Is WooCommerce PCI compliant? No. WooCommerce is not PCI compliant by default, and the responsibility for meeting PCI DSS requirements falls entirely on you as the store owner. This surprises a lot of people who assume installing a popular plugin is enough.
We checked this guide against the PCI Security Standards Council’s SAQ A update and the WooCommerce PCI documentation in October 2026. PCI DSS 4.0.1 has been fully in force since March 31, 2025. Its new checkout script rules decide which questionnaire your store can use.
This guide covers what PCI DSS requires and how WooCommerce fits into it. Then it walks through what changed in version 4.0 and the steps to bring your store into compliance.
What Is PCI DSS and Why Does It Apply to WooCommerce?
PCI DSS stands for Payment Card Industry Data Security Standard. It is a set of security rules from the PCI Security Standards Council. Visa, Mastercard, American Express, Discover and JCB founded the council to reduce card fraud.
If your WooCommerce store accepts credit or debit card payments, you are in scope. That’s true even if you redirect customers to a third-party payment page. Even if you never touch a card number directly. The moment your site is part of the payment flow, PCI DSS applies.
Who Created PCI DSS and Why It Matters for Store Owners?
The PCI SSC published the first version of the standard in 2004. Version 4.0.1 is still the current standard as of October 2026. Every requirement in it has been mandatory since March 31, 2025.
According to the official WooCommerce PCI DSS documentation, PCI compliance is enforced by your payment processor. They may ask you to complete a self-assessment questionnaire (SAQ) or run scans through an approved scanning vendor. If you do not comply, they can charge you or stop your ability to accept cards.
What Happens If You’re Not PCI Compliant?
Your merchant agreement with the payment processor sets the penalties. They can include monthly non-compliance fees until you file your SAQ. After a breach they can also include the cost of the investigation, and your processor can close your merchant account.
Beyond the financial hit, a data leak destroys customer trust fast. For small stores, that damage tends to be permanent.
What Does WooCommerce Handle?
WooCommerce itself does not process card numbers. It does not store them. It passes the transaction off to a payment gateway, which handles the actual card data. That design reduces your security work because sensitive data never passes through your server.
The same holds for wallet payments such as Venmo in WooCommerce, where PayPal handles the payment data.
But “reduced burden” is not the same as “no burden.” Your site still presents the checkout experience. Your server still runs the WordPress and WooCommerce code. Your plugins still load scripts on the payment page. All of that falls under PCI scope, and all of it is your responsibility.
WooCommerce gives you tools that support compliance. It does not deliver compliance for you.
The WooPayments Nuance: PCI Level 1 Provider vs. Your Store’s Compliance
It is easy to read that WooPayments is a Level 1 PCI DSS certified service provider and assume your store is covered.
It isn’t. WooPayments being Level 1 means their payment systems are certified. It means card details are collected in a secure hosted field served from WooPayments’ certified environment instead of from your server. That’s good. It reduces the scope of your compliance obligations significantly.
But your site still loads scripts. Your WordPress admin still needs secure access. Your server still needs to be patched and monitored. WooPayments handles the card data portion. You still own everything else.
WooCommerce PCI Compliance Levels: Where Does Your Store Fit?
PCI DSS uses four merchant levels based on annual card transaction volume. Your level decides how you prove compliance each year. The thresholds below follow the common card brand levels, and most small WooCommerce stores sit at Level 4 with a self-assessment.
| Level | Annual Transactions | Requirement |
|---|---|---|
| Level 1 | Over 6 million | On-site audit by a Qualified Security Assessor (QSA) |
| Level 2 | 1 million to 6 million | Self-Assessment Questionnaire (SAQ) |
| Level 3 | 20,000 to 1 million | Self-Assessment Questionnaire (SAQ) |
| Level 4 | Fewer than 20,000 | Self-Assessment Questionnaire (SAQ) |
Most WooCommerce stores are Level 4. At this level, your payment processor will ask you to complete an SAQ. The type depends on how you process payments:
- SAQ A: This applies if you redirect customers to a third-party payment page such as PayPal Standard. It also covers payment forms embedded from a compliant provider in an iframe, such as Stripe Elements or WooPayments hosted fields. Since the 2025 update, embedded forms also need you to confirm your site is protected from script attacks.
