PCI DSS SAQ Types Explained: Which One Actually Needs an ASV Scan?
PCI DSS SAQ types explained: compare SAQ A, SAQ A-EP, and SAQ D, and find out exactly which one requires a quarterly ASV scan. Get scan-ready today.
If you run a WooCommerce store in the US and accept credit or debit card payments, PCI DSS compliance is not optional; it is a contractual requirement imposed by Visa, Mastercard, and every US payment processor you work with.
The problem is that most WooCommerce documentation focuses on getting the store running, not on what happens after the first sale. PCI DSS gets a footnote if it is mentioned at all. Store owners often assume that installing Stripe or WooCommerce Payments handles it automatically. It does not.
This guide breaks down exactly what PCI DSS compliance means for a WooCommerce store in 2026, which Self-Assessment Questionnaire applies to your setup, whether you need quarterly ASV scans, and what steps you need to take to get and stay compliant. No jargon. No unnecessary complexity. Just what you actually need to know.
Use our free PCI Compliance Checker to find out your SAQ type, whether scanning is required, and what your next step is in under two minutes.
PCI DSS (Payment Card Industry Data Security Standard): A set of security requirements created by the PCI Security Standards Council (PCI SSC) that applies to any business that stores, processes, or transmits cardholder data. In the US, compliance is enforced by your acquiring bank (the bank or payment processor that settles your card transactions). Non-compliance can result in fines, increased transaction fees, or loss of the ability to accept card payments.
Cardholder Data: The full primary account number (PAN) printed on a card, along with the cardholder name, expiration date, and service code. The CVV/CVV2 security code is considered sensitive authentication data and is subject to even stricter rules; it must never be stored after authorisation.
SAQ (Self-Assessment Questionnaire): An annual self-audit tool published by the PCI SSC. There are multiple SAQ types (A, A-EP, B, B-IP, C, D, and P2PE), and the one that applies to your store depends on how your checkout is configured, specifically, whether cardholder data ever touches your server.
ASV (Approved Scanning Vendor): A company approved by the PCI SSC to perform external vulnerability scans on IP addresses and domains that are in scope for PCI compliance. An ASV scan checks your internet-facing systems for vulnerabilities that could expose cardholder data. For merchants required to complete SAQ A-EP or SAQ D, a passing quarterly ASV scan report is a mandatory compliance deliverable.
Acquiring Bank: Your US payment processor or merchant bank, companies like Chase Merchant Services, Fiserv, Stripe (as a payment facilitator), Square, or your bank's merchant account. They are responsible for enforcing PCI DSS compliance among their merchants. They can also be the entity that fines you if you breach and are found non-compliant.
PCI SSC (PCI Security Standards Council): The body founded by American Express, Discover, JCB, Mastercard, and Visa that writes and maintains the PCI DSS standard. Based in Wakefield, Massachusetts. They publish the official list of approved ASVs.
The fastest path to a first-time pass is running your own Nmap scan 2–3 weeks before your ASV scan date, then remediating everything with a CVSS of 4.0 or above. That window is enough time to patch, reboot, and confirm fixes are in place before the official scan runs.
The PCI DSS does not have a small business exemption. Even if you process five orders a month, your acquiring bank requires you to comply. What changes at lower transaction volumes is that most merchants qualify for the self-assessment track (SAQ) rather than a full third-party audit (QSA assessment), which keeps compliance manageable and low-cost.
The key question is not whether you need to comply; it is which compliance track applies to your specific checkout setup.
The SAQ that applies to your WooCommerce store depends on whether cardholder data is stored on your server. If your gateway fully hosts the payment page, you're SAQ A with no scan required. If card entry happens on your site, even via JavaScript, you're SAQ A-EP and need quarterly ASV scans. Full server-side processing puts you on SAQ D, the most demanding track.
The SAQ type that applies to you depends on one thing: does cardholder data (card numbers, CVVs, and expiration dates) ever pass through or get processed by your WordPress/WooCommerce server?
You qualify for SAQ A if:
Common WooCommerce setups that qualify for SAQ A:
SAQ A is the shortest questionnaire, with 22 requirements, and does not require an ASV scan. This is the most common track for modern WooCommerce stores using a reputable gateway correctly.
Important caveat: Even on SAQ A, your WordPress site must still meet basic security requirements. If your site is compromised at the CMS layer (a malicious script injecting into your checkout page), you could intercept card data before it ever reaches the iframe. The SAQ A rules require you to ensure your site is secured against such attacks.
You qualify for SAQ A-EP if:
Common WooCommerce setups that may fall into SAQ A-EP:
SAQ A-EP has 191 requirements and requires quarterly external vulnerability scans from a PCI SSC-approved ASV. This is where most WooCommerce store owners who have a "card entry on my site" checkout land.
You qualify for SAQ D if:
SAQ D is the most demanding track, with 329 requirements, and also requires quarterly ASV scans. Most modern WooCommerce stores do not fall here unless they have legacy or custom payment integrations.
If you're on SAQ A-EP or SAQ D, you need an external vulnerability scan from a PCI SSC-approved ASV every 90 days, four times per year. SAQ A merchants are exempt. A passing scan means no CVSS 4.0+ vulnerabilities on your internet-facing systems. Miss a quarter and you're out of compliance, even if every other scan passed.
ASV scanning does not apply to SAQ A merchants. If your checkout is fully hosted by your payment processor, you can skip this section. For everyone else, here is what ASV scanning actually involves:
An ASV scan is an external, automated scan of your internet-facing IP addresses and hostnames (your WooCommerce domain and server IP). The scanner looks for:
The scanner does not log into your server. It only tests what is visible from the outside, exactly what an attacker would see.
A passing ASV scan means no CVSS 4.0+ scoring vulnerabilities were found on your external-facing systems. If vulnerabilities are found, you fix them and rescan. The ASV provides a passing attestation that you submit to your acquiring bank as part of your annual compliance package.
Every 90 days, four times per year. Missing a scan window puts you out of compliance, even if you pass all four eventually.
You submit the IP addresses and hostnames of all internet-facing systems in your cardholder data environment. For most WooCommerce stores, this is the following:
To achieve PCI compliance for your WooCommerce store: identify your SAQ type based on your payment integration, complete your SAQ annually, run quarterly ASV scans if you're on SAQ A-EP or SAQ D, remediate any vulnerabilities found, and submit your passing scan report and completed SAQ to your acquiring bank's compliance portal.
Review how your payment gateway is integrated. Log into your WooCommerce dashboard, go to WooCommerce → Settings → Payments, and open your active payment gateway settings. Check whether card entry happens on a hosted page (redirect/iframe) or directly on your site.
If you are unsure, contact your payment gateway’s support and ask: “Is your WooCommerce integration SAQ A or SAQ A-EP eligible?” Most major US gateways will confirm this.
Download the correct SAQ from the PCI SSC website (pcisecuritystandards.org). Work through each requirement. For SAQ A, most requirements are administrative: document your policies, confirm your gateway is PCI-listed, and sign the Attestation of Compliance (AOC).
For SAQ A-EP and SAQ D, the questionnaire is more technical and involves your server configuration, patch management, access controls, and logging practices.
Select a PCI SSC-approved ASV, submit your IP addresses and hostnames, and receive your scan results. If the scan finds vulnerabilities, remediate them, typically by updating WordPress, plugins, PHP, or your server software, and rescan.
A passing scan from an approved ASV is what gets submitted to your acquiring bank as evidence of compliance.
Common vulnerabilities found on WooCommerce servers include:
Most WooCommerce hosts allow you to upgrade PHP through your hosting control panel. WordPress and plugin updates are done from the dashboard. SSL configuration is typically managed at the server or CDN level.
Most US acquiring banks and payment processors have a compliance portal where you upload your completed SAQ and, if required, your ASV passing scan report. Some processors (like Stripe) handle this differently; check your merchant account dashboard for a “PCI Compliance” section.
Secusy offers flat-rate quarterly ASV scanning for WooCommerce stores — one annual fee, four scans, unlimited rescans, and passing reports formatted for US acquiring banks.
Your hosting environment directly affects your ability to pass an ASV scan. Shared hosting is the riskiest option for PCI-scoped stores. Managed WordPress hosts like WP Engine or Kinsta reduce your attack surface but don't take on your compliance liability. Regardless of host, keeping WordPress core, plugins, and themes updated is your responsibility, and the most common reason WooCommerce stores fail their ASV scan.
Your hosting environment is a significant factor in how easily you can pass an ASV scan and maintain PCI compliance.
Shared hosting is generally not recommended for PCI-scoped environments. You share server resources with other sites, and vulnerabilities in a neighbour’s site can affect your scan results or your actual security posture.
Managed WordPress hosting (WP Engine, Kinsta, and Flywheel) often includes server-level hardening, automatic PHP updates, and WAF protection that reduce your PCI attack surface. Some managed hosts explicitly claim to help with PCI compliance, but verify their specific claims in writing, as they do not take on your compliance liability.
VPS and dedicated servers give you full control but require you or your developer to maintain server-level security configuration, which is a meaningful ongoing responsibility.
Regardless of your host, you are responsible for keeping WordPress core, plugins, and themes updated. A vulnerable plugin on a PCI-scoped site is a scan failure waiting to happen.
Not every WooCommerce plugin is in PCI scope, but the wrong ones can quietly expand it. Plugins that modify checkout, capture abandoned cart data, or log POST data can pull your server into cardholder data scope even if your payment gateway is fully hosted. Audit your active plugins annually and remove anything that touches the checkout flow but isn't actively needed.
Not every plugin on your site is in PCI scope, but some plugins can unexpectedly expand your compliance footprint.
Plugins that can increase PCI scope:
Best practice: Audit your active plugin list annually. Remove plugins you are not actively using. Review any plugin that touches the checkout flow or order processing for how it handles data. Check that every plugin is updated to its latest version before your scheduled ASV scan.
PCI DSS v4.0 has been the only active version since March 31, 2024. For WooCommerce stores, the three changes that matter most are: MFA is now mandatory on your WordPress admin and hosting control panel; TLS 1.0 and 1.1 must be disabled at the server level, and checkout pages must have a mechanism to detect unauthorised script changes. If your store hasn't addressed these three, it won't pass a v4.0-aligned assessment.
PCI DSS v4.0 became the only active version as of March 31, 2024. The retirement of PCI DSS v3.2.1 means all assessments and SAQs now use v4.0 requirements.
Key v4.0 changes relevant to WooCommerce merchants:
Multi-factor authentication (MFA) is now required for all access to the cardholder data environment. For WooCommerce, this means MFA on your WordPress admin login and your hosting control panel if they are considered in scope. Plugins like WP 2FA or Google Authenticator for WordPress handle this.
TLS 1.0 and 1.1 must be disabled. If your server still supports these protocol versions, an ASV scan will flag them as vulnerabilities. Your hosting provider or server administrator needs to disable them at the web server level.
E-commerce skimming (Requirements 6.4.3 and 11.6.1): v4.0 added explicit requirements for detecting script tampering on payment pages. This is directly targeted at the type of Magecart-style attacks that compromise checkout pages. WooCommerce merchants must have a mechanism to detect unauthorised script changes on their checkout page.
Customised approach; v4.0 introduced a “customised approach” option for mature security programs, but this is not relevant to most WooCommerce SMBs. Stick with the defined approach.
The most common WooCommerce PCI compliance mistakes are assuming your payment plugin handles everything, misclassifying an SAQ A-EP checkout as SAQ A, scanning once instead of quarterly, ignoring failing scan results instead of treating them as a remediation list, and never uploading completed documentation to your acquiring bank's compliance portal.
Assuming the payment plugin handles all compliance. Stripe, PayPal, and other gateway plugins handle card data security on their end; they do not make your WordPress site compliant. Your server, hosting, and WordPress environment remain in scope.
Using SAQ A when the integration is actually SAQ A-EP. Some store owners (and even some developers) misclassify their checkout as fully hosted when the card entry form is actually served from their WordPress server. If your domain appears in the browser address bar when the customer enters their card number, you are likely SAQ A-EP.
Scanning once and forgetting. ‘Quarterly’ means four times a year. Setting a calendar reminder for January, April, July, and October is a reasonable approach to staying on schedule.
Ignoring the scan results. A failing scan is not the end of the process; it is the beginning of remediation. Treat scan failures as a patching task list, not a reason to panic. Most common failures are resolved by updating the software.
Not checking their processor’s compliance portal. Many US merchants complete their SAQ and assume they are done. Acquiring banks often want you to upload your documentation to their merchant portal to formally record compliance. Check with your processor.
ASV scanning for a typical WooCommerce store costs between $50 and $150 per year on a flat-rate plan, covering all four required quarterly scans plus rescans. Avoid per-scan or per-IP pricing models that add up quickly. For most SMB stores with one or two IPs and one domain, a flat annual fee is the most predictable and cost-effective option.
ASV scanning for a typical WooCommerce store (one or two IPs, one domain) is one of the more affordable line items in a compliance budget.
Flat-rate ASV scan services designed for SMBs typically run between $50 and $150 per year for unlimited quarterly scans on a small number of IPs. This covers all four required quarterly scans, unlimited rescans after remediation, and a passing attestation report you can submit to your acquiring bank.
The pricing model matters. Some ASV vendors charge per-scan or per-IP in ways that add up quickly. For a WooCommerce store, look for a flat annual fee covering four quarterly scans with rescans included.
Secusy offers flat-rate ASV scanning built for US SMBs and SaaS businesses, straightforward pricing, no hidden per-scan fees, and reports formatted for US acquiring bank submission.
WooCommerce PCI compliance is not a checkbox exercise, and it is not something that resolves itself by choosing a reputable payment processor. It is an ongoing programme of technical controls, documentation, and validation; one that the PCI SSC, acquiring banks, and card brands expect you to maintain continuously, not just at the moment you first launch your store.
For US WooCommerce merchants operating in 2026, the combination of PCI DSS v4.0’s expanded requirements and increasing scrutiny of Level 4 merchants from card brands makes this an especially poor time to treat compliance as optional.
The practical path forward is methodical rather than overwhelming. Identify your correct SAQ type based on your actual checkout integration. Implement a quarterly external scanning programme with a PCI SSC-approved ASV. Keep your WordPress and WooCommerce installation patched and your plugin footprint minimal.
Document your security controls, because undocumented controls are effectively non-existent in the context of a compliance review. These steps do not require an enterprise security budget; they require clarity about what your obligations are and a partner equipped to help you meet them efficiently.
Secusy handles your quarterly ASV scans so you can focus on running your store. Flat-rate pricing, no hidden fees, and reports your acquiring bank will accept.
WooCommerce PCI compliance is the responsibility of the individual merchant operating the store, not of WooCommerce, WordPress, or any payment processor integrated into the checkout flow. The correct SAQ type, compliance level, and specific requirements, including whether quarterly external ASV scanning is mandatory; depend on the merchant's transaction volume and checkout integration architecture. Most WooCommerce merchants in the US fall into SAQ A-EP, SAQ C, or SAQ D categories, all of which require quarterly external vulnerability scans conducted by a PCI SSC-approved ASV to maintain valid compliance status.
No. WooCommerce is a shopping cart plugin, it does not make your store PCI compliant. Compliance is about your entire environment: your server, hosting, payment integration, WordPress configuration, and operational practices. WooCommerce does not take on PCI liability on your behalf.
It depends on which Stripe integration you use. If you use Stripe's hosted checkout (redirect to Stripe's page) or Stripe Elements with the iframe implementation, you likely qualify for SAQ A, and SAQ A does not require an ASV scan. If card entry happens on a page served by your WordPress server, you may be SAQ A-EP and would need quarterly ASV scans. Confirm with Stripe's support team which SAQ their integration qualifies for.
Yes. There is no volume threshold below which PCI DSS stops applying. What changes at lower volumes is that you qualify for Level 4 merchant status, which uses the self-assessment (SAQ) track rather than a full audit. This is simpler and cheaper, but compliance is still required.
Your acquiring bank can fine you, increase your per-transaction rates, or terminate your merchant account. Visa and Mastercard can also impose fines on your acquiring bank, which gets passed to you. In the US, you may also face liability under state data breach notification laws if cardholder data is exposed. Non-compliance does not cause the breach, but it significantly increases your financial exposure if a breach occurs.
The PCI SSC maintains a public list of all approved ASVs at pcisecuritystandards.org/assessors_and_solutions/approved_scanning_vendors. Only scans performed by vendors on this list are accepted for PCI compliance purposes.
Some managed WordPress hosts offer PCI-friendly environments with hardened server configurations, WAFs, and up-to-date software. This reduces your compliance burden but does not eliminate it. You are always responsible for completing your SAQ, updating WordPress and plugins, and (if required) managing your ASV scans. Your host cannot complete your SAQ or submit scan attestations to your acquiring bank on your behalf.
An ASV scan is an automated external vulnerability scan performed quarterly. It identifies known vulnerabilities in your internet-facing systems. A penetration test (pen test) is a more in-depth, manual or semi-manual assessment where a security professional actively attempts to exploit vulnerabilities. PCI DSS v4.0 requires annual penetration testing for merchants who manage their own segmentation controls, but most small WooCommerce merchants do not reach that threshold. ASV scans are the primary quarterly requirement for Level 3 and Level 4 merchants.
Most external ASV scans complete within one to two hours for a typical WooCommerce store with one or two IP addresses. You submit your IPs and domain, the scan runs automatically, and you receive your results report by email. If vulnerabilities are found, you remediate and request a rescan, rescans typically run just as fast.
No, you only need to run the scan on your quarterly schedule. However, if you make a significant infrastructure change (moving hosts, changing your server IP, adding new subdomains to your checkout flow), you should update your scan targets and consider running an out-of-cycle scan to confirm nothing was introduced.
A passing ASV scan report is a formal document (PDF) that includes your scanned IP addresses and hostnames, the scan date, a summary of findings (none at CVSS 4.0 or above for a passing report), and an attestation signed by your ASV confirming that your external environment passed the scan. This document is what you submit to your acquiring bank as evidence of quarterly compliance.
Binoy Koonammavu, is the Founder and CEO of Secusy ASV, where he helps SMBs and fintech companies meet PCI DSS scanning requirements without the complexity of enterprise-grade tools. His writing focuses on making ASV compliance straightforward for growing businesses.