PCI ASV scanning for Shopify stores
Shopify runs the checkout, but the storefront your customers load is yours, and since PCI DSS 4.0 it needs a passing external scan every quarter. Here is what applies to a Shopify store, what to scan, and how to get it done the same day.
Do Shopify stores need a PCI ASV scan?
Shopify's own platform and checkout are covered by Shopify's PCI DSS certification; that does not extend to the merchant's storefront domain, custom apps, headless front ends or any server the merchant runs. A standard Shopify store with the hosted checkout usually qualifies for SAQ A.
Since PCI DSS 4.0, SAQ A includes Requirement 11.3.2, so even a fully outsourced checkout needs a passing external scan every 90 days.
Stores running Hydrogen or another headless front end, a custom checkout on Shopify Plus, or merchant-run servers that take part in the purchase flow usually move to SAQ A-EP or SAQ D, which add an annual penetration test.
Your SAQ depends on how your checkout is built. Confirm it with your acquirer or QSA, or use our free SAQ finder.
Which SAQ do Shopify merchants usually file?
Standard Shopify store, hosted checkout
Quarterly ASV scan of your storefront domain; no pen test.
Headless or custom storefront (Hydrogen, custom front end) with Shopify checkout
Quarterly ASV scan of every public domain and IP you run, plus an annual penetration test.
Shopify Plus with a customized checkout or merchant-run payment components
Quarterly ASV scan plus annual penetration test and segmentation testing where applicable.
What the scan looks at on Shopify
- Your storefront domain and www subdomain
- Any subdomain you run yourself (blog, help, api)
- Custom apps or servers that load on the storefront or checkout
- TLS and certificate configuration on anything you control
- DNS entries that still point at old servers
Scan results come with an Attestation of Scan Compliance for every passing scan, and rescans are unlimited until you pass.
Why do this now
PCI DSS has already moved once in this direction: version 3.2.1 asked nothing of fully outsourced merchants, and version 4.0 added quarterly ASV scans for them. The standard changes on a multi-year cycle and the changes have added requirements, not removed them. A quarterly scan on your storefront is the lowest-cost way to have a clean scan history ready when your acquirer, bank or a customer asks for it, and it catches the misconfigurations (expired certificates, old TLS, exposed admin paths) that cause most failed scans before they become a problem.
What every PCI ASV scan includes.
The package price is the whole price. Nothing below costs extra.
Unlimited rescans until you pass.
Rescan as many times as it takes, at no charge.
Buy and scan the same day.
No sales call and no onboarding wait; your scan is ready right after checkout.
24/7 support by email and phone.
Call 800-414-0321 any time.
False positives reviewed within 24 hours.
File an exception in the portal and get an answer within a day.
Attestation of Scan Compliance with every passing scan.
The document your bank or QSA asks for, downloadable from your portal.
A listed PCI ASV since 2007.
Your scan comes from the vendor on the PCI Security Standards Council's list, not a reseller of one.
Free trust seal for your website with any scan.
Does your SAQ also require a penetration test?
A quarterly ASV scan covers Requirement 11.3.2. Some SAQs also require an annual penetration test under Requirement 11.4, and most merchants find out from their bank or QSA after the fact.
SAQ A-EP, C or D
A penetration test is required at least annually and after significant changes, plus segmentation testing where you segment.
See what each SAQ requiresNot sure which SAQ you file?
Answer a few questions and get the SAQ, and whether a pen test applies, in under a minute.
Use the SAQ finderAutomated external tests start the same day you order, with retests included for 30 days. Expert-led tests are scoped per environment.
Simple annual pricing for PCI ASV scanning.
Every plan includes unlimited re-scans until you pass, the Attestation of Scan Compliance, and portal access.
Need more than 50 IPs or Domains? Contact us for a custom quote.