PCI DSS and Hosted Checkouts: What Store Owners Still Need to Do

Why this matters for a small store

PCI DSS is a security standard maintained by the PCI Security Standards Council. It is enforced through the card networks and your payment provider rather than by a government regulator, and it applies to any business that accepts card payments. Most small online stores never touch a card number directly, and that is the point: the less card data your website handles, the smaller your obligations.

Three ways a store can take card payments

Hosted platforms run the checkout themselves. Shopify, for example, states that its checkout is designed to meet PCI DSS version 4 requirements with no additional merchant work^[1]. On self-hosted platforms such as WooCommerce, your choice of payment gateway decides which of the first two approaches you use.

The SAQ A change in 2025

The PCI Security Standards Council's document library lists PCI DSS v4.0.1 as the latest version of the standard^[2]. Merchants that outsource card handling usually validate with a self-assessment questionnaire, and SAQ A is the shortest.

In January 2025 the Council published a revised SAQ A for v4.0.1, issued as revision 1 (SAQ A r1), which took effect on 31 March 2025. The Council's announcement says the revision removed requirements 6.4.3 (payment page scripts), 11.6.1 (change detection on payment pages) and 12.3.1 (the targeted risk analysis for 11.6.1) from the questionnaire. In their place, merchants must confirm their site is not susceptible to attacks from scripts that could affect their e-commerce systems. The Council stresses that the underlying PCI DSS requirements are not removed or diminished^[3]. A secondary summary from a PCI assessor describes the same change^[4].

What it means for your integration

How you take payments decides how much of this falls on your pages. With an embedded payment form, such as an iframe from your provider, the card field sits inside your own page, so the other scripts on that page matter. With a full redirect, the shopper types card details on the provider's page instead. Ask your payment provider which SAQ fits your integration, and what confirmation it gives about script attacks.

Both approaches can be secure. With an embedded form, the scripts on your checkout page become part of your security responsibility.

Why scripts are the risk

Attacks on online stores often work by injecting a malicious script into the page around the payment form, then reading what the shopper types or replacing the form. Every analytics tag, chat widget, review app and marketing pixel on a checkout page is another script that could be compromised upstream. Keeping that list short is the cheapest security measure a store can take.

What stays with you, even with a hosted checkout

• Choosing a reputable payment provider and keeping its integration current
• Keeping admin accounts secure, with unique passwords and multi-factor sign-in
• Limiting apps and scripts on checkout and payment pages, and reviewing them regularly
• Applying platform, theme and extension updates promptly on self-hosted stores
• Completing the self-assessment your payment provider asks for, accurately
• Never asking customers for card numbers by email, chat or contact form

Personal information is a separate obligation

PCI DSS covers card data. Names, addresses and order histories are personal information, covered by the Privacy Act for businesses it applies to. APP 11 asks covered businesses to take reasonable steps to secure it, and amendments in December 2024 spelt out that those steps cover technical and organisational measures^[5]. Many small businesses with turnover of $3 million or less are exempt, but some are covered regardless of size^[6].

A practical setup for most small stores

• Use a hosted checkout or hosted payment page where your platform offers one.
• On self-hosted stores, choose a gateway that collects card data in hosted fields or on its own page.
• List every script on checkout pages and remove anything that is not essential.
• Ask your provider for its documentation on SAQ A eligibility and script protection for embedded forms.
• Secure admin access with multi-factor authentication for every account.
• Review the setup twice a year, and after adding any app that touches checkout.

This guide is general information, not a compliance assessment. Your payment provider or acquiring bank can tell you which questionnaire applies to your business, and a Qualified Security Assessor can help with anything more complex.