Whose server sees the card number
When you pay on a hosted payment page, whose computer reads your card number? The payment provider’s. Payments company Adyen’s Hosted Checkout guide has the shop redirect the shopper to an Adyen-hosted webpage and then bring them back. The shop makes two calls to Adyen’s sessions endpoint, one to get the page’s address and one to learn the outcome.
Payments company Stripe offers the same idea in several shapes. Its Checkout documentation lists a full payment page, shown either through a redirect to a Stripe-hosted page or embedded in the shop’s site, next to an embedded form and fully custom elements.
The pull for merchants is the audit. Stripe’s security guide warns that a business taking raw card numbers on its own page might have to meet more than 300 security controls in PCI DSS.
Redirect or frame, in the PCI Council’s words
The card industry’s security council sees more than one kind of payment page. Its glossary says one can be rendered as a single document, as a component in an inline frame on a non-payment page, or as several such frames.
The difference matters for Self-Assessment Questionnaire A, the form under PCI DSS for merchants that outsource all card handling. The council’s FAQ 1588, read on November 12, 2026, says the criterion asking a merchant to confirm its site is not susceptible to script attacks applies only to pages that embed a provider’s form in an iframe.
A shop that redirects, by an HTTP 30x response, a meta tag or JavaScript, is outside that criterion. So is one that just emails the customer a link to the provider’s site. Frames are another matter. An iframe merchant meets it either with script protections like those in Requirements 6.4.3 and 11.6.1, or with confirmation from its provider that the embedded form already includes them.
A redirect still leaves homework
A redirect does not end a merchant’s card security duties, and the council’s FAQ 1604 is explicit about it. SAQ A still requires external vulnerability scans of the merchant’s own e-commerce pages by an approved scanning vendor, under Requirements 11.3.2 and 11.3.2.1, because a compromised shop page can compromise the payment that starts there.
That covers redirecting pages and iframe pages alike. FAQ 1588 tells merchants to confirm which questionnaire applies with the body they file it with, typically their acquiring bank or the card brands.
The crypto version
Crypto checkouts run on the same pattern. In crypto payments company BitPay’s invoice reference, each invoice carries a url field, the web address of a hosted invoice that expires at the invoice’s expiration time. The crypto price is fixed at a locked exchange rate for 15 minutes.
Payments that arrive short are refunded automatically if the invoice is never paid in full. A bitcoin invoice counts as complete after six confirmations, which BitPay says takes about an hour on average. Anyone planning to accept stablecoin payments through such a page should check how long its invoices stay open and what happens to an underpayment.