SecurityUpdated Feb 2026
PCI DSS Compliance Hosting: Accept Payments Safely Online
If your website accepts credit card payments, PCI DSS compliance isn't optional; it's required by every major card brand. But PCI compliance is confusing: 12 requirements, 4 merchant levels, 9 SAQ types, and a shared responsibility model between you and your hosting provider. This guide cuts through the complexity with clear hosting recommendations, cost breakdowns, and a step-by-step path to compliance.
Mallory Keegan
Web hosting enthusiast who tests providers and breaks down features, pricing, and real world speed
Quick Verdict
🏆 Liquid Web
Best PCI Certified (9.4/10)
PCI DSS Level 1 certified with AOC. Managed dedicated servers, built-in firewall/IDS, automatic patching. Gold standard for PCI hosting.
☁️ AWS
Best Cloud PCI (9.2/10)
70+ PCI-scoped services. Most comprehensive cloud compliance, but requires deep AWS expertise. Shared responsibility model.
💰 SiteGround
Best Budget PCI-Ready (8.3/10)
Not PCI-certified, but PCI-ready with SSL, WAF, and hardening. Perfect for small stores using Stripe Checkout / PayPal (SAQ A).
What Is PCI DSS?
PCI DSS (Payment Card Industry Data Security Standard) is a set of security requirements created by Visa, Mastercard, American Express, Discover, and JCB to protect cardholder data. Any business that stores, processes, or transmits credit card information must comply, regardless of size.
| Aspect | Details |
|---|---|
| Current version | PCI DSS v4.0.1 (mandatory since March 2025) |
| Who must comply | Any entity that stores, processes, or transmits cardholder data |
| Enforced by | Card brands (Visa, Mastercard, Amex, Discover, JCB) via acquiring banks |
| Requirements | 12 core requirements organized into 6 control objectives |
| Validation | Self-Assessment Questionnaire (SAQ) or on-site QSA audit, depending on merchant level |
| Penalties | $5,000–100,000/month for non-compliance; liability for breach costs |
| Applies to | Merchants AND service providers (including hosting providers) |
| Key change in v4.0 | MFA for all CDE access, WAF required for public web apps, TLS 1.2+ minimum |
PCI Compliance Levels Explained
| Level | Annual Transactions | Validation Required | Typical Cost | Examples |
|---|---|---|---|---|
| Level 1 | 6M+ (any channel) OR any merchant that had a breach | Annual QSA on-site audit + quarterly ASV scans | $50,000–200,000+/yr | Amazon, Walmart, major retailers |
| Level 2 | 1M–6M transactions | Annual SAQ + quarterly ASV scans | $10,000–50,000/yr | Mid-size e-commerce, regional chains |
| Level 3 | 20K–1M e-commerce transactions | Annual SAQ + quarterly ASV scans | $1,000–10,000/yr | Growing online stores |
| Level 4 | <20K e-commerce OR <1M other channels | Annual SAQ (ASV scans recommended) | $0–1,000/yr | Small businesses, startups, local shops |
The 12 PCI DSS Requirements
| # | Requirement | Hosting Provider Role | Your Role |
|---|---|---|---|
| 1 | Install and maintain network security controls (firewalls) | Server-level firewall configuration, network segmentation | Application-level firewall rules, WAF configuration |
| 2 | Apply secure configurations to all system components | Hardened OS, default password removal, secure services | Application hardening, CMS security, plugin management |
| 3 | Protect stored account data | Encrypted storage (disk encryption, key management) | Never store card data; use tokenization (Stripe tokens) |
| 4 | Protect cardholder data in transit with strong cryptography | TLS 1.2+ on servers, valid SSL certificates | Enforce HTTPS sitewide, HSTS headers, secure API calls |
| 5 | Protect all systems against malware | Server-level antivirus, malware scanning | Application-level scanning, plugin security, file integrity |
| 6 | Develop and maintain secure systems and software | OS/server patching within 30 days of critical patches | Application patching, secure coding, dependency updates |
