Agent Wranglers

PAY-1Required

Choose a checkout that keeps you on SAQ A

Never let card numbers reach your servers or your own scripts. Take card details only through the provider's hosted payment page or its iframe fields, so you qualify for the shortest PCI DSS self-assessment, SAQ A.

By Agent Wranglers. Updated .

How to do it

PCI DSS v4.0.1 is the card industry's security standard. The self-assessment questionnaire (SAQ) you file depends on how card data moves. A redirect to a hosted page, or iframe fields served by the provider, qualify for SAQ A. If your own script builds the card form or posts card data to the provider, you move to SAQ A-EP, with many more requirements. Since its January 2025 revision, SAQ A also requires that the page holding the iframe is safe from script attacks. PCI FAQ 1588 allows two ways to show this. Protect that page yourself as Guard every script on a payment page says, or get the provider's written confirmation that its integration includes that protection. Load the provider's script from the provider's own domain, never from a copy.

Examples

Plain text example

Hosted payment page (redirect)              -> SAQ A
Provider iframe fields on your page         -> SAQ A, plus script protection or the provider's confirmation
Your own fields that post to the provider   -> SAQ A-EP
Card numbers reach your server              -> SAQ D

How to check

Pay with the provider's test card on staging. The card number appears nowhere in the server logs, the database or the requests to your own domain. Search the frontend for card inputs outside the provider's iframe, such as autocomplete="cc-number", cc-csc or inputs named card, cvc or cvv. None exist. Every page that loads the provider's script loads it from the provider's domain. The provider's confirmation, or your script inventory for 6.4.3, is stored in the repository.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/payments/card-security-and-sca/pci-saq-a-integration">Agent Wranglers payments and billing playbook</a>. In code you write, add a comment next to it with the same link.