How a Hosted Payment Gateway Works and Why Merchants Use Them
What a hosted payment gateway does
A hosted payment gateway is a payment processor's own webpage where your customer enters their credit card or bank details—not on your website. When someone buys from you, you send them to that secure page, they complete the transaction there, and then they return to your site with a confirmation. You never see or store their card number.
The key difference from other payment methods: the payment processor owns and maintains the checkout page itself. You do not build it, host it, or handle the sensitive data. This shifts the security burden and the compliance work almost entirely to the processor, which is why many small merchants choose this route.
The flow is simple. Customer clicks "Pay Now" on your site. They land on the processor's page. They enter card details. The processor charges the card, sends the money to your bank account, and redirects the customer back to a confirmation page you control. The whole transaction happens on someone else's server.
Key Takeaways
- A hosted payment gateway means your customer enters payment details on the processor's webpage, not yours, so you never handle card data directly.
- Setup is faster and cheaper than building your own payment form because the processor provides the entire checkout page.
- You meet lower security and compliance standards (PCI DSS) because the processor, not you, stores and processes the card information.
- The trade-off is less control over the look and feel of checkout and slightly higher transaction fees than self-hosted options.
- Hosted gateways work for online stores, invoicing systems, donation pages, and any business that needs to collect card payments without building custom checkout code.
Why merchants choose hosted payment gateways
The main reason is speed and simplicity. You do not need a developer to build a payment form. You do not need to apply for a merchant account separately or negotiate with a bank. You sign up with the processor, get a link or button code, drop it on your website, and you are done. The whole setup takes hours, not weeks.
The second reason is security responsibility. PCI DSS (Payment Card Industry Data Security Standard) compliance is a set of rules that protect card data. If you host your own payment form, you must meet strict PCI requirements: firewalls, encryption, regular security audits, and liability if a breach happens. A hosted gateway moves that burden to the processor. They maintain the security. They pay for the audits. You stay out of scope for most PCI rules.
The third reason is cost to start. You do not pay for SSL certificates, server hardening, or compliance consulting. The processor builds that into their service. For a small business or nonprofit, that can save thousands of dollars in the first year.
How the money reaches your bank account
When a customer completes a transaction on the hosted gateway, the processor holds the funds temporarily. They verify the card is valid, check for fraud, and confirm the charge went through. This usually takes a few seconds to a few minutes.
Once approved, the processor deposits the money into your bank account on a schedule you choose—usually daily, twice weekly, or weekly. This is called a settlement. The processor deducts their fee (typically 2.2% to 3.5% of the transaction, plus a per-transaction fee of $0.25 to $0.50) before the deposit hits your account.
You can see all transactions in a dashboard the processor provides. You can filter by date, customer, or status. You can download reports for your accounting. Most processors also send you a daily or weekly email summary of deposits and fees.
What you control and what you do not
You control the button or link that sends customers to the gateway. You can customize the text, color, and placement on your website. You control what happens after the transaction—the confirmation page, the email receipt, the next step in your workflow.
You do not control the look of the payment form itself. The processor's page has their branding, their layout, their field order. Some processors let you add your logo or change colors slightly, but the form structure stays theirs. This can feel jarring if your website has a specific design language.
You also do not control the payment methods available. If the processor only accepts Visa, Mastercard, and American Express, that is what your customers see. If you want to add PayPal, Apple Pay, or bank transfers, you need a processor that offers those options—or you need to add a separate payment method alongside the gateway.
Fees and what they cover
Hosted gateways charge a transaction fee, usually a percentage of the sale plus a flat amount per transaction. A typical rate is 2.9% + $0.30 per transaction. Some processors charge a flat monthly fee instead of per-transaction fees, which can be cheaper if you process high volume.
The fee covers the processor's cost to verify the card, check for fraud, handle chargebacks (when a customer disputes the charge), and deposit the money to your bank. It also covers their customer support if something goes wrong.
Some processors charge extra for features like invoicing, recurring billing, or detailed reporting. Others include these at no extra cost. Read the processor's pricing page carefully—fees vary widely, and a processor that looks cheap on the headline rate may charge more for features you actually need.
When a hosted gateway is the right choice
A hosted gateway works best if you are new to online payments, have low transaction volume, or do not want to manage security compliance yourself. It is common for small ecommerce stores, service businesses that invoice clients, nonprofits collecting donations, and creators selling digital products.
It also works well if your website is on a platform like Shopify, WordPress, or Squarespace that has built-in hosted gateway integrations. You do not have to choose a processor and build the connection yourself—the platform handles it.
A hosted gateway is less ideal if you need a highly customized checkout experience, process thousands of transactions per day and want to negotiate lower fees, or want to offer many payment methods (crypto, local bank transfers, etc.). In those cases, a self-hosted gateway or a full payment platform may be better.
How to set up a hosted payment gateway
First, choose a processor. Common options include Stripe, Square, PayPal, Authorize.net, and Worldpay. Compare their transaction fees, the payment methods they support, and whether they integrate with your website platform.
Second, sign up for an account. You will need your business name, tax ID, bank account details, and a government-issued ID. The processor verifies this information—this usually takes one to three business days.
Third, get your gateway link or embed code. The processor gives you a URL you can send customers to, or a code snippet you can paste into your website. If you use a website builder, look for a built-in payment integration first—it will be simpler than copying code.
Fourth, test the gateway with a test transaction. The processor provides test card numbers that do not charge real money. Use these to make sure the payment form works, the confirmation page displays correctly, and the money shows up in your test dashboard.
Fifth, go live. Switch from test mode to live mode in your processor's settings. Your real customers can now complete real transactions.
Frequently Asked Questions
Do I need a merchant account to use a hosted payment gateway?
Not separately. The processor that runs the hosted gateway also acts as your merchant service provider. When you sign up with them, you get a merchant account as part of the setup. You do not need to apply to a bank or a separate acquirer.
What happens if a customer disputes a charge?
The processor handles the dispute process, called a chargeback. The customer contacts their bank and says the charge was unauthorized or the product did not arrive. The processor investigates, asks you for proof of delivery or consent, and decides whether to refund the customer or defend the charge. If you lose, the money comes out of your account, and you may pay a chargeback fee ($15 to $100).
Can I use a hosted gateway on a mobile app?
Yes, but it is awkward. You would open the gateway URL in a web browser within the app, which breaks the user experience. For mobile apps, most processors offer a mobile SDK (software development kit) instead, which lets you build a payment form directly in the app. Check whether your processor supports this before you choose.
What if the processor goes out of business?
Your money in their account is protected by the processor's bank, not by the processor itself. If they fail, your deposits are still safe. However, you will need to move to a new processor and update your payment links or code. This is why it is worth choosing a processor with a long track record and strong financial backing.
Can I use multiple hosted gateways on the same website?
Yes. You can offer customers a choice of payment methods by linking to different gateways, or you can use one gateway for online sales and another for invoicing. However, this complicates your accounting because you have to reconcile deposits from multiple sources. Most businesses stick with one processor unless they have a specific reason to split.