PCI-compliant hosted fields vs the old way: what changed

The shift in one sentence

For years, taking a card online meant the number passed through your own servers, which put your entire stack in the blast radius of a breach. PCI-compliant hosted fields changed that by moving the card input into an iframe served from the payment provider's domain, so the sensitive data never touches your systems.

To see why that matters, it helps to look at what the old way actually cost, and what the new model quietly removed.

The old way: card data flowed through you

In the traditional model, you rendered a card form on your own page. The number, expiry, and security code were entered into inputs your JavaScript could read, posted to your server, and forwarded to a processor. Every system that data passed through, web servers, application logs, load balancers, error trackers, was in PCI scope.

A single verbose log statement or a misconfigured cache could capture card numbers. Compliance meant auditing all of it, and a breach anywhere in that path was your breach.

What PCI-compliant hosted fields changed

Hosted fields invert the flow. Instead of your page owning the card inputs, the provider serves them as origin-isolated iframes. With Flux, they load from payments.fluxpayments.com. The customer types into those iframes, and the data goes straight from the browser to the provider, which returns a token.

Your server sees the token, never the number. The card data has been rerouted around your infrastructure entirely, which is the whole point.

Why origin isolation is the load-bearing part

It is tempting to think any embedded form is equally safe, but the security comes from the origin boundary. Because the fields live on a different origin than your site, the browser's same-origin policy prevents your scripts, and any malicious script that lands on your page, from reading what the customer types.

This is enforcement by the browser, not by trust. That is why hosted and origin-isolated are the operative words, and why Flux carries SAQ-D Level 2 PCI DSS certification for the part it handles.

What it means for your audit scope

The practical result is a much smaller compliance footprint. When the card number never reaches your servers, the list of systems you must secure, monitor, and attest to shrinks. You still have obligations, and hosted fields are not a magic exemption, but the heaviest part of PCI, protecting stored and transmitted card data, moves to the provider.

For most teams that is the difference between a sprawling audit and a manageable one, which is felt in staff time as much as in risk.

What you keep from the old way

The trade is not control for safety. You still design the checkout, place the fields in your layout, and style them to match your brand. Customers see one coherent form.

What changed is invisible to them and enormous for you: the riskiest data in the transaction no longer lives in your environment. That is the quiet revolution of PCI-compliant hosted fields. You get the custom checkout of the old way without the liability that used to come with it.