transaction between your business, the card networks and the banks, then settles the money to your account.
• Merchant account: a type of bank account that holds card sale funds before they’re paid out to your business bank account.
• Card networks: Visa, Mastercard, American Express and Discover set the rules and route transactions.
• Issuing bank: the customer’s bank, which approves or declines the payment.

The good news for small businesses: modern providers such as Stripe, PayPal and Square bundle the gateway, processing and merchant account into a single sign-up. You don’t need to apply for each piece separately. Larger businesses sometimes separate them to negotiate lower rates, but that’s rarely worth it at small volumes.

Choose your type of payment provider

Many sites use 2 together: a card processor for most payments and a PayPal button for customers who prefer it. Before choosing, compare checkout experience, payout timing and how disputes are handled. Our Stripe vs PayPal comparison covers those differences in detail.

Understand the fees

Most small-business providers charge a flat percentage plus a fixed fee per transaction, with no monthly fee. As published on their US pricing pages:

Other costs to plan for:

• Dispute or chargeback fees when a customer disputes a charge with their bank.
• Currency conversion if you sell internationally.
• Instant payout fees if you want money faster than the standard schedule.
• Platform fees if your website builder charges extra for using a third-party processor.

Rates vary by provider, plan, card type and volume, and they change. Check each provider’s current pricing page before deciding, and remember that the cheapest headline rate isn’t always cheapest once disputes, payout speed and account stability are factored in.

Pick how your checkout is built

How payment details are collected affects both customer experience and your security burden.

1. Payment links and buttons. The provider gives you a link or button that opens a checkout page it hosts. No coding. Great for a few products, services, deposits or donations.

2. Hosted checkout page (redirect). Customers click “Pay” and go to a checkout page hosted by your provider, then return to your site. Card data never touches your server, which keeps your PCI scope smallest.

3. Embedded payment form (iframe). The payment fields appear inside your page but are actually served by the provider. It looks native while keeping card data off your systems.

4. Direct API integration. Your developer builds a fully custom checkout using the provider’s APIs and front-end libraries. This gives the most control but needs developer time and expands your compliance responsibilities if card data ever passes through your systems.

5. Built-in store checkout. If you use an ecommerce platform, payments are already part of the checkout. You connect your provider in settings.

For most small sites, options 1, 2 or 5 are the right starting point. If you’re thinking about a custom build, read our guide to custom software development costs first.

Add digital wallets and other payment methods

Customers increasingly expect to pay without typing a card number. Common options:

• Digital wallets such as Apple Pay, Google Pay and PayPal speed up checkout, especially on phones. Many providers let you turn these on with a setting.
• Buy now, pay later options split a purchase into installments. They can lift conversion on higher-priced items but usually cost more per transaction.
• Bank payments (ACH) often cost less than cards and suit invoices, subscriptions and larger B2B payments, but settle more slowly.
• Saved payment details let returning customers pay faster, using the provider’s secure tokenization.

Don’t add every option at once. Start with cards plus 1 or 2 wallets, then add methods your customers ask for. For more on where payments are heading, including instant payment rails, see our guide to embedded finance and real-time payments.

PCI DSS basics for small sites

If you accept card payments, you must follow the Payment Card Industry Data Security Standard (PCI DSS). The current version is PCI DSS v4.0.1. Most small merchants confirm compliance each year with a Self-Assessment Questionnaire (SAQ), and which one you use depends on how you accept payments:

Recent changes matter for online stores. In January 2025, the PCI Security Standards Council updated SAQ A, effective March 31, 2025: requirements 6.4.3 and 11.6.1 on payment page scripts were removed from SAQ A reporting, but merchants must now confirm their site isn’t susceptible to script-based attacks that could affect their ecommerce systems. In practice, that means keeping your website, plugins and third-party scripts updated and limited.

Key takeaway: The simplest way to reduce your PCI burden is to never let card data touch your own systems. Use a hosted or embedded checkout from a compliant provider, and never collect card numbers by email, phone notes or web forms.

Ask your provider which SAQ applies to your setup. Our full guide to PCI compliance for small businesses explains merchant levels and the questionnaires in more depth. This is not legal advice.

Step-by-step: set up online payments

1. List what you’re selling and how. One-time products, services, deposits, subscriptions or invoices each fit different tools.
2. Choose a provider. Compare rates, payout timing, supported payment methods, integrations with your website and dispute handling.
3. Create your account. Provide your legal business name, tax ID or SSN, business address, website and bank account for payouts. Expect identity and business verification.
4. Set your statement descriptor. Use a business name customers will recognize on their card statement. Unclear descriptors are a common cause of disputes.
5. Connect to your website. Use your platform’s built-in integration, a plugin, a payment link or a developer integration.
6. Turn on wallets and fraud tools. Enable Apple Pay and Google Pay, address and security code checks, and your provider’s fraud screening.
7. Publish your policies. Add clear refund, shipping and cancellation policies, plus contact details, where customers can see them before paying.
8. Test the full flow. Use your provider’s test mode, then make a small live purchase and refund it.
9. Secure your accounts. Turn on two-factor authentication for your payment dashboard and website admin. Our guide on how to set up two-factor authentication shows how.
10. Complete your PCI SAQ and set a yearly reminder.

Conclusion

Accepting payments online is easier than it looks. Choose an all-in-one provider, use its hosted or embedded checkout, add the wallets your customers use and keep card data off your systems. Then focus on the details that protect your revenue: clear policies, recognizable statement descriptors, fraud tools and secure accounts. Start simple and add complexity only when your sales justify it.

Sources

• Stripe: Pricing — standard US card pricing and international card fee
• PayPal: Merchant fees — PayPal Checkout, Advanced card payments and Pay Later rates
• PCI SSC: Important updates for merchants validating to SAQ A — January 2025 SAQ A changes, effective March 31, 2025
• PCI SSC: Just published PCI DSS v4.0.1 — current version of the standard
• Stripe Docs: Statement descriptors — why clear descriptors reduce disputes