| 7 | Restrict access by business need-to-know | Role-based server access, SSH key management | Application-level access controls, admin user management |
| 8 | Identify users and authenticate access | MFA for server access, unique admin accounts | MFA for CMS/admin, unique user accounts, password policies |
| 9 | Restrict physical access to cardholder data | Data center physical security (badges, CCTV, locks) | N/A for most merchants (handled by hosting provider) |
| 10 | Log and monitor all access to system components | Server access logs, network logs, SIEM integration | Application logs, admin activity logging, log review |
| 11 | Test security of systems and networks regularly | ASV vulnerability scans, penetration testing infrastructure | Application-level testing, code reviews, pen testing |
| 12 | Support security with organizational policies | Security policies, incident response, staff training | Your own security policies, employee training, IR plan |
Your Hosting Provider's Role in PCI Compliance
| Hosting Type | Provider Handles | You Handle | PCI Suitability |
|---|---|---|---|
| Shared hosting | Physical security, network, OS basics | Everything application-level; limited server control | ⚠️ SAQ A only (hosted payment pages) |
| VPS (unmanaged) | Physical security, hypervisor, network | OS, firewall, patching, application, monitoring, everything | ⚠️ Possible but high burden on you |
| VPS (managed) | Physical, OS, patching, firewall, monitoring | Application security, access controls, compliance docs | ✅ Good for SAQ A-EP and SAQ C |
| Dedicated (managed) | Physical, OS, network, patching, firewall, IDS, logs | Application layer, WAF config, compliance documentation | ✅ Recommended for SAQ C and D |
| PCI-certified dedicated | All infrastructure + AOC documentation + audit support | Application security + your portion of SAQ/audit | ✅✅ Best for all SAQ types |
| Cloud (AWS/Azure/GCP) | Physical, hypervisor, managed services security | EVERYTHING else (OS, network config, IAM, encryption, logging) | ✅ With expertise, shared responsibility |
Top PCI-Compliant Hosting Providers
#1
Liquid Web
Best Overall PCI Hosting9.4/10Price: From $199/mo (Dedicated)
Compliance: PCI DSS Level 1 Certified (AOC available)
Best for: E-commerce businesses needing full PCI-compliant infrastructure with managed support
Pros
PCI DSS Level 1 certified, AOC provided on request
Managed dedicated servers with root access
Built-in firewall, IDS/IPS, and log monitoring
Automatic security patching
100% uptime SLA
24/7 Heroic Support with <59s response time
Cons
Premium pricing ($199+/mo for PCI-ready)
No shared hosting options
Setup requires security questionnaire
Verdict: The gold standard for PCI-compliant hosting. Liquid Web provides AOC documentation, handles server-level compliance requirements, and offers managed security, letting you focus on your application layer.
#2
AWS (Amazon Web Services)
Best Cloud PCI9.2/10Price: Pay-as-you-go
Compliance: PCI DSS Level 1 Service Provider
Best for: Enterprises and SaaS platforms needing scalable PCI-compliant cloud infrastructure
Pros
70+ services in PCI DSS scope (EC2, RDS, S3, Lambda, etc.)
AWS Artifact provides compliance reports and AOC
GuardDuty, WAF, Shield, CloudTrail for security
Encryption at rest and in transit by default (most services)
Multi-region redundancy
SOC 2, HIPAA, ISO 27001 also covered
Cons
PCI compliance is YOUR responsibility on top of AWS's
Complex, requires deep AWS security knowledge
Costs can spiral without careful architecture
Shared responsibility model requires thorough understanding
Verdict: AWS provides the most comprehensive PCI-compliant cloud infrastructure, but compliance is shared, AWS secures the cloud, you secure everything IN the cloud. Best for teams with DevOps/security expertise.
