Hosted vs Integrated Payment Pages
Three Ways to Collect Card Details Online
Hosted payment page vs integrated payment is a choice about who serves the payment fields. A hosted payment page is a checkout page served by the payment provider rather than by the shop. An integrated payment page is one where the shop's own page shows the payment fields, populated by the provider's code or by the shop's own code. The method decides who receives the card number.
There are three common approaches:
- Redirect to a hosted page. The customer leaves the shop's site, enters card details on the provider's domain, and returns to a confirmation page.
- Embedded fields (iFrame). The card fields are a frame, a box that loads content from another site, placed inside the shop's page. The customer stays on the shop's site while the card number is typed into the provider's frame.
- Direct API. The shop collects card data on its own page and sends it to the provider from its own server.
Control, Experience and Security Trade-Offs
A redirect leaves most of the payment flow to the provider. It is usually the simplest to build and keeps card data off the shop's servers. The drawback is that the customer temporarily leaves the shop's branding, which can reduce trust for some buyers.
Embedded fields keep the customer on the shop's site. The card number is still handled inside the provider's frame, but the shop controls the surrounding page, its scripts and its layout, and must keep all of them secure. This suits many shops well.
A direct API gives the shop full control of the checkout design. It also means card numbers pass through the shop's own systems, which brings the heaviest security and compliance obligations.
How the Choice Affects PCI Scope
The payment security standard, PCI DSS, sets requirements based on whether a merchant stores, processes or transmits card data. Redirect and embedded-field methods can reduce that scope considerably, because card numbers never reach the shop's servers. A direct API integration generally expands it. The questionnaire type that follows from each setup is covered in PCI SAQ types explained.
The design also affects sales. A redirect can add a step that some customers abandon, so the checkout structure matters as well. See one-page and multi-step checkout for the layout options.
Frequently asked questions
Which payment page type is the most secure?
For the shop, a hosted page or embedded fields are usually the most secure choice, because card numbers never reach its servers. Security still depends on the provider, the page code and the shop's own systems. No method removes the need to keep the platform updated and to keep unwanted scripts off the checkout.
Does an iFrame payment form reduce PCI compliance work?
Often it does. When card fields are loaded from the provider in a frame, card data is entered directly with the provider, which can shrink the questionnaire a shop must complete. The reduction is not automatic. If the shop's own page can change the payment form or the data it sends, the requirements may be larger than expected, so the integration should be confirmed with the provider.