If your website takes card payments, you must follow the Payment Card Industry Data Security Standard (PCI DSS).
Keep card data off your website
The simplest and safest approach is to use a payment provider that handles card details on its own pages or secure fields, such as Stripe, PayPal, Square, Worldpay or SagePay/Opayo. Card numbers then never touch your hosting, which greatly reduces what you need to prove for compliance (usually a short self-assessment questionnaire, often SAQ A or SAQ A-EP).
Never store card numbers, expiry dates or security codes in your database, emails or files.
What you're still responsible for
- Keeping your website software, plugins and themes up to date
- Using strong, unique passwords and 2FA on admin accounts
- Serving the whole site over HTTPS
- Removing unused plugins, admin accounts and old copies of the site
- Completing your provider's annual PCI questionnaire
Server scans
Your payment provider may ask for a quarterly vulnerability scan of your website. If a scan reports issues relating to the server, raise a ticket with the report and we'll review it.
