PCI Compliance for Ecommerce: What Shopify and WooCommerce Don’t Cover
The short version: Using a PCI-compliant platform like Shopify or BigCommerce does not make your individual store PCI compliant. You, the merchant, share the responsibility.
This guide maps exactly where the platform’s job ends and yours begins. It covers what changes if you run a self-hosted store like WooCommerce or Magento, how to pick the right SAQ, and what your hosting and payment gateway choices mean for your compliance burden.
Who owns what? Quick-reference map
Responsibility area Hosted (Shopify, BigCommerce, Wix) Self-hosted (WooCommerce, Magento) Network security & firewalls Platform You Server patching & malware protection Platform You Secure checkout infrastructure Platform Depends on setup Admin access & staff MFA You You Third-party app vetting You You Annual SAQ validation You You Security policy for YOUR business You You Quarterly ASV scans & pen testing Platform (their side) You
The single biggest misconception is believing the platform handles the entire compliance burden. Hosted ecommerce platforms do provide a highly secure foundation, but using a secure platform does not automatically make your individual store compliant. You, the merchant, share the responsibility for protecting cardholder data.
What many store owners miss: assuming your software vendor covers every obligation is a common mistake. It leaves online stores exposed to breaches and the penalties that follow.
The legal landscape: The Payment Card Industry Data Security Standard (PCI DSS) applies to any business that accepts, processes, stores, or transmits payment card data. Size and transaction volume do not matter.
PCI compliance is not a government law in the US. It is a strict contractual obligation created and maintained by the PCI Security Standards Council, founded by the major card brands (Visa, Mastercard, American Express, Discover, and JCB). Your merchant agreement with your payment processor or acquiring bank enforces this obligation.
The current standard version is PCI DSS 4.0.1, which superseded version 4.0 after version 3.2.1 was retired on March 31, 2024. The future-dated requirements introduced with PCI DSS 4.0 became mandatory on March 31, 2025. If you run an online store today, you must meet these updated standards.
This guide explains the exact boundaries of the pci compliance shared responsibility model. It covers what platforms actually handle, what security tasks remain on your plate, and how to correctly determine your own validation requirements.
PCI Compliance for Ecommerce: The Shared Responsibility Model
Think of your ecommerce platform like the landlord of a secure commercial building. The landlord provides the physical vault, the perimeter guards, and the armored transport. But you are still responsible for locking your own cash drawer, vetting your own employees, and ensuring nobody props open the back door to your specific office.
PCI DSS 12 Requirements at a Glance
PCI DSS is organized into 12 requirements under six main goals. Before digging into the platform-specific breakdowns below, here is exactly who typically owns each requirement, whether you run a hosted platform like Shopify or a self-hosted platform like WooCommerce.
| Requirement # | What it Covers | Hosted Platform (Shopify) | Self-Hosted (WooCommerce) |
|---|---|---|---|
| 1 | Install and maintain network security controls and firewalls | Handled for their infrastructure | You configure your own firewalls |
| 2 | Apply secure configurations, never use vendor defaults | Handled for their infrastructure | Stays yours, on your own server |
| 3 | Protect stored cardholder data (never store sensitive authentication data) | Not applicable, the platform doesn’t store it for you | Stays yours if your server touches cardholder data |
| 4 | Protect cardholder data with strong cryptography in transit | Handled | Depends on your setup |
| 5 | Protect systems against malware | Not applicable to their infrastructure | Stays yours, install and update antivirus |
| 6 | Develop and maintain secure systems and software (patching) | Handled for their platform | Stays yours: core software, theme, every plugin |
| 7 | Restrict access by business need-to-know | Not applicable to the platform | Stays yours, on your own admin access |
| 8 | Identify users and authenticate access (unique IDs, MFA) | Handled for their internal networks | Stays yours, for your own staff |
| 9 | Restrict physical access to the cardholder data environment | Handled, they secure their data centers | Stays yours if your server is on premises |
| 10 | Log and monitor all access | Handled for their servers | Stays yours, for your own systems |
| 11 | Test security regularly (scans, penetration testing) | Handled for their systems | Stays yours: quarterly ASV scans, penetration testing |
| 12 | Maintain an information security policy and program | Not applicable, this is business-specific | Stays yours, for your own operations |
What Hosted Platforms Actually Cover
When evaluating your PCI compliance on Shopify, it helps to understand what the platform manages on the backend. Shopify operates as a PCI DSS Level 1 Service Provider, the highest validation tier available under the standard.
