Do I need to be PCI compliant to sell online?

The short version

• PCI DSS is the card industry’s security standard. It applies to every business that takes cards.
• Your payment provider or bank tells you how to show you comply, usually a yearly self-assessment questionnaire.
• The less card data touches your site, the less you have to do. Use hosted card fields or a hosted checkout page.
• Never store card numbers, and never ask customers to email them.
• Keep the store itself secure: updates, strong logins with two-step sign-in, and few admin accounts.

This isn’t legal or compliance advice. Your payment provider or bank decides what you must file.

What is PCI DSS?

The Payment Card Industry Data Security Standard is a set of security rules for anyone who stores, processes or sends card data. The PCI Security Standards Council’s merchant page says it applies regardless of a merchant’s size or number of transactions, though small merchants often have simpler setups and less to do. The council writes the standard. The card brands and your acquiring bank decide whether and how you must prove you meet it.

Stripe’s integration security guide calls it a shared responsibility: Stripe is assessed every year as a Level 1 service provider, and the business taking payments must accept cards in a compliant way and attest to it every year.

What does a small store actually have to do?

1. Use a low-risk checkout. Choose your provider’s hosted card field, or send customers to its hosted checkout page. Card numbers then go straight to the provider. Stripe says a business that handles raw card numbers itself can face more than 300 security controls, and its hosted options reduce that.
2. Find your questionnaire. Your payment provider’s dashboard or your bank tells you which Self-Assessment Questionnaire (SAQ) fits. The one meant for stores that hand all card entry to a provider is called SAQ A, and it’s the simplest for most small stores.
3. Complete it every year, and keep a copy.
4. Keep your site on HTTPS throughout. Stripe says payment pages must use TLS 1.2 or later.
5. Keep the store secure. That part is still yours, as below.

What changed for SAQ A in 2025?

In January 2025 the PCI council announced updates to SAQ A, the questionnaire for merchants who hand card entry to a provider. Two script-monitoring requirements were removed from it, and a new eligibility check was added: the merchant confirms its site isn’t open to script attacks that could affect its e-commerce system. In plain terms, scripts on your checkout page now matter even when the card form belongs to the provider. Older articles that say “hosted checkout means PCI doesn’t apply to you” are out of date. Ask your provider or bank which version of the form they want.

What else keeps a store secure?

• Update WordPress, WooCommerce, the theme and plugins promptly, starting with security releases. See updating WooCommerce without breaking checkout.
• Few admin accounts. Give staff the Shop Manager role instead of Administrator where it’s enough. Our answer on WordPress user roles explains the difference.
• Two-step sign-in on the website and the payment account. Shopify requires it for Shopify Payments. See two-factor authentication.
• Fewer third-party scripts on checkout. Stripe says each outside script makes your security depend on someone else’s. Remove chat widgets, trackers and pop-ups from checkout where you can.
• Protect your payment keys. Never paste them into emails or chats.
• Daily backups, stored off the server.
• Watch for card testing, a sign someone is abusing your checkout. See card testing attacks.

Why does it matter?

A store that leaks card data can face costs and questions from its bank and payment provider, and it loses its customers’ trust. Even without a breach, a missed questionnaire can lead to extra fees or a closed account, depending on your provider’s terms. A hosted checkout and a well-kept site make all of this far less likely.

What are the common mistakes and edge cases?

• Taking card numbers by phone or email and typing them into the store. That puts you outside the simple questionnaire. Use your provider’s virtual terminal or a payment link instead.
• Keeping a spreadsheet of customers’ cards for repeat orders. Use the provider’s saved-card feature.
• Adding marketing scripts to checkout without thinking about what they can see.
• Assuming the platform covers everything. Shopify and payment providers do much of the heavy lifting, but staff logins and apps are still yours to manage.
• Ignoring the questionnaire email because it looks like spam. Check it in your provider’s dashboard.

What if this didn’t work?

• You don’t know which questionnaire applies. Ask your payment provider’s support team. Have your checkout type ready, such as hosted field or redirect.
• A scan or questionnaire flagged a problem. Note the exact item and send it to whoever looks after your site.
• You think card data was exposed. Contact your payment provider straight away, and your web team.

How much does it cost, and how long does it take?

With a hosted checkout, the yearly questionnaire is usually short. Some providers include it; others use a third-party compliance service with its own fee. The security habits above are part of ordinary site care.

How does E-3 handle this?

On stores in our website care, monitoring tracks the PHP version, waiting updates and known plugin vulnerabilities; updates are tested; backups run daily; and security alerts are watched. Payment accounts E-3 sets up are created in the client’s name, with E-3 added as a user. The PCI questionnaire itself is the business’s own attestation, so it’s yours to sign, but we’re glad to help you answer the technical questions about how your checkout works.

Related questions

• Which payment provider should my store use?
• Why am I getting lots of small failed orders?
• How do I update WooCommerce without breaking checkout?
• What’s the simplest way to take payments online?
• Back to the complete online store guide

Sources

1. Merchant resources (PCI Security Standards Council)
2. Important updates announced for merchants validating to Self-Assessment Questionnaire A (PCI SSC blog)
3. Integration security guide (Stripe documentation)
4. Payment gateway extensions: how to choose (WooCommerce documentation)
5. Shopify Payments (Shopify Help Center)