WooCommerce PCI DSS Compliance: A Practical Guide
If your WooCommerce store accepts card payments, PCI DSS applies to you — even when a gateway handles the actual card data. Compliance is less about paperwork and more about keeping cardholder data out of your servers and your site free of skimmers.
This guide explains which self-assessment questionnaire (SAQ) fits WooCommerce and the practical controls that keep you compliant. Run a free MageArgus scan to check your store's security posture.
- Hosted payment fields keep most stores in the simpler SAQ A — PCI SSC guidance
- Magecart skimmers directly cause PCI breaches on WooCommerce — Sansec / Sucuri
Which SAQ applies to WooCommerce?
If you use a gateway with hosted fields or a redirect (Stripe, PayPal, Braintree) so card data never touches your server, you generally qualify for SAQ A — the shortest path. Self-hosted card capture pushes you to SAQ A-EP or SAQ D, which are far heavier. Keep payments hosted.
Protect the checkout page
Even with hosted fields, a skimmer injected into your site can overlay a fake form or exfiltrate keystrokes. Lock the checkout down with a strict Content-Security-Policy, Subresource Integrity on scripts, and a tight allow-list of third-party hosts.
The baseline controls
- TLS everywhere (HTTPS + HSTS) — no mixed content
- Keep WordPress, WooCommerce and plugins patched
- Unique logins + 2FA for admins; least privilege
- File-integrity monitoring and regular malware scans
- Remove unused plugins and stale admin accounts
Prove it with scanning
PCI expects regular vulnerability scanning and evidence you're monitoring for changes. Automated malware and file-integrity scanning gives you both the detection and the audit trail — catching an injected skimmer before it becomes a reportable breach.
Frequently asked questions
Do I need PCI compliance if Stripe handles payments?
Yes. Using a compliant gateway reduces your scope (often to SAQ A) but you are still responsible for your site not leaking or skimming card data.
Does WooCommerce store card numbers?
By default no — with a hosted gateway the card data goes straight to the processor. Never install plugins that store full card numbers on your server.
What actually causes WooCommerce PCI breaches?
Most are Magecart-style skimmers injected via a vulnerable plugin or stolen admin login — which is why patching and scanning are core PCI controls.