Online payment forms: how to set up orders and donations

An online payment form needs four things: the details you need to fulfill the order, prices and a total the buyer can check before paying, a payment step run by your payment processor (never card fields you build yourself), and an automatic receipt with your refund policy. Build those, then test every path in test mode before you share the link.

The steps below work the same for a bakery taking preorders, a studio taking class bookings, a club selling event places and a nonprofit taking donations.

Step 1: Decide what you need to fulfill the order

Start from what you must know to deliver the order, booking or gift, and collect nothing else. Every field before the payment step is one more reason to stop.

Ask for a phone number only if you will call or text about the order, as a delivery driver will. Otherwise make it optional or leave it out.

Step 2: Add the fields, with payment last

Put contact details first, then the order itself, then the total, and the payment step at the very end, so nobody pays before they have seen exactly what they are paying for.

Make a field required only when you cannot fulfill the order without it, and keep the marketing opt-in as a separate, unticked checkbox after the order details. Under the EU's GDPR, Recital 32 says pre-ticked boxes do not count as consent, and buying a loaf is not agreement to a newsletter. If some options apply only to some buyers (delivery addresses, a second attendee's name), show them with skip logic instead of asking everyone.

Step 3: Set prices, quantities and the total

Show the price on every option, let the form calculate the total, and show the subtotal, any discount, tax and the final total on separate lines before the payment step.

• Put the unit price in the option label, as in "Sourdough loaf, 800 g ($8.00)", so nobody has to look for it.
• Set a minimum and a maximum quantity for every item. The maximum is how you stop selling what you do not have.
• Show a delivery fee, an add-on or a second attendee's fields only when an earlier answer makes them relevant.
• Apply discounts before tax unless your local rules say otherwise, and round once, at the end.
• For recurring payments, state the amount, how often it is charged, when the next charge happens and how to cancel, right next to the pay button.

A worked total for two loaves and a jar of jam with a 10 percent discount code and 8 percent sales tax:

The same figure must appear on the form, in your payment processor's dashboard and on the receipt. Buyers notice a one-cent difference, and nobody on your side can easily explain it.

Step 4: Keep card details out of your form fields

Never ask for a card number, security code, online banking password or PIN in an ordinary form field. Card details belong only in the payment step that your payment processor provides.

Anything typed into a normal field is stored with the response, copied into exports and often pasted into notification emails. The Payment Card Industry Data Security Standard (PCI DSS) applies to any business that stores, processes or transmits card data, and it does not allow the card security code to be kept at all once a payment is authorized. A processor's payment element keeps card details on the processor's side, which is what keeps them out of your records.

The same rule covers full national ID or social security numbers you are not legally required to collect, and photos of cards or ID documents. If you must check age or identity, do it in person or with a service built for it.

Step 5: Write the receipt and the refund policy

Send a receipt automatically to every buyer, and put the refund policy on the form itself, next to the payment step, in two or three plain sentences.

A receipt should carry your business or organization name and a contact address, the date, the items, quantities and total including tax, an order reference, what happens next (pickup time, class date, event address) and the refund policy or a link to it. For donations, add the organization's legal name, its charity registration number where it has one, and whether the donor received anything in return. In the US, IRS Publication 1771 explains when a charity must give donors a written acknowledgment and what it must say; other countries have their own rules, so check with your accountant.

Refund policies to adapt:

Orders: You can cancel for a full refund until 24 hours before your pickup time. After that we cannot refund fresh goods, but we will replace anything that is wrong or damaged. Email us with your order number.

Bookings: Cancel up to 48 hours before your class for a full refund. Later cancellations and no-shows are not refunded, but you can move your booking once at no cost.

Events: Tickets are refundable until [date]. After that, you can transfer your ticket by emailing us the new attendee's name. If we cancel the event, everyone gets a full refund.

Donations: Donations are not normally refundable. If you gave the wrong amount by mistake, email us within 30 days and we will refund it.

Refund through the same payment processor rather than in cash, so the payment record and the refund stay together.

Step 6: Test the payment form, then go live

Run every path of the form in your payment processor's test mode before you publish, then make one small live purchase and refund it. Stripe, for example, publishes test card numbers that simulate a successful payment, a decline and a card that asks for extra authentication.

1. Order every product at least once, at the minimum and the maximum quantity.
2. Apply a valid discount code, an expired one and a mistyped one.
3. Compare the total on the form, in the processor's dashboard and on the receipt, to the cent.
4. Use a test card that is declined, and check that the buyer sees a clear message and no order is recorded as paid.
5. Open the receipt email on a phone and check the name, items, total and refund policy.
6. Issue a refund and check that both your records and the processor's show it.
7. Switch to live mode, place one real order with your own card, refund it, then delete all test responses.

Common mistakes

• Card details in a text field. Use the processor's payment step only.
• The total appears only after the buyer clicks pay. Show it on the form first.
• A required phone number you will never use. Make it optional or remove it.
• A pre-ticked newsletter box. Leave it unticked and separate from the order.
• No refund policy until the first refund request. Write it before launch and put it next to the payment step.
• Testing only the successful payment. Test declines, expired codes and refunds too.

Doing this in Claform

A Claform payment form is built in the same builder as surveys: you add products with prices and quantities, show the right options with logic, and set discount codes and tax per form, with tax applied after the discount. Buyers pay inside the form through your own connected Stripe account by card, Apple Pay, Google Pay or Link, and the submission is only accepted once Stripe confirms the payment. Each buyer gets an email receipt, you see every payment next to the answers, and refunds are issued from the dashboard. For nonprofits, the donation form adds suggested and custom amounts, a fundraising goal with a progress bar and, on Business, monthly giving. See order and payment forms and donation forms; to hear from buyers afterward, the post-purchase survey template is a good start.

Frequently asked questions

Is it safe to collect card details in an online form?

Only inside the payment step provided by a payment processor such as Stripe, where the card details stay with the processor. Never collect card numbers or security codes in a regular text field: they end up in your responses, exports and emails, and PCI DSS does not allow the security code to be stored at all.

Do I need my own payment processor account to take payments in a form?

Yes. Form tools connect to a processor account in your name, and the money is paid into that account and then to your bank on the processor's payout schedule. Setting one up means verifying your business details with the processor, so start it a few days before you need to take the first payment.

Should I show prices with or without tax?

Follow what buyers in your market expect. Consumer prices in the EU and the UK are normally shown including VAT, while US prices are usually shown before sales tax, which is then added at checkout. Either way, show the tax as its own line before the buyer pays, and check how your local rules treat discounts.

How should I handle refunds for orders taken through a form?

Publish the policy on the form before anyone pays, refund through the same processor so the record stays linked to the payment, and note the reason for each refund. If refunds cluster around one product, date or question on the form, the form or the offer needs fixing, not just the refund.

Start building for free