No hosting company can make your WooCommerce store PCI compliant by itself. PCI DSS splits the work across your payment gateway, your host, and you. A host that takes this seriously will hand you a current Attestation of Compliance and a responsibility matrix showing which requirements it covers. Ask for both before you take a card.
What does PCI compliance require from a WooCommerce store owner?
PCI DSS is a contractual standard, not a law. You agreed to it when you signed your merchant account. It has 12 top level requirements covering network security, cardholder data protection, vulnerability management, access control, monitoring, and policy. How many of those you personally validate depends on how card data flows through your site.
Most WooCommerce owners assume Stripe or PayPal handles all of it. Your gateway handles the storage and transmission of card numbers, which is the heaviest part. It does not handle the security of the page that loads the payment form. According to the PCI Security Standards Council, the future-dated v4.0 requirements took effect on March 31, 2025, and two of them, 6.4.3 (managing scripts on payment pages) and 11.6.1 (detecting unauthorized changes to payment pages), sit squarely with the merchant running the site.
That change matters because of how a modern WordPress checkout gets built. A typical store loads Google Tag Manager, a heatmap tool, a chat widget, a review plugin, and two analytics scripts on the same page as the Stripe iframe. Every one of those is a script you now have to inventory, justify, and monitor for tampering. We wrote about the performance side of that pile in what Microsoft Clarity costs a WordPress page; the compliance side is a separate bill for the same habit.
Is a host PCI compliant, or just sitting on compliant infrastructure?
There is a real difference, and it is where most hosting marketing gets slippery. A provider running on AWS or Google Cloud can say "PCI compliant infrastructure" because AWS holds a Level 1 service provider AOC. That says nothing about the provider's own controls, and nothing about yours.
Three claims you will see, ranked by how much they are worth:
"We run on PCI compliant data centers." This is the weakest. It describes the building, not the stack. Every host on earth can say it.
"We are PCI compliant." Ask which SAQ or AOC, from which QSA, covering which services, dated when. If the answer is a marketing page instead of a PDF, treat the claim as decoration.
"We are a validated Level 1 service provider, here is our AOC and our responsibility matrix." This is the one you can hand to your acquirer. It tells your assessor exactly which requirements the host attests to and which ones remain yours.
According to Verizon's Payment Security Report, 43.4% of assessed organizations maintained full PCI DSS compliance (2022). More than half of the companies that had already been through a formal assessment could not hold the standard year round. A shared host with 300 sites per server is not quietly beating that number.
Who covers what across you, your host, and your gateway
Here is the split for a standard WooCommerce store using a hosted payment field or iframe. Print it, fill in your own provider names, and you have most of a responsibility matrix.
| PCI area | Payment gateway | Managed host | You |
|---|---|---|---|
| Storing and transmitting card numbers | Owns it entirely | No access to card data | Never store PAN in WordPress |
| Firewall and network segmentation | Own environment | Owns WAF, server firewall, isolation | Keep third party services documented |
| TLS certificate and protocol versions | Owns their iframe | Issues and renews the cert, disables old TLS | Force HTTPS sitewide, fix mixed content |
| OS, PHP, and web server patching | Own environment | Owns it | Keep PHP on a supported branch |
| WordPress core, plugin, and theme updates | Not involved | Can manage if contracted | Yours by default |
| Payment page script inventory (6.4.3) | Not involved | Can supply tooling | Yours |
| Change detection on payment pages (11.6.1) | Not involved | File integrity monitoring | Yours to review |
| Access control and unique logins | Own dashboard | Server and panel accounts | WordPress admin accounts, MFA, offboarding |
| Log retention and review (Req 10) | Own logs | Server and access logs, retention window | Application level logs and review cadence |
| Quarterly ASV scans and remediation | Not involved | Fixes server side findings | Schedules the scan, fixes app findings |
| Written policies and annual SAQ | Not involved | Supplies evidence | Yours |
Read the right-hand column again. That is the part no hosting plan removes. What managed hosting does is shrink the middle column to zero effort on your side, which is most of the technical work. We broke down the general scope in what managed WordPress hosting covers in 2026.
Why most shared hosting plans cannot pass a PCI review
A $6/mo plan is not disqualified because it is cheap. It is disqualified because of what it cannot produce when someone asks for evidence.
Log retention is the first wall. Requirement 10.5.1 expects at least 12 months of audit history with three months immediately available. Most shared panels rotate access logs every 7 to 30 days and give you no way to extend it. When your acquirer asks who logged into the server on the day the skimmer appeared, there is nothing to hand over.
File integrity monitoring is the second. Requirement 11.5.2 wants change detection on critical files, and 11.6.1 now wants it on the payment page specifically. Shared hosts do not run it per account, and a malware scanner that checks signatures once a week is not the same control. That gap is the whole reason we built TopSyde Sentinel to watch for file changes rather than wait for a signature match.
Account isolation is the third. If your neighbor on the server gets popped and the host runs everyone under a shared PHP process or loose permissions, your cardholder data environment inherits their problem. Isolation is a hardware and configuration decision, and it is the main reason we keep telling store owners that WooCommerce needs managed hosting rather than shared.
Then there is patch speed. Requirement 6.3.3 gives you one month to apply critical security patches. When a WordPress or plugin zero-day drops, that clock starts before a patch even exists, and your only cover is a network rule. How a host handles that window is worth asking about directly, and we walked through the specifics in whether your managed host protects you from zero-days.
