I really hope WePay destroys PayPal. They have screwed myself and my friends too many times.
The homepage layout is all wrong though. Poor element placement, messy typography, and the color scheme is off. It looks amateur and unpolished. All those SEO'd subpages are worthless if they don't convert.
Also:
- Upgrade to Nginx 0.7.67, there was a lot of bug fixes in 0.7.65 and 0.7.66.
- Limit the number of login attempts to prevent brute forcing.
- Don't show "That email address was not found" when someone tries to recover a password. You are giving out too much info, which can be used maliciously.
- Block scraper/vuln scanner/curl scripts by user-agent to keep away the script kiddies and botnets.
- Don't host your Javascript on Google. This gives hackers another possible point of entry. It's probably safe, but you're better off limiting points of entry.
- Use mod_rewrite as an additional layer of security. You'll need to slightly modify it to make it work with Nginx.
- Remove "access info anytime" and "post to my wall anytime" when signing up with Facebook.
- Limit SSH access by IP address.
Feel free to contact me if you need help.