title: PayPal IPN security VERIFIED
body: <p>There is PayPal IPN PHP example code <a href="https://www.x.com/developers/PayPal/documentation-tools/code-sample/216623" rel="nofollow">https://www.x.com/developers/PayPal/documentation-tools/code-sample/216623</a></p>
  
  <p>Could somebody please tell me how it's secured as I don't get it?</p>
  
  <p>Example: I have an internet shop. I dont have https.</p>
  
  <ol>
  <li>receive a data from PayPal on our <a href="http://my-magazine.com/process_pp.php" rel="nofollow">http://my-magazine.com/process_pp.php</a> 
  This data is not encrypted because my site is on http. Am I right?
  So (if it's not encrypted) some hacker can change it.</li>
  <li>We send a https request to verify our payment on paypal.</li>
  <li>PayPal answers INVALID with http (not https) so hacker can change it again on VERIFIED. Hacker gets profit.</li>
  </ol>
  
  <p>Please tell me, where is my mistake. I am confused because other payment systems use <code>SecretKey</code> and then you should verify the hash they sent.</p>