Payment Page Security Controls

Overview

Card data is entered directly into hosted fields or iframes provided by the campground's configured payment gateway (e.g. eWay, Square, Pin Payments, ANZ Worldline, OnlinePay). Camper BMS does not receive, transmit, or store cardholder data.

For a breakdown of which security responsibilities sit with Camper BMS, the campground, and the payment provider, see the PCI DSS Shared Responsibility Matrix.

Script Authorisation

Camper BMS deploys Content Security Policy (CSP) controls with per-request cryptographic nonces to authorise scripts and restrict third-party resources on payment pages.

Third-party script domains on payment pages are limited to the campground's configured payment gateway. No analytics, marketing, mapping, or other non-payment scripts load on payment pages:

Analytics scripts (Google Analytics, Meta Pixel), where configured by the campground, run only on booking funnel pages and never on card-capture pages.
Address autocomplete is performed server-side by Camper BMS; no Google Maps script loads in the browser.
No tag manager, session-replay, or support-widget scripts are present on any page of the booking flow.

Script Inventory

A documented inventory of all scripts that load on payment pages is maintained and reviewed quarterly. The inventory records each script's source, purpose, and authorisation method.

Tamper Detection and Alerting

CSP violation reports are collected when browsers detect policy violations or blocked resources on a payment page. Violations are stored and may generate administrator alerts to support investigation and review.

Violation records are retained for 36 months, after which they are automatically deleted by a scheduled data retention job.

The Content Security Policy is enforced by default, so browsers block any resource the policy does not allow. While a new payment provider integration or 3-D Secure authentication flow is being validated, the policy can be switched to report-only for a limited period, during which browsers report violations instead of blocking them. The embedded booking widget's frame-ancestors restriction stays enforced in report-only mode.

Transport Security

All payment pages are served exclusively over HTTPS with TLS. HTTP Strict Transport Security (HSTS) headers are set with a one-year max-age including subdomains.

Security Headers

The following headers are applied to production responses. Some headers differ between the administrative application and the embedded booking widget, because the widget is designed to be loaded inside a merchant-controlled iframe.

Header	Application Pages	Embedded Booking Widget
Content-Security-Policy (Content-Security-Policy-Report-Only while report-only mode is on)	Nonce-based policy with domain allowlisting	Per-request nonce-based policy with domain allowlisting, plus a `frame-ancestors` directive restricted to the campground's configured embed origins
Strict-Transport-Security	`max-age=31536000; includeSubDomains`	`max-age=31536000; includeSubDomains`
X-Content-Type-Options	`nosniff`	`nosniff`
X-Frame-Options	`DENY`	`SAMEORIGIN` when no embed origins are configured; omitted once the campground configures permitted embed origins, where the CSP `frame-ancestors` allowlist is the framing control
Referrer-Policy	`strict-origin-when-cross-origin`	`strict-origin-when-cross-origin`
Permissions-Policy	`accelerometer=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(self), usb=(), xr-spatial-tracking=()` `payment=(self)` lets the payment page offer Apple Pay and Google Pay. For an OnlinePay campground with a wallet turned on, payment pages set `payment=(self "<Verifone checkout origin>")` so the wallet can open inside Verifone's checkout iframe.	`accelerometer=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), usb=(), xr-spatial-tracking=()` The payment window, which opens outside the campground's website, sets `payment=(self)`, or `payment=(self "<Verifone checkout origin>")` for an OnlinePay campground with a wallet turned on.
Cross-Origin-Opener-Policy	`same-origin-allow-popups`	Not set - applied to application pages only so the widget can load inside a merchant-controlled iframe
Cross-Origin-Resource-Policy	`same-origin`	Not set - applied to application pages only so the widget can load inside a merchant-controlled iframe
X-Permitted-Cross-Domain-Policies	`none`	`none`
Reporting-Endpoints / Report-To	CSP violation endpoint configured	CSP violation endpoint configured

Supported Payment Gateways

Gateway	Integration Method
eWay	Hosted Secure Fields
Square	Web Payments SDK (hosted fields)
Pin Payments	Hosted Fields
OnlinePay (Verifone: Westpac, St.George, BankSA, Bank of Melbourne)	Hosted checkout iframe
ANZ Worldline	Hosted tokenisation iframe