Learn the 4 essential payment gateway types, how they work technically, and which one best fits your WooCommerce store's checkout flow and security needs.
If you run or are planning an online store, understanding the different payment gateway types available is essential before making any technical decisions. Not all gateways work the same way, not all integrate identically, and not all deliver the same experience to the end user. This article breaks down how they work under the hood, what the key technical differences are, and what factors you should know before implementing one.
What Is a Payment Gateway and How Does It Work?
A payment gateway is the technological intermediary that connects your online store with the customer’s bank and with the merchant’s acquiring bank. Its job is to capture payment data, encrypt it, forward it to the appropriate processor, and return an authorization or rejection within seconds.
The full process follows these steps:
- The customer enters their payment details in the checkout form.
- The gateway encrypts that data using TLS and transmits it to the payment processor.
- The processor queries the card-issuing bank to check whether sufficient funds are available.
- The issuing bank approves or declines the transaction.
- The gateway returns the result to both the store and the customer in real time.
All of this happens in under three seconds. The security standard that governs this flow is PCI DSS, which every party involved in card payment processing must comply with.
The 4 Main Payment Gateway Types
The most widely used classification divides payment gateway types by where the customer’s data is processed and hosted. Each model implies different levels of technical responsibility, regulatory compliance, and user experience.
Hosted Payment Gateways
With this model, the customer temporarily leaves your site to complete payment on an external page managed by the provider. PayPal Checkout and Redsys in its standard configuration are common examples.
Advantages: your store never handles card data directly, which dramatically reduces PCI liability. Drawback: the customer notices the domain change, which can create friction or cart abandonment if the external page doesn’t inspire confidence.
Self-Hosted Payment Gateways
The payment form lives on your own server. Card data is collected on your domain and transmitted to the processor via an API call. This gives you full control over design and user experience, but it demands much stricter PCI compliance because card data passes through your infrastructure.
This type suits businesses with technical teams capable of maintaining server security and passing periodic PCI audits.
Iframe or Embedded JavaScript Gateways
This is today’s most popular hybrid model. The payment form renders inside your page via an embedded component (iframe or JavaScript SDK), but data is transmitted directly to the provider’s server — never yours. Stripe Elements and Braintree Drop-in UI work this way.
The result: the visual experience feels native (the user never leaves your domain), yet PCI liability stays minimal because sensitive data never touches your server. For most stores, this is the sweet spot between UX and security.
Direct API Gateways with Redirect Option
Some providers offer both a redirect option and direct API integration. With the API integration, the merchant builds their own form and tokenizes card data before sending it. This requires more development effort but enables complete customization of the checkout flow.
Payment Gateway Types: Side-by-Side Comparison
| Type | Data on Your Server | PCI Liability | UX | Technical Effort |
|---|---|---|---|---|
| Hosted | No | Low | Visible redirect | Low |
| Self-Hosted | Yes | High | Fully native | High |
| Iframe / Embedded JS | No | Low–Medium | Native (no redirect) | Medium |
| Direct API | Partially (token) | Medium | Fully customizable | High |
Technical Factors That Are Rarely Mentioned
“Best payment gateway” roundups tend to focus on fees and brand names. But when the context is WordPress or WooCommerce, several other technical factors matter just as much:
Tokenization and Recurring Payments
If your business model includes subscriptions or repeat orders, you need a gateway that supports card tokenization. The token replaces the real card data for future charges so the customer doesn’t have to re-enter their details. Not every gateway offers this natively, and some charge for it as an add-on module.
3D Secure 2 (3DS2) and Conversion Rates
Since the PSD2 directive came into force in Europe, Strong Customer Authentication (SCA) is mandatory for most online payments. Modern gateways implement 3DS2, which enables frictionless authentication — no manual approval from the user — when the risk analysis allows it. Older or less up-to-date gateways still rely on 3DS1, which always requires the user to validate the payment and significantly increases checkout abandonment.
Webhooks and Asynchronous Payment Confirmation
Some gateways confirm payments synchronously — an immediate response within the same HTTP request. Others do so asynchronously via webhooks, sending a POST notification to your server once the bank confirms the charge, which can take seconds or even minutes. This difference directly affects how you need to manage order status in WooCommerce and the logic on your server side.
Most Relevant Gateways in the Spanish Market
The Spanish ecosystem has some unique characteristics. Redsys is the dominant bank-backed gateway, used by the vast majority of Spanish banks for their virtual POS terminals. Its technical integration is more manual than international solutions, but it carries established trust and recognition among local users.
Stripe leads on integration ease and technical documentation, with native support for 3DS2, recurring payments, and a very mature SDK for WordPress and WooCommerce. PayPal remains a common option — primarily as an alternative for users who prefer not to use a card directly. MONEI has gained ground as a Spanish-built solution with competitive pricing and solid WooCommerce integration.
Frequently Asked Questions About Payment Gateways
Can a WooCommerce store use multiple payment gateways at the same time?
Yes. WooCommerce lets you activate multiple payment methods simultaneously. A common setup combines a card gateway (Stripe or Redsys) with PayPal as an alternative. The customer chooses their preferred method at checkout. This boosts conversion by removing friction for users with different preferences.
Which payment gateway has the lowest fees?
It depends on your sales volume. At low volumes, the difference between 1.4% and 1.8% per transaction is marginal. At high volumes, that gap translates into thousands of dollars a year. Bank-backed gateways (Redsys through your bank’s virtual POS) often have negotiable rates based on volume. International options like Stripe have fixed but predictable pricing.
Does the payment gateway affect my store’s SEO ranking?
Not directly. But it can have an indirect impact: a gateway that causes slow redirects or introduces errors in the payment flow raises checkout abandonment rates, which is reflected in behavioral metrics that Google may interpret negatively. The loading speed of the payment form counts too.
Is an SSL certificate required for any payment gateway?
Yes, without exception. All payment gateways require the domain to have active HTTPS. Without a valid SSL certificate, gateways reject the integration and browsers display security warnings that deter customers.
If you’re weighing which payment integration approach makes the most sense for your specific project, my services page covers how I approach WooCommerce store development with gateway configurations tailored to each business model.
My Take as a WordPress Developer
What I see time and again is that many projects choose a payment gateway out of inertia — “PayPal because I know it” or “Redsys because my bank offers it” — without evaluating whether that choice actually fits the checkout flow they want to build. When I approach a payment integration, the first thing I analyze isn’t the fee — it’s the data flow: where the server touches sensitive data, how the gateway handles network errors, and whether the webhook logic is compatible with how WooCommerce updates order statuses. These are details that rarely appear in comparison guides, but they determine whether checkout holds up reliably under real load.
Need help with your project? I work with businesses and agencies on WordPress, WooCommerce, AI and integrations. Get in touch and we can discuss it.
