Does a Payment Iframe Remove PCI DSS 6.4.3 & 11.6.1 Scope?
A hosted payment page, payment widget iframe or hosted fields keep card data off your systems, which reduces PCI scope substantially. They don't take the page around the iframe out of scope for PCI DSS 6.4.3 & 11.6.1, because a script there can overlay the form or capture keystrokes. This video covers the three models, what the iframe boundary protects, the 2025 SAQ A carve-out and its condition, the two routes in PCI SSC FAQ 1588, and why SAQ A-EP carries both requirements in full.
Full answer: Hosted Payment Pages, Iframes and PCI Scope
Transcript
Not entirely. A hosted payment page or iframe keeps card data off your systems, which removes a great deal from your scope. But the page that hosts the iframe is still yours. If the card is typed into a form served from your provider's domain, your servers, databases and logs fall outside the cardholder data environment. That's a genuine reduction. What it doesn't remove is your own page. There are three models. A full redirect sends the customer to your provider's domain: the largest reduction. An iframe embeds the provider's form in your page. Hosted fields put provider inputs inside your own form. The browser's same-origin policy stops a script on your page from reading inside the iframe. That's real. But the script can still draw a fake form over it, capture keystrokes before the iframe gets them, or swap the iframe's source for a lookalike. So is the parent page in scope for 6.4.3 & 11.6.1? Yes. It's a page where a cardholder enters card data, and it's where a malicious script would run. Your questionnaire changes how much applies. A 2025 update exempted eligible SAQ A merchants from these two requirements, on a condition: you confirm your site isn't susceptible to attacks from scripts that could affect your ecommerce systems. PCI SSC FAQ 1588 gives two ways to support that: apply the techniques of 6.4.3 & 11.6.1 to your page, or get written confirmation from your provider that its solution protects your page from script attacks. If your own page can affect the security of the payment transaction, you're probably SAQ A-EP, and both requirements apply in full. Confirm with your acquirer. Either way, know what runs on the page around your iframe. Even under SAQ A, that's how you make the confirmation honestly. Script Monitoring records it in every session, and gives you a weekly PDF evidence pack for your assessor. Script Monitoring is free for 1,000 page views a month, counted only on the pages you scope. Pro starts at $99 a month. Start for free at scriptmonitoring.com.