WHMCS supports 100+ payment gateways out of the box, but most resellers do fine with a small set: Stripe, PayPal, and a manual-payment option. This article covers what to enable, how to set each up, and the trade-offs that matter for a small hosting business.
Recommended starter set
- Stripe — takes credit cards on a hosted page. Lowest friction for most customers. ~2.9% + 30 cents per transaction.
- PayPal — covers customers who don't want to share card details with a new vendor. Some customers will only pay via PayPal. ~3.49% + 49 cents per transaction.
- Mail-in Payment — for the rare customer who wants to send a check. Free but slow. Often required for B2B customers with procurement processes.
Skip the others until a customer specifically asks. Adding gateways isn't free of friction — each one is a checkout-page option you'll need to maintain.
Setting up Stripe
- Sign up at stripe.com and complete the business verification.
- Go to your Stripe dashboard → Developers → API keys.
- Copy the Publishable key and Secret key. Use the live keys, not test keys.
- In WHMCS → System Settings → Payment Gateways, find Stripe and click Activate.
- Paste the keys.
- Set Display Name to "Credit Card" — your customers don't need to know the underlying processor.
- Save.
Configure Stripe webhooks
Webhooks let Stripe notify WHMCS of payment events asynchronously (subscription renewals, refunds, disputed charges). Without webhooks, recurring billing is unreliable.
- Stripe dashboard → Developers → Webhooks → Add endpoint.
- Endpoint URL:
https://yourbillingdomain.com/modules/gateways/callback/stripe.php - Events to send: select all charge.*, customer.subscription.*, and invoice.*.
- Save the endpoint signing secret and paste it back into the WHMCS Stripe settings under "Webhook Secret."
Setting up PayPal
PayPal has multiple integration methods. WHMCS supports two:
PayPal Smart Buttons (recommended)
- Sign up at developer.paypal.com and create a REST API app.
- Copy the Client ID and Secret from the app dashboard.
- WHMCS → Payment Gateways → PayPal Smart Buttons → Activate.
- Paste the credentials.
- Save.
This shows a "Pay with PayPal" button on checkout. Customers can use a PayPal account or pay-with-card-without-account.
PayPal IPN (legacy)
The older method, still supported. Requires:
- PayPal account email
- IPN URL configured in PayPal:
https://yourbillingdomain.com/modules/gateways/callback/paypal.php
Use Smart Buttons unless you have a specific reason for IPN.
Setting up Mail-in Payment
- WHMCS → Payment Gateways → Mail-in Payment → Activate.
- Paste payment instructions: where to send the check, who to make it out to, what to write in the memo line.
- Save.
Customers selecting this option get an unpaid invoice. You manually mark it Paid when the check clears.
Other gateways worth knowing about
- Authorize.net — the "established" credit card gateway. Higher monthly fees ($25/mo) but lower per-transaction fees if you do high volume. Good for established hosts.
- 2Checkout / Verifone — merchant of record service that handles VAT, sales tax, and chargebacks for you. Higher fees (~5%) but eliminates compliance burden for international sales.
- Crypto.com Pay, Coinbase Commerce, BitPay — cryptocurrency payment gateways. Niche but appreciated by some customer segments.
- GoCardless — direct debit (ACH in the US, BACS in the UK). Cheaper than cards (~1%) but slower.
Currency considerations
If you sell in multiple currencies:
- Set up additional currencies in WHMCS → System Settings → Currencies.
- Set exchange rates manually or enable automatic updates from WHMCS's currency feed.
- Each gateway only supports specific currencies — verify before announcing support to customers.
Most US-based resellers stick to USD for simplicity. International expansion is a separate project.
Handling failed payments
WHMCS automatically retries failed credit card payments per its retry schedule (configurable in Automation Settings). Default: retry on day 3, 5, and 7 after due date, then suspend on day 7-14.
For accounts with chronic payment failures (declined cards, expired cards), the customer needs to update payment details. WHMCS sends automated emails for this; the email template is editable.
PCI scope considerations
Both Stripe and PayPal Smart Buttons keep card data off your server entirely (Pattern A in our PCI compliance article). Your PCI obligations are the simplest possible (SAQ A).
Avoid gateway integrations that ask you to enter or store the customer's card number on your server — that pulls you into a much harder PCI scope.
Common pitfalls
- Test mode in production. Easy to forget you're still using test API keys. Confirm by trying a small real transaction after going live.
- Webhook URLs not whitelisted. If you use a firewall or Cloudflare, make sure Stripe and PayPal can reach your WHMCS webhook endpoints.
- Currency mismatch. Customer in EUR, gateway processes in USD. Customer sees "currency conversion fee" on their card statement and chargebacks.
- Missed renewals. Cron isn't running, or the gateway's recurring billing isn't configured. Test by setting up a one-month subscription and waiting for the renewal.