From the paypal site ;
Quote:
Merchants and partners use Instant Payment Notification (IPN) to receive notifications of events related to PayPal transactions. The IPN message service requires that you acknowledge receipt of these messages and validate them. This process includes posting the messages back to PayPal for verification. In the past, PayPal has allowed the use of HTTP for these postbacks. For increased security going forward, only HTTPS will be allowed for postbacks to PayPal. At this time, there is no requirement for HTTPS on the outbound IPN call from PayPal to the merchant’s IPN listener.
|
The part in bold is the https postback to paypal, that was fixed to be correct in 4.2.4 onwards.
The second part (in red) confirms that you do
not need to use https on your website for the calls from paypal.
(
https://www.paypal.com/en/webapps/mp...fication-https)