What a hosted payment gateway is

A hosted payment gateway is a payment processor's own checkout page that you redirect your customer to instead of building your own. When someone buys from you, they leave your website, enter their payment details on the processor's secure page, and then return to you after the transaction completes. You never see or store their card number—the processor handles all of it.

The processor owns the page, maintains the security, and takes responsibility for keeping payment data safe. You embed a link or button on your site that sends customers to their checkout. This is different from an integrated gateway, where the checkout stays on your domain but the processor's code runs behind the scenes.

Hosted gateways are common for small businesses, nonprofits, and anyone who wants to accept payments without managing the technical or compliance burden of storing sensitive card data themselves.

Key Takeaways

  • A hosted gateway redirects customers to the processor's checkout page instead of keeping them on your site, so you never handle raw card data.
  • The processor is responsible for PCI compliance and data security, which removes a major technical and legal burden from your business.
  • Setup is faster than integrated gateways because you do not need to build or customize a checkout form.
  • Customers leave your site during checkout, which can reduce conversion rates compared to keeping them on your domain the entire time.
  • Costs are typically lower than integrated solutions, but you have less control over the checkout experience and branding.

How the transaction flow works

The customer clicks a "Pay Now" or "Checkout" button on your site. That button links to a hosted checkout page owned by the payment processor—usually a URL like checkout.processor.com with your merchant ID attached. The customer enters their card details, billing address, and any other required information on that page.

The processor encrypts the data, processes the charge, and decides whether to approve or decline it. Once the transaction completes, the processor redirects the customer back to your site—usually to a confirmation page you specify. You receive a notification (called a webhook or IPN) that tells you the payment went through, and your system updates the order status.

The entire card number and security code never touch your servers. The processor stores the encrypted data in their own vault, which they maintain to meet PCI DSS (Payment Card Industry Data Security Standard) requirements. You only see the last four digits and transaction ID in your records.

Hosted vs. integrated gateways: the main differences

An integrated gateway keeps the checkout form on your website. The customer enters their card details in a form that looks like part of your site, but the data is encrypted before it leaves their browser and sent directly to the processor. You never see the unencrypted card number, but you do need to implement the processor's code correctly and maintain certain security standards on your own domain.

A hosted gateway sends the customer away from your site entirely. The checkout page is clearly the processor's property, not yours. This means less work for you to set up and maintain, but also less control over how the checkout looks and feels.

Hosted gateways are simpler to launch and require less technical knowledge. Integrated gateways give you more flexibility to customize the checkout experience and keep customers on your domain, which can improve conversion rates. The trade-off is that integrated gateways require more development work and a deeper understanding of payment security.

PCI compliance and security responsibility

PCI DSS is a set of security standards that anyone handling credit card data must follow. The standards cover how you store data, who can access it, how you encrypt it, and how you monitor for breaches. Compliance is mandatory—it is not optional—and violations can result in fines from card networks and payment processors.

With a hosted gateway, the processor takes on most of the compliance burden. They maintain the secure infrastructure, conduct regular security audits, and handle data encryption. You still need to protect your own systems and keep your merchant account credentials secure, but you do not need to build or maintain a PCI-compliant checkout system yourself.

This is one of the biggest advantages of hosted gateways for small businesses. You avoid the cost and complexity of hiring security experts or paying for compliance audits. The processor's responsibility for the checkout page means you can focus on running your business instead of managing payment infrastructure.

When a hosted gateway makes sense for your business

A hosted gateway is a good fit if you are just starting to take payments online and do not have a development team. Setup takes hours or days instead of weeks. You can add a payment button to your site with minimal code, and the processor handles everything else.

Hosted gateways also work well for nonprofits, freelancers, and small e-commerce sites that do not need a highly customized checkout experience. If your customers are comfortable leaving your site to pay, and you do not need to collect complex information during checkout, a hosted solution is usually the fastest and cheapest route.

They are also useful if you sell through multiple channels—your website, a marketplace, email invoices—and want a single payment processor that works everywhere. Many hosted gateways generate payment links you can send via email or embed in different places, so you do not need separate checkout systems for each channel.

Drawbacks and when to consider alternatives

The main drawback is that customers leave your site during checkout. This can hurt conversion rates because some people abandon the purchase when they see they are being redirected to an unfamiliar page. You also have limited control over the checkout design and cannot easily add custom fields or logic specific to your business.

If you need a highly branded checkout experience, the ability to collect custom information, or the ability to keep customers on your domain the entire time, an integrated gateway or a full payment platform is a better choice. These options cost more and require more technical setup, but they give you much more control.

Hosted gateways can also be slower to load than integrated checkouts, especially if your internet connection is slow or the processor's servers are experiencing latency. For high-volume businesses, this delay can add up to lost sales.

Common hosted gateway providers

PayPal's Standard Checkout and Stripe Checkout are two of the most widely used hosted solutions. PayPal redirects customers to PayPal's login page, where they can pay with a PayPal account or a credit card. Stripe Checkout is a pre-built page that accepts cards, Apple Pay, Google Pay, and other payment methods.

Square Online, WooCommerce Payments, and Authorize.Net also offer hosted checkout options. Each processor has slightly different features, pricing, and supported payment methods, so the right choice depends on your business type, sales volume, and the payment methods your customers prefer.

Most hosted gateways charge a percentage of each transaction (typically 2.2% to 3.5% plus a per-transaction fee) and do not charge a monthly platform fee. Some offer higher rates for certain payment methods or transaction types, so read the pricing page carefully before committing.

Frequently Asked Questions

Can I customize the look and feel of a hosted payment page?

Most hosted gateways let you add your logo and choose colors, but you cannot change the layout or add custom fields. If you need full control over the checkout design, an integrated gateway is a better option. Some processors offer a middle ground—a semi-hosted solution that stays on your domain but uses their checkout form.

What happens if the customer closes their browser during checkout?

If they close the browser before completing the payment, the transaction does not go through and they are not charged. When they return to your site, they will see an incomplete order. Most processors let you send them a payment link to finish the purchase, or they can start over from the beginning.

Do I need to store customer payment information for repeat purchases?

No. The processor stores the encrypted card data in their vault, and you receive a token—a unique identifier—that you can use to charge that customer again without asking for their card number. This is called tokenization, and it makes repeat billing and subscriptions much easier.

How long does it take to set up a hosted gateway?

Most hosted gateways can be set up in a few hours. You create a merchant account, add your bank details, generate a payment link or button, and embed it on your site. No coding is required for basic setups, though connecting it to your order management system may take longer depending on your platform.

What if a customer disputes a charge after paying through a hosted gateway?

The processor handles the dispute process. The customer contacts their bank or card issuer, who contacts the processor. You will receive a chargeback notice and have a window (usually 7 to 10 days) to respond with evidence that the transaction was legitimate. The processor provides tools to upload receipts, shipping confirmations, and other proof.