iFastHostingDoes my store need to be PCI compliant?
Almost certainly yes in some form, but how much work that means depends entirely on whether card data ever touches your own server.
If your store accepts card payments in any form, PCI DSS applies to you — the question that actually matters is how much of it, and that depends almost entirely on whether card data ever passes through your own server. PCI DSS obligations are a matter between you, as the merchant, and your acquiring bank or payment provider. Confirm your specific SAQ (Self-Assessment Questionnaire) type directly with them rather than assuming — this article explains the mechanism, not your specific obligation.
What actually determines your scope
The critical distinction is not what your store looks like to a customer — it is what happens to the card number technically. A checkout that visually looks entirely custom-built can still keep card data completely off your server if it uses the right integration.
| Setup | Where the card number goes | Typical scope |
|---|---|---|
| Hosted / redirect checkout (customer briefly leaves your site to pay) | Directly to the payment provider. Never touches your server. | Minimal — usually the simplest SAQ type. |
| Tokenised embedded fields (Stripe Elements, PayPal's on-page buttons) | Directly to the provider via fields they control, even though they appear to sit on your page. Your server receives only a token. | Reduced, but not zero — you are still responsible for keeping the surrounding page secure. |
| Self-hosted card form (you built the form and your code handles the number) | Your server, your code, your database if you store anything. | Full scope — the most demanding and the most work to maintain correctly. |
Using Stripe Elements or PayPal instead of a form you built yourself is the single biggest thing most small stores can do to reduce PCI scope, because it removes card data from your server and your code entirely. This does not eliminate your obligations — you still need to keep the page secure, keep software updated, and complete whatever self-assessment your acquirer requires — but it is a meaningfully smaller undertaking than processing cards directly.
PCI DSS compliance is a certification about how your specific business handles payment data end to end — it is not a status a hosting company can grant by hosting your files. Be sceptical of anything, including this article, that implies otherwise. What hosting can provide is the infrastructure a compliant setup depends on: HTTPS, current software, and a secure server — the rest is your configuration and your processes.
What you are responsible for regardless of setup
- HTTPS on every page that touches checkout, with a valid, non-expired certificate. Free SSL is included with hosting here — see getting HTTPS working on a store if this is not already sorted.
- Keeping WordPress, WooCommerce, your theme and every plugin updated. Outdated software is a direct route to a compromised checkout regardless of which payment method you use.
- Not storing card data yourself unless you have a specific, well-understood reason to and the compliance level to support it. Most stores have no reason to store a card number at all — tokenisation exists precisely so you never need to.
- Completing whatever self-assessment your acquirer or payment provider asks for. This is usually a short questionnaire for a tokenised or hosted setup, and considerably longer for a self-hosted card form.
Finding out your specific SAQ type
Your acquiring bank or your payment provider — Stripe, PayPal, or whoever processes your transactions — is the correct source for which SAQ type applies to your setup, and they will typically confirm this based on how you have integrated with them. Ask directly rather than guessing from a generic table online; the exact categorisation depends on details of your integration that only your provider can see.
The practical takeaway
Use a tokenised or hosted payment flow rather than building your own card form, keep everything updated, keep HTTPS active everywhere, and confirm your specific obligations with your payment provider. That combination covers the vast majority of what a small store genuinely needs to do, and it is considerably less work than the phrase "PCI compliance" tends to suggest.
Related reading
Hosted checkout, embedded fields, or building your own form — the choice affects your security workload far more than your conversion rate.
How to connect Stripe to WooCommerceInstalling the plugin takes minutes — getting from test mode to a live payment without a mistake is where this guide actually helps.
How to secure an online storeA store is a bigger target than a brochure site because there is more to steal and more ways in — here is where to focus first.
How to get HTTPS working on a storeA checkout page half on HTTPS and half on HTTP is not a minor warning — most payment providers simply will not process on it.