Bank account number and Sort Code in a form [closed]

This sounds like bad news. There are many technical and legal hurdles involved in collecting bank info online. It is easy to mess up.

All SSL does is protect information in transit between a browser (person filling the form) and the server.

Once it gets to the server you need to handle it properly. If you plan to use a common form plugin, the info will most likely get stored in your DB or emailed as plain text; that’s bad. I’d be sceptical of encryption plugins as well unless they were audited, even then you may have another rouge plugin that can cause issues.

I’d start by looking into the following:

  • Your local/national regulatory requirements

  • Where the bank info goes after the owner get’s it. Is it a third party? Do they offer a secure API or portal you can leverage?

  • PCI compliance. Even though you probably don’t fall into its scope they can give you an idea of how this type of information is handled

Related Posts:

  1. what is a auth_user_file.txt?
  2. How to view PHP on live site
  3. Is moving wp-config outside the web root really beneficial?
  4. Hide the fact a site is using WordPress?
  5. Verifying that I have fully removed a WordPress hack?
  6. Can I Prevent Enumeration of Usernames?
  7. Best way to eliminate xmlrpc.php?
  8. If a hacker changed the blog_charset to UTF-7 does that make WordPress vulnerable to further attacks?
  9. Should I remove install.php and install-helper.php?
  10. Are Nonces Useless?
  11. What is the difference between esc_html filter vs attribute_escape filter?
  12. How do I technically prove that WordPress is secure?
  13. Which KSES should be used and when?
  14. How do WordPress Nonces Work?
  15. How can I easily verify a core or plugin update has not broken anything?
  16. Disable comment windows for all existing posts (pages/blogposts)
  17. Generate WordPress salt
  18. Vanilla WordPress install, what can/should I put in disable_functions?
  19. Stop wordpress automatically escaping $_POST data
  20. Secure my “add_settings_field” translation?
  21. how can i embed wordpress backend in iframe
  22. Handling nonces for actions from guests to logged-in users
  23. Can I force a password change?
  24. How brute-forcer knows that the password is cracked for target username?
  25. wp_insert_post disable HTML filter
  26. What is pclzip.lib.php file that wordfence think it’s a malicious code
  27. Can someone (Support of my themeprovider) get access to my server If I send them my admin login?
  28. How to disable XML-RPC from Linux command-line in a total way?
  29. How to remove javascript malware in wordpress site [closed]
  30. Completely remove the author url
  31. Securing my WordPress Files and Directories
  32. Restricting access to content
  33. About WordPress site security
  34. Single sign-on: wp_authenticate_user vs wp_authenticate
  35. How to allow internal links using wp_kses filtration
  36. How does Cross Site Scripting (XSS) work exactly? [closed]
  37. Relative security of different releases of WordPress
  38. How does the “authentication unique keys and salts” feature work?
  39. vs WordPress Security
  40. esc_html__ security : what for in this example?
  41. Using HTACCESS for Secret Access
  42. wp-config.php being written by attacker
  43. Definitive wordpress directory ownership and permissions on linux
  44. XML-RPC errors they know my username?
  45. Is [admin / admin] acceptable for all local websites?
  46. Simple Online Payment for Event Registration [closed]
  47. What may be causing failure of auto-install features in WordPress (v3.0.3)?
  48. Client side HTTP parameter pollution (reflected)
  49. Local file inclusion critical security issue [closed]
  50. Malware script in database post table only? [closed]
  51. Best practices to assert current_user_can() with guests
  52. wordpress website host price and security [closed]
  53. XMLRPC slow and weird websites/services
  54. Are there security risks in working directly in the themes folder that builds into a theme folder?
  55. Is it safe to hand over the admin rights?
  56. how much information can we hide when using wordpress cms?
  57. How to find exploited wordpress plugin [closed]
  58. How I can open back door for myself?
  59. System setting changed by system user
  60. Does meta-data need to be sanitized?
  61. How can I force a specific password?
  62. Are SVG image files safe to upload? Why WP defines them as a security risk? [duplicate]
  63. Who updates the wp-admin/core file?
  64. How WordPress sanitizes post content on save? Or it doesn’t?
  65. Does this code indicate an exploit?
  66. How to prevent to direct access of my custom plugin folder/files
  67. Checking for origin of a xmlrpc request
  68. RESTRICT EDIT of PHP files?
  69. wp-content – permissions for files/folders created by apache
  70. How can I restrict access to specific parts of a page, not just the page itself?
  71. Has anyone developed a anti-spam plugin to simply allow users to BLOCK whatever they wish to, but one that will also go easy on IP addresses?
  72. User generated content and security
  73. Monitor wordpress all external calls
  74. HSTS header not being added correctly
  75. how to protect wordpress content from crawler
  76. Securing WordPress running on Azure platform
  77. Can WordPress admin user + database credentials be used to gain Cpanel or FTP access?
  78. Should I worry about SQL injection when using REST API?
  79. Spam Registrations
  80. Links to root domain from search engines don’t work, but direct links and links from other referrers do
  81. How can I backup my site if it gets hacked?
  82. How can I have more confidence that WP plugins aren’t getting and storing user data?
  83. Standard Method for Securing a WordPress Site
  84. Avoid ‘uploads’ 777 permissions: Potential threat or clean solution?
  85. Secure Multiple WordPress Installations on shared hosting
  86. Any way to disable /wp-login.php redirecting to the site folder?
  87. Able to go to WordPress admin even after deleting auth cookies from request headers
  88. Is WordPress ready for GDPR compliance? [closed]
  89. Step by Step Instructions for Making Media/Uploads Private to Only Logged-In Users
  90. Secure a WordPress website in 2019: one plugin or a combinations of them?
  91. What are the different types of firewall protections available for a WordPress website?
  92. Should WordPress Add Options to Enhance Security or Leave it to plugin developers? [closed]
  93. Competitor is somehow accessing MetaData on a hidden WordPress site
  94. WordPress Hacks/Defacing [closed]
  95. checking the form submit in right order
  96. Our security auditor is an idiot. How do I give him the information he wants?
  97. SSH keypair generation: RSA or DSA?
  98. How do I protect my company from my IT guy? [closed]
  99. Does changing default port number actually increase security? [closed]
  100. WordPress – tracking options