PCI Compliance for WooCommerce: What Your Host Must Provide

PCI compliance for WooCommerce is a split responsibility: your host secures the servers, network and patching layer, while you control the checkout, plugins and payment flow that actually touch card data. Most store owners discover that split only after a bank sends a compliance questionnaire. This guide breaks down which of the 12 PCI DSS requirements your hosting provider must cover, which stay on your plate, and the exact questions to ask before you sign.

What PCI DSS Actually Is

The Payment Card Industry Data Security Standard is a contractual security framework maintained by the PCI Security Standards Council, founded by Visa, Mastercard, American Express, Discover and JCB. It is not a law. It reaches you through your merchant agreement with your acquiring bank or payment processor.

The current version is PCI DSS v4.0.1, and the future-dated requirements that were optional during the transition became mandatory on 31 March 2025. Every merchant that accepts cards is in scope, from a store doing 40 orders a month to one doing 40,000. The difference is how you prove it.

The Piece Most Guides Skip: Which SAQ Applies to You

Small merchants validate compliance with a Self-Assessment Questionnaire. Which one you fill out depends entirely on how your WooCommerce checkout handles the card, and this single detail changes your workload by roughly 300 questions.

• SAQ A (around 30 questions): all payment page content is served and controlled by a validated third party. Think a full redirect to PayPal or a hosted payment page.
• SAQ A-EP (around 190 questions): your site does not receive card data, but your server delivers the page that creates the payment form. Most Stripe and Square iframe or embedded-element setups land here.
• SAQ D (330+ questions): your application touches, transmits or stores card data directly. Avoid this unless you have a security team.

The uncomfortable truth is that a large share of WooCommerce stores using embedded card fields assume they are SAQ A when they are genuinely SAQ A-EP. Under A-EP, your hosting environment falls squarely into scope, including quarterly external vulnerability scans. That is why the host you pick matters more than the marketing copy suggests.

What Your Host Must Provide

No provider can hand you compliance in a box. A good one removes six to eight of the twelve requirement families from your daily workload. Here is the concrete list to hold a provider against.

• A managed firewall and network segmentation covering Requirement 1, with documented rules and no shared database access between unrelated tenants.
• No vendor-default passwords or configurations on any system component, satisfying Requirement 2 at the platform layer.
• Encryption in transit using TLS 1.2 as a floor and TLS 1.3 in practice, plus automated certificate renewal. Free, always-on SSL certificates on every WordPress site are table stakes in 2026, not an upsell.
• Encryption at rest for backups and volumes, with backup retention you can actually verify.
• Anti-malware and file integrity monitoring running at the server level, mapped to Requirements 5 and 11.
• Patch management with a documented SLA. Requirement 6 expects critical patches within one month, and serious providers move faster than that on kernel and PHP-level fixes.
• Role-based access control and unique IDs for every staff member who can reach your environment, with MFA on the hosting dashboard. Our view on the difference between hosting-level and plugin-level 2FA is worth reading before you rely on a plugin alone.
• Centralised logging retained for 12 months, with at least three months immediately available for review. This is Requirement 10 and it is where budget hosts quietly fail.
• An Attestation of Compliance (AOC) for the hosting service itself, plus a responsibility matrix showing which controls the provider owns.

That last item is the real test. Ask for the AOC as a document. A provider that says “we are PCI compliant” on a features page but cannot produce paperwork is describing an aspiration.

For a closer look at this topic, see our guide: Shopify vs. WooCommerce: The Total Cost of Ownership in 2026.

What Stays Your Job

Hosting covers the floor and the walls. The shop fittings are yours.

• Choosing a payment gateway that keeps card data off your server. WooCommerce documents its position on PCI DSS and merchant responsibility clearly.
• Keeping WordPress core, WooCommerce and every plugin updated, and removing what you do not use.
• Restricting admin accounts, enforcing strong passwords and offboarding staff the same day they leave.
• Never logging full card numbers in order notes, exports, error logs or third-party analytics.
• Completing the correct SAQ annually and submitting quarterly ASV scan results where required.

Several of these overlap with the baseline WooCommerce security features every host should offer, which is a useful cross-check when you compare providers.

ASV Scans and Scope

If you validate under SAQ A-EP or SAQ D, you need quarterly external vulnerability scans from an Approved Scanning Vendor listed by the PCI SSC. The scan scope is every external-facing IP address and domain in your cardholder data environment, including staging subdomains that resolve publicly.

Two practical problems come up constantly. Shared IP addresses mean a neighbour’s misconfiguration can fail your scan, and a WAF that blocks the scanner will produce an inconclusive report. Ask any prospective host whether they will whitelist ASV scanner IPs and whether your store sits on a dedicated address. Expect ASV scanning to cost roughly $100 to $600 per year depending on the number of IPs.

Red Flags When a Host Says “PCI Compliant Hosting”

Reddit threads on this topic are full of merchants who bought a badge and got nothing. Treat these as warning signs:

• No AOC, no shared responsibility matrix, no named compliance contact.
• Log retention shorter than 12 months, or logs you cannot export.
• PHP versions that fall out of security support while still being offered as a default.
• Refusal to whitelist ASV scanners or to confirm your IP arrangement.
• Backups stored in the same region and account as production, with no restore testing.

Infrastructure choice also affects your scan surface. Our comparison of dedicated versus cloud hosting for growing WooCommerce stores covers the isolation trade-offs, and if you run seasonal peaks, the Black Friday scaling architecture guide explains how autoscaling changes what you must document. Cost is a fair constraint, though we would rather see a store on solid affordable WordPress hosting with proper logging than on a premium plan with none.

Frequently Asked Questions

What are the 12 requirements for PCI compliance?

PCI DSS v4.0.1 has 12 requirements grouped into six control objectives: install and maintain network security controls, apply secure configurations, protect stored account data, encrypt data in transmission, protect against malware, develop secure systems and software, restrict access by business need to know, identify and authenticate users, restrict physical access, log and monitor all access, test security regularly, and maintain an information security policy. A managed host typically covers most of requirements 1, 2, 5, 6, 10 and 11 at the infrastructure layer. The remainder depends on how you configure your store.

Can I do PCI compliance myself?

Yes. Merchants processing under 6 million card transactions a year (Levels 2 to 4) can self-assess using the appropriate SAQ, with no external auditor required. You will still need quarterly ASV scans if you fall under SAQ A-EP or SAQ D, and Level 1 merchants need a Qualified Security Assessor.

What are the requirements for PCI compliance?

At minimum you need a compliant payment method, an annual SAQ signed by an officer of the business, quarterly ASV scans where applicable, and evidence that the 12 requirements are met across your environment. Your acquiring bank sets the submission deadlines and format, so confirm with them rather than assuming an annual date.

Do I have to pay a PCI compliance fee?

Many payment processors charge a PCI programme fee of roughly $5 to $20 per month, and a non-compliance fee of $20 to $50 per month if you never submit your SAQ. The fee is charged by the processor, not by the PCI Security Standards Council, and completing your questionnaire usually removes the penalty portion.

Building a Store on Hosting That Carries Its Share

If you are weighing providers, ask each one for the AOC and the responsibility matrix before you compare prices. Our managed WooCommerce hosting plans include the logging, patching, WAF and TLS layers your assessment will ask about, and our team can walk through your SAQ scope with you.