Modify the payment module to only be enabled when the IP address is that of the admin.
As a quick fix you can hard code it directly into the module...
As a better more flexible version
I add a new key to the module to hold a list of admin IP addresses```php
$db->Execute("insert into " . TABLE_CONFIGURATION . " (configuration_title, configuration_key, configuration_value, configuration_description, configuration_group_id, sort_order, date_added) values ('Admin IP's to allow access', 'MODULE_PAYMENT_PHONEORDER_ADMINIP', '123.123.123.123', 'Enter the Admin IP's that are allowed to access this module.<br />Separate multiple IP's with a comma.<br />No Spaces.', '6', '60', now());");
Then I add something like this to the module to disable if not from an admin IP
```php
// disable if NOT accessed from an ADMIN IP address
if (!in_array($_SESSION['customers_ip_address'], explode(',',MODULE_PAYMENT_PHONEORDER_ADMINIP))) {
$this->enabled = false;
}
nb: You need to edit the code to suit your module, cannot use as it