Agent WranglersData and secrets Required
Keep card numbers off your servers
Never let card numbers reach your servers or your own scripts. Take payments through the provider's hosted checkout or its embedded payment fields.
How to do it
A redirect to a hosted checkout, or the provider's iframe fields, keeps card data with the provider. That keeps you on PCI DSS SAQ A, the shortest self-assessment. Since 2025 it asks you to protect the page that holds the iframe from script attacks. Use a strict CSP and integrity checks on that page, as the website security chapter describes. See also choose a checkout that keeps you on SAQ A.
How to check
Pay with the provider's test card on staging. Search the server logs, the database and the requests to your own domain for the card number. It appears nowhere.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/hosted-payment-fields.