twrobel

At a bare minimum you can get a free SSL cert here - https://www.startssl.com/?app=1

It doesn't include any real verification, so it doesn't give any assurance that you are who you purport to be, but it at least prevents people's credit card numbers from being sent across the web in plain text.

If you're letting people enter in their credit card information at any point for any reason you MUST get an SSL certificate and force people to use a TLS secured connection.

Infosec 101