PCI ASV scanning for Magento and Adobe Commerce
Magento and Adobe Commerce stores run on infrastructure the merchant manages, so the storefront, admin and APIs are all in scope for quarterly PCI ASV scanning. Here is which SAQ usually applies, what the scan covers, and how to pass it the same day.
Do Magento stores need a PCI ASV scan?
Magento Open Source and Adobe Commerce (on-premise or merchant-managed cloud) serve the checkout from the merchant's own environment, so the merchant, not a platform, is responsible for the store's PCI validation. Most Magento stores use a payment integration that keeps card entry inside the merchant's pages or posts through the merchant's server, which places them in SAQ A-EP; SAQ A applies only when the whole checkout is a redirect to the processor.
Since PCI DSS 4.0, SAQ A includes Requirement 11.3.2, so even a fully outsourced checkout needs a passing external scan every 90 days.
If cardholder data is ever stored or processed in the environment, SAQ D applies. SAQ A-EP and SAQ D both add an annual penetration test. Magento stores have been a primary target for card-skimming (Magecart) attacks for years, which is why acquirers look closely at Magento scan history.
Your SAQ depends on how your checkout is built. Confirm it with your acquirer or QSA, or use our free SAQ finder.
Which SAQ do Magento merchants usually file?
Fully redirected hosted checkout
Quarterly ASV scan of every public domain and IP; no pen test.
Payment integration inside your pages (most Magento stores)
Quarterly ASV scan plus annual penetration test.
Cardholder data stored or processed in your environment
Quarterly ASV scan, internal scanning, annual penetration test and segmentation testing.
What the scan looks at on Magento
- The storefront domain and every public IP behind it
- A separate admin origin or admin path if you run one
- REST and GraphQL API endpoints
- TLS and certificate configuration
- Magento and extension versions visible from outside
- Open ports and services on the host
- Staging copies left reachable
Scan results come with an Attestation of Scan Compliance for every passing scan, and rescans are unlimited until you pass.
Why do this now
PCI DSS has already moved once in this direction: version 3.2.1 asked nothing of fully outsourced merchants, and version 4.0 added quarterly ASV scans for them. The standard changes on a multi-year cycle and the changes have added requirements, not removed them. A quarterly scan on your storefront is the lowest-cost way to have a clean scan history ready when your acquirer, bank or a customer asks for it, and it catches the misconfigurations (expired certificates, old TLS, exposed admin paths) that cause most failed scans before they become a problem.
What every PCI ASV scan includes.
The package price is the whole price. Nothing below costs extra.
Unlimited rescans until you pass.
Rescan as many times as it takes, at no charge.
Buy and scan the same day.
No sales call and no onboarding wait; your scan is ready right after checkout.
24/7 support by email and phone.
Call 800-414-0321 any time.
False positives reviewed within 24 hours.
File an exception in the portal and get an answer within a day.
Attestation of Scan Compliance with every passing scan.
The document your bank or QSA asks for, downloadable from your portal.
A listed PCI ASV since 2007.
Your scan comes from the vendor on the PCI Security Standards Council's list, not a reseller of one.
Free trust seal for your website with any scan.
Does your SAQ also require a penetration test?
A quarterly ASV scan covers Requirement 11.3.2. Some SAQs also require an annual penetration test under Requirement 11.4, and most merchants find out from their bank or QSA after the fact.
SAQ A-EP, C or D
A penetration test is required at least annually and after significant changes, plus segmentation testing where you segment.
See what each SAQ requiresNot sure which SAQ you file?
Answer a few questions and get the SAQ, and whether a pen test applies, in under a minute.
Use the SAQ finderAutomated external tests start the same day you order, with retests included for 30 days. Expert-led tests are scoped per environment.
Simple annual pricing for PCI ASV scanning.
Every plan includes unlimited re-scans until you pass, the Attestation of Scan Compliance, and portal access.
Need more than 50 IPs or Domains? Contact us for a custom quote.