Unfortunately, PCI does not put very many restrictions on the parent website. If credit card elements are in an iFrame, the parent site is excluded from most requirements because the iFrame is "secure."
Of course, if you own the parent site you can replace the iFrame with anything you want.
Of course, if you own the parent site you can replace the iFrame with anything you want.