Say you photograph weddings in Patna. Six bookings a month, advances already collected over UPI, and a new site going up, so the obvious question is which payment gateway to integrate. The sensible answer is an uncomfortable one: for six bookings a month, probably none yet. Integrating one means taking on KYC paperwork, a per-transaction cut, a settlement cycle and a plugin to maintain, in order to automate something currently done perfectly well by hand in thirty seconds. That framing rarely appears in the guides, because a tutorial about a full checkout is more interesting to write than one about a QR code on a booking page. Payments on a small site are a ladder, and the most common mistake is jumping to the top rung because that is what the tutorials demonstrate. Here is the ladder, and how to tell which rung you are actually on.
rung one: a UPI ID and a payment link
If you take a handful of payments a month, you need somewhere on the site that says how to pay and a way to confirm you were paid. A UPI ID displayed as text, plus a QR code image, does that. Most gateways also issue payment links without any website integration at all: you create a link for an amount, send it on WhatsApp, and the customer pays by card, netbanking or UPI. No plugin, no code, no developer.
The cost of this rung is your attention. You confirm each payment manually and you send the receipt yourself. For low volume that is a few minutes a week, which is cheaper than any integration. Do add a payments or booking page to the site rather than burying the details in a footer, and the structural advice in my beginner’s guide to building a site in India applies here as much as anywhere.
the ladder, and where each rung runs out
| Rung | Suits | It stops working when |
|---|---|---|
| UPI ID and QR on a page | A few payments a month | You lose track of who paid for what |
| Gateway payment links | Custom amounts, invoices, advances | You are creating links all day |
| Gateway buttons or a simple checkout plugin | A short, stable product list | You need stock, variants or shipping |
| WooCommerce with a gateway | A real catalogue and repeat orders | Rarely, but it needs maintaining |
Read that third column rather than the first. The right rung is the one just below the point where your current method causes mistakes, and moving up is easy. Moving down, after you have built a store you do not need, feels like failure and so people never do it.
what a gateway actually does for you
A payment gateway is not just a form. It handles the card networks, netbanking, UPI collect requests and wallets behind one interface; it deals with two-factor flows; it keeps the audit trail; and it takes the compliance burden of touching card data away from you. That last point is the one worth paying for.
KYC, and why onboarding is not instant
Every gateway must verify who you are before it moves money for you. Expect to submit PAN, bank account details in the business’s name, and address proof, plus GST registration and incorporation documents if you are a registered entity. Individuals and sole proprietors can usually sign up, but the list differs by provider.
Budget days, not minutes. A mismatch between the name on your bank account and the name you typed during signup is the classic delay, and it is tedious to unpick. Start the paperwork a couple of weeks before you want to launch.
settlement is not the same as payment
When a customer pays, the money reaches the gateway, not your bank. It is transferred to you on a settlement cycle, commonly a couple of working days, and holidays and weekends stretch that. New accounts sometimes sit on a longer hold while the provider builds confidence in the account.
So plan cashflow around the settlement date, not the order date. A dashboard showing a healthy day’s sales is not money you have. The provider also deducts its cut before settling, which means the amount landing in your account will not match your order total, and reconciling those two is a normal part of running this.
do not store card details. ever.
Let me be blunt about this one. Card numbers, CVVs and expiry dates must never touch your database, your logs or your email. In India this is a rule, not just good practice: RBI’s card-on-file directions say no entity in the card payment chain other than card issuers and card networks may store actual card data. The moment they do, you have inherited a compliance obligation you are not equipped to meet, and a breach becomes your problem rather than an inconvenience.
The correct pattern is to let the gateway collect the card, either on its own hosted page or in an iframe it controls, and hand your site back a token or a payment ID. Your database stores that reference, which is useless to anyone who steals it. This keeps the heavy PCI DSS scope with the gateway, which is exactly what you are paying them for. Any plugin or freelancer suggesting you save card data to “make repeat orders easier” should be politely declined.
The safest data is the data you never had. If your server cannot see a card number, it cannot leak one.
when WooCommerce earns its weight
WooCommerce is capable and free, and it is also a genuine commitment: more plugins, more updates, a heavier database and a checkout you are now responsible for. It earns that when you have real inventory, product variants, shipping rules, coupons or customers who reorder. It does not earn it for three products and a booking form.
