Modify the payment module to only be enabled when the IP address is that of the admin.
As a quick fix you can hard code it directly into the module...
----------
As a better more flexible version
I add a new key to the module to hold a list of admin IP addresses
PHP Code:
$db->Execute("insert into " . TABLE_CONFIGURATION . " (configuration_title, configuration_key, configuration_value, configuration_description, configuration_group_id, sort_order, date_added) values ('Admin IP\'s to allow access', 'MODULE_PAYMENT_PHONEORDER_ADMINIP', '123.123.123.123', 'Enter the Admin IP\'s that are allowed to access this module.<br />Separate multiple IP\'s with a comma.<br />No Spaces.', '6', '60', now());");
Then I add something like this to the module to disable if not from an admin IP
PHP Code:
// disable if NOT accessed from an ADMIN IP address
if (!in_array($_SESSION['customers_ip_address'], explode(',',MODULE_PAYMENT_PHONEORDER_ADMINIP))) {
$this->enabled = false;
}
nb: You need to edit the code to suit your module, cannot use as it