Payment providers notify the site via webhooks. Razorpay and Cashfree use HMAC signatures; PayPal uses official signature verification. Extra protections include HTTPS requirement, per-IP rate limits, payload size limits, idempotency (no double credit) and redacted logs. Admins monitor deliveries under Webhook Logs and review the security checklist in Settings.