[cflsystems]

PayPal is well known and actually I think everyone trying to pay with PP will expect to be redirected to PP page to login and complete payment so I don't see a problem there. It is another question that a lot of customers actually don't like PP and will try to avoid using it.

For me personally the problem with redirecting to payment gateway hosted page is not that you are taking customers away form the site but the way the hosted page looks. There is very little control to modify the desing of the page to look like the site. I am pretty sure the average customer do not pay that much attention to the address bar and url as long as they feel the page is legit and secure.

As for XPayments on different server - I don't think putting it on shared hosting is any different or more secure than in XC subdirectory. What happens when some other site on that same shared hosting account is not compliant or is compromized? Your XPayments installation will also be compromized. You will have to do scan on it as well and state that is on shared hosting. This just doesn't seem like good solution to me