[Skip to main content](#vessel-content) # PCI DSS free Gateway Plugins ## - **[netpastor](/forum/user/9934-netpastor "View netpastor's Profile")** - [![netpastor's Avatar](https://www.hikashop.com/media/kunena/core/svg/person.svg)](/forum/user/9934-netpastor "View netpastor's Profile") Topic Author - [ Offline](/forum/user/9934-netpastor) Less More - Posts: 55 - Thank you received: 3 - - 10 years 2 months ago [\#249763](#249763) by [netpastor](/forum/user/9934-netpastor "View netpastor's Profile") *[PCI DSS free Gateway Plugins](/forum/29-payment-methods/886406-pci-dss-free-gateway-plugins#249763 "-- Joomla version -- : n/a -- PHP version -- : n/a -- Browser(s) name and version -- : n/a -- Error-message(debug-mod must be tuned on) -- : n/a I am wondering if there is any discussion (couldn't find any), re the use of payment plugins that don't require PCI DSS compliance on the host server. I was just looking at the MIGS plugin, but there is no indication on the product page as to whether it may or may not be. On researching the options, I think the simple way to avoid PCI DSS requirements (on your hosting environment) is to use Direct Post as the post method; so that even whilst a form for cc details may be generated on your own hosted site, the action of that form submits the details directly to the payment gateway concerned, with then a 'callback' from the gateway to your own site with a paid/notpaid result. Most of the plugins I have looked at, do not do this, but instead post the form (including cc data) into the hikashop scripts (thus then requiring your hosting to meet PCI DSS compliance - ie very expensive hosting.) As coding wise, it can be straightforward to use direct post, I am not sure why very few payment plugins use this action? I see that 'stripe' uses an iframe popup on one example i saw (in a wordpress shopping cart) - with the iframe being generated by the stripe site - so it may be that those guys have thought about how most shared hosting in the world does not meet PCI DSS security requirements. I would ask the hikashop devs to consider a clear indication on each of the payment plugins to indicate whether the end user should insist on PCI DSS hosting to use the particular plugin or not (sorry if I have missed this, and it already exists) Thanks Ian")* was created by *[netpastor](/forum/user/9934-netpastor "View netpastor's Profile")* -- Joomla version -- : n/a -- PHP version -- : n/a -- Browser(s) name and version -- : n/a -- Error-message(debug-mod must be tuned on) -- : n/a I am wondering if there is any discussion (couldn't find any), re the use of payment plugins that don't require PCI DSS compliance on the host server. I was just looking at the MIGS plugin, but there is no indication on the product page as to whether it may or may not be. On researching the options, I think the simple way to avoid PCI DSS requirements (on your hosting environment) is to use Direct Post as the post method; so that even whilst a form for cc details may be generated on your own hosted site, the action of that form submits the details directly to the payment gateway concerned, with then a 'callback' from the gateway to your own site with a paid/notpaid result. Most of the plugins I have looked at, do not do this, but instead post the form (including cc data) into the hikashop scripts (thus then requiring your hosting to meet PCI DSS compliance - ie very expensive hosting.) As coding wise, it can be straightforward to use direct post, I am not sure why very few payment plugins use this action? I see that 'stripe' uses an iframe popup on one example i saw (in a wordpress shopping cart) - with the iframe being generated by the stripe site - so it may be that those guys have thought about how most shared hosting in the world does not meet PCI DSS security requirements. I would ask the hikashop devs to consider a clear indication on each of the payment plugins to indicate whether the end user should insist on PCI DSS hosting to use the particular plugin or not (sorry if I have missed this, and it already exists) Thanks Ian Please [Log in](/login?return=aHR0cHM6Ly93d3cuaGlrYXNob3AuY29tL2ZvcnVtLzI5LXBheW1lbnQtbWV0aG9kcy84ODY0MDYtcGNpLWRzcy1mcmVlLWdhdGV3YXktcGx1Z2lucz90bXBsPW1hcmtkb3du) or [Create an account](/component/users/registration?Itemid=101) to join the conversation. - **[nicolas](/forum/user/63-nicolas "View nicolas's Profile")** - [![nicolas's Avatar](https://www.hikashop.com/media/kunena/avatars/resized/size144/users/avatar63.png?1793428657)](/forum/user/63-nicolas "View nicolas's Profile") - [ Offline](/forum/user/63-nicolas) Less More - Posts: 86541 - Thank you received: 14304 - - 10 years 1 month ago [\#249795](#249795) by [nicolas](/forum/user/63-nicolas "View nicolas's Profile") Replied by *[nicolas](/forum/user/63-nicolas "View nicolas's Profile")* on topic *[PCI DSS free Gateway Plugins](/forum/29-payment-methods/886406-pci-dss-free-gateway-plugins#249795 "-- Joomla version -- : n/a -- PHP version -- : n/a -- Browser(s) name and version -- : n/a -- Error-message(debug-mod must be tuned on) -- : n/a I am wondering if there is any discussion (couldn't find any), re the use of payment plugins that don't require PCI DSS compliance on the host server. I was just looking at the MIGS plugin, but there is no indication on the product page as to whether it may or may not be. On researching the options, I think the simple way to avoid PCI DSS requirements (on your hosting environment) is to use Direct Post as the post method; so that even whilst a form for cc details may be generated on your own hosted site, the action of that form submits the details directly to the payment gateway concerned, with then a 'callback' from the gateway to your own site with a paid/notpaid result. Most of the plugins I have looked at, do not do this, but instead post the form (including cc data) into the hikashop scripts (thus then requiring your hosting to meet PCI DSS compliance - ie very expensive hosting.) As coding wise, it can be straightforward to use direct post, I am not sure why very few payment plugins use this action? I see that 'stripe' uses an iframe popup on one example i saw (in a wordpress shopping cart) - with the iframe being generated by the stripe site - so it may be that those guys have thought about how most shared hosting in the world does not meet PCI DSS security requirements. I would ask the hikashop devs to consider a clear indication on each of the payment plugins to indicate whether the end user should insist on PCI DSS hosting to use the particular plugin or not (sorry if I have missed this, and it already exists) Thanks Ian")* Hi, Most payment plugins actually redirect the customer to the payment gateway for entering the credit card at the end of the checkout and thus don't require that. Only a handful of them ask the credit card data during the checkout, like the MIGS plugin and indeed, in that case, PCI DSS is strongly advised on the hosting. Having a credit card form sending the credit card data to the payment gateway in the middle of the checkout is tricky. The issue is that the checkout pages are a form already. And having a form in a form is not possible. That's why the iframe is a good compromise, but not all payment gateways offer that capability. Some also propose to have the credit card form at the end of the checkout, in which case there is no checkout form anymore. Basically PCI DSS compliance should be asked for payment plugins where you enter the credit card data in the middle of the checkout: PayPal Pro, Authorize.net in AIM, MIGS, the "credit card" payment plugin, eSelect, iPayDNA, iveri, PayJunction, Payment Express in PxPost, VirtualMerchant, WestPac in API, WorldNetTPS. As you can see, for 4 of them, there is an alternative solution with the same payment gateway (another API which doesn't collect the credit card during the checkout). Please [Log in](/login?return=aHR0cHM6Ly93d3cuaGlrYXNob3AuY29tL2ZvcnVtLzI5LXBheW1lbnQtbWV0aG9kcy84ODY0MDYtcGNpLWRzcy1mcmVlLWdhdGV3YXktcGx1Z2lucz90bXBsPW1hcmtkb3du) or [Create an account](/component/users/registration?Itemid=101) to join the conversation. - **[netpastor](/forum/user/9934-netpastor "View netpastor's Profile")** - [![netpastor's Avatar](https://www.hikashop.com/media/kunena/core/svg/person.svg)](/forum/user/9934-netpastor "View netpastor's Profile") Topic Author - [ Offline](/forum/user/9934-netpastor) Less More - Posts: 55 - Thank you received: 3 - - 10 years 1 month ago [\#249866](#249866) by [netpastor](/forum/user/9934-netpastor "View netpastor's Profile") Replied by *[netpastor](/forum/user/9934-netpastor "View netpastor's Profile")* on topic *[PCI DSS free Gateway Plugins](/forum/29-payment-methods/886406-pci-dss-free-gateway-plugins#249866 "-- Joomla version -- : n/a -- PHP version -- : n/a -- Browser(s) name and version -- : n/a -- Error-message(debug-mod must be tuned on) -- : n/a I am wondering if there is any discussion (couldn't find any), re the use of payment plugins that don't require PCI DSS compliance on the host server. I was just looking at the MIGS plugin, but there is no indication on the product page as to whether it may or may not be. On researching the options, I think the simple way to avoid PCI DSS requirements (on your hosting environment) is to use Direct Post as the post method; so that even whilst a form for cc details may be generated on your own hosted site, the action of that form submits the details directly to the payment gateway concerned, with then a 'callback' from the gateway to your own site with a paid/notpaid result. Most of the plugins I have looked at, do not do this, but instead post the form (including cc data) into the hikashop scripts (thus then requiring your hosting to meet PCI DSS compliance - ie very expensive hosting.) As coding wise, it can be