If you run a WooCommerce store and take cards through a plugin like Stripe or Square, your PCI self-assessment is probably SAQ A. Since PCI DSS 4.0 replaced version 3.2.1 in March 2024, SAQ A includes Requirement 11.3.2: an external vulnerability scan every 90 days, run by a PCI SSC Approved Scanning Vendor (ASV), with a passing result. This post explains what that scan actually looks at, why WordPress sites fail it, and what you need to keep on file.
What an ASV scan actually checks
An ASV scan is an external, unauthenticated scan of the public IP addresses and hostnames where your store lives. It is run from the internet, the way an attacker would see you. It is not a WordPress plugin scan and it does not log in or look inside WordPress. It checks the web server, TLS configuration, open ports and services, known vulnerable software versions, and the certificate on your domain. Under the PCI SSC ASV Program Guide, a scan passes only when no vulnerability rated CVSS 4.0 or higher is found on any in-scope host.
Why WooCommerce sites fail
In our experience the same handful of findings account for most WooCommerce failures:
- TLS 1.0 or 1.1 still enabled on the server (an automatic fail).
- The web server or PHP version disclosed in response headers, where that version has a known vulnerability.
- Expired, self-signed, or mismatched SSL certificates, often on a staging subdomain nobody remembers.
- Open ports for services the store does not use, such as FTP, old mail services, or a database port.
- Outdated server software on shared hosting that the merchant cannot patch themselves.
Almost all of these are fixed at the hosting level, not in WordPress. If you are on shared or managed WordPress hosting, open a ticket with your host before you run the scan and ask them specifically about TLS versions, open ports and certificate coverage.
Shared hosting and false positives
On shared hosting, the scan targets a server you share with other customers, so findings may belong to someone else’s site on the same IP. The ASV program allows you to dispute findings with evidence (for example, that a flagged service is not reachable or has been patched by the host). Pick an ASV that handles disputes for you and does not charge for rescans, because you will usually need more than one attempt the first quarter.
What you have to keep
Three things: a passing ASV scan report at least every 90 days, the Attestation of Scan Compliance the ASV generates with it, and your signed SAQ A. Your payment processor will not usually ask for the scan report, but your acquiring bank can, and SAQ A states that you have it. Scan as often as you like; only one passing scan per quarter is required.
How to choose an ASV
Any company on the PCI SSC’s published ASV list is acceptable, so the differences are practical: how many IPs or domains the plan covers, whether rescans are free, whether the vendor disputes false positives for you, how the report is delivered to your auditor or bank, and whether you can buy and run it yourself without a sales call. Enterprise scanners are solid if you already use them for other things; for a single store they are usually more than you need.
How Clone Systems can help
Clone Systems has been a PCI SSC Approved Scanning Vendor since 2007. You can buy an ASV scan online, add your domain, run it the same day, rescan as many times as you need until you pass, and download the attestation from your dashboard. See PCI ASV scanning or pricing.
Frequently Asked Questions
Does SAQ A really require an ASV scan? Yes. Requirement 11.3.2 is part of SAQ A under PCI DSS 4.0 and 4.0.1.
Do I scan my WordPress site or my hosting server? The public IP or hostname your store resolves to. On shared hosting that is the host’s server.
What if my host will not fix a finding? You can dispute it with evidence through your ASV, or move hosts. Findings the host controls cannot be fixed from inside WordPress.
How long does a scan take? Usually under an hour for a single site.
Is a passing scan the same as being PCI compliant? No. It satisfies one requirement. The rest of SAQ A still applies.
Conclusion
The scan is simpler than it sounds once you know it is looking at your server, not your plugins. Fix TLS, certificates and open ports with your host, run the scan, keep the attestation, and repeat every quarter.
References
[1] PCI SSC, Self-Assessment Questionnaire A, PCI DSS v4.0.1
[2] PCI SSC, ASV Program Guide
[3] PCI SSC, Approved Scanning Vendors list, https://www.pcisecuritystandards.org/assessors_and_solutions/approved_scanning_vendors
