0

In my experience, when purchasing something online, the checkout page of the vendor usually redirects to a payment gateway of the company handling the payments. I insert my credit card details on the payment gateway page, the payment is processed, which then redirects me back to the vendor’s website.

Would it lead to a better user experience if the payment gateway is embedded in an iframe on the vendor’s website instead? This would allow customers to complete the purchase without any navigation in the browser.

Improve this question
1
  • 4
    When it comes to payments, there are more important factors than UX. You need to consider security, accountability, auditability, and also some payment providers only allow embedding if you pay extra. For most sites, a simple redirect is not only the cheapest option, but also the most secure option.
    – musefan
    Commented May 11, 2022 at 11:14

1 Answer 1

Reset to default
5

I've worked on this problem in the past; musefan's comment is exactly why you see hosted order pages.

Many payment systems offer APIs that can be embedded seamlessly into a site, but then your organization becomes responsible for keeping them secure, and hackers spend a lot of time performing junk transactions and other attacks to breach your site. If you're a smaller organization without a big infosec team, a hosted order page brings a lot of peace of mind.

Why not embed the external payment page in an iframe? Here's what I ran into:

  1. iframes don't play well with responsive design. You end up struggling with making things work on a variety of viewports, and it looks hinky.
  2. The hosted order page provider usually limits how much customization you can do. You can usually get the CSS looking 90% like your site, but something won't match, and again, looks hinky.
  3. Cross-domain warnings can pop up on occasion. The iframe is https, your site is hopefully also https, the certificates don't match, and browsers get mad and throw warnings about embedded scripts, images, and other stuff. Users don't like entering sensitive info into sites that throw warnings.

Hosted order pages aren't the greatest experience, either, but users can be prompted to expect them, and they "feel" more secure. The payment gateway or provider is 100% responsible for keeping them safe to use. It's better for the user, and better for the merchant.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.