Why it is called hosted checkout
Hosted checkout is a common name for the online payment step that a third party manages. The phrase emphasizes the customer completing a purchase, while hosted payment page emphasizes the page where payment details are entered. In practice, providers use both names for the same kind of payment setup, and the labels do not by themselves promise different security features.
You might see "hosted checkout" in a provider proposal, integration settings, or website setup instructions. The customer enters payment details in a checkout experience managed by a payment service, rather than in a payment form your business manages directly. That can reduce the card data your website handles, but your site still needs protection. The rest of this page explains the primary term, Hosted Payment Page.
What a Hosted Payment Page is
A hosted payment page is a checkout web page run by a third-party provider. Your customer leaves your website, enters payment details on the provider’s page, and returns to your site after the payment is processed. Some integrations use an embedded page instead of a redirect.
The provider handles the payment form and sensitive card details in this setup. Your website sends the customer to the page and receives a payment result, such as an approval or refusal. The exact flow depends on the integration.
A hosted checkout moves card entry to another page, but your website still needs protection.
How checkout works
Your checkout creates or opens a payment session, then directs the customer to the hosted page. The customer enters card details, the provider submits the transaction for authorization, and your business receives the result so it can confirm the order. Some integrations also send a notification to your system when payment is complete.
A redirect is visible to the customer, so the page should clearly identify your business and make the move to the payment provider understandable. A broken return path can leave a paid order looking unfinished in your system.
What it changes for PCI security
When payment details go directly from the customer to the provider, your website does not transmit, store, or process those details in the hosted-page flow described here. That can reduce the systems in scope for PCI DSS, the card-data security standard. Your exact requirements depend on how the page is integrated and validated.
A hosted page does not make your website irrelevant to payment security. If someone compromises your site, they could redirect customers to a fake page or interfere with the real checkout. As of 2026, PCI DSS v4.0.1 is current, and e-commerce payment-page script controls are among the requirements that took effect March 31, 2025.
Where the risk remains
A malicious redirect can send customers to a page that steals card details, or route information through an attacker while the legitimate payment still appears to complete. Keep your website patched, scan for vulnerabilities, monitor for unexpected changes, and use access controls and network protections.
The provider’s page and your own site have different security roles. Confirm the checkout domain before launch, test the full payment and return journey, and monitor your site for unauthorized scripts or redirects. A hosted checkout changes where card data is entered, not the need to protect the web environment that sends customers there.
What it means for your costs
A hosted page does not set your card-processing rate. Card costs still include interchange, network fees, and processor markup, and only the markup is negotiable. The research does not establish a standard hosted-page fee, so compare any setup, monthly, or per-transaction charges listed in your agreement against the service provided.
The practical tradeoff is development and maintenance versus the provider’s charges and checkout experience. A hosted page avoids building and maintaining your own payment form, but compare the full processing bill rather than assuming that outsourcing checkout lowers your card fees.
What you can actually change
- Confirm the payment flow. Find out whether customers are redirected or use an embedded form, and confirm which system receives the payment details. The integration affects the security scope you need to validate.
- Test the full journey. Run a test purchase from checkout through the return to your site. Confirm the order status updates after approval and that declined payments do not appear as completed orders.
- Secure your website. Patch your site, scan for vulnerabilities, monitor for unexpected scripts or redirects, and restrict administrative access. A hosted page does not protect a compromised website from sending customers to a fake checkout.
- Review every charge. Compare any hosted-page setup, monthly, or transaction charges with your processing statement. Separate provider charges from interchange, network fees, and processor markup before judging the total cost.
Frequently asked questions
Is hosted checkout the same as a hosted payment page?
Yes. Hosted checkout is another name for a hosted payment page. The wording focuses on the payment step as part of completing an online purchase.
Does hosted checkout mean my website has no security responsibilities?
No. A third-party checkout can reduce the payment data your website handles, but it does not remove your responsibility to secure your site. The name alone does not establish what security controls your setup requires.