#3
Rackspace Technology
Best Managed PCI8.9/10Price: Custom pricing
Compliance: PCI DSS Level 1 Certified
Best for: Mid-market businesses wanting managed PCI compliance without in-house security teams
Pros
PCI DSS Level 1 certified infrastructure
Managed security services (SIEM, IDS/IPS, log management)
Compliance assistance and audit preparation
Multi-cloud support (AWS, Azure, GCP, private cloud)
24/7/365 security operations center (SOC)
Vulnerability scanning and penetration testing available
Cons
Custom pricing, not transparent
Can be expensive for small businesses
Contract-based (less flexibility)
Verdict: Best choice for businesses that need hands-on compliance management. Rackspace's security team handles much of the PCI burden, making it ideal for companies without dedicated security staff.
#4
SiteGround
Best Budget PCI-Ready8.3/10Price: From $2.99/mo (shared) / $100/mo (cloud)
Compliance: PCI-ready environment (not certified; you handle SAQ)
Best for: Small e-commerce sites using Stripe/PayPal (SAQ A) wanting affordable PCI-ready hosting
Pros
Free SSL certificates (Let's Encrypt + Wildcard)
WAF with custom rules (AI-powered)
Daily backups with restore
Server-level security hardening
PHP version management
Affordable entry pricing
Cons
Not PCI DSS certified, no AOC provided
Shared hosting has inherent isolation limitations
You're responsible for all SAQ requirements
Limited compliance documentation
Verdict: Best affordable option for small stores using hosted payment pages (Stripe Checkout, PayPal). SiteGround provides the infrastructure security, but you handle all PCI self-assessment. Works for SAQ A merchants.
#5
Nexcess (by Liquid Web)
Best for WooCommerce PCI8.7/10Price: From $21/mo (managed WooCommerce)
Compliance: PCI-ready managed WordPress/WooCommerce hosting
Best for: WooCommerce stores needing managed hosting with PCI-ready infrastructure
Pros
Purpose-built for WooCommerce
Auto-scaling during traffic spikes
Plugin performance monitoring
Built-in CDN and image compression
Automatic plugin/theme updates with visual regression testing
Staging environments
Cons
Not PCI DSS certified itself (inherits from Liquid Web infrastructure)
WooCommerce/WordPress focused
PCI compliance still requires merchant effort (SAQ)
Verdict: Best managed WooCommerce hosting for PCI-conscious merchants. Built on Liquid Web infrastructure with auto-scaling and performance monitoring. Use with Stripe/PayPal for SAQ A simplicity.
Provider Comparison Table
| Feature | Liquid Web | AWS | Rackspace | SiteGround | Nexcess |
|---|---|---|---|---|---|
| PCI certified (AOC) | ✅ Level 1 | ✅ Level 1 | ✅ Level 1 | ❌ PCI-ready | ⚠️ Inherits LW |
| Starting price | $199/mo | Pay-as-you-go | Custom | $2.99/mo | $21/mo |
| Managed firewall | ✅ | ✅ (Security Groups + WAF) | ✅ | ✅ (WAF) | ✅ |
| IDS/IPS | ✅ Built-in | ✅ GuardDuty | ✅ Managed | ⚠️ Basic | ⚠️ Basic |
| Log management | ✅ Managed | ✅ CloudTrail + CloudWatch | ✅ SIEM | ⚠️ Limited | ⚠️ Limited |
| MFA support | ✅ | ✅ IAM MFA | ✅ | ✅ | ✅ |
| Auto patching | ✅ | ✅ Systems Manager | ✅ | ✅ | ✅ |
| Vulnerability scanning | ✅ | ✅ Inspector | ✅ | ⚠️ Limited | ⚠️ Limited |
| Encryption at rest | ✅ AES-256 | ✅ KMS | ✅ | ✅ | ✅ |
| Compliance documentation | ✅ AOC on request | ✅ AWS Artifact | ✅ AOC on request | ❌ | ❌ |
| Best SAQ type | SAQ A: D (all) | SAQ A: D (all) | SAQ A: D (all) | SAQ A only | SAQ A / A-EP |
Payment Gateway Integration
| Integration Method | How It Works | SAQ Type | PCI Burden |
|---|---|---|---|
| Hosted payment page (redirect) | Customer redirected to Stripe Checkout / PayPal page, card data never touches your server | SAQ A (22 requirements) | 🟢 Minimal, easiest path to compliance |
| Embedded iframes (Stripe Elements, PayPal JS SDK) | Payment fields are iframes from the processor; your page never sees card data | SAQ A-EP (139 requirements) | 🟡 Moderate; your page hosts the iframe but doesn't handle data |
| JavaScript tokenization (Braintree, Square) | Client-side JS captures card data, tokenizes before submission, token sent to your server | SAQ A-EP (139 requirements) | 🟡 Moderate, card data passes through browser on your page |
| Direct API integration | Your server collects card data via your form and submits to processor API directly | SAQ D (329 requirements) | 🔴 Maximum; you handle raw card data; full PCI audit scope |
| Point-to-point encryption (P2PE) | Hardware terminal encrypts at swipe, data never in your environment (in-person only) | SAQ P2PE (33 requirements) | 🟢 Minimal, hardware handles encryption |
Recommendation: Use Stripe Checkout (hosted payment page) or Stripe Elements (embedded iframes) for the lowest PCI burden. Card data never touches your server, qualifying you for SAQ A or SAQ A-EP, the simplest compliance paths.
