I hate to nitpick, but this part caught my eye: I needed to fix about the site – SSL (even though all of the payments are secured through Stripe). If the checkout page isn't loaded over SSL, my credit card number isn't secure since the page is still vulnerable to a MITM attack completely removing the Stripe code.
However what I'd like to point out is that 'simple eavesdropping' effectively is a Man-In-The-Middle attack, be it a passive one (the man in the middle is just keeping his mouth shut and only listening).
And eavesdropping on someones internet connection is, contrary to popular believe, not that simple.
The eavesdropper needs at least one of:
a) effectively have a (virtual) presence on either one of the endpoints of the connection b) unfettered access to exactly the correct pieces of equipment that are part of the internet's infrastructure. c) some way of persuading your traffic to take a de-tour from a remote location
Option a) is the easiest I guess - just drop a piece of malware on someones PC (takes care of that whole pesky SSL issue as well). Although certainly doable - I would not describe it as trivial. Most 'cyberattacks' targeted at the masses are not exactly efficient - their success largely depends on the large numbers of targets - targeting a specific person is quite a bit of work.
Option b) is, depending on who you are either relatively easy or nearly impossible. If it's easy for you, you've probably signed a piece of paper promising you a large bank account withdrawal and/or all kinds of 'benefits' in a state-sponsored facility if you abuse your powers. That won't stop everybody and there are parties for who it is actually their job to do this kind of things, but for the most part you can forget about option b) unless you happened to have attracted the interest of aforementioned parties. In which case I wish you good luck.
The feasibility of option c) depends even more on local circumstances of the victim than option a) but is a real possibility, but certainly not trivial. Something like dns-cache poisoning comes to mind.
So - eavesdropping is certainly possible, but I would by no means call it simple.
Rgds, Jeroen
You pay everywhere with your credit card. Everytime you buy something with your credit card number, the site you put it in can make a copy of it. Has the number any value at all?