Two possible error messages for 4020: “Information received from an Invalid IP address” and just “Invalid IP address”.
While I was configuring SagePay Direct for an osCommerce store I made, the checkout process wasn’t completing because SagePay was returning error 4020. This means that the IP address I added to the “Valid IPs” tab on the SagePay control panel isn’t matching up with the IP address the request is coming from. If you’re getting this error too then it is most likely because you’ve entered the wrong IP, or no IP at all. You can log in to SagePay live at https://live.sagepay.com/mysagepay/. If you switch SagePay to Simulator mode, the error message will also include the IP address it received the request from, so then you can go and add the correct IP address. You can sign up for a simulator account at https://support.sagepay.com/apply/RequestSimAccount.asp – If you definitely have the correct IP address added, and you are still getting the same error, then something else must be up…
Attempt #1: I figured out that perhaps SagePay had updated their API and my SagePay Direct payment module for osCommerce was out of date? The osCommerce community addons website shows that the latest version of SagePay Direct payment module is v1.1, whereas I was using v1.0. It seems that the osCommerce v2.3.1 package I downloaded shipped with SagePay Direct v1.0. After installing v1.1 I am still getting the same error. Something else must be up?
Attempt #2 (solution!): SagePay seems to be returning “Error 4020: Invalid IP Address” because the transaction wasn’t being secured with SSL. It’s actually a legal requirement in UK, due to data security standards laws, to secure all sensitive information (address, credit card numberr, etc) by having the checkout process encrypted with 128bit SSL. The error seems to have gone away.