Just a comment to Tim Holman – your web server does NOT host Stripe Javascript. It’s retrieved from Stripe’s secure servers. No part of the transaction occurs on your servers – not files hosted, or validation. My understanding is the only thing that is on your servers is essentially a link to the stripe order form.