SAQ Types & Which One You Need
| SAQ Type | Requirements | Applies To | Hosting Needed |
|---|---|---|---|
| SAQ A | ~22 | E-commerce using fully hosted payment pages (Stripe Checkout, PayPal redirect) | Any hosting (even shared), minimal requirements |
| SAQ A-EP | ~139 | E-commerce with embedded payment iframes (Stripe Elements, Braintree Drop-in) | VPS or managed hosting with SSL, WAF, patching |
| SAQ B | ~41 | Merchants using only imprint machines or dial-out terminals (no e-commerce) | N/A, no web hosting involved |
| SAQ B-IP | ~82 | Merchants using IP-connected POS terminals (no e-commerce) | Network security for POS, minimal web hosting |
| SAQ C-VT | ~79 | Merchants using web-based virtual terminals (one transaction at a time) | Dedicated workstation + secure hosting for virtual terminal |
| SAQ C | ~160 | Merchants with payment applications connected to the internet | Managed VPS or dedicated with firewall, patching, logging |
| SAQ D (Merchant) | ~329 | All other merchants, including those storing/processing card data directly | PCI-certified dedicated hosting (Liquid Web, AWS, Rackspace) |
| SAQ D (Service Provider) | ~329 | Service providers handling card data on behalf of merchants | PCI-certified infrastructure + annual QSA audit |
PCI Security Hardening Checklist
Infrastructure (Hosting Provider) ✅
TLS 1.2+ enforced on all connections
WAF deployed for all public-facing web apps (v4.0 requirement)
Server firewall configured with deny-all default
Network segmentation isolating payment systems
OS hardened, default accounts disabled, unnecessary services removed
Automatic security patching within 30 days of critical patches
Encrypted storage (AES-256 for any sensitive data at rest)
Intrusion Detection/Prevention System (IDS/IPS) active
Centralized logging with 90-day retention minimum
MFA enforced for all server/admin access (v4.0 requirement)
Application (Your Responsibility) ✅
HTTPS enforced sitewide with HSTS header
Payment integration uses hosted pages or iframes (SAQ A/A-EP)
NEVER store card numbers, CVV, or magnetic stripe data
MFA enabled on CMS admin and all backend access
Strong password policy (12+ characters, complexity requirements)
Admin access limited to named individuals (no shared accounts)
Plugins/dependencies updated within 30 days of security patches
File integrity monitoring on payment-related pages
Annual security awareness training for all staff
Documented incident response plan tested annually
Common PCI Compliance Mistakes
| Mistake | Why It's Dangerous | Fix |
|---|---|---|
| Storing card numbers in your database | Immediately makes you SAQ D (329 requirements) and liable for full breach costs | Use Stripe/PayPal tokens, never store raw card data. Ever. |
| "We use Stripe so we're automatically compliant" | Using Stripe reduces scope but doesn't eliminate it; you still need SAQ A/A-EP | Complete the appropriate SAQ annually and maintain hosting security |
| Running outdated WordPress/plugins | Known vulnerabilities are actively exploited, Magecart attacks target payment pages | Auto-update or patch within 30 days; use file integrity monitoring |
| No WAF on payment pages | PCI DSS v4.0 requires WAF for all public-facing web applications | Deploy Cloudflare WAF, ModSecurity, or host-provided WAF |
| Shared hosting for SAQ C/D merchants | Shared environments lack network segmentation required for card data handling | Upgrade to VPS, dedicated, or PCI-certified hosting |
