Payment Gateway Health (payment-gateway-health)

Summary

Detects payment SDKs in HTML and probes gateway reachability/latency.

Classification

• Category: ECOMMERCE
• Plugin id: payment-gateway-health
• Version: 1.0.0
• Target types: WEBSHOP
• Weight class: LIGHT
• Risk level: not set on plugin object
• Browser required: No (HTTP / Node / other — see source)
• Tier / group: Tier 1 — HTTP-only

Schedule

• scheduleHints: { defaultInterval: '0 */3 * * *', priority: 5 }
• Prerequisites: None declared on this plugin.

Configurable inputs

Public keys are derived from inputSchema: z.object({ ... }) (underscore-prefixed keys are runtime-only and omitted here).

Field	Notes
timeout	Zod field in inputSchema — see source for defaults, min/max, and .describe().
gateways	Zod field in inputSchema — see source for defaults, min/max, and .describe().

Runtime / injected config

• None documented beyond standard worker context (target, config, logger, reportProgress). Underscore-prefixed keys are internal.

Checks that produce findings

These checks run inside this plugin during a single test run. They are not separate tests in the database — each becomes a Finding linked to the Run for payment-gateway-health.

Gateways auto-detected from HTML regex: Klarna, Vipps, Stripe, Nets/Nexi (DIBS), PayPal, Adyen, Bambora, Svea. Override with config gateways.

Check	Typical severity	Why
Payment gateway unreachable	WARNING	HEAD to provider SDK/health URL returned unreachable or HTTP ≥500 — checkout may fail for that method.
Gateway responding slowly (> 5000 ms)	INFO	Same probe succeeded but latency >5s — degraded checkout UX.

How each check works

1. Detect — GET storefront HTML; match PAYMENT_PATTERNS unless gateways config overrides. If fetch fails or no match, default to Klarna, Vipps, Stripe, Nets/Nexi.
2. Probe — For each known gateway, HEAD healthUrl if defined else statusUrl (10s timeout default). Reachable = status < 500.
3. Findings — Unreachable → WARNING with status URL for human verification. Latency >5000 ms → INFO.
4. Score — −25 per down gateway, −10 per slow gateway.

Built-in health endpoints include e.g. js.klarna.com/..., api.vipps.no/healthcheck, js.stripe.com/v3/, checkout.dibspayment.eu/..., PayPal SDK URL, Adyen live shopper SDK. Bambora/Svea fall back to marketing/status pages only.

Caveats and concerns

• SDK reachability ≠ checkout — HEAD to JS CDN does not prove merchant credentials or live payment flow works.
• False detection — Regex on HTML may match comments, docs, or unrelated strings.
• WEBSHOP-only — Plugin does not run on plain WEBSITE targets.
• Regional gateways — Default fallback is Nordic-heavy; global shops may need explicit gateways list.
• 401/403 on SDK URLs — Some providers return 403 to bots but still load in browser — may false-positive as “unreachable” if status ≥500 logic differs (reachable if status < 500).

Source

packages/test-plugins/src/plugins/payment-gateway-health.ts