How to tell which SAQ your store falls under
Your SAQ type is set by how the card data reaches the processor. Getting this wrong is the most common mistake in a WooCommerce build, because the difference between two checkout plugins can move you from 20-odd questions to 300.
| Checkout setup | Likely SAQ | Questions | What it means for hosting |
|---|---|---|---|
| Redirect to Stripe Checkout or PayPal hosted page | SAQ A | ~30 | Lightest scope, but 6.4.3 and 11.6.1 still apply to your site |
| Stripe Elements or Braintree hosted fields in an iframe | SAQ A | ~30 | Same as above, script control matters more |
| Card fields rendered by your own theme or plugin, posted to an API | SAQ A-EP | ~190 | Your server is in scope, managed hosting stops being optional |
| Any plugin that touches or logs a full card number | SAQ D | 300+ | Full audit territory, budget for a QSA |
The January 2025 revision of SAQ A added an eligibility condition around protecting the payment page from script based attacks, so even the lightest path now assumes you have some control over what loads at checkout. If you are shopping gateways, factor SAQ impact into the decision alongside fees; we covered the migration mechanics in switching WooCommerce payment gateways.
What a failed checkout page costs a real store
Skip the fine schedules for a second, because the penalty numbers vary by acquirer and nobody publishes theirs. Look at the operational cost instead.
A card skimmer on a WooCommerce checkout usually gets found by the card brands, not by you. The pattern is a common point of purchase alert, then a forensic investigation you pay for, then your acquirer moving you to a higher SAQ or a monthly review until you can prove remediation. Meanwhile your checkout is either down or under suspicion.
According to IBM's Cost of a Data Breach Report, the global average cost of a breach was $4.44 million, with the US average at $10.22 million (2025). Those figures skew enterprise, and a 40-product store is not losing eight figures. The line items scale down but they do not disappear: forensic investigator, remediation labor, notification, gateway penalties, and the revenue you did not take while the store was closed. We put numbers on that last piece in what website downtime costs per minute.
The part that hurts small stores most is the merchant account. Losing your processor after a breach means applying as a higher-risk merchant, which means worse rates for years. That cost compounds long after the malware is gone.
What to ask a host before you launch a store
Send these seven questions in one email. How fast and how specifically a host answers tells you more than any badge on their homepage.
- Can you send your current AOC and shared responsibility matrix? If they need a week to find it, it is stale or it does not exist.
- How long do you retain server access and error logs, and can I export them? You want 12 months, or a documented path to get there.
- Do you run file integrity monitoring per account, and what alerts on a change? Ask what the alert looks like, not whether the feature exists.
- Is each site isolated at the process and filesystem level? Follow up with what happens if a neighbor account is compromised.
- Who applies critical patches to PHP, the OS, and the web server, and on what timeline? One month is the PCI ceiling, not a target.
- Will you support a quarterly ASV scan and remediate server side findings? Some hosts block the scanner outright, which creates its own problem.
- What TLS versions are enabled, and can you disable TLS 1.0 and 1.1 on my account? If the answer is server-wide only, walk.
A host that answers all seven in plain language is doing the work. One that replies "we are fully PCI compliant" and nothing else is selling you a sticker.
What compliant-by-default hosting looks like at TopSyde
We build the middle column of that matrix into every plan rather than selling it as a security add-on. That means per-site isolation, a managed WAF, current PHP branches, TLS handled for you, extended log retention, and TopSyde Sentinel watching file changes on checkout templates and plugin directories. The spec sheet lists what runs on every server, and our stack page covers the infrastructure behind it.
Plans start at $89/mo per site. Support responds in under 2 hours during business hours, and monitoring runs 24/7, so a file change on a payment template does not sit unnoticed over a weekend. Migrations are handled by our team, and there is a 30-day money-back guarantee if the fit is wrong.
What we do not do is sign your SAQ. Nobody can. Your admin accounts, your plugin choices, your script inventory, and your annual attestation stay with you. What changes is that the infrastructure half is documented, monitored, and defensible when someone asks for evidence.
If you are running a store on a plan that cannot tell you how long it keeps logs, start there. Compare plans and migration options or send us your current setup and we will tell you which of the seven questions above your host would struggle with.
Frequently Asked Questions
Does using Stripe or PayPal make my WooCommerce store PCI compliant?
No. A hosted gateway takes card storage and transmission out of your scope, which is the biggest piece, but you still complete an annual SAQ and still own requirements 6.4.3 and 11.6.1 covering scripts and change detection on your payment page. Your site security remains your responsibility.
Can shared hosting ever be PCI compliant for a store?
In theory a shared plan can sit inside a compliant environment, but in practice most fail on log retention, per-account file integrity monitoring, and process isolation. If your host cannot export 12 months of access logs or confirm account-level isolation, you will not be able to evidence those requirements during a review.
What documents should I ask my host for?
Two: a current Attestation of Compliance naming the host as a validated service provider, and a shared responsibility matrix mapping the 12 PCI DSS requirements to host and customer. Both should be dated within the last 12 months and issued or reviewed by a QSA.
Do I need a quarterly ASV scan for a small WooCommerce store?
It depends on your SAQ type and acquirer. SAQ A merchants using a fully hosted or iframed payment page typically do not require an ASV scan, while SAQ A-EP and SAQ D merchants do. Check your merchant agreement, since some acquirers require scans regardless of SAQ level.
Content & SEO Strategist
7+ years SEO & content strategy, Google Analytics certified
Elena drives content strategy and SEO at TopSyde, helping clients maximize organic visibility and AI search presence. She combines technical WordPress knowledge with data-driven content optimization.
