Hosted checkout
Redirecting card entry keeps raw payment data outside merchant systems. Cardflo’s hosted payment page supports PCI DSS SAQ A scope, branded colours and automatic 3DS challenges through a ready-made redirect flow.
- Category
- Checkout
- Capabilities
- 10
- Available on
- All plans
Cardflo's Hosted Checkout provides a secure and customisable payment experience for your customers. This solution offloads PCI compliance burdens while maintaining brand consistency.
It integrates seamlessly into your existing site, offering a reliable and efficient way to process transactions across multiple payment methods and acquirers.
Cardflo's hosted checkout reduces PCI DSS scope and streamlines 3DS flows, enhancing security whilst minimising development overhead. This leads to improved conversion rates and a smoother payment experience for customers.
Hosted checkout overview
A hosted checkout serves as a PCI-compliant payment interface managed by a payment service provider rather than the merchant. When a consumer initiates a transaction, they are redirected to a secure page hosted on the provider's infrastructure or presented with an overlay that captures sensitive card data.
This structure ensures that Primary Account Numbers and security codes never touch the merchant's servers, effectively reducing the PCI DSS assessment scope to the simplest level, typically SAQ A. Beyond compliance, the hosted model integrates several critical layers of the payment stack, including 3D Secure 2 authentication, fraud screening, and address verification.
It acts as the final intake point before the gateway routes the authorisation request to the relevant acquirer. By decoupling the payment capture from the merchant's core application, businesses can update payment methods or security protocols without modifying their internal codebase, ensuring support for various schemes and alternative payment methods via a single integration point.
How hosted checkout works
Initialisation and session management
The merchant server initiates a checkout session via a server-to-server API call. The payment service provider returns a unique session identifier and a secure URL. This step ensures that the transaction context, including currency, amount, and order ID, is established in a controlled environment before the customer enters any sensitive payment details.
Secure customer redirection
The customer is redirected to the hosted environment or an embedded iframe. This interface is served directly from the provider’s PCI-certified infrastructure. The merchant may customise the visual elements, such as colours and logos, via a configuration dashboard or CSS parameters to ensure the transition from the shop to the checkout remains cohesive.
Payment data capture
The customer enters their credentials, such as card details or digital wallet information. If required by PSD2 regulations, the hosted page triggers Strong Customer Authentication (SCA) through 3D Secure. All sensitive data is tokenised immediately, ensuring the merchant only receives a non-sensitive reference for the transaction rather than the actual card numbers.
Authorisation and settlement
The provider forwards the captured data to the acquirer for authorisation. Once the issuer approves or declines the transaction, the hosted page processes the result. Upon completion, the customer is redirected back to the merchant's success or failure page, while a server-side webhook notifies the merchant's backend to update the order status.
Why hosted checkout matters
Reduced Compliance Infrastructure Costs
Managing a fully PCI-certified environment requires significant investment in security monitoring, auditing, and infrastructure hardening. By utilising a hosted checkout, merchants offload the capture of cardholder data to the provider. This typically allows the merchant to qualify for the most basic level of PCI compliance, minimising the administrative burden and technical risks associated with data breaches and regulatory fines.
Dynamic Payment Method Support
As the payments landscape evolves, supporting local alternative payment methods becomes essential for conversion. A hosted page allows for the remote activation of digital wallets, bank transfers, and Buy Now Pay Later options without requiring the merchant to rewrite their frontend code. This flexibility enables rapid expansion into new geographic regions where specific local schemes may be preferred over traditional card networks.
Hosted checkout use cases
Redirect checkout for ticketing volumes
Festival operators facing concentrated onsale traffic need card entry and 3DS2 challenges handled outside the ticketing environment without disrupting seat or allocation holds. Cardflo provides a hosted payment page redirect flow that returns buyers to the booking confirmation, while acquirer partners handle authorisation and SCA requirements.
Hosted pages for subscription boxes
Charities collecting one-off donations during televised appeals need a secure card form that can adopt campaign colours without bringing payment fields into the charity website. Cardflo supplies a branded hosted payment page, manages automatic 3DS challenge presentation and keeps card collection within infrastructure designed to support PCI DSS SAQ A scope.
