Hosted payment page
A checkout page that lives with the payment provider rather than the shop, so the merchant's server never sees a card number.
The customer clicks "Pay", lands on a page on the provider's domain, enters the card there and is sent back with a receipt. The pattern is as old as e-commerce, but PCI DSS is what made it the default. A merchant that never touches card data can attest compliance with the shortest self-assessment questionnaire, SAQ A, instead of several hundred requirements. The provider also handles 3-D Secure, local payment methods and regulatory chores the merchant would otherwise have to build.
The price is control. The redirect breaks the experience, and every extra page load at checkout costs sales. The industry's compromise was hosted fields, where only the card input sits in an iframe served by the provider and the rest of the page belongs to the merchant. That protects less than it seems: if someone hijacks the merchant's page, as in the Magecart attacks, the iframe can simply be swapped for a fake one.