是否符合PCI标准（不仅仅是一个不同的子域，而是另一个域）（安全地）提供图像？

Question

Is it PCI-compliant to serve images (securely) from a different domain? I searched the PCI DSS 2.0 PDF and didn't find any references to it.

Answer 1

Images do not fall under PCI compliance. PCI DSS covers the storing, transmission, and processing of credit card information only . So you can serve your images from any server you like without having any PCI issues.

Answer 2

I take it these images are going to appear on the same page as the credit card entry form? If so as long as they are rendered over SSL, then they cannot be hijacked and additional code rendered in their place.

I would say that it would aid in your compliance to have the images served via SSL regardless of the domain due to the fact that your payment page must be presented in SSL to the end user.