This designation means they undergo annual on-site assessments by a Qualified Security Assessor (QSA) and invest heavily in securing their infrastructure, covering major portions of the PCI DSS requirements on your behalf as the table above shows.
When you use an integrated processor like Shopify Payments, you rely on their pre-vetted system to handle the actual transmission of the primary account number (PAN), the cardholder name, the expiration date, and the service code. This significantly reduces your scope, but it does not eliminate it.
What Stays Yours (The Merchant’s Burden)
Even with a secure platform handling the heavy lifting, several critical responsibilities remain yours. Neglecting these tasks can lead to a data breach, and the consequences flow directly through your processor.
Non-compliance can trigger fees assessed on your merchant account. After a card-data breach, you can face a forensic investigation, card-brand assessments passed through the acquirer, card reissuance costs, higher processing rates, and potentially losing the ability to accept cards at all.
Hosted vs. Self-hosted: your five responsibilities side by side
Merchant responsibility Hosted (Shopify, BigCommerce) Self-hosted (WooCommerce, Magento) Admin access & MFA Fully yours Fully yours Third-party app vetting Fully yours Fully yours (plus the theme and every plugin) Never store CVV/track data/PIN Fully yours Fully yours Security policy for your business Fully yours Fully yours Annual SAQ submission Fully yours Fully yours (more rigorous form) Server patching & malware Handled by platform Fully yours Firewall & network config Handled by platform Fully yours Quarterly ASV scans Handled by platform (their side) Fully yours
Your ongoing responsibilities include:
- Securing Your Admin Access: You must restrict access by business need-to-know (Requirement 7). Not every employee needs administrator-level permissions to your store backend. You must identify users and authenticate access (Requirement 8) by ensuring every staff member has a unique ID. You must also implement multi-factor authentication (MFA) for anyone accessing the cardholder data environment.
- Vetting Third-Party Apps: Every plugin or app you add to your store can potentially create a security vulnerability. If a third-party app injects malicious JavaScript into your checkout page, it can skim credit card details before they ever reach the secure payment processor. You are responsible for ensuring that your storefront scripts are secure.
- Protecting Stored Account Data: You must ensure you never store sensitive authentication data after authorization (Requirement 3). Sensitive authentication data includes the CVV/CVC security code, full magnetic-stripe/track data, and PINs. This data may NEVER be stored, even if it is encrypted.
- Maintaining Security Policies: You must maintain an information security policy and program (Requirement 12) for your own business operations.
- Completing Your Validation: The platform does not validate your business for you. Most small and mid-size businesses validate compliance annually with a Self-Assessment Questionnaire (SAQ). You must complete this paperwork accurately and submit it to your processor.
Using a shopify third party payment processor setup instead of the default integrated gateway can further change your responsibilities. Routing payments through an external gateway often alters how data flows through your checkout page, which can change which SAQ you must complete.
Your gateway choice directly affects your SAQ type and your scope. A hosted payment page that redirects customers entirely off your site (like PayPal Standard or Stripe Checkout in redirect mode) keeps you in SAQ A territory, the lightest burden. An embedded iFrame or direct-post method (like Stripe Elements or Braintree’s Drop-in UI) puts you in SAQ A-EP, which adds secure coding requirements and quarterly ASV scans. Tokenization — where the gateway replaces card data with a non-sensitive token before it touches your server — can shrink your CDE scope regardless of the integration method. Before committing to a gateway, ask whether the integration qualifies you for SAQ A or A-EP and whether the provider offers tokenization to reduce your exposure.
Why Self-Hosted Platforms Carry More Risk
If a hosted platform is like renting a secure storefront, using a self-hosted solution is like building your own store from the ground up. You gain total control over the architecture, but you also take on far more responsibility for pci compliance.
With a self-hosted platform, you are responsible for almost everything a hosted provider normally handles by default. The cardholder data environment (CDE) is the set of systems, people, and processes that store, process, or transmit cardholder data or sensitive authentication data, plus any system connected to them. In a self-hosted environment, your entire web server often becomes part of the CDE.
To meet the ecommerce PCI compliance checklist on a self-hosted site, you must:
- Secure the Hosting Environment: You must apply secure configurations and never keep vendor defaults (Requirement 2). You must configure your own firewalls to protect the server.
- Protect Against Malware: You must protect systems against malware (Requirement 5) by installing and updating antivirus software on the servers hosting your store.
- Patch Systems Relentlessly: You must develop and maintain secure systems and software (Requirement 6). This means you are solely responsible for updating your core software, your theme, and every single plugin. A single outdated plugin can allow attackers to compromise your server and capture payment data.
