E-commerce (web) Redirection Server
PCIComplianceHubLast updated
The merchant-side server that sends a customer's browser from the merchant's website to another location, the payment provider's page, to enter card data. It is the merchant's half of a redirect integration, and the reason a redirect merchant is not entirely out of the picture.
Applies to. E-commerce merchants using a URL redirect to a compliant provider's payment page, which is one of the two SAQ A integrations.
Example. The customer clicks Pay; the merchant's web server responds with a redirect to the provider's hosted page. The merchant never sees card data, but a compromise of that server could send customers to a look-alike page instead.
Limits. The redirection server holds no account data and is not in the CDE, yet it decides where the customer goes, which is why SAQ A for v4.x added quarterly ASV scans (11.3.2) for redirect merchants (FAQ 1604). The SAQ A criterion about script attacks applies only to embedded forms (FAQ 1588), so for a redirect it is the scans and the redirecting page's own security that carry the weight. 'We only redirect' describes the data path, not the attack surface.
In PCI DSS v4.0.1. 11.3.2
Sources. PCI DSS v4.0.1, Appendix G: Glossary of Terms, Abbreviations, and Acronyms, PCI DSS v4.0.1 SAQ Instructions and Guidelines, r1, PCI DSS v4.0.1 (June 2024), PCI SSC FAQ 1588, How does an e-commerce merchant meet the SAQ A eligibility criteria for scripts? (February 2025), PCI SSC FAQ 1604, Do ASV scans in SAQ A apply to merchants with webpages that redirect to TPSPs or include TPSPs' embedded iframes? (June 2026)