Free tools Windows power users keep installed
One-click scans. No signup required.
Using a payment processor can reduce the card-data systems your store must protect, but it does not automatically take your website or your compliance duties out of scope. Your real workload and costs depend on how checkout works, which systems can affect it, and what your acquirer or other compliance-accepting entity requires.
Does PCI DSS apply if I use a payment processor?
PCI DSS is a payment-card security standard supported by payment-brand compliance programs—not a government-issued certification with one universal price or fine schedule. It is intended for entities that store, process, or transmit cardholder data, including when those activities are performed through a third party. PCI SSC explains how outsourcing affects merchant responsibilities.
As an Amazon Associate I earn from qualifying purchases.
If a provider handles all payment processing and your business does not itself store, process, or transmit cardholder data, many requirements may not apply directly to your environment. You still need to validate through the process that applies to your business, check that the provider is compliant for the service it performs, and oversee the responsibilities that remain yours.
- Keep a written agreement that acknowledges the provider’s and merchant’s responsibilities, as required by PCI DSS Requirement 12.8.2.
- Monitor the provider’s compliance at least annually, as required by Requirement 12.8.4.
- Document which party handles each relevant control, and confirm the reporting process with the entity accepting your compliance validation.
Is my website still in scope if checkout redirects?
It can be. A merchant website that meets SAQ A criteria remains in scope so its web-server configuration and redirect mechanism can be examined. Applicable protections still need to be implemented even if payment data is entered on a provider-hosted page. PCI SSC explains why a merchant website can remain in scope.
#1 Best Overall
The exact security and reporting duties depend on the payment flow and your environment. A simple redirect does not make the merchant-managed server irrelevant: PCI SSC identifies changing default passwords, using unique user IDs and strong passwords, and applying relevant security patches—including critical patches within one month of release—as protections for that server and redirect mechanism. See PCI SSC’s guidance on SAQ A merchant environments.
How checkout patterns affect scope and validation
Where customers enter card data and how your site delivers the payment page affect the questions you need to resolve. These patterns are not automatic shortcuts to a particular questionnaire or compliance status.
Rank #2
| Checkout pattern | What the evidence establishes | What to verify |
|---|---|---|
| Provider-hosted page reached by redirect | The merchant website and redirect mechanism can remain in scope. FAQ 1604 says covered SAQ A ecommerce pages require external vulnerability scanning, including redirect pages. | Which validation form and evidence apply, and which website protections and scans your compliance-accepting entity requires. |
| Payment form embedded in the merchant page | For the described SAQ A eligibility case, the merchant must confirm its site is not susceptible to script attacks that could affect its ecommerce system. FAQ 1604 also includes iframe pages in its scanning guidance. | How the script-attack condition is met, what evidence to retain, and whether your full setup meets every SAQ A criterion. |
| Payment link sent to the customer | FAQ 1588 says its script-attack eligibility condition does not apply to the described fully outsourced payment-link implementation. | All other SAQ A eligibility criteria and the validation process required for your business. |
| Merchant stores, processes, or transmits card data | The merchant’s own environment performs a card-data function, so the outsourced-all-processing scenario does not describe it. | The applicable PCI DSS scope, questionnaire or assessment, and reporting duties with your compliance-accepting entity. |
These descriptions are boundaries to discuss with your acquirer or other compliance-accepting entity, not a substitute for an eligibility decision.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Do I need SAQ A?
Not simply because you use a processor or redirect customers. PCI SSC describes SAQ A merchants as outsourcing all payment processing and not electronically storing, processing, or transmitting cardholder data. Your setup must also meet every eligibility criterion for that questionnaire, and the entity receiving your validation must confirm which form and reporting process applies. PCI SSC discusses SAQ eligibility and merchant responsibilities.