- Conduct External Vulnerability Scans: Depending on your setup, you may be required to test security regularly (Requirement 11). This often includes mandatory quarterly external scans conducted by an Approved Scanning Vendor (ASV), as well as penetration testing.
- Implement Network Segmentation: Network segmentation can shrink the CDE and therefore reduce what has to meet the standard. If you do not properly segment your web server from the rest of your business network, your entire corporate network might fall into scope for PCI DSS.
Because the merchant’s website directly impacts the security of the payment transaction, self-hosted stores generally face a much heavier compliance burden and must complete more rigorous validation documentation.
How to Choose PCI-Compliant Ecommerce Hosting
Before installing WooCommerce or Magento, the hosting provider you pick sets the baseline for your PCI posture. The right host handles several infrastructure-level requirements for you; the wrong one expands your CDE needlessly.
Ask any prospective ecommerce hosting provider these four questions:
- Do you run quarterly ASV scans on the infrastructure and share the reports? A host that runs approved scans on their network layer and gives you the attestation reduces your Requirement 11 burden.
- Do you provide a managed firewall and network segmentation? A host that segments your server from other tenants and manages the perimeter firewall removes Requirement 1 from your plate.
- Do you handle server-level patching and malware detection? Managed hosting that patches the OS and runs server-side malware scans takes Requirement 5 and part of Requirement 6 off your list.
- What is your physical data-center security posture? A provider with SOC 2 or ISO 27001 certified data centers satisfies Requirement 9 for the server’s physical environment.
Managed WooCommerce hosts (like WP Engine or Kinsta) and cloud platforms with compliance add-ons (like AWS with PCI DSS-qualified services) handle more of the infrastructure burden than a bare-metal VPS or an unmanaged shared host. The more the host manages, the less your CDE expands, and the shorter your SAQ becomes.
What About Magento, BigCommerce, and Wix?
So far this guide has focused on Shopify and WooCommerce because they represent the two ends of the spectrum, fully hosted versus fully self-hosted. Other major platforms fall somewhere in between, and knowing where yours lands determines your compliance burden.
BigCommerce operates on the hosted side of the line, similar to Shopify. As a SaaS platform, BigCommerce handles network security, server patching, and physical data-center security. The merchant still owns admin access, third-party app vetting, annual SAQ validation, and their own security policies. BigCommerce’s native payment integrations use the same redirect or iFrame patterns described in the SAQ section above.
Wix (specifically Wix Stores) is a fully hosted solution. Wix’s checkout is a redirect to their secure payment page, which typically keeps merchants in SAQ A territory. The merchant burden is the same as Shopify’s: secure your admin credentials, vet any third-party apps you install from the Wix App Market, and complete your annual SAQ.
Magento (Adobe Commerce) is self-hosted by default, placing it squarely in the WooCommerce camp. The open-source Magento Open Source edition requires you to manage your own hosting, patching, firewalls, malware protection, and ASV scans, the full self-hosted burden. Adobe Commerce (the cloud-hosted enterprise edition) takes on some of the infrastructure work, but the codebase, themes, extensions, customizations, remains your responsibility under Requirement 6. If you run Magento, plan for SAQ D or a carefully scoped SAQ A-EP with a fully outsourced payment page.
The quick reference: Shopify and BigCommerce sit on the hosted side. Wix is hosted and typically SAQ A. WooCommerce and Magento Open Source are self-hosted, carrying the full burden. Magento’s enterprise cloud edition splits the difference, infrastructure is managed, code is yours.
The SAQ A vs A-EP Distinction for Ecommerce
For a business looking at pci compliance for online store requirements, the validation process revolves around the Self-Assessment Questionnaire. Which SAQ applies depends entirely on how you take payments.
There are several SAQ types, including SAQ B (imprint machines or standalone dial-out terminals), SAQ B-IP (standalone IP-connected terminals), SAQ C (payment application systems connected to the internet), SAQ C-VT (manual entry via a virtual terminal), and SAQ P2PE (validated point-to-point encryption solutions).
