Recurring Payments on Your Own Website: What Has to Work Every Month

The first collection is never the problem. Your customer is sitting there with a card in their hand, they have just decided to buy, and everything works exactly as designed. It is collection number seven, on an ordinary Tuesday in October, that tells you whether you built recurring revenue or simply gathered a list of people who paid you once.

I spend most of my working life watching systems that run when nobody is looking at them. Backups. Certificate renewals. Monitoring agents. Recurring billing belongs in that same family, and it fails the same way they do. It does not collapse loudly. It stops one customer at a time, quietly, and you find out weeks later when the month's figure comes in lower than it should be and you cannot immediately say why.

This is a reference piece rather than a pitch. If you are considering putting a monthly plan, a membership, a service retainer or a subscription box on your own website instead of chasing one-off invoices, these are the moving parts in roughly the order they matter. Some of it is payments plumbing. Some of it is Irish and European consumer law, which has more to say about subscriptions than most business owners realise. All of it is knowable in advance, which is the point.

Two Ways to Collect the Same Money

You have two realistic mechanisms for taking money from the same customer repeatedly without asking them each time. The first is a card stored with your payment processor, which you charge on a schedule. The second is a SEPA Direct Debit mandate, where the customer authorises collections directly from their bank account.

On your website they look almost identical. One extra field, one extra tick box. Three months in they behave nothing alike.

What matters	Card on file	SEPA Direct Debit
Setting it up	Customer authenticates once at checkout, card is stored by the processor	Signed mandate, plus advance notice before each collection
How it fails	Card expires, is replaced, or the bank declines the charge	Insufficient funds, or the customer cancels the mandate at their bank
How long money can be pulled back	Card dispute windows run to months	Eight weeks, no questions asked
Best suited to	Smaller consumer amounts, customers outside Ireland, instant sign-up	Predictable euro amounts, larger local invoices, long-running plans

Both are perfectly good. Neither is the "right" one in the abstract. What follows is what each of those four rows actually means when it happens to you.

The Only Payment Your Customer Ever Authenticates

Under the European payment rules, the customer proves who they are on the first transaction. After that, they do not.

The technical rule sits in the regulatory standards that accompany the second Payment Services Directive, and the European Banking Authority has spelled it out in its own Q&A: strong customer authentication applies when a payer "creates, amends, or initiates for the first time, a series of recurring transactions" ^[1]. Set up once, authenticated once. Every collection after that is initiated by you, the merchant, against a stored instruction, and the customer's bank does not ask them to approve anything.

That is the whole appeal. It is also the whole risk, and they are the same fact viewed from two sides.

Your customer is not involved in collection number seven. They receive no code by text, they tap nothing, they confirm nothing. So when collection number seven fails, they experience precisely nothing. No alert, no interruption, no reason to contact you. They carry on receiving the thing they signed up for, and you carry on delivering it, and the money has silently stopped.

The same asymmetry applies to direct debit. Under the SEPA Core scheme rules the mandate is the one-time act, and the ongoing obligation lands on you: the creditor must send pre-notification to the customer "at the latest 14 Calendar Days before the Due Date", unless a shorter period is bilaterally agreed ^[2]. In practice most billing software handles that automatically as part of the invoice email. It is worth confirming yours actually does, because that notice is not optional under the scheme.

What Actually Breaks, and How Long It Takes You to Notice

Cards expire. That is not a fault, it is the design. Every card your customers hold has an end date somewhere in the next three or four years, which means a meaningful slice of your billing base rolls over every single year whether anyone plans for it or not.

The payment networks built a fix for this. Visa, Mastercard and American Express each run an account updater service, and processors query it on your behalf so that a replaced card quietly becomes the new stored card without anyone lifting a finger. Excellent when it works. Stripe's own documentation is refreshingly blunt about where it does: automatic card updates are "widely supported in the United States", and "International support varies from country to country" ^[3]. Read that as an Irish business owner and the honest translation is that some of your customers' replacement cards will update themselves, some will not, and you cannot tell which in advance.

So the failures arrive anyway, and what happens next is entirely down to configuration you probably set once and never looked at again. The most widely used subscription extension for WordPress applies five retry rules by default, spread over seven days, with the first attempt twelve hours after the failure and the subscription sitting on hold in the meantime. Its documentation also notes that the customer is deliberately not emailed on that first attempt, because the retry is intended to catch temporary declines and happens too quickly for anyone to act on ^[4].

Seven days. That is your window. After it closes, in a default setup, the subscription lapses and the customer keeps whatever access or delivery you have not thought to switch off.

We changed a retry configuration on an internal billing system a couple of years back and did not push a test collection through it afterwards. Two accounts fell out before anyone spotted the pattern. Nothing that touches billing goes out here now without a test transaction behind it.

