Your money never touches our servers
AlkaPay is software on your own WordPress server — not a payment processor, not a wallet, not an intermediary.
AlkaPay's only job is verification: it confirms with Safaricom that the payment happened and updates your WooCommerce order. Funds settle under your own agreement with Safaricom. We can't hold, delay, or redirect a shilling.
What's actually in the code
Every item below ships in the current release — none of this is roadmap.
Encrypted API credentials
Your Daraja Consumer Key, Consumer Secret, and Passkey are encrypted at rest in your database, keyed to your site's own WordPress salts. A leaked database dump doesn't hand an attacker your M-Pesa API access.
AES-256-CBC · per-site key from WordPress auth saltsSecret, per-site callback URL
Payment confirmations from Safaricom arrive at an unguessable URL unique to your site. Requests to the wrong address are rejected, so outsiders can't spoof a "payment received" notification.
Secret path token · legacy endpoint gated by Safaricom IP allow-listReplay & reuse protection
A transaction code can only ever complete one order. Duplicate callbacks for already-paid orders are ignored, and a code matched to one order is rejected everywhere else — no double-spending a single M-Pesa receipt.
Idempotent completion · matched-code lockingServer-side amount validation
Every confirmation is checked against the order total on your server. Underpayments never complete an order — the customer is automatically asked for the balance. Overpayments complete but are flagged for you.
Order-total reconciliation on every callbackOrder-ownership checks
Every payment request from the checkout page must prove it belongs to the order it references — via the order key, the logged-in customer, or the checkout session. Strangers can't probe or interfere with other people's orders.
hash_equals order-key comparison · session bindingPrivate, masked logs
Transaction logs are stored outside the web-served plugin folder with server-level access guards, customer phone numbers are masked, and sensitive fields are stripped before anything is written. Log retention is configurable and pruned automatically.
Protected log directory · PII masking · auto-pruningWordPress security fundamentals
Prepared statements on every database query, sanitized inputs, escaped outputs, nonce checks on every form and AJAX action, and capability checks on every admin function. The boring fundamentals, done everywhere.
WPCS-aligned · audited pre-releaseClean uninstall
Removing AlkaPay removes its data: options, transients, its callbacks table, and its log files. No credentials or customer traces left behind on a site that stops using it.
Full cleanup on uninstallCustomer data stays on your server
AlkaPay processes your customers' payment details (phone number, amount, M-Pesa receipt code) on your own WordPress site, as part of normal WooCommerce order handling. That data is never sent to AlkaPay — we have no server that receives it. Your site talks directly to Safaricom's Daraja API over HTTPS, and that's the whole data path. This matters for Kenya's Data Protection Act 2019: you remain the data controller, your customer data doesn't gain a new third party, and there's no extra cross-border transfer just because you installed a plugin. Details in our Privacy Policy.
Found something?
If you believe you've found a security vulnerability in AlkaPay, please report it privately before any public disclosure. We take reports seriously and respond quickly.