If you do go there, install the gateway’s official plugin rather than a third-party bridge, keep the number of extensions small, and test the whole checkout on a phone over mobile data. Store checkouts are the heaviest pages on most small sites, and an abandoned cart on a slow connection is indistinguishable from no interest at all, which is why the work in making WordPress fast on Indian broadband matters more on a store than on a blog.
refunds, failures and the habit of reconciling
Decide your refund policy before your first sale and publish it on a page of its own. Most gateways let you refund fully or partially from the dashboard, and the money takes several working days to reach the customer’s account because it travels back through the same chain. Tell the customer that up front and you will halve the follow-up messages.
Failed and pending payments deserve equal attention. A UPI collect request that times out, a netbanking session abandoned midway, or a card that needs an extra authentication step all leave records in a half-finished state. Check the gateway dashboard for pending items weekly. And make sure the confirmation email actually reaches customers, which for most small sites means routing it through an authenticated relay as described in why your contact form email never arrives.
invoices, GST and where I stop talking
Taking money online creates records, and those records have tax implications that depend on what you sell, where your customers are and whether you are registered. Digital services, physical goods and services delivered in person are treated differently, and thresholds change.
So here is my honest limit: I can tell you that your site should generate a numbered invoice for every order, that it should carry your business details and the customer’s, and that you should keep those records somewhere you can export. Whether you need GST registration, what rate applies, and how to treat customers in other states is a question for a chartered accountant, and one conversation costs far less than getting it wrong for a year.
choosing a provider on volume, not features
Every gateway’s marketing page lists the same features. What actually differs for a small Indian site is the per-transaction cut, whether there is a setup or annual fee, how long settlement takes, how painful onboarding is, and whether support answers a human question. Razorpay, PayU, Cashfree, Instamojo and the older CCAvenue all serve this market; the documentation quality and the support experience vary more than the feature lists do.
Compare on those five things, sign up with one, and do not integrate two gateways on a small site to hedge. Two checkouts means twice the reconciliation and twice the surface to keep updated, for no customer benefit whatsoever.
FAQ
Can I just take UPI and skip gateways entirely?
For low volume, yes, and plenty of small businesses in India run exactly that way. The limits show up in bookkeeping rather than technology: you match payments to orders by hand, you have no automatic receipts, and refunds are a manual transfer. When that matching starts costing you evenings or producing mistakes, move up a rung.
How much does a gateway cost?
Nearly all of them take a percentage of each transaction, and the percentage differs by instrument, with UPI generally the cheapest and international cards the most expensive. Some add an annual or setup fee. Read the current pricing page rather than trusting any article, including this one, because these numbers move and vary by the volume you commit to.
Do I need an SSL certificate and a company to take payments?
HTTPS is non-negotiable and free through automated certificates, so that is settled. A registered company is usually not required: many providers onboard individuals and sole proprietors, though the document list is longer and some features are restricted. Check the specific provider’s onboarding requirements before you plan around it.
What if the payment succeeds but my site does not record the order?
This happens, usually when the customer closes the tab before being redirected back. Which is why gateways send server-to-server webhooks as well as redirecting the browser: the webhook is the reliable signal. Make sure it is enabled and pointing at your live domain, and check the failed-webhook log after any host move or domain change.
Take payments with the simplest tool that your current volume justifies, and let the volume tell you when to climb. Every rung you add is real maintenance, so make the site earn it first.
Update history: stated India’s rule on storing card data and replaced the regulator homepage link with the specific RBI circulars.
Sources
Primary references for the claims above. Where this guide and a regulator or provider disagree, trust the official source — rules and pricing change faster than articles do.
- Razorpay developer documentation — payment links, checkout integration, webhooks and settlement behaviour.
- NPCI — the operator of UPI, and the source for how the underlying rails work.
- RBI: Tokenisation – Card Transactions: Permitting Card-on-File Tokenisation (CoFT) Services (7 September 2021) — states that no entity in the card payment chain other than card issuers and card networks may store actual card data.
- RBI: Restriction on storage of actual card data [Card-on-File] (23 December 2021) — the follow-up circular on card-on-file storage.
- RBI Master Directions — lists the Master Direction on Regulation of Payment Aggregator (PA), dated 15 September 2025.