For specified ecommerce pages that embed a third-party payment form, FAQ 1588 says the merchant must confirm the site is not susceptible to script attacks that could affect its ecommerce system. This can involve techniques such as those in PCI DSS Requirements 6.4.3 and 11.6.1, implemented by the merchant or a third party, or confirmation from the compliant payment provider that its solution protects the payment page when implemented according to the provider’s instructions. The FAQ says this particular criterion does not apply to the described redirect implementations or fully outsourced emailed payment links; it does not waive the other SAQ A criteria.
In January 2025, PCI SSC removed Requirements 6.4.3 and 11.6.1 from SAQ A and replaced them with the script-attack eligibility condition for applicable embedded payment pages. That changed SAQ A reporting; it did not remove or reduce the underlying PCI DSS requirements. Read PCI SSC’s update on the SAQ A change.
Rank #4
Does SAQ A require an external vulnerability scan?
According to PCI SSC FAQ 1604, published in June 2026, SAQ A under PCI DSS v4.x requires external vulnerability scans by a PCI SSC Approved Scanning Vendor for merchant ecommerce pages, even when payment processing is outsourced. The guidance explicitly includes redirect and embedded iframe pages. See FAQ 1604.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsUse an ASV listed by PCI SSC and confirm the scan obligation and submission requirements with the entity receiving your validation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Who sets consequences for non-compliance?
PCI SSC does not impose merchant penalties. Its FAQ 1015 states: “The PCI Security Standards Council does not manage compliance programs and does not impose any consequences for non-compliance.” Payment brands may operate programs with financial or operational consequences for some businesses. PCI SSC’s FAQ and Visa’s Account Information Security guidance describe how those programs work.
Visa says a non-compliance assessment may be made to an issuer or acquirer when a merchant or service provider fails to comply or correct an issue; that issuer or acquirer is responsible for paying the assessment. This is not a universal fine charged directly by PCI SSC to an ecommerce merchant. Any merchant-level contractual, financial, or operational consequence depends on the applicable program and the merchant’s relationship and agreement with its acquirer.
Will PCI compliance cost my store money?
There is no universal price or substantiated “typical” total that applies to every online store. The cost depends on your card-data environment, the controls you must implement, the validation path, and services your setup requires. Budget planning should account for categories rather than assume a single standard fee:
Recommended Free Tools
- Implementing and maintaining controls for systems and webpages that remain in scope.
- Staff time for documentation, validation, and provider oversight.
- External scanning where required for covered ecommerce pages.
- Remediation if a scan, review, or other validation identifies an issue.
- Any program-specific operational or contractual consequences that apply to your merchant relationship.
Small merchants often have simpler environments, less cardholder data, and fewer systems to protect, which can reduce compliance effort compared with larger businesses. The required validation and reporting still need to be confirmed with the acquirer or payment brand. PCI SSC offers guidance for small merchants.
What to do next
- Map the payment journey. Record whether customers use a merchant-hosted form, embedded provider form, full redirect, or provider-hosted payment link.
- Identify systems that affect payment. Determine whether any merchant system stores, processes, or transmits account data, and which webpages or servers can affect the payment flow.
- Confirm validation requirements. Ask your acquirer or other compliance-accepting entity which SAQ or assessment, evidence, and submission schedule applies. Do not choose SAQ A from a generic checklist alone.
- Set provider boundaries in writing. Confirm the provider’s PCI DSS status for the exact service you use, document each party’s responsibilities, and identify controls that remain yours.
- Track provider compliance. Monitor the provider at least annually and keep evidence of the review.
- Check scanning and scripts. If your ecommerce page is covered by SAQ A, verify the applicable ASV scan requirement. For an embedded payment form, establish how the script-attack eligibility condition is met and retain relevant provider confirmation or other evidence.
A script provider is not automatically a third-party service provider for Requirements 12.8 and 12.9: PCI SSC describes a narrow case where a provider only supplies scripts unrelated to payment processing and the merchant confirms those scripts cannot affect cardholder or sensitive authentication data. That specific statement is not a general exemption from script security or other PCI DSS requirements. Read PCI SSC’s clarification on script providers.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