straightforward to use direct post, I am not sure why very few payment plugins use this action? I see that 'stripe' uses an iframe popup on one example i saw (in a wordpress shopping cart) - with the iframe being generated by the stripe site - so it may be that those guys have thought about how most shared hosting in the world does not meet PCI DSS security requirements. I would ask the hikashop devs to consider a clear indication on each of the payment plugins to indicate whether the end user should insist on PCI DSS hosting to use the particular plugin or not (sorry if I have missed this, and it already exists) Thanks Ian")* > nicolas wrote: Hi, > > As you can see, for 4 of them, there is an alternative solution with the same payment gateway (another API which doesn't collect the credit card during the checkout). Thanks Nicolas Which four sorry? ie not sure which one's you mean Please [Log in](/login?return=aHR0cHM6Ly93d3cuaGlrYXNob3AuY29tL2ZvcnVtLzI5LXBheW1lbnQtbWV0aG9kcy84ODY0MDYtcGNpLWRzcy1mcmVlLWdhdGV3YXktcGx1Z2lucz90bXBsPW1hcmtkb3du) or [Create an account](/component/users/registration?Itemid=101) to join the conversation. - **[nicolas](/forum/user/63-nicolas "View nicolas's Profile")** - [![nicolas's Avatar](https://www.hikashop.com/media/kunena/avatars/resized/size144/users/avatar63.png?1793428657)](/forum/user/63-nicolas "View nicolas's Profile") - [ Offline](/forum/user/63-nicolas) Less More - Posts: 86541 - Thank you received: 14304 - - 10 years 1 month ago [\#249868](#249868) by [nicolas](/forum/user/63-nicolas "View nicolas's Profile") Replied by *[nicolas](/forum/user/63-nicolas "View nicolas's Profile")* on topic *[PCI DSS free Gateway Plugins](/forum/29-payment-methods/886406-pci-dss-free-gateway-plugins#249868 "-- Joomla version -- : n/a -- PHP version -- : n/a -- Browser(s) name and version -- : n/a -- Error-message(debug-mod must be tuned on) -- : n/a I am wondering if there is any discussion (couldn't find any), re the use of payment plugins that don't require PCI DSS compliance on the host server. I was just looking at the MIGS plugin, but there is no indication on the product page as to whether it may or may not be. On researching the options, I think the simple way to avoid PCI DSS requirements (on your hosting environment) is to use Direct Post as the post method; so that even whilst a form for cc details may be generated on your own hosted site, the action of that form submits the details directly to the payment gateway concerned, with then a 'callback' from the gateway to your own site with a paid/notpaid result. Most of the plugins I have looked at, do not do this, but instead post the form (including cc data) into the hikashop scripts (thus then requiring your hosting to meet PCI DSS compliance - ie very expensive hosting.) As coding wise, it can be straightforward to use direct post, I am not sure why very few payment plugins use this action? I see that 'stripe' uses an iframe popup on one example i saw (in a wordpress shopping cart) - with the iframe being generated by the stripe site - so it may be that those guys have thought about how most shared hosting in the world does not meet PCI DSS security requirements. I would ask the hikashop devs to consider a clear indication on each of the payment plugins to indicate whether the end user should insist on PCI DSS hosting to use the particular plugin or not (sorry if I have missed this, and it already exists) Thanks Ian")* PayPal, Authorize.net, Payment Express and WestPac. Please [Log in](/login?return=aHR0cHM6Ly93d3cuaGlrYXNob3AuY29tL2ZvcnVtLzI5LXBheW1lbnQtbWV0aG9kcy84ODY0MDYtcGNpLWRzcy1mcmVlLWdhdGV3YXktcGx1Z2lucz90bXBsPW1hcmtkb3du) or [Create an account](/component/users/registration?Itemid=101) to join the conversation. Board Categories HikaShop Install & Update Product & Category Display Content Creation Sales and Orders Orders management Reports & Statistics Customers Checkout Payment Methods Shipping Methods Import & Export (CSV, XLS…) Specific Features Affilation Taxes Wishlist Vote Carousel & Slider Mass Actions Filters & Search Discount & Coupon Feature Request Integrations Showcase General Talk about HikaShop Development HikaShop 3.0 Beta Translation Commercial Jobs HikaShop Components HikaMarket Market: Feature requests Market: How to? Market: Bug Report HikaSerial General talk about HikaSerial Serial: Bug Report Serial: How to? Support en Français de HikaSerial (French Support) HikaSubscription HikaAuction Auction: Feature requests Auction: How to? Auction: Bug report Hikashop around the world Support en Français (French Support) Russian FAQ. Курс выживания с Hikashop. Частые вопросы и о Расширения Hikashop Наши сайты на Hikashop 日本語版サポート(Japanese Support) Thai German Archives Bug Report How to? [](/forum/topics/feed/mode-topics?format=feed&type=rss) Time to create page: 0.059 seconds [Powered by](/forum/credits) [Kunena Forum](https://www.kunena.org)