Is it PCI-compliant to serve images (securely) from not just a different subdomain, but a different domain?

StackOverflow https://stackoverflow.com/questions/5081870

Question

Is it PCI-compliant to serve images (securely) from a different domain? I searched the PCI DSS 2.0 PDF and didn't find any references to it.

Was it helpful?

Solution

Images do not fall under PCI compliance. PCI DSS covers the storing, transmission, and processing of credit card information only. So you can serve your images from any server you like without having any PCI issues.

OTHER TIPS

I take it these images are going to appear on the same page as the credit card entry form? If so as long as they are rendered over SSL, then they cannot be hijacked and additional code rendered in their place.

I would say that it would aid in your compliance to have the images served via SSL regardless of the domain due to the fact that your payment page must be presented in SSL to the end user.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top