Do I Need PCI Compliance for a WooCommerce Store?
How Modern Gateways Reduce the WooCommerce Burden
PCI DSS (the Payment Card Industry Data Security Standard) applies to anyone who stores, processes, or transmits card data, with the scope and difficulty of compliance scaling with how directly that data touches your own systems. Hosted-field integrations like Stripe Elements or PayPal's embedded checkout send card details directly from the customer's browser to the gateway's own secure servers — WooCommerce and the store's hosting never see the raw card number at all, which qualifies most merchants for the simplest compliance level (commonly SAQ A).
What Still Applies Even Then
- A Self-Assessment Questionnaire is still typically required, even for the simplest compliance level — it covers basics like keeping software updated, using strong access controls, and not storing card data anywhere on the site.
- An older or custom-built gateway integration that handles card fields directly on the store's own checkout page (rather than a hosted/tokenized field) puts the store in a much higher compliance tier, with significantly more requirements — worth confirming which category the current setup actually falls into.
- Storing card numbers anywhere (a support ticket, an email, a spreadsheet, even temporarily) is a serious compliance and security violation regardless of which gateway integration is used elsewhere.
- The merchant account/acquiring bank, not WooCommerce or the gateway plugin, is typically who requires and reviews the SAQ — this is worth confirming with whoever manages that account.
Staying on Top of It
- Confirm the gateway integration uses hosted/tokenized card fields, not a custom implementation handling raw card data directly.
- Complete whichever SAQ level applies, as required by the merchant account provider, even if the technical requirements are minimal.
- Never store card numbers outside the gateway's own secure systems, in any form, for any reason.
- Keep WordPress, WooCommerce, and all plugins updated, since general site security is itself part of what most compliance levels require.
Unsure which compliance level applies to a specific setup? See WooCommerce fixes for a proper review.