Start a project
Start a project Book a call
Compliance

PCI DSS and website security for an online store: what a small merchant should check

A plain guide to PCI DSS for small online merchants: who enforces it, which questionnaire types exist, the payment page script rules in force since 31 March 2025, and what stays your job with a hosted checkout.

ESTASOFT
13 min read
Dark green cover with a lime padlock, with the title PCI DSS and store security
On this page
    On this page

      Your bank, payment provider or card processor mentions PCI DSS, and a questionnaire may arrive. You run an online store, you may never see a card number, and you want to know what applies to you, what your platform covers and what stays your job.

      This article explains who sets and enforces PCI DSS, what changed on 31 March 2025 for scripts on payment pages, how the self-assessment questionnaires differ, and what a hosted checkout such as Shopify's changes. It then points to small business security pages from the UK, Canada and the US and ends with a review checklist. Standards change, so read the current versions before you act.

      What PCI DSS is and who enforces it

      PCI DSS is the Payment Card Industry Data Security Standard, published by the PCI Security Standards Council. A Council guide dated October 2010 says it applies to any business that stores, processes or transmits payment card data, whatever its size, and that your duty extends to the third parties in your payment process.

      The same guide says the Council does not enforce compliance, and that your acquirer or the card brands tell you what validation they need. A Council overview, also from October 2010, says the major card brands enforce the standards. Both are old, so read them as what the Council describes. A Council post of 30 January 2025 repeats the point: the Council does not set validation duties, and merchants should consult their compliance-enforcing entity, such as a card brand or acquirer.

      The Council pages we opened describe no separate rules for the US, Canada, the UK or the EU, and none says that a national law requires the standard. Ask your acquirer what it expects in your country, and an adviser whether any local law refers to PCI DSS.

      Which version applies, and what changed in 2025

      The Council published PCI DSS v4.0 on 31 March 2022. Its post of 26 March 2025 says v3.2.1 was retired on 31 March 2024 and refers to v4.0.1. A Council post of 11 June 2024 calls v4.0.1 a limited revision and says it becomes the only supported version once v4.0 retires on 31 December 2024. We could not open the Council's document library, so check the Council's library for the current version, and ask your acquirer which one applies to your next assessment.

      The Council made some v4 requirements future-dated. Until 31 March 2025 they were recommended practice. From that date they are mandatory and part of assessments, as a Council post of 26 March 2025 says. Requirements 6.4.3 and 11.6.1 are two of them. They concern the scripts on payment pages: authorising them, checking their integrity and watching for unauthorised changes. The Council ties them to e-skimming, where attackers use scripts to steal card data. It says its guidance is for businesses that take e-commerce payments through embedded iframes or through pages that can affect payment security, and for their service providers.

      Self-assessment questionnaires for online stores

      A self-assessment questionnaire, or SAQ, is a yes or no checklist that the Council describes as a validation tool for small merchants that do not have to submit a full report. The Council describes several SAQ types. Its SAQ page was last modified on 31 May 2022, so the current wording may differ. Three types matter to online stores as that page describes them. Check with your acquirer which applies to you:

      • SAQ A. For card-not-present merchants that have outsourced all cardholder data functions to compliant third parties and keep no card data on their own systems.
      • SAQ A-EP. For e-commerce merchants that outsource payment processing but run a website that can still affect the security of the transaction. The v4.0 form (April 2022) says the site never receives card data itself.
      • SAQ D. For merchants that do not fit the other types.

      The page also lists types for terminals and payment applications.

      SAQ A changed in January 2025. A Council post of 30 January 2025 says the new version, effective 31 March 2025, no longer contains requirements 6.4.3, 11.6.1 and 12.3.1. Instead, the merchant confirms that its site is not open to script attacks. Council FAQ 1588 (February 2025) says this applies only if your page embeds a provider's payment page or form, for example in an iframe, and not if you redirect shoppers to the provider's site or outsource payment entirely. It offers two ways to show that a page is "not susceptible to script attacks": use techniques like those in 6.4.3 and 11.6.1, yourself or through a third party, or obtain written confirmation from your PCI DSS-compliant provider that its solution, used as instructed, protects the page. The Council stresses that the requirements stay in the standard and were removed only from SAQ A.

      A hosted checkout changes the work, not the duty

      Shopify says on its security page that it is certified Level 1 PCI DSS compliant and that this applies by default to every store on its platform. That page shows no date and names no version. A Shopify article dated 13 February 2025 says its checkout sandboxes third-party scripts and that PCI DSS v4 requirements need no additional work from merchants. Shopify's Help Center says its Attestation of Compliance, the form recording the result of its annual PCI DSS assessment, is reissued after each assessment and can be viewed after you log in to your Shopify account. These are Shopify's own statements and some pages are undated, so check Shopify's pages and your account for the current position.