Consider a dog grooming salon in Louth that moved its regulars onto a monthly plan, which is exactly the kind of business this suits. A card gets replaced in June after a fraud alert. Nothing visible changes: the dog still arrives every fourth Thursday, the groomer still grooms, and the customer, who never sees a payment notification because there is nothing for them to approve, has no idea anything has changed. It takes until the accountant queries the September figures for anyone to work out that one client has had three months of appointments for free, and now somebody has to make that phone call. That is not a fraud problem or a technology problem. It is a monitoring problem, and monitoring problems are solvable.

Two Reversal Windows, and They Are Not the Same Length

Money that arrives is not the same as money you keep. Both mechanisms let the customer take it back, on very different terms.

Direct debit is the sharper of the two. The SEPA Core scheme rulebook describes "a no-questions-asked, fast and simple Refund procedure available within eight weeks" of the debit date, and where a collection is claimed to be unauthorised, the customer can go to their bank up to 13 months later ^[2]. No dispute, no evidence, no adjudication. Inside those eight weeks the customer's bank simply returns the money and tells you afterwards.

Card payments run the other route, through the card dispute process, where the windows are longer, the outcome is contested rather than automatic, and the burden of evidence sits with you. We covered how those disputes actually play out, and what documentation decides them, in our guide to what happens when a customer disputes a card payment. For recurring charges specifically, the evidence that wins is boring and procedural: the record of the original sign-up, the terms shown at the time, and proof the service was delivered in the period charged.

Here is the honest limitation, and it is worth knowing before it happens rather than after. Neither mechanism gives you certainty at the moment the money lands. A direct debit that cleared five weeks ago can still be reversed unilaterally, without you being asked. If your business runs on tight margins and you have already spent that month's collections on stock or wages, treat recent recurring income as provisional rather than banked. The business-to-business variant of the SEPA scheme removes that refund right, but it only applies where the customer is a business and their bank supports it, so it is not a general answer for anyone billing consumers.

Which leaves the practical question of what suits what. Direct debit fits predictable euro amounts billed to local customers over a long horizon, where the sums are large enough that an expired card would be a genuine nuisance and the eight-week window is a risk you can carry. Cards fit smaller consumer amounts, immediate sign-up, and anyone paying you from outside the country. Offering both costs you one extra option at checkout and lets the customer choose the one they will not cancel out of.

What Your Website Has to Say Before the First Charge

Selling a subscription online in Ireland means you are concluding a distance contract, and the European Union (Consumer Information, Cancellation and Other Rights) Regulations 2013 attach a specific set of duties to that. The Department of Enterprise guidance note is the clearest published summary of them ^[5]. Four points matter most for anything recurring.

The button wording is prescribed. Where placing an order involves activating a button, the guidance is explicit that it must be labelled "in an easily legible manner only with the words 'order with obligation to pay' or with a corresponding and unambiguous formulation" ^[5]. "Subscribe" on its own is thin. "Subscribe and pay €35 monthly" is not.

Subscription pricing has its own disclosure rule. For a contract of indeterminate duration or one containing a subscription, you must give the total costs per billing period, or the total monthly cost where the contract is charged at a fixed rate ^[5]. A headline annual figure with the monthly reality buried in the terms does not satisfy that.

Automatic renewal must come with an exit. Where a contract is of indeterminate duration or is to be extended automatically, the conditions for terminating it are part of the pre-contract information ^[5]. If a customer cannot find out how to stop paying you before they start paying you, the disclosure has failed.

Getting the cancellation notice wrong is expensive. The 14-day cancellation right for a service contract runs from the day the contract is concluded. If you never told the customer that right existed, the guidance notes that the cancellation period does not quietly lapse: it expires 12 months later ^[5]. That is a live liability sitting on every sign-up form with a missing paragraph. Where the customer expressly asks you to start the service inside the 14 days and later cancels, they pay an amount proportionate to what was actually provided, which is a fair and workable outcome as long as you can show what you delivered.

One useful wrinkle for anyone shipping a physical subscription box: for contracts involving regular delivery of goods over a defined period, the cancellation clock starts from physical possession of the first item, not each one ^[5].

If you already sell prepaid value such as gift vouchers from your own website, some of this will look familiar. Money taken in advance of delivery attracts rules. Money taken repeatedly in advance of delivery attracts more of them.

This area is also about to move. The European Parliament's legislative tracker lists the Digital Fairness Act as announced, with an indicative Commission date of the fourth quarter of 2026, and it names "difficulties with the cancellation and renewal of digital subscriptions" as one of the consumer problems it intends to address ^[6]. Nothing is law yet, and the timeline for anything actually binding stretches well beyond this year. The sensible read is directional: whatever arrives will make cancelling easier, not harder. Build the easy cancellation now and you are simply early.