Click and collect payments
Retailers taking payment before click and collect fulfilment need to connect an existing order journey to secure card collection without building a bespoke checkout interface. Cardflo redirects shoppers to a hosted payment page with merchant branding, then returns the payment outcome and order reference for collection workflow updates.
Hosted checkout by the numbers
This represents an industry-typical reduction in the number of security controls a merchant must personally manage when moving from direct API capture to a hosted model.
Merchants frequently observe improved conversion on mobile devices when moving to a responsive hosted page compared to legacy, non-optimised internal checkouts.
This is a standard timeframe for a technical team to implement a basic hosted redirect flow, which is generally faster than building a custom card-capture interface.
Methodology: these figures are illustrative ranges drawn from published industry data and observed merchant cohorts, not guarantees. Actual results depend on your risk profile, card mix, geography and acquiring setup, and are confirmed only in your own pricing and approval terms.
Related terms
Talk to our team about a live rollout across our acquirer partners' rails.
What you get with Hosted checkout
- Minimise PCI DSS liability by hosting the payment capture form on certified external infrastructure.
- Support regional alternative payment methods through a single, unified integration and configuration interface.
- Automate SCA and 3D Secure workflows to ensure compliance with European PSD2 and PSD3 regulations.
- Customise the checkout UI with CSS to maintain brand consistency throughout the payment journey.
- Utilise responsive design to ensure the payment interface functions across mobile, tablet, and desktop devices.
- Integrate via simple redirect or embedded iframe to suit different technical and user experience requirements.
- Enable tokenisation at the point of entry to facilitate secure subsequent merchant-initiated transactions.
- Access real-time webhook notifications for immediate synchronisation of order status and payment capture events.
- Optimise conversion rates with localised languages and currency displays based on customer geo-location data.
- Manage fraud risks through integrated AVS and CVV checks performed at the point of entry.
A short scoping call, then a written plan for your MIDs.
Questions about Hosted checkout
How does a hosted checkout reduce my PCI DSS compliance burden?
PCI DSS compliance is mandatory for any entity that processes, stores, or transmits cardholder data. By using a hosted checkout, the merchant never handles the raw card data; instead, the data is entered directly into the provider's secure servers.
This often reduces the merchant's reporting requirement to the Self-Assessment Questionnaire A (SAQ A), which is significantly shorter and less complex than the requirements for merchants who capture card data on their own servers.
Can I maintain my brand identity on a page hosted by a third party?
Yes, most hosted checkouts allow for extensive visual customisation. Merchants can typically configure colours, fonts, headers, and logos to match their primary website.
Some providers allow for advanced customisation through CSS, ensuring that the transition from the merchant's catalogue to the payment page is visually unobtrusive and does not degrade customer trust during the final stages of the journey.
What happens if a customer’s payment fails on the hosted page?
When a payment is declined, the hosted checkout remains active, allowing the customer to attempt the transaction again with a different card or payment method. The page displays the refusal reason if provided by the issuer.
Once the customer either succeeds or decides to cancel, they are redirected back to the merchant’s site via predefined URLs, while a webhook sends the final status to the merchant’s backend.
How does a hosted payment page reduce PCI DSS scope?
A hosted payment page redirects customers from the merchant’s website to a payment form operated within Cardflo’s PCI DSS compliant environment.
Card details are entered and handled on that hosted page rather than passing through the merchant’s systems, which can allow eligible merchants to complete SAQ A instead of a more extensive assessment.
Merchants must still follow applicable PCI DSS requirements for their own website, redirect implementation and security controls.
How does a hosted checkout handle Strong Customer Authentication?
The hosted page is built to orchestrate the 3D Secure (3DS) flow. When the transaction falls under the scope of SCA, the hosted page handles the redirect to the issuer's authentication page or displays the challenge within the session.
This managed approach simplifies the implementation of complex authentication protocols for the merchant, as the logic is maintained by the provider.
Can I use my own domain for the hosted checkout page?
Some providers offer a custom domain feature, allowing the hosted page to reside at a subdomain like payments. yourdomain. com. This requires specific DNS configurations and SSL certificate management.
While this can improve user trust by keeping the domain consistent, many merchants find that a standard provider-hosted URL is sufficient given the clear branding available on the page itself.
Related features.
Related guides.
See how Cardflo compares.
Ready to improve your payments setup?
Tell us about your business. We'll match you with the right acquiring partners and the right route, typically inside a week.