Hosted vs. Embedded WooCommerce Payment Forms
The Core WooCommerce Tradeoff
Both approaches ultimately keep raw card data away from the store's own server, which is the main PCI compliance benefit either way. The difference is purely in the customer's visible experience: a hosted page is a genuine navigation to the gateway's domain (noticeable in the browser's address bar), while an embedded form uses the gateway's secure iframe fields rendered directly inside your own checkout page, so the domain never visibly changes.
Which One Fits a Given Store
- Hosted checkout is faster to set up and requires less ongoing integration maintenance, making it a reasonable choice for a smaller store prioritizing simplicity over a fully seamless checkout experience.
- Embedded forms generally convert better, since customers can be hesitant or confused by an unexpected domain change mid-purchase, particularly on mobile where the transition can feel jarring.
- Branding consistency is easier to maintain with an embedded form, since the checkout page's own design carries through the entire payment step rather than handing off to the gateway's own (often more generic) page design.
- Both remain valid, PCI-compliant options — this is a UX and conversion decision more than a security one, since the underlying data handling is similarly safe either way.
Choosing and Switching
- Check whether the current gateway plugin offers both options, since many modern integrations support switching between them via a settings toggle rather than a full reintegration.
- If conversion data suggests hesitation at the payment step specifically, an embedded form is worth testing as a potential improvement.
- Test thoroughly on mobile after any switch, since embedded iframe fields sometimes need specific responsive handling a hosted redirect doesn't.
Need help switching checkout styles or improving payment-step conversion? See WooCommerce fixes.