Where a Subscription Platform Genuinely Wins

I would not put a purely digital, cross-border subscription business on its own website billing stack without thinking hard about it first. If you are selling a software product or digital content to consumers in fifteen countries, with trials, proration, coupons, dunning sequences and VAT determined by the customer's location, a dedicated subscription platform earns its percentage several times over. That is a genuinely hard problem, and the platforms that solve it employ tax specialists so that you do not have to.

That is a different business from a physiotherapy clinic billing forty local clients a fixed monthly fee in euro. For that shape of business, the platform is charging a percentage of every collection to solve problems you do not have, and taking the customer relationship as part of the fee.

Where This Matters Differently

The stakes shift depending on what the money is actually for. A missed collection is an administrative annoyance in one business and a service you are actively giving away in another.

• Retainer-based service businesses. The work continues while the payment does not, so the loss compounds every week nobody checks. Your exposure is measured in hours already delivered, not in one missed charge.
• Subscription boxes and regular deliveries. You are shipping physical stock against a payment that failed, which means a real cost leaves the building every cycle. Pause fulfilment on payment failure or you are posting goods for free.
• Memberships and class-based businesses. Access usually persists after payment stops, because the login still works and nobody thought to link the two. If members-only content is part of the offer, tie access to billing status rather than protecting the page with a shared password.

A Ten-Minute Monthly Billing Routine

None of the above needs a full-time bookkeeper. It needs someone to look, on a schedule, at the things that fail silently.

1. Reconcile. Compare the collections that actually landed against the customers who should have paid, and treat any gap as a fault to be closed rather than a number to be accepted.
2. Verify. Open the failed and retrying payments, confirm the retry sequence ran, and check that anyone whose payment finally gave up has stopped receiving the service.
3. Notify. Contact the small number of customers whose payment method needs replacing, early and plainly, because a card that expired is nobody's fault and the conversation is easy while the balance owed is one month.
4. Prune. Cancel dead subscriptions properly instead of leaving them on hold indefinitely, so next month's report reflects the business you actually have.
5. Rehearse. Before updating your billing plugin or payment gateway, deploy the update to a staging environment and run one test subscription through it, because a checkout that breaks silently on a live site is a month of collections you never see.

That last step is where most self-hosted billing setups come unstuck. Billing extensions update often, they touch checkout, and a broken checkout announces itself through absence. Running the site on managed WordPress hosting that includes one-click staging, nightly backups and Irish support for €60 a year turns that from a risk you carry into a fifteen-minute routine, and it is the difference between finding a fault yourself and having a customer find it for you.

Conclusion

Recurring revenue changes the shape of a small business. It smooths the cash flow, it makes forecasting something other than guesswork, and it turns a customer who might come back into a customer who is already coming back. That is worth building.

What it asks in return is a small amount of ongoing attention, in exchange for the money arriving without anyone having to ask for it. The mechanism is not fragile. It is silent, which is a different property, and the businesses that do well with it are the ones that decided in advance who looks, how often, and what they do when the number is wrong.

Pick your mechanism, write the terms so a customer can find the exit, and put ten minutes in the calendar on the same day every month.

Frequently Asked Questions

Can I take recurring payments on a WordPress site without a monthly platform fee?

Yes. A WordPress site with a payments extension and a payment processor can store a card or a direct debit mandate and collect on a schedule. You still pay your processor's per-transaction fees, which are unavoidable on any platform, but you are not paying a percentage of revenue to a subscription service on top of them.

Should I use card payments or direct debit for a monthly plan in Ireland?

For smaller consumer amounts, instant sign-up and customers outside Ireland, cards are usually the practical choice. For predictable euro amounts billed to local customers over a long period, direct debit avoids card expiry entirely. Many Irish businesses offer both and let the customer decide, which costs you nothing beyond the initial setup.

What happens if a customer's card expires mid-subscription?

The collection fails and your billing software retries it according to its rules, typically over several days. If the card is replaced rather than renewed, the account updater services run by the card networks may update it automatically, though coverage outside the United States varies. If no retry succeeds, the subscription lapses, so you need a process to catch it.

Do I have to let customers cancel a subscription online?

You must tell them, before they sign up, how the contract can be terminated where it renews automatically or has no fixed end date. Making the cancellation process itself easy is, for most consumer subscriptions, currently best practice rather than a specific Irish legal requirement, but proposed European legislation is heading that way, and a hard-to-cancel subscription generates card disputes.

How long can a customer reverse a recurring payment?

Under the SEPA Direct Debit Core scheme, a customer can request a refund with no questions asked within eight weeks of the debit date, and up to 13 months where they claim the collection was unauthorised. Card payments follow the dispute process instead, where windows are generally longer and the outcome depends on the evidence both sides submit.

Sources