Answers

Should a service business take payments on its website?

Often yes, for payments that follow an agreement: a deposit to hold a date, a paid invoice, or a simple fixed-price job. When the price depends on a visit or a conversation, a call and a quote usually come first. If you add payments, let a payment provider's hosted checkout take the card, so card details never sit on your own pages, and record each paid deposit as a won lead.

When online payment helps

Letting customers book a time online is a separate choice; the related answer on online booking covers when it fits.

  • A deposit to hold a booked date or visit, once the customer has agreed to it.
  • Paying an invoice after the job, from a link instead of a check or a phone call.
  • Standard, fixed-price jobs that need no quote, where paying is the natural next step.
  • Customers who would rather pay at night than call during the day.

When a call should come first

When every job is different, asking for money before anyone has talked can put off a good customer who still has questions, and a refund costs time on both sides. In those cases a quote, then a payment link, often works better. Whether to show prices at all is covered in the related answer on putting prices on your website.

Keep card details off your own pages

The PCI Security Standards Council, the body behind the PCI DSS card data standard, says that standard is intended for every business involved in payment processing, including merchants, "regardless of their size or transaction volume". It adds that small merchants often have simpler setups with fewer systems to protect, which can reduce the effort, and that whether a small merchant must prove compliance is decided by the payment brands, so questions go to your acquirer (merchant bank) or the payment brand.

The Council's small-business resources include a guide to safe payments and a list of questions to ask your vendors, and it names weak or default passwords, insecure remote access and unpatched software among the leading causes of payment data breaches for businesses.

As general advice, not the Council's wording: a payment provider's hosted page or payment link, where the customer types the card on the provider's own page, usually keeps card numbers off your website and inbox. Ask the provider what that means for your own obligations, and never ask customers to send card numbers by email or text. This is a plain summary, not legal advice.

Record the payment as the outcome

A paid deposit is the clearest sign a lead was won. Mark it won in your lead list on the day it arrives, keep the channel the customer first came from, and note what was paid for, so you can later see which channels bring paying customers rather than only inquiries.

Sources

  1. PCI Security Standards Council, "Merchant Resources" (accessed 2026-10-25)

Related answers

Websites, upgraded or built

Most businesses do not need a new website. They need the one they have to load fast, say clearly what they do and ask the visitor to take one step.