Payment Page
PCIComplianceHubLast updated
The page a cardholder enters card data into, and the unit PCI DSS Requirements 6.4.3 and 11.6.1 are written about. For those requirements the page is what the consumer browser assembles and renders, not what the merchant server emits: a provider iframe, a third-party script and the merchant HTML are all part of the same rendered page from the browser point of view, which is why script authorisation and change detection are judged as the consumer receives them.
Applies to. Any merchant or service provider whose page contains form elements that capture or submit account data, whether that is a single document, a document shown in an iframe within a non-payment page, or a form assembled by script. Requirements 6.4.3 and 11.6.1 are judged on the page as the consumer's browser receives it.
Example. A checkout page on a merchant domain that shows a provider's card form inside an iframe is a payment page. So is the provider's form document itself. The merchant page around the frame carries scripts of its own, and those run in the same browser tab as the card fields.
Limits. The page is the unit the requirements are written about, not the merchant's server: a script that arrives through a tag manager is on the page even though no merchant deployment put it there. Where the form is a provider's embedded page, the guidance to 11.6.1 says the entity should expect the provider to provide evidence that it meets the requirement for its part, in line with the provider's own assessment and Requirement 12.9.