The setup

While migrating a production EC-CUBE (PHP e-commerce) site to a new cloud instance, I clicked "confirm payment" on the new server and got this from the payment gateway (GMO Epsilon, a common Japanese payment provider):

ERR_CODE 908 "The order's source host information does not match the source IP address"

Enter fullscreen mode

Exit fullscreen mode

The gateway's admin console already had the site's domain name and the old IPs registered as allowed sources. The domain's A record was already pointing at the new IP. So why was it rejected? Digging in, I found that the assumption "we registered the domain, so we're safe when the IP changes" had never actually worked — not even once .

Three traps

1. What I saw wasn't a 908 — it was a 500

The first visible symptom wasn't even a payment error. It was EC-CUBE's generic "system error" page (HTTP 500). The logs told the real story:

gmo_epsilon.ERROR: ... ERR_CODE=908 ERR_DETAIL=...…