Worldpay eProtect
Worldpay eProtect is a cloud service for card-not-present payments that reduces how much payment card data passes through a merchant’s systems.
What Worldpay eProtect is
Worldpay eProtect is a cloud service for card-not-present payments that reduces how much payment card data passes through a merchant’s systems. It substitutes a low-value Registration ID for card details, then Worldpay can exchange that ID for an OmniToken during authorization, a sale, or token registration. The token may support card-on-file transactions, returns, and recurring billing. Merchants can integrate through a hosted iFrame, a JavaScript Customer Browser API, or a Mobile API. The iFrame hosts card number, expiration date, and CVV2 fields in Worldpay’s PCI-compliant environment; the JavaScript option validates and encrypts the account number before sending it to Worldpay. Worldpay says card data does not travel through the merchant’s web server and that eProtect reduces applicable PCI controls. The guide also covers Apple Pay, Apple Pay on the Web, Google Pay, and Visa Checkout. Before production, an organization must be enabled and certified to process OmniTokens, obtain a PayPage ID, and pass eProtect certification testing. The token exchange does not validate CVV, AVS, or expiration dates.
Good
- Offers iFrame, JavaScript, and Mobile API integrations
- Can support card-on-file payments and recurring billing
- Card data does not pass through the merchant web server
- Guide covers Apple Pay and other listed wallets
Watch out
- Requires OmniToken enablement and certification before use
- Requires a PayPage ID from an implementation consultant
- Token exchange does not validate CVV, AVS, or expiration dates
- Pricing is available on request
Who it suits
eProtect is aimed at merchants handling card-not-present payments who need tokenization and integration options for web or mobile checkout. Organizations must meet the stated OmniToken onboarding and certification requirements before production use.
Verdict
Worldpay eProtect offers multiple integration paths and replaces card details with a token flow for supported follow-on transactions. Buyers should account for its onboarding requirements and the fact that the token exchange does not validate CVV, AVS, or expiration dates.
The facts
Each one read from Worldpay eProtect's own pages, with the date it was checked.
What it does
- Accessibility
- The guide says iFrame version 4 improves screen-reader accessibility for expiration fields and error messages; version 3 lacks those upgrades.checked 7 Oct 2026
- Availability
- Worldpay says primary and secondary endpoint routing supports high availability for eProtect JavaScript API version 3 or higher.checked 7 Oct 2026
- Card data handling
- The guide states that card data is not transmitted through the merchant web server and that the token server stores the card number but not CVV or expiration date.checked 7 Oct 2026
- Certification
- The guide says successful eProtect certification testing is required before production use.checked 7 Oct 2026
- Checkout features
- The iFrame offers real-time inline field validation, configurable payment-form behaviors, and account-number auto-formatting based on card type.checked 7 Oct 2026
- Follow-on payments
- The guide says an OmniToken may be used for card-on-file transactions, returns, and recurring billing.checked 7 Oct 2026
- Hosted card fields
- With the iFrame API, payment card fields are hosted from Worldpay’s PCI-compliance environment instead of being embedded in the merchant checkout page.checked 7 Oct 2026
- iFrame fields
- The iFrame API hosts sensitive payment fields, including card number, expiration date, and CVV2, in Worldpay’s PCI-compliant environment.checked 7 Oct 2026
- Integration methods
- The guide describes iFrame API, JavaScript Customer Browser API, and Mobile API integrations.checked 7 Oct 2026
- Integration options
- The guide describes iFrame, JavaScript Customer Browser API, and Mobile API integration options.checked 7 Oct 2026
- JavaScript handling
- The JavaScript API validates and encrypts the account number before sending it to Worldpay and returns a Registration ID in its place.checked 7 Oct 2026
- Onboarding requirement
- Before using eProtect, an organization must be enabled and certified to process OmniTokens and obtain a PayPage ID from its eProtect Implementation Consultant.checked 7 Oct 2026
- Payment methods
- The guide includes integration instructions for Apple Pay on the Web, Google Pay, and Visa Checkout.checked 7 Oct 2026
- Payment types
- The eProtect PCI Non-Sensitive feature can tokenize private-label and Worldpay gift cards, subject to the Worldpay message interface specification.checked 7 Oct 2026
- Prerequisites
- Before using eProtect, an organization must be enabled and certified to process OmniTokens and obtain a PayPage ID from its eProtect Implementation Consultant.checked 7 Oct 2026
- Purpose
- eProtect is designed for card-not-present payments and reduces the amount of payment data in a merchant’s systems.checked 7 Oct 2026
- Security and PCI
- Worldpay says no card data is transmitted through the merchant’s web server and that eProtect reduces applicable PCI controls.checked 7 Oct 2026
- Support
- The guide lists 24/7 technical support for critical production issues and says technical support representatives respond to eCommerce technical issues within 15 minutes.checked 7 Oct 2026
- Token flow
- eProtect returns a low-value Registration ID, which Worldpay can exchange for an OmniToken during authorization, sale, or token registration.checked 7 Oct 2026
- Tokenization
- It exchanges card details for a low-value Registration ID, which is exchanged for a Worldpay token during a transaction.checked 7 Oct 2026
- Token use
- The guide says the resulting OmniToken can be used for follow-on transactions such as card-on-file, returns, and recurring billing.checked 7 Oct 2026
- Validation limit
- The guide states that eProtect’s token exchange does not check CVV or AVS information and does not validate expiration dates.checked 7 Oct 2026
- Wallets
- The guide includes eProtect support sections for Apple Pay, Apple Pay on the Web, Google Pay, and Visa Checkout.checked 7 Oct 2026
The company
- Company headquarters
- Worldpay states that it is headquartered in Cincinnati, Ohio, United States.checked 7 Oct 2026
Alternatives to Worldpay eProtect
- 1
DeloPay
AndroidiOSWebAPI7.7From $2.25 a month - 2
IXOPAY
AndroidiOSWebAPI7.6From $1,000 a month - 3
American Express Token Service
AndroidiOSWebAPI7.3 - 4
PayU
AndroidiOSWebAPI6.6 - 5
Basis Theory
AndroidiOSWebAPI6.4From $995 a month - 6
Hyperswitch Card Vault
Free planAPILinuxSelf-hosted6.4Free plan