Pay Drop Documentation

Everything you need to sell your first file with PayDrop, from installation to the day-to-day work of adding products. If something is not covered here, use the contact form.

1. Installation

1. Log in to the Joomla administrator as a Super User.
2. Go to System → Install → Extensions.
3. On the Upload Package File tab, drop in pkg_paydrop.zip.

The package installs one component and four plugins, and enables all of them:

• PayDrop — the component, where your products and sales live
• System – PayDrop — guards the thank-you page, verifies payments, issues download links
• Content – PayDrop — turns the shortcode into a buy button
• Button – PayDrop — the button under the editor that inserts shortcodes
• Privacy – PayDrop — lets Joomla's privacy tools export and anonymise buyer data

A folder called /files/ is created and closed to the web for you. If any plugin ends up disabled, enable it in System → Plugins by searching for paydrop.

2. Preparing your PayPal account

PayDrop verifies every payment with PayPal before serving a file. For that it needs a PDT identity token.

1. Sign in to paypal.com with the business account that receives payments.
2. Click the gear icon (Account Settings), then Website payments in the left menu.
3. Next to Website preferences click Update.
4. Set Auto return to On and enter any return URL. PayPal will not enable PDT without this.
5. Set Payment data transfer to On.
6. Scroll down and click Save. The token is not shown until you save.
7. Open Website preferences → Update again. The Identity Token now appears under Payment data transfer.

While you are on that page: set PayPal account optional to On if you want buyers to be able to pay by card without opening a PayPal account. Leave Encrypted website payments off — it is unrelated.

3. Options

Open Components → PayDrop → Products and click Options in the toolbar.

PayPal

• PayPal e-mail — the account that receives payments.
• PDT identity token — the token from step 2.
• Verify payments (PDT) — leave this on. With it off, anyone who knows a product token can download without paying.
• Show card form first — sends buyers straight to the card form instead of the PayPal login. Requires PayPal account optional on the PayPal side.
• PayPal sandbox — for testing with a sandbox account.

Downloads

• Files folder — where your files live. Pick it from the list; PayDrop closes it to the web by itself.
• Link lifetime (hours) — how long a download link stays valid after payment. Default 72.
• Maximum downloads — how many times one link may be used. 0 means unlimited until it expires.
• Button text — the wording on the download and buy buttons.

E-mail

• E-mail the link to the buyer — on by default, and worth keeping on.
• Subject and Message — your own wording. Placeholders: {name}, {product}, {link}, {hours}, {sitename}. Leave empty for the built-in text.

Mail matters. Set your site to SMTP in Global Configuration → Server → Mail, and make sure the From address is the same as the SMTP account. Most hosts silently reject mail when they differ, and PHP's own mail function reports success even when nothing was delivered.

4. The thank-you page

Create one ordinary Joomla article, for example titled Thank you, with a short message. This is where PayPal returns your buyers, and where the download button appears.

One article is enough for every product. It is unreachable without a valid token, so nobody stumbles onto it.

5. Adding a product

Components → PayDrop → Products → New

• Product name — shown on the PayPal checkout page.
• Thank-you article — the article from step 4.
• Upload file — upload the file you are selling. It goes into the protected folder and is selected below automatically.
• File name — or pick a file that is already in the folder.
• Product token — leave empty and a strong one is generated.
• PayPal item number — a unique id per product, for example ebook-01. Recommended: it stops a payment for a cheap product from unlocking an expensive one.
• Price and Currency.

Save. The edit screen then shows the shortcode for this product, something like Pay and Download.

6. Putting the buy button on a page

Open the article where you sell the product and either paste the shortcode, or click the PayDrop button under the editor and pick the product from the list. Nothing else is needed — price, name and return address all come from the product.

If the shortcode shows up as plain text on the page, the Content – PayDrop plugin is disabled.

7. What the buyer sees

1. Clicks the button and pays at PayPal, with an account or by card.
2. Comes back to your thank-you page. The address is cleaned of PayPal's parameters, so their name and e-mail are not left in the URL.
3. Clicks Download and gets the file.
4. Receives the same link by e-mail, valid for as long as you configured.

8. Sales

Components → PayDrop → Sales & Downloads lists every verified purchase: buyer name and e-mail, amount, PayPal transaction id, how many times the link was used, and when it expires. The three figures at the top are your totals.

9. Folder protection

PayDrop writes .htaccess, web.config and an empty index.html into your files folder, and shows the status above the product list. Green means direct downloads are blocked.

On nginx those files are ignored, and PayDrop tells you so. Add the rule to your server configuration instead:

location ^~ /files/ { deny all; }

You can check it yourself at any time: open the direct address of one of your files in a private browser window. It must return 403 Forbidden. If the file downloads, the folder is not protected.

10. Troubleshooting

The shortcode is printed as text

The Content – PayDrop plugin is disabled, or the page is cached from before you added it. Enable the plugin and clear the cache.

“Access forbidden” on the thank-you page

Expected when the page is opened without a valid token, and after PayDrop has cleaned the address. If it happens right after a real payment, check that the PayPal item number on the product matches what PayPal sent back, and that the PDT identity token is correct.

The buyer got no e-mail

Almost always the site mailer. Send a test mail from Global Configuration → Server → Mail, use SMTP, and make sure the From address matches the SMTP account. The download link is also shown on screen, so the sale is not lost.

Two buyers got the same file

This cannot happen on a current version — tokens are never written into cached HTML. If you see it, clear the Joomla cache and make sure you are on the latest release.

The download link stopped working

It expired, or it reached the download limit. Both are set in Options. You can raise the limits at any time; they apply to links issued afterwards.

11. Privacy

PayDrop stores, for each sale: buyer name and e-mail as supplied by PayPal, the amount, the PayPal transaction id and a download counter. The bundled privacy plugin lets Joomla's own privacy tools export that data or anonymise it when someone asks to be forgotten.

The only outgoing connection is the verification request to PayPal when a buyer returns from checkout. There is no telemetry and no licence check.

12. Updates

Your purchase includes a licence key. Open System → Update → Update Sites, find the PayDrop entry, and put your key into the Extra Query field like this:

dlid=SA-XXXX-XXXX-XXXX-XXXX

From then on System → Update → Extensions offers new versions like it does for any other extension. If no update shows up after a new release, clear the update cache first — Joomla caches update sites.