Payment Page Security Controls

Overview

Card data is entered directly into hosted fields or iframes provided by the campground's configured payment gateway (e.g. eWay, Square, Pin Payments, ANZ Worldline, Westpac OnlinePay). Camper BMS does not receive, transmit, or store cardholder data.

For a breakdown of which security responsibilities sit with Camper BMS, the campground, and the payment provider, see the PCI DSS Shared Responsibility Matrix.

Script Authorisation

Camper BMS deploys Content Security Policy (CSP) controls with per-request cryptographic nonces to authorise scripts and restrict third-party resources on payment pages.

Third-party script domains on payment pages are limited to the campground's configured payment gateway. No analytics, marketing, mapping, or other non-payment scripts load on payment pages:

Analytics scripts (Google Analytics, Meta Pixel), where configured by the campground, run only on booking funnel pages and never on card-capture pages.
Address autocomplete is performed server-side by Camper BMS; no Google Maps script loads in the browser.
No tag manager, session-replay, or support-widget scripts are present on any page of the booking flow.

Script Inventory

A documented inventory of all scripts that load on payment pages is maintained and reviewed quarterly. The inventory records each script's source, purpose, and authorisation method.

Tamper Detection and Alerting

CSP violation reports are collected when browsers detect policy violations or blocked resources on a payment page. Violations are stored and may generate administrator alerts to support investigation and review.

Violation records are retained for 36 months, after which they are automatically deleted by a scheduled data retention job.

CSP controls may operate in staged enforcement modes during onboarding or validation of new payment provider integrations and 3-D Secure authentication flows.

Transport Security

All payment pages are served exclusively over HTTPS with TLS. HTTP Strict Transport Security (HSTS) headers are set with a one-year max-age including subdomains.

Security Headers

The following headers are applied to production responses. Some headers differ between the administrative application and the embedded booking widget, because the widget is designed to be loaded inside a merchant-controlled iframe.

Header	Application Pages	Embedded Booking Widget
Content-Security-Policy / Content-Security-Policy-Report-Only	Nonce-based policy with domain allowlisting, operating in staged enforcement modes where applicable	Per-request nonce-based policy with domain allowlisting, plus a `frame-ancestors` directive restricted to the campground's configured embed origins, in staged enforcement modes where applicable
Strict-Transport-Security	`max-age=31536000; includeSubDomains`	`max-age=31536000; includeSubDomains`
X-Content-Type-Options	`nosniff`	`nosniff`
X-Frame-Options	`DENY`	`SAMEORIGIN` when no embed origins are configured; omitted once the campground configures permitted embed origins, where the CSP `frame-ancestors` allowlist is the framing control
Referrer-Policy	`strict-origin-when-cross-origin`	`strict-origin-when-cross-origin`
Permissions-Policy	`accelerometer=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), usb=(), xr-spatial-tracking=()`	`accelerometer=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), usb=(), xr-spatial-tracking=()`
Cross-Origin-Opener-Policy	`same-origin-allow-popups`	Not set - applied to application pages only so the widget can load inside a merchant-controlled iframe
Cross-Origin-Resource-Policy	`same-origin`	Not set - applied to application pages only so the widget can load inside a merchant-controlled iframe
X-Permitted-Cross-Domain-Policies	`none`	`none`
Reporting-Endpoints / Report-To	CSP violation endpoint configured	CSP violation endpoint configured

Supported Payment Gateways

Gateway	Integration Method
eWay	Hosted Secure Fields
Square	Web Payments SDK (hosted fields)
Pin Payments	Hosted Fields
Westpac OnlinePay (Verifone)	Hosted checkout iframe
ANZ Worldline	Hosted tokenisation iframe