      None of the Shopify pages we opened says which questionnaire a merchant should complete. Treat that as a question for your acquirer or payment provider. The same questions suit any hosted checkout:

      • Do shoppers leave your site to pay, or is the provider's form embedded in your page?
      • Will the provider give you its attestation each year?
      • If the form is embedded, will the provider confirm the script protection in writing?
      • Which questionnaire does your acquirer want you to complete, and how often?

      What stays your job with a hosted checkout

      A hosted checkout covers the payment step. The rest of the store and the people who run it remain yours. The pages we opened point to these areas:

      • Scripts on your other pages. Chat widgets, analytics and ad tags are scripts too. FAQ 1588 says a supplier whose only service is non-payment scripts that cannot affect card data security is not treated as a third-party service provider for SAQ A.
      • Accounts and access. The requirements for the UK Cyber Essentials scheme (v3.3, April 2026) say authentication to cloud services must always use multi-factor authentication, and that accounts you own stay in scope even when suppliers use them. It also puts devices in scope, including personal ones that reach company data. See our OWASP Top 10 article for common web flaws.
      • Apps, plugins and updates. Cyber Essentials lists security update management as one of its five technical themes. If you run WordPress, see our WordPress security checklist.
      • Suppliers. The US Federal Trade Commission (FTC) guide Start with Security (August 2023) says to put security requirements in contracts with service providers and to verify that they meet them.
      • Backups. The UK National Cyber Security Centre (NCSC) Small Business Guide (October 2020) advises keeping copies apart from the originals and checking that you can restore them. Our 3-2-1 backup rule article explains how many copies to keep.

      Small business security pages in the UK, Canada and the US

      These pages are not PCI DSS and do not replace what your acquirer asks for. They are free starting points for small organisations.

      • UK. The NCSC hub for small organisations lists free tools such as the Cyber Action Toolkit and Check your cyber security, and Cyber Essentials, a government-backed certification scheme. Its five technical themes are firewalls, secure configuration, security update management, user access control and malware protection. The v3.3 requirements are dated April 2026 and effective from 27 April 2026, per the NCSC.
      • Canada. The Canadian Centre for Cyber Security publishes baseline controls for small and medium organisations. Version 1.2 has 42 baseline controls in 13 areas, including website security and cloud and outsourced IT. Its page was last modified on 18 February 2020 and says the information remains valid. A newer page (February 2024) lists 13 top measures and says to start with the first four: an incident response plan, patching, strong user authentication, and backup and encryption.
      • US. The FTC's cybersecurity page for small business (published 8 November 2021, last modified 5 December 2025) covers topics such as the NIST Cybersecurity Framework, email authentication, secure remote access, hiring a web host, vendor security and cyber insurance. The page does not mention PCI DSS.
      • EU. We opened no EU or national small business security page for this article, so we name none. Ask your national cyber security agency or an adviser.

      A review checklist for a small online store

      Use it once a year and after any change of checkout, platform or provider. Keep dated notes.

      1. Ask your acquirer or payment provider in writing which questionnaire applies, how often to submit it and where.
      2. Draw the payment path: redirect to the provider, an embedded form, or a form on your own page. Note who handles card data at each step.
      3. Collect the provider's current attestation, and the written script protection confirmation if you embed their form.
      4. List every script on the cart, checkout and payment pages, including tag managers. Note who added each one and remove what you no longer use.
      5. If you answer the script question yourself, decide who authorises scripts and how a change to a payment page is detected.
      6. List all admin accounts. Remove former staff and agencies, and turn on multi-factor sign-in.
      7. List apps, plugins and themes. Update them or remove the ones you do not use. Check staff devices for updates and screen locks.
      8. Ask whether staff ever receive card numbers by email, chat or phone, and whether that changes your questionnaire.
      9. Restore a backup as a test and note the result.
      10. Write a one-page incident plan: who to call at your acquirer, provider and adviser, and who decides.
      11. Set a date to repeat the review and to check the Council's pages for new versions.

      Our security review page describes the service we offer. For the difference between a scan, a penetration test and a review, see our security review article, which also covers Gulf data laws.

      This is general information, not legal or tax advice. Check the current rules or ask a qualified adviser before you decide.

      ESTASOFT can help with security review: send a short brief on the contact page. If your next question is where your site and data sit, read hosting location and data transfers.

      Sources

      Written by
      ESTASOFT

      Need help with a project?

      Share a short brief. We reply with next steps.

      Start a project Book a call

      Book a call

      30 minutes. Free.

      Tell us about your project and we will suggest a time.

      Send a request

      Or email us at info@estasoft.com

      Cookie preferences

      Necessary

      Needed for the site to work. Always on.

      Always on

      Preferences

      Remember choices such as language and region.

      Analytics

      Help us understand which pages are useful.

      Marketing

      Used to measure and improve campaigns.