Also called: Hosted Checkout, Secure Payment Page
What a Hosted Payment Page is
A hosted payment page is a checkout web page run by a third-party provider. Your customer leaves your website, enters payment details on the provider’s page, and returns to your site after the payment is processed. Some integrations use an embedded page instead of a redirect.
The provider handles the payment form and sensitive card details in this setup. Your website sends the customer to the page and receives a payment result, such as an approval or refusal. The exact flow depends on the integration.
A hosted checkout moves card entry to another page, but your website still needs protection.
How checkout works
Your checkout creates or opens a payment session, then directs the customer to the hosted page. The customer enters card details, the provider submits the transaction for authorization, and your business receives the result so it can confirm the order. Some integrations also send a notification to your system when payment is complete.
A redirect is visible to the customer, so the page should clearly identify your business and make the move to the payment provider understandable. A broken return path can leave a paid order looking unfinished in your system.
What it changes for PCI security
When payment details go directly from the customer to the provider, your website does not transmit, store, or process those details in the hosted-page flow described here. That can reduce the systems in scope for PCI DSS, the card-data security standard. Your exact requirements depend on how the page is integrated and validated.
A hosted page does not make your website irrelevant to payment security. If someone compromises your site, they could redirect customers to a fake page or interfere with the real checkout. As of 2026, PCI DSS v4.0.1 is current, and e-commerce payment-page script controls are among the requirements that took effect March 31, 2025.
Where the risk remains
A malicious redirect can send customers to a page that steals card details, or route information through an attacker while the legitimate payment still appears to complete. Keep your website patched, scan for vulnerabilities, monitor for unexpected changes, and use access controls and network protections.
The provider’s page and your own site have different security roles. Confirm the checkout domain before launch, test the full payment and return journey, and monitor your site for unauthorized scripts or redirects. A hosted checkout changes where card data is entered, not the need to protect the web environment that sends customers there.
What it means for your costs
A hosted page does not set your card-processing rate. Card costs still include interchange, network fees, and processor markup, and only the markup is negotiable. The research does not establish a standard hosted-page fee, so compare any setup, monthly, or per-transaction charges listed in your agreement against the service provided.
The practical tradeoff is development and maintenance versus the provider’s charges and checkout experience. A hosted page avoids building and maintaining your own payment form, but compare the full processing bill rather than assuming that outsourcing checkout lowers your card fees.
What you can actually change
- Confirm the payment flow. Find out whether customers are redirected or use an embedded form, and confirm which system receives the payment details. The integration affects the security scope you need to validate.
- Test the full journey. Run a test purchase from checkout through the return to your site. Confirm the order status updates after approval and that declined payments do not appear as completed orders.
- Secure your website. Patch your site, scan for vulnerabilities, monitor for unexpected scripts or redirects, and restrict administrative access. A hosted page does not protect a compromised website from sending customers to a fake checkout.
- Review every charge. Compare any hosted-page setup, monthly, or transaction charges with your processing statement. Separate provider charges from interchange, network fees, and processor markup before judging the total cost.
Frequently asked questions
Does a hosted payment page mean I no longer need PCI compliance?
No. Sending card details directly to a provider can reduce which parts of your environment are in scope, but your obligations depend on the integration and validation. You still need to protect your website and follow the applicable PCI DSS requirements.
Does a hosted payment page lower my processing fees?
The page format does not set interchange or network fees, and it does not automatically lower your processor markup. Compare any separate hosted-page charges with your full processing bill. Only processor markup is negotiable.
Will customers leave my website to pay?
A redirect sends customers to a provider-hosted page and returns them to your site after payment. Other integrations embed a form, though the exact options and security implications depend on the implementation.
Can a hosted payment page still expose my customers to fraud?
Yes. A compromised website could redirect customers to a fake payment page or interfere with the checkout. Keep your site patched, scan for vulnerabilities, monitor changes, and test that checkout links lead to the correct provider.