Compliance · 2026-07-04

Magento PCI DSS Compliance: A Practical 2026 Guide

If your Magento store touches card data — even through an off-site gateway — PCI DSS applies to you. The good news: most of what PCI DSS 4.0 asks of a small store is ordinary security hygiene. This guide translates the requirements that actually affect Magento into concrete actions, without the consultant jargon.

Start with a baseline: run a free MageArgus scan to see your patch status, TLS, headers and exposed files — several of these map directly to PCI controls.

By the numbers

PCI DSS 4.0 is the current standard; v3.2.1 retired in 2024 — PCI Security Standards Council
New 4.0 rules (6.4.3 / 11.6.1) specifically target payment-page scripts and change detection — PCI SSC

Which SAQ applies to you

Most Magento merchants using a redirect or iframe gateway (PayPal, Amazon Pay, hosted Stripe/Braintree) fall under SAQ A or SAQ A-EP. If any card data is entered on a page you control, you're A-EP, which carries more requirements — including the payment-script controls below. Confirm your level with your acquirer.

The 4.0 rules that matter most for ecommerce

6.4.3 — manage and justify every script that runs on the payment page (know what loads and why).
11.6.1 — detect unauthorised change to payment-page HTTP headers and content (tamper/skimmer detection).

In practice this means an enforced CSP script-src allow-list plus change monitoring on checkout — exactly the defences that stop Magecart. See enforcing Magento CSP.

Core controls Magento merchants must cover

Patch management — keep Magento and extensions current (req. 6).
Strong access control — unique admin logins, 2FA, least privilege (req. 7–8).
TLS everywhere and secure config (req. 4).
Logging & file integrity — detect change and keep audit trails (req. 10–11).
Vulnerability scanning — regular internal/external scans (req. 11).

Do you store card data? (You probably shouldn't)

The cheapest path to compliance is to never store PANs. With an off-site gateway Magento stores no card numbers (cc_number_enc stays empty). Verify this — storing card data pulls you into the far heavier SAQ D and full DSS scope.

A practical compliance loop

Patch → harden (see the hardening checklist) → enforce CSP + monitor checkout → scan regularly → document. Re-run each quarter and after any change. That satisfies the spirit and most of the letter of DSS for a typical store.

Frequently asked questions

I use PayPal — am I automatically PCI compliant?

No. Using an off-site gateway reduces your scope (usually SAQ A/A-EP), but you still must complete the SAQ, keep Magento patched, secure admin access, and — under 4.0 — manage and monitor payment-page scripts.

Does a skimmer breach mean a PCI violation?

Yes. A skimmer capturing card data is a reportable incident and a DSS failure regardless of how many cards were taken. Notify your acquirer and follow your incident-response plan.