You set up a WooCommerce store, connected a payment gateway, and started taking orders. Then a payment processor or a security audit mentioned PCI compliance, and suddenly there are acronyms — DSS, SAQ, QSA, ROC — and it isn’t clear which apply to you.
For most small store owners, the reality is simpler than it first looks. But simpler doesn’t mean optional, and the hosting environment matters more than most people realize. Here’s how the levels work, what they require, and what to look for in a host.
What PCI compliance is, and why it applies to you
PCI DSS is the Payment Card Industry Data Security Standard, created by the major card brands to make sure any business accepting cards protects payment data. If your store takes credit or debit cards in any form, it applies — regardless of size or sales volume.
Even if you never see a card number, you’re part of the payment chain. The moment your site collects, transmits, or redirects cardholder data, it’s in scope.
The four merchant levels
Levels are based mainly on annual card transactions, though your acquiring bank or processor makes the official call. Even Level 4 isn’t exempt — validation is just simpler. A breach, or a processor deciding you’re higher risk, can move you up.
Level 16M+ per year
Or any merchant that’s had a breach. Annual on-site audit by a QSA, a Report on Compliance, quarterly ASV scans, and annual penetration testing.
Level 21M–6M per year
Annual Self-Assessment Questionnaire, quarterly ASV scans, and sometimes QSA attestation depending on the bank.
Level 320K–1M ecommerce
Annual SAQ, quarterly ASV scans, and an Attestation of Compliance.
Level 4Under 20K ecommerce
Most small online stores. Annual SAQ, quarterly ASV scans as the bank requires, and an Attestation of Compliance.
Most small WooCommerce stores are Level 4, validated through documentation and scanning rather than on-site audits. What you actually owe still depends on how checkout is set up and whether card data ever touches your server.
What a Self-Assessment Questionnaire is
For Levels 2 through 4, the SAQ is the main way you validate compliance — a structured checklist covering data protection, access control, configuration, and vulnerability management. Which version you complete depends entirely on how checkout handles card data, and your processor confirms it.
SAQ typeTap to open
SAQ A
For merchants who fully outsource payment processing to a PCI-compliant third party and never store, process, or transmit card data on their own systems. The simplest, lowest-scope option.
SAQ A-EP
For merchants who outsource processing but whose website still plays a role in the payment page — embedding or hosting a payment form. More requirements, because your site stays in scope.
A common mix-up: stores using embedded fields like Stripe Elements or Braintree hosted fields sometimes assume SAQ A, but depending on implementation, SAQ A-EP may apply. Confirm with your processor before you fill anything in.
Where hosting fits in
PCI requirements reach the servers behind your site, not just your gateway. If card data passes through, is redirected by, or is influenced by your server, your hosting is part of the compliance picture.
Shared hostingLowest isolation
Many sites share one server. Cheaper, but a compromised neighbor can put your site at risk depending on configuration.
VPS hostingIsolated
Your own virtual environment, with more control over firewalls, updates, and access.
Dedicated hostingFull control
A fully isolated physical server for maximum control and higher compliance needs.
Managed PCI-compliantInfrastructure covered
Patching, monitoring, intrusion detection, and vulnerability management handled for you.
Watch for: You still own the application layer.
The shared responsibility model
A PCI-compliant host doesn’t make your store compliant automatically. Responsibility is split:
- Your host handles infrastructure: data center security, network controls, server hardening, and system patching.
- Your payment gateway processes card data on its own certified infrastructure, keeping it off your server.
- You own the application layer: how WooCommerce is configured, which plugins run, who has access, and how fast vulnerabilities get fixed.
For example, your host may patch the operating system on schedule, but if you’re running an outdated WooCommerce version or a vulnerable plugin, that gap is yours.
What to look for in a PCI-compliant host
If a host can’t answer these, that’s reason enough to keep looking.
The simplest path for most small stores
< 20KLevel 4
Ecommerce transactions
Per year. Where most small WooCommerce stores land.
SAQ ALowest scope
Fully outsourced checkout
Card data never touches your server.
QuarterlyOften missed
ASV scans
One of the most commonly skipped requirements for small stores.
- Use a fully hosted, PCI-certified gateway like Stripe, PayPal, or Square so card data never touches your server.
- Confirm your SAQ type with your processor or bank — often SAQ A for a fully outsourced checkout.
- Host with PCI-aligned security, even when your scope is small.
- Complete the annual SAQ and quarterly ASV scans to keep compliance documented.
Plugins that support PCI and security
Plugins don’t make you compliant, but the right ones strengthen the application layer that’s your responsibility.
WooCommerce Stripe Payment GatewayGateway
Outsources card processing to Stripe. Hosted fields or redirect checkout help most small stores qualify for SAQ A. Apple Pay, Google Pay, 3D Secure, and tokenized saved cards.
Watch for: Embedded fields can mean SAQ A-EP. Confirm with Stripe.
WooCommerce PayPal PaymentsGateway
Hosted, off-site checkout keeps raw card data off your server. Pay Later, Venmo, vaulting, and built-in fraud tools.
Wordfence SecuritySecurity
A web application firewall, malware scanning, login limits, two-factor authentication, and real-time IP blocking.
Sucuri SecuritySecurity
File integrity monitoring, malware scanning, activity auditing, and post-hack remediation support.
WP Activity LogLogging
Detailed admin and user activity logs, WooCommerce event tracking, alerts, and log retention.
Taking control of your compliance
The most common mistake is assuming the gateway or the host covers everything. Neither does. A practical starting point:
- Confirm your merchant level and SAQ type with your processor or bank. That one conversation clarifies most of what applies.
- Audit your checkout flow. Know exactly where card data goes when a customer pays.
- Review your hosting. Ask for a documented AOC, the security features included, and what stays with you.
- Schedule quarterly ASV scans. Commonly missed, and easy once the right host or vendor is in place.
- Complete the annual SAQ. The PCI Security Standards Council publishes the forms at pcisecuritystandards.org.
Knowing what’s required and acting on it consistently is what compliance looks like in practice.