| No MFA on admin access | PCI v4.0 requires MFA for ALL access to cardholder data environment | Enable MFA on CMS admin, hosting panel, SSH, and payment dashboard |
| Logging disabled or logs not reviewed | Can't detect breaches; violates requirements 10 and 11 | Enable logging, retain 90+ days, review daily (or use SIEM with alerts) |
| No documented incident response plan | Requirement 12 mandates tested IR plan, many merchants skip this | Write IR plan covering detection, containment, notification, and recovery |
| Forgetting annual SAQ submission | Non-compliance fines start immediately; banks may increase processing fees | Calendar reminder for annual SAQ + quarterly ASV scans if applicable |
| Using TLS 1.0 or 1.1 | Prohibited since v3.2.1, immediate non-compliance if still enabled | Disable TLS 1.0/1.1; enforce TLS 1.2+ on all connections |
Cost of Non-Compliance
| Consequence | Cost Range | Details |
|---|---|---|
| Monthly non-compliance fines | $5,000–100,000/month | Assessed by card brands (Visa, Mastercard) through your acquiring bank until compliance achieved |
| Forensic investigation (post-breach) | $50,000–500,000 | PCI Forensic Investigator (PFI) required after breach, paid by you |
| Customer notification | $1–3 per affected customer | Legal requirement in most jurisdictions; includes printing, mailing, call centers |
| Credit monitoring | $10–30 per customer × 12–24 months | Often legally required or offered as goodwill after breach |
| Legal fees and lawsuits | $50,000–5,000,000+ | Class action from affected customers; regulatory fines (GDPR if EU customers) |
| Increased processing rates | 0.5–2% higher per transaction | Banks increase rates for non-compliant or breached merchants |
| Loss of card processing ability | Revenue impact = all card revenue | Card brands can revoke your ability to accept payments, business-ending |
| Brand damage | Incalculable | Customer trust loss; 60% of small businesses close within 6 months of a major breach |
| Mandatory Level 1 audit | $50,000–200,000 | Breached merchants must undergo full QSA audit regardless of previous level |
| Average total breach cost | $4.45 million (IBM 2025) | Includes all direct and indirect costs; small business average: $120,000–200,000 |
Frequently Asked Questions
Do I need PCI compliance if I use Stripe or PayPal?
Yes, but your compliance burden is drastically reduced. When you use hosted payment pages (Stripe Checkout, PayPal buttons), card data never touches your server. This qualifies you for SAQ A, the simplest self-assessment with only ~22 requirements (vs 300+ for SAQ D). You still need: SSL/TLS on your entire site, secure hosting environment, access controls, vulnerability management, and an annual SAQ A submission to your acquiring bank. Using Stripe Elements or PayPal's JavaScript SDK (where card fields are iframes from Stripe/PayPal) also qualifies for SAQ A-EP, slightly more requirements (~139) but still much simpler than handling card data directly.
What's the difference between PCI-compliant and PCI-certified hosting?
PCI-certified: The hosting provider has undergone a formal audit by a Qualified Security Assessor (QSA) and holds an Attestation of Compliance (AOC). They can provide documentation proving their infrastructure meets PCI DSS requirements. Examples: Liquid Web, AWS, Rackspace, Azure. PCI-compliant (or PCI-ready): The hosting provider follows PCI best practices (firewalls, encryption, patching) but hasn't been formally audited. