PCI ASV scanning for WooCommerce stores
A WooCommerce store runs on a server you control, so the whole site is in scope for quarterly PCI ASV scanning. Here is which SAQ you usually file, what the scan covers on a WordPress host, and how to pass it the same day.
Do WooCommerce stores need a PCI ASV scan?
WooCommerce is self-hosted, so unlike a hosted platform there is no provider certification covering the store itself; the web server, WordPress, plugins and every public domain or IP serving the store are the merchant's responsibility. With a gateway that redirects to the processor or embeds the processor's hosted fields (Stripe Checkout, PayPal, Square hosted fields and similar), the store usually qualifies for SAQ A.
Since PCI DSS 4.0, SAQ A includes Requirement 11.3.2, so even a fully outsourced checkout needs a passing external scan every 90 days.
With a gateway that posts card data through your site, or any custom payment code, the store moves to SAQ A-EP, which adds an annual penetration test; if cardholder data is ever stored or processed on the server, SAQ D applies.
Your SAQ depends on how your checkout is built. Confirm it with your acquirer or QSA, or use our free SAQ finder.
Which SAQ do WooCommerce merchants usually file?
Redirect or hosted-fields gateway
Quarterly ASV scan of every public domain and IP serving the store; no pen test.
Card data touches your server
Quarterly ASV scan, internal scanning, annual penetration test and segmentation testing.
What the scan looks at on WooCommerce
- The web server's public IP and every domain pointed at it
- wp-admin and wp-login exposure
- WordPress core, WooCommerce and plugin versions visible from outside
- TLS and certificate configuration
- Open ports and services on the host (database, SSH, mail)
- Staging or dev copies left reachable
Scan results come with an Attestation of Scan Compliance for every passing scan, and rescans are unlimited until you pass.
Why do this now
PCI DSS has already moved once in this direction: version 3.2.1 asked nothing of fully outsourced merchants, and version 4.0 added quarterly ASV scans for them. The standard changes on a multi-year cycle and the changes have added requirements, not removed them. A quarterly scan on your storefront is the lowest-cost way to have a clean scan history ready when your acquirer, bank or a customer asks for it, and it catches the misconfigurations (expired certificates, old TLS, exposed admin paths) that cause most failed scans before they become a problem.
What every PCI ASV scan includes.
The package price is the whole price. Nothing below costs extra.
Unlimited rescans until you pass.
Rescan as many times as it takes, at no charge.
Buy and scan the same day.
No sales call and no onboarding wait; your scan is ready right after checkout.
24/7 support by email and phone.
Call 800-414-0321 any time.
False positives reviewed within 24 hours.
File an exception in the portal and get an answer within a day.
Attestation of Scan Compliance with every passing scan.
The document your bank or QSA asks for, downloadable from your portal.
A listed PCI ASV since 2007.
Your scan comes from the vendor on the PCI Security Standards Council's list, not a reseller of one.
Free trust seal for your website with any scan.
Does your SAQ also require a penetration test?
A quarterly ASV scan covers Requirement 11.3.2. Some SAQs also require an annual penetration test under Requirement 11.4, and most merchants find out from their bank or QSA after the fact.
SAQ A-EP, C or D
A penetration test is required at least annually and after significant changes, plus segmentation testing where you segment.
See what each SAQ requiresNot sure which SAQ you file?
Answer a few questions and get the SAQ, and whether a pen test applies, in under a minute.
Use the SAQ finderAutomated external tests start the same day you order, with retests included for 30 days. Expert-led tests are scoped per environment.
Simple annual pricing for PCI ASV scanning.
Every plan includes unlimited re-scans until you pass, the Attestation of Scan Compliance, and portal access.
Need more than 50 IPs or Domains? Contact us for a custom quote.