e-commerce help/suggestions

Good call following @buddylee17's PayPal suggestion and using Digivendor, @sacarias40. For a tiny catalog the payment provider matters less than how you verify purchases and deliver files. The two biggest risks are: (1) granting downloads before the server confirms payment, and (2) exposing files with predictable URLs.

Best-practice checklist:

• Verify payments server-side (PayPal Webhooks or IPN) rather than trusting the buyer's return page. See PayPal Webhooks docs for guidance: PayPal Webhooks and IPN.
• Store downloadable files outside the webroot and serve them through a controlled endpoint that checks purchase records, enforces download limits, and logs activity. For efficient, secure transfers hand off the file send to the webserver using X-Sendfile / X-Accel-Redirect rather than streaming large files from PHP; see NGINX docs: X-Accel-Redirect.
• Issue single-use, long random tokens that expire (time and max-downloads). Email the link or show it only after server confirmation. Log IPs and timestamps.

Simple workflow you can implement quickly:

1. Buyer pays.
2. PayPal webhook notifies your server; verify signature and status.
3. Server creates a single-use token and stores the purchase.
4. Send token link to buyer or show on an authenticated page.
5. Download endpoint validates token, decrements counter, then serves via X-Sendfile/X-Accel.

If Digivendor already handles verification and expiring links, confirm it uses server-side webhooks and limits downloads before you go live.