PCI compliance, in plain English
What PCI compliance means for your WooCommerce store, why it matters, and what you actually need to do about it.
- Difficulty
- Beginner
PCI compliance sounds intimidating. In practice, if you use a reputable payment gateway, most of the hard work is already done for you. This guide explains what PCI means in plain terms and what your responsibilities are.
Quick summary
PCI DSS is a security standard for businesses that handle card payments. If you use Stripe, WooPayments, or PayPal, the card details go straight to them rather than to your site. PCI DSS still applies to you, because your site serves the checkout page, but your scope is much smaller. Your main job is to keep your software updated, use HTTPS, and never store card data.
What is PCI DSS?
PCI DSS stands for Payment Card Industry Data Security Standard. It's a set of rules set by the Payment Card Industry Security Standards Council, the body the major card brands set up, and it applies to anyone who stores, processes or transmits cardholder data.
The goal is simple: protect customers' card information from theft.
Does it apply to you?
If your store accepts card payments — yes, PCI DSS applies to you at some level. But the size of your obligation depends on how card data flows.
Use a gateway that takes payments off-site or through hosted fields, such as Stripe, WooPayments or PayPal, and your site is not handling raw card data. PCI DSS still applies, because your site serves the checkout page, but your compliance scope may be significantly reduced.
How you then confirm your compliance is set by your payment processor, and it depends on your integration and your transaction volume. Most stores on a hosted gateway validate with the self-assessment questionnaire called SAQ A. Your processor will tell you which one applies to you.
Why modern payment gateways make this easy
When you use Stripe, WooPayments, or PayPal:
- Your server never sees the card number. The payment fields are served by the gateway, usually inside an iframe on your checkout page, and the details go straight to them.
- You never store card data. WooCommerce never stores card details, and the official gateways keep only partial data such as the last four digits.
- The heavy compliance burden falls on them. Stripe and WooPayments are both validated as PCI DSS Level 1 service providers.
It still isn't nothing, though. Using a hosted gateway reduces the burden; it doesn't remove it. You remain responsible for the rest of your environment, including things like vulnerability scans if your processor asks for them.
Your responsibilities
Even in the simplest setup, you still have responsibilities:
| Responsibility | What to do |
|---|---|
| Use HTTPS | Your checkout and account pages must be served over SSL/HTTPS. Most gateways require it, and the standard requires card data to be encrypted in transit. |
| Keep software updated | WordPress, WooCommerce, themes, and plugins must be current. The standard asks you to develop and maintain secure systems and software. |
| Strong passwords + 2FA | Secure admin access to WordPress, hosting, and payment accounts, and give people only the access they need. |
| Don't store card data | Never save card numbers in order notes, emails, spreadsheets, or anywhere. |
| Use reputable payment gateways | Stick to well-known processors that keep card data off your site. WooCommerce names Stripe, PayPal and WooPayments; for any other gateway, check its own PCI documentation. |
| Choose secure hosting | Many of the requirements — firewalls, malware protection, logging — sit with your host. Ask them what they cover. |
| Monitor for breaches | A security plugin can alert you to suspicious activity. Your processor may also require regular scans by an Approved Scanning Vendor (ASV). |
Never collect card numbers yourself
Never create a form asking customers to type their credit card number into a text field you control. Never accept card numbers by email, message, or phone and enter them into WooCommerce. Always direct customers to the official payment form on your checkout page.
Self-assessment questionnaire (SAQ)
PCI compliance is usually enforced by your payment processor, who may ask you to complete a self-assessment questionnaire (SAQ), or to have your site scanned by an Approved Scanning Vendor. With a gateway like Stripe or PayPal handling card data:
- The questionnaire is usually SAQ A.
- Depending on factors like your PCI level, your processor may ask for a different SAQ type, or ask that yours be signed off by a Qualified Security Assessor.
- Some processors provide their own compliance portal where you complete this online.
Check your payment gateway's documentation or compliance dashboard for specifics, and ask them directly if you're not sure which applies.
What we do to keep you compliant
When we build and maintain your store, we:
- Configure payment gateways so card details are collected by the gateway and never by your site, which is the integration that keeps your scope smallest.
- Ensure HTTPS is active and properly configured.
- Keep your core software updated.
- Do not install plugins that would store card data.
If you ever have concerns about compliance, reach out and we'll review your setup.
Common questions
Do I need to get formally 'certified' as PCI compliant?
Most small online stores don't need a third-party audit. Completing the self-assessment questionnaire your payment processor asks for is typically enough. Businesses processing higher volumes may have more to do, including having the questionnaire signed by a Qualified Security Assessor. Your payment gateway will tell you which applies to your account.
What happens if there's a data breach?
If customer card data is compromised, the consequences can be serious. Your payment processor and the card brands decide what follows, and there is reputational damage on top of whatever they require. This is why keeping software updated and using reputable gateways matters. If you suspect a breach, contact your payment gateway and hosting provider immediately, and reach out to us.
Does PayPal have a different compliance level?
PayPal's checkout also keeps card data off your server, so your scope is reduced in the same way. The exact questionnaire depends on how PayPal is integrated on your site and on your account, so confirm it with PayPal rather than assuming it matches another gateway.
Which version of the standard is current?
WooCommerce's own PCI guidance summarises the 12 core requirements as defined in PCI DSS v4.0.1. The Payment Card Industry Security Standards Council publishes the full standard and any updates.
Related guides
Need a hand?
Learn more
Last updated