- SAQ A-EP: This applies if your own page builds the payment form or posts card data straight to the processor. Your server never receives the card number, but your site controls how it is sent.
- SAQ D: This applies if your server stores, processes or sends card data directly. Very few WooCommerce stores using default setups end up here, but it’s the heaviest compliance path if you do.
How to Make Your WooCommerce Store PCI Compliant
To make a WooCommerce store PCI compliant, use a certified gateway with hosted fields and force HTTPS across the site. Then pick secure hosting, turn on two-factor login and keep every plugin updated. Finish with regular scans and the checkout script audit in the next section.
Step 1: Choose a PCI Compliant Payment Gateway
Your gateway choice does more for your compliance posture than any other single decision. A PCI-certified gateway like Stripe, WooPayments, PayPal, or Authorize.net handles card data inside its own certified environment. Card numbers never hit your server.
The thing to verify is whether your gateway uses hosted payment fields or a full redirect. Both work. What you want to avoid is any setup where raw card numbers pass through your server first. That puts you in SAQ-D territory and makes everything else harder.
Don’t install checkout plugins without checking what they load on your payment page. One poorly reviewed plugin can add unknown scripts to your checkout. That can cost you SAQ A eligibility and opens the door to card skimming.
Step 2: Install and Force SSL Across Your Site
Every page needs HTTPS. Checkout alone is not enough. PCI DSS Requirement 4 asks for strong encryption whenever card data crosses public networks. HTTPS on every page also stops login cookies from leaking on other pages.
Get an SSL certificate from your host or use a free one from Let’s Encrypt. Force HTTPS sitewide in WordPress settings and add an HSTS header so browsers don’t allow downgrade attacks. If something breaks after setup, the guide on fixing SSL issues in WordPress covers the most common problems.
Step 3: Choose PCI-Ready Hosting
Shared hosting with no isolation is a real problem for PCI compliance. If your server doesn’t have its own firewall rules, malware scanning, or attack detection, you’re going to struggle to show compliance in an SAQ.
Many free and budget hosting panels offer little more than file management, a database tool and SSL settings. That leaves you nothing to point to when the SAQ asks about firewalls and malware detection.
What you need is the opposite of that: an isolated or dedicated server environment, server-level firewalls, automated malware scanning, attack detection, and patching on a regular schedule. Managed WordPress hosts often include these controls. When you talk to your host, ask directly what their PCI shared responsibility scope covers. Some will provide a document for it. If they can’t answer the question, that’s a signal.
Step 4: Enable Two-Factor Authentication
PCI DSS 4.0 requires multi-factor authentication for all access into the cardholder data environment. Your SAQ type decides how much of that applies to your store. Turning on 2FA for your WordPress dashboard, hosting panel and gateway account is a cheap control in every case.
WooCommerce doesn’t include 2FA. The WooCommerce Google Authenticator plugin, built by DevDiggers, asks for a six-digit code from the Google Authenticator app after the password. Users enroll from the My Account page by scanning a QR code.
A stolen admin password is one of the easiest ways into a store. A second factor means the password alone is not enough to log in.
Step 5: Keep WordPress, WooCommerce and Plugins Updated
PCI DSS Requirement 6.3.3 asks you to install critical security patches within one month of release. Other patches follow a schedule you set based on risk. The easiest way to stay inside both is to update as patches ship.
An outdated plugin with a known vulnerability is a compliance gap as well as a security risk. That distinction matters when your processor asks for your SAQ. Test updates on a staging environment before pushing to production, but don’t use that step as a reason to delay. Remove plugins you’re not using. Inactive plugins sitting on a live store are an attack surface with zero upside.
Step 6: Run Regular Vulnerability Scans
Your SAQ type decides whether you need quarterly external scans by an Approved Scanning Vendor. Ask your processor which applies to you. Regular security scans are worth running either way, and they give you something to show your processor.
Tools like Sucuri and Wordfence run automated checks and catch common issues. Sucuri’s free WordPress plugin compares your core files with the official copies. Its WordPress Integrity check flags any modified file that could point to a hack or a broken install.