However, for ecommerce merchants, the decision usually comes down to SAQ A, SAQ A-EP, or SAQ D.
| Criteria | SAQ A: The Fully Outsourced Path | SAQ A-EP: The Modern Ecommerce Standard | SAQ D: The Catch-All |
|---|---|---|---|
| Does data touch your site? | No, your website cannot store, process, or transmit cardholder data | Your website does not store or process data, but it can impact the payment page’s security | Yes, if you store cardholder data on your own servers, or you act as a service provider |
| Checkout method | Customer is redirected entirely to the processor’s secure page | A direct post method or iFrame displays the payment form on your own checkout page | Not defined by checkout method, this is the catch-all |
| Relative complexity | Fewest requirements, your scope is minimized | Significantly more requirements than SAQ A: secure coding, vulnerability scanning, penetration testing | The longest form, covering all PCI DSS requirements |
| Who qualifies | Card-not-present merchants (ecommerce or mail/telephone order) with fully outsourced payment processing | Merchants whose processing is outsourced but whose website can still affect payment security | Merchants who store cardholder data themselves, or act as a service provider |
| Typical platform fit | Wix Stores, PayPal Standard redirect, Shopify with fully redirected checkout | Shopify with Shop Pay / embedded checkout, Stripe Elements, Braintree Drop-in | WooCommerce with on-site checkout touching card data, Magento Open Source |
Understanding Merchant Levels
The card brands tier merchants by annual transaction volume to determine validation requirements. Under the commonly used Visa/Mastercard tiering system:
Merchant levels at a glance
Level Annual transactions Validation required Level 1 Over 6 million On-site QSA assessment producing a This level requires an on-site assessment by a Qualified Security Assessor (QSA) producing a Report on Compliance (ROC). Level 2 1 to 6 million SAQ + potentially an on-site assessment Level 3 20,000 to 1 million ecommerce SAQ Level 4 Fewer than 20,000 ecommerce or up to 1 million total SAQ
Most small businesses are Level 4 and validate with an SAQ. However, the exact thresholds and validation requirements are ultimately set by each card brand and your specific acquirer.
See Where You Stand
Free 2-minute PCI self-check: 8 plain-English questions, your risk level and the exact gaps to fix. No sign-up to see your result. free PCI compliance risk check
Related Guides
- What Is PCI Compliance? A Plain-English Guide
- Which PCI SAQ Do I Need? A 2-Minute Decision Guide
- The 12 PCI DSS Requirements Explained in Plain English
- PCI Compliance Levels 1-4: Which Merchant Level Are You?
Frequently Asked Questions
Does Shopify require PCI compliance?
Yes. While the platform itself operates as a PCI DSS Level 1 Service Provider, they require you to be compliant as part of your terms of service and your merchant agreement. You are responsible for your own secure business practices, managing staff access, and formally validating your compliance annually with your payment processor.
Is WooCommerce PCI compliant?
WooCommerce itself is not automatically PCI compliant, because it is self-hosted software — not a managed service. The codebase follows secure development practices, but PCI compliance depends on how you host, configure, and maintain it. You are responsible for your server’s firewall, patching, malware protection, quarterly ASV scans, secure coding of any customizations, and your annual SAQ. A correctly hardened WooCommerce store on a PCI-friendly host can meet the standard; an unpatched store on a bare VPS will not.
Do merchants have to be PCI compliant?
Yes. The standard applies to any business that accepts, processes, stores, or transmits payment card data, regardless of size or transaction volume. It is a strict contractual obligation enforced by the card brands through your acquiring bank or payment processor.
Is it safe to give my SSN to Shopify?
When setting up Shopify Payments, the platform requires your Social Security Number to verify your identity, a standard identity check that payment processors run before they will let a business accept card payments. They utilize strong cryptography to protect sensitive data over public networks and maintain strict physical access controls to their data centers to keep this information secure.
Is Shopify safer than PayPal?
Both platforms are large, PCI-validated payment providers that invest heavily in network security controls and encryption. The safety of your specific store depends less on choosing between these two providers and more on how well you manage your own shared responsibilities, such as enforcing multi-factor authentication and vetting third-party apps.
Secure Your Online Store with LeadingIT
Meeting the PCI DSS e-commerce guidelines and managing the shared responsibility model takes work, but you do not have to handle it alone. LeadingIT is a Chicagoland managed it and cybersecurity provider that has helped Illinois businesses since 2010. Serving roughly 200 organizations, LeadingIT operates the technical half of PCI as part of managed it.
While LeadingIT is NOT a QSA or ASV and does not certify PCI compliance, our team helps you become and stay compliant by implementing network segmentation, MFA, patching, logging, and scan remediation. We also help clients complete their SAQ correctly. If you need help securing your ecommerce environment, explore LeadingIT’s PCI compliance services (done-for-you path) or book a call today. You can also contact us directly at 815-788-6041.
