Palmprint recognition has attracted considerable attention due to its advantages over other biometric modalities such as fingerprints, in that it is larger in area, richer in information and able to work at a distance. However, the issue of palmprint privacy and security (especially palmprint template protection) remains under-studied. Among the very few research works, most of them only use orientational features of the palmprint with transformation processing, yielding unsatisfactory recognition and protection performance. Thus, this research work proposes a palmprint feature extraction method for palmprint template protection that is fixed-length and ordered in nature, by fusing point features and orientational features. Firstly, dual orientations are extracted and encoded with more accuracy based on the Modified Finite Radon Transform (MFRAT). Then, SURF feature points are extracted and converted to be fixed-length and ordered features. Finally, Composite Fixed-Length Ordered Features that fuse up the dual orientations and SURF points are transformed using the irreversible transformation of Index-of-Max (IOM) to generate the revocable palmprint templates. Experiments show that the matching accuracy of the proposed method of fixed-length and ordered point features are superior to all other feature extraction methods on the PolyU and CASIA datasets. It is also demonstrated that the EERs before and after IOM transformation are better than all other representative template protection methods. A thorough security and privacy analysis including brute-force attack, false accept attack, birthday attack, attack via record multiplicity, irreversibility, unlinkability and revocability is also given, which proves that our proposed method has both high performance and security.