Iframe (Inline Frame)
PCIComplianceHubLast updated
An HTML element that embeds a separate document, from a separate origin, inside a page. In e-commerce it is the usual way a provider-hosted payment form appears within a merchant page: the card fields belong to the provider document, and the browser same-origin policy stops merchant scripts reading them. That separation is what lets an iframe integration qualify for SAQ A. It is not absolute protection, because a script on the merchant page can still overlay or replace the frame, which is why SAQ A's eligibility criteria for e-commerce channels include confirming that the merchant site is not susceptible to script attacks.
Applies to. E-commerce merchants who embed a provider's payment form, the provider whose document appears in the frame, and any page that frames third-party content.
Example. A merchant page contains an iframe whose src is the provider's form address. The card fields exist in the provider's document. A merchant script cannot read them, because the browser's same-origin policy keeps the two documents apart.
Limits. Same-origin isolation protects the contents of the frame, not the page around it. A script on the merchant page can remove the frame and draw a look-alike form, cover it, or change where the customer is sent afterwards; none of that reads the provider's document, and all of it captures card data. The 6.4.3 guidance points to the parent page's CSP as a way of restricting where the frame may be loaded from.