The Situation
City Permits operates a live transactional platform handling parking ticket payments and permit applications in Leeds, West Yorkshire. The site had been running reliably for years, processing payments through Barclays ePDQ without issue. Nothing was broken. Nothing felt urgent.
Then two things happened in quick succession.
In November 2025, an independent compliance scan carried out by SecurityMetrics returned a fail. The maximum vulnerability score was 10.0, the highest possible rating. PCI DSS, the Payment Card Industry Data Security Standard, is the security framework set by Visa and Mastercard and enforced in practice by the acquiring bank. It requires any business taking card payments online to maintain a minimum level of infrastructure security. The scan showed the site was running on software that had been unsupported for years, a PHP version with no security patches since 2016, alongside an outdated operating system, web server, and frontend library, each carrying known vulnerabilities. The site had never been compromised, but the exposure was real and formally documented. Continued non-compliance gives the acquiring bank grounds to raise fees, impose penalties, or ultimately suspend the merchant account and stop card processing entirely.
The upgrade work to bring the site into compliance was already underway when a second issue landed. Barclays sent notification that their ePDQ payment gateway service was being permanently terminated, with a hard cutoff of March 2026. City Permits was already mid-project on one critical problem and now had a second one running alongside it.
What We Did
We were already engaged on the compliance upgrade when the Barclays notice arrived. Rather than treat them as separate projects, we sequenced them tightly and ran the two workstreams together.
Phase one was the infrastructure and code upgrade. The application was migrated from a PHP version with no security support since 2016 to PHP 8.2, the current supported release. The application framework was rebuilt to modern standards, the frontend library was updated to remove documented security vulnerabilities, and the site was moved to a modern hosting environment, resolving the server-level issues identified in the scan. Security headers were added, an exposed source directory was locked down, and hardcoded credentials were removed from the codebase and moved to environment configuration. The SecurityMetrics compliance scan ran again on February 4, 2026. Maximum score: 0.00. Zero vulnerabilities. Passing.
With compliance confirmed, phase two began immediately. We migrated the payment integration from Barclays ePDQ to Stripe Checkout, completing the cutover ahead of the March 2026 deadline. The new integration uses webhook-based payment confirmation, which is significantly more reliable than the redirect-based callbacks the old gateway depended on. Stripe handles 3D Secure authentication natively, supports Apple Pay and Google Pay, and gives the City Permits team direct visibility into every transaction through the Stripe dashboard. There are no monthly gateway fees, only a per-transaction charge on successful payments.
Across both phases, the work delivered:
- PHP upgraded from an unsupported 2016 release to PHP 8.2
- Application framework rebuilt to modern standards
- Frontend library updated to remove documented security vulnerabilities
- Migrated to modern hosting, resolving server-level compliance failures
- Security headers added, exposed source directory locked down, hardcoded credentials moved to environment configuration
- SecurityMetrics compliance scan re-run: score 0.00, passing
- Payment integration migrated from Barclays ePDQ to Stripe Checkout, ahead of the March 2026 cutoff
- Webhook-based payment confirmation implemented, replacing fragile redirect callbacks
- 3D Secure, Apple Pay and Google Pay enabled
The Outcome
City Permits went from a failing compliance scan and a gateway facing forced shutdown to a fully compliant, modernised payment platform, with both problems resolved before either caused a disruption to the business. The SecurityMetrics pass report, dated February 4, 2026, shows zero vulnerabilities detected. The Stripe migration completed before the Barclays deadline.
The timing of these two issues arriving so close together was coincidence. The fact that neither resulted in downtime, suspended payments, or a missed deadline was not.
If you operate a transactional website and cannot remember the last time your infrastructure was independently assessed, that is worth sitting with. Platforms like this can run quietly for years with exposure accumulating underneath. The question is not whether a scan would find something. It is whether you would rather find it first.
What the business has as a result:
- PCI DSS compliance achieved and formally confirmed, February 4, 2026
- Zero vulnerabilities detected on re-scan, maximum score 0.00
- Gateway migration completed before the Barclays hard deadline
- No payment downtime at any point during either project
- Modern payment methods now supported: 3D Secure, Apple Pay, Google Pay
- Full transaction visibility through the Stripe dashboard
- Per-transaction pricing only, no monthly gateway fees
We delivered. Here is the evidence.
Visit the live site →
