Skip to main content

How do I define my payment pages for PCI? [HOW-TO GUIDE]

  • Updated

To ensure Source Defense accurately tags checkout traffic and highlights PCI-related events, you need to define your payment page URL(s). If no URL is specified, the platform will apply the default "Checkout" label broadly, which may lead to over-reporting by including non-payment pages.

Why the label matters
Each payment URL you configure is automatically assigned a label (for example, Checkout, Payment-iFrame, or a custom name). That label appears in every part of the Admin-dashboards, reports, script policies, alerts-so you can instantly recognize which traffic or event came from a payment page and apply the right PCI controls.

Permissions - Only Admin-role users can create, edit, or remove payment-page settings.

Navigation

  1. Click Sites in the left-hand navigation.

  2. Select the site you want to manage.

  3. Scroll down until you see Payment URLs.

How to add a static payment URL

A static payment page always has the same address for every purchase.

  1. On the Payment URLs screen, click ＋ Add URL.

  2. Enter the full, exact URL where customers type card details.

  3. Edit the Label if you want something more descriptive than Checkout.

  4. Click Save.

How to add a dynamic payment URL with a wildcard

If the checkout path changes per order (IDs, hashes, etc.), replace the variable segment with *.

  1. Click ＋ Add URL.

  2. In URL, type the wildcard pattern—for example:

    https://shop.example.com/order/*

  3. Assign a specific Label - for instance, Order-Checkout.

  4. Click Save.

What happens when a payment URL is deleted

When a payment URL is removed, all data associated with that specific payment URL (including labels, events, and reporting context tied to it) is permanently deleted and will no longer appear in the Admin dashboards, reports, or alerts.

Quick Recap

  • Navigate to Sites → Payment URLs to configure checkout addresses.

  • The Label you assign makes it easy to spot payment-page traffic and events anywhere in the Admin.

  • Use an exact URL for static pages; use * for dynamic paths.

  • Only Admins can modify payment-page rules.

  • Removing a payment URL permanently deletes all data associated with that URL, including related events, labels, and reporting context.

Related articles