---
title: "Keep card numbers off your servers · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/hosted-payment-fields
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep card numbers off your servers

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Data and secrets](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets)
- Rule: Never let card numbers reach your servers or your own scripts. Take payments through the provider's hosted checkout or its embedded payment fields.
- How: A redirect to a hosted checkout, or the provider's iframe fields, keeps card data with the provider. That keeps you on PCI DSS SAQ A, the shortest self-assessment. Since 2025 it asks you to protect the page that holds the iframe from script attacks. Use a strict CSP and integrity checks on that page, as the [website security chapter](https://agentwranglers.se/playbook/website/security) describes. See also [choose a checkout that keeps you on SAQ A](https://agentwranglers.se/playbook/payments/checkout-and-card-data/pci-saq-a-integration).
- Check: Pay with the provider's test card on staging. Search the server logs, the database and the requests to your own domain for the card number. It appears nowhere.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/hosted-payment-fields`.

- Previous: [Keep storage buckets private](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/private-storage-buckets)
- [Data and secrets](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets)