Find out where the card number is typed. A payment company's hosted page means the short questionnaire, a form on your own page adds questions about your website, and handling numbers yourself means the full standard.

Card fields under your own logo

A small online shop's checkout shows the shop's logo, its colours and a neat box for the card number. The owner assumes the card details are handled somewhere safe, and has never needed to know where.

Then the payment company's yearly reminder arrives, asking for a self-assessment questionnaire under the card industry's security standard. Which questionnaire depends on exactly that question.

Version 3.0 of the standard took effect on January 1, and the questionnaires that go with it are due early this year. Some shops may then land in a different group than before.

Three groups, five common builds

Card payments on a small shop's website are usually built in one of five ways, each belonging to one of three groups:

What each group fills in

The first group fills in the shortest questionnaire, known as A. It asks mostly about the payment company you rely on and how any paper records are kept.

The middle group is where the answer is least settled. The card industry's own guidance for online shops warns that these builds leave the shop's website in the card number's path.

Expect that group's questionnaire to ask about the website's security, not only the payment company's. Shops whose own server receives card numbers fill in D, which covers the whole standard.

Why the middle group carries more

With a direct-post form or a payment script, the card number never reaches the shop's server. But that server sends the page holding the form, and the browser trusts whatever the page contains.

If someone breaks into the site, they can change the form so each number is copied elsewhere as it is typed. The customer notices nothing, and the payment still goes through.

That is why the industry's guidance sets these shops apart from those using a hosted page. The weak point is the website, so the questions turn to the website.

Why a hosted page keeps the work off the site

With a redirect or a frame, the page where the number is typed comes from the payment company's servers. The shop's site only sends the customer there and hears back that the payment succeeded.

A break-in on the shop's site cannot rewrite a form the site does not serve. The payment company secures that page and answers for it under its own assessment.

Hosted pages can usually carry the shop's logo and colours, so customers still feel they are paying the shop. The difference shows in the address bar, not the design.

What a hosted page still leaves you

The link to the payment page must still point to the right place, and a site that has been broken into could send customers to a fake one.

So the site's software still needs updates, and its logins still need strong passwords. Card numbers taken by phone, or written on order slips, raise questions of their own.

A worked example

A watch repair shop in a small downtown arcade services mechanical and quartz watches. It also sells straps, bracelets and a few restored vintage pieces through an online shop.

Its checkout was built three years ago, with the card fields on a page carrying the shop's logo. The owner believed the payment company handled everything, and had filed the short questionnaire each year.

Reading the page's code showed a form posting from the shop's own page straight to the payment company. That put the shop in the middle group, not the first.

The WordPress site behind it was also several updates behind: exactly the weak point the industry's guidance describes.

The checkout now sends customers to the payment company's hosted page, set up with the shop's logo and colours. Customers pay there and return to a thank-you page on the shop's site.

The shop's pages no longer build the card form, so a break-in could not alter it, and the shop belongs in the first group. The site is now updated monthly as well.

Telling which group you are in

Go to your own checkout and stop at the card fields. If the address bar shows the payment company's address, the page is theirs.

If the address is still yours, the fields may sit in a frame from the payment company or in a form on your page. From the outside the two can look identical.

Ask whoever built the checkout to state in writing where the form comes from and where it sends the number. That one sentence decides the group.

Version 2.0 until December 31

Version 2.0 can still be used until December 31. Your payment company decides which version it accepts and when your next questionnaire is due.

A shop planning a new checkout this year should build it for version 3.0 from the start.

This is general information about the standard, not advice on your own merchant agreement; your payment company has the final word on what it requires.

The counter-case

Some shops want the whole checkout on their own pages, for the look or to keep customers from leaving even briefly. That is a legitimate choice.

It means the middle or third group, with more questions to answer and a site kept current every month, not whenever someone remembers.

A shop with its own developers can carry that work. For most small shops, a hosted page wearing the shop's logo reassures customers just as well, with far less to answer for.

Before the next questionnaire is due

  1. Open your checkout and note the address at the card fields.
  2. Ask your developer where the card form sends the number.
  3. Ask your payment company which questionnaire and version it expects.
  4. Note the date your next questionnaire is due.
  5. Look at the hosted page your payment company offers.
  6. Keep the site's software current whichever group you are in.
  7. File the questionnaire with the payment company's proof of its own compliance.

Step two decides the rest. The answer puts the shop in one of the three groups, and the questionnaire and the work on the site follow from it.

Where a checkout's certificate and the hosting beneath it fit among the year's costs is covered in setting the website budget for the year ahead.

Frequently asked questions

What changed on January 1?

Version 3.0 of the card security standard took effect, with questionnaires due early this year. Shops whose own pages build the card form can expect more questions than shops with a hosted page.

Which questionnaire goes with a hosted payment page?

Usually the shortest one, A, because the card number is typed on the payment company's page. It asks mostly about that company and any paper records you keep.

What if the card form sits on my own page?

If your page builds the form, even though the number goes straight to the payment company, your website is in the card number's path. Expect questions about its security.

Can a hosted page look like part of my shop?

Usually, yes. Most payment companies let the hosted page carry your logo and colours. The address bar shows their address, which is what keeps the work off your site.

Can I still use version 2.0?

Until December 31, if your payment company accepts it. Ask which version it expects for your next questionnaire, and build any new checkout for version 3.0.

Does a hosted page remove all my security work?

No. The site still needs updates and strong passwords, because a site that has been broken into could send customers to a fake payment page instead of the real one.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Not sure where your card form sends the number?

Send us your checkout's address, and we will tell you which group it falls in and what a hosted page would change.

Start a Conversation