What PCI DSS means
If you take card payments, you are expected to follow PCI DSS. Using a hosted payment gateway that keeps card data off your servers makes compliance much simpler. Card data stored or handled carelessly can lead to fines, lost processing ability and breaches.
Why it matters for your website
If you take card payments, your bank and card brands expect you to follow PCI DSS. Ignoring it can lead to fines from your processor, higher fees or losing the ability to accept cards after a breach. Using hosted payment pages or trusted gateways can greatly reduce how much of the standard applies to you.
Example
A gift shop's website sends shoppers to its gateway's hosted payment form, so card numbers never touch its own server. Its yearly compliance check becomes much simpler.
Tips
- Use a payment gateway's hosted fields or checkout page so card data never touches your server.
- Complete the self-assessment questionnaire your processor asks for each year.
- Keep your site, plugins and admin accounts secure, since checkout pages can still be targeted.
Common mistakes
- Asking customers to email or phone in card numbers that then get written down.
- Assuming you have no PCI responsibilities just because you use a third-party gateway.
Questions about PCI DSS
What is PCI DSS?
The Payment Card Industry Data Security Standard: security rules for any business that accepts card payments.
Is PCI compliance required by law?
PCI DSS is an industry standard, not a government law. It's enforced through your agreements with payment processors and card brands, and some laws also touch on card data security.
Does using a hosted checkout make me PCI compliant?
It reduces your scope a lot, but you still have duties, such as completing a self-assessment and securing your website and accounts.