For a more thorough pass, combine them with the WooCommerce security checklist, which covers PCI controls and general hardening.
What PCI DSS 4.0 Means for Your WooCommerce Checkout Page?
PCI DSS 4.0 added two checkout script rules that became mandatory on March 31, 2025. Requirement 6.4.3 asks you to authorize, inventory and integrity-check every script on the payment page. Requirement 11.6.1 asks you to detect unauthorized changes to that page.
The January 2025 update to SAQ A took those two requirements out of that questionnaire. A store that embeds a provider’s payment form must instead confirm its site is not open to script attacks. The PCI SSC FAQ on the new SAQ A criteria says a full redirect to the provider skips that check.
Stores on SAQ A-EP or SAQ D still have to meet 6.4.3 and 11.6.1 in full. Every script counts there. That includes tracking pixels, chat widgets, analytics tools and scripts from plugins you forgot about.
Worth knowing: If a malicious script skims card numbers as customers type them, the theft happens on your page. Your gateway and your host cannot fix what your own site loads.
This attack type is called e-skimming, also known as Magecart. The attacker hides a script on the checkout page that copies card details and sends them to another server.
Here’s what to do:
- Open your checkout page in Chrome and open DevTools. On the Network tab filter by JS and list every script that loads.
- Check each one against what you knowingly installed. Anything you can’t identify gets removed.
- Add a Content Security Policy (CSP) header to restrict which domains can execute scripts on your checkout page.
- Use Subresource Integrity (SRI) checks on any external scripts you choose to keep.
Repeat the audit each time you add a plugin that loads on the checkout page.
What Is the Cost of Non-Compliance for WooCommerce Stores?
Non-compliance costs come from your payment processor and from any breach. Processors can charge non-compliance fees and close your merchant account. A breach adds a forensic investigation, card brand fines passed on by your acquirer, customer notices and lost trust.
Losing your merchant account means you cannot accept card payments. For most online stores that stops sales until a new processor accepts you. Working on preventing eCommerce fraud is part of the same job.
Compliance costs time and some money. It costs far less than a breach.
For the wider question of whether WooCommerce is safe, see our test results and security tips.
Conclusion
Is WooCommerce PCI compliant? Not out of the box. But that’s not a reason to panic. It’s a reason to set things up correctly.
Use a certified payment gateway with hosted fields. Force HTTPS everywhere. Lock down admin access with MFA and keep your plugins updated. Then run the script audit on your checkout page, since your SAQ type depends on it.
Start with the WooCommerce security checklist for the foundational work and then layer in the compliance-specific steps above. The stores that stay compliant are the ones that treat security as something they maintain. They do not set it and forget it.
If you also handle European customer data, the guide on making your WooCommerce store GDPR compliant pairs well with this one. The two standards overlap in places.
Frequently Asked Questions (FAQs)
Q1. Does WooCommerce store credit card data?
No. By default, WooCommerce does not store credit card numbers. It connects to external payment gateways that handle card data in their own certified environments. When a customer saves a card, the gateway keeps it and WooCommerce stores only a token with the last four digits.
Q2. Do I need PCI compliance if I use PayPal or Stripe on WooCommerce?
Yes, but your compliance scope is smaller. A redirect or an embedded form from the provider usually puts you on SAQ A. SAQ A-EP applies when your own page builds the form. You still need SSL, secure hosting, updated software and MFA on your admin accounts.
Q3. What is an SAQ and how do I complete one?
A Self-Assessment Questionnaire (SAQ) is a form from the PCI Security Standards Council that documents your compliance status. Most WooCommerce stores using hosted payment fields complete SAQ A. Download the right version from the PCI SSC website and submit it to your payment processor or merchant bank.
Q4. How often does PCI compliance need to be reviewed?
Complete your SAQ again every year and run external scans every 3 months if your SAQ requires them. Review your controls whenever you change your store, hosting or payment setup. Any new plugin that loads on your checkout page is a reason to repeat the script audit.
Q5. Can my hosting provider make me PCI compliant?
Partly. A PCI-ready host covers their side: server firewalls, attack detection, physical security and network controls. The application layer is still yours. That means WordPress, WooCommerce, your plugins, your admin access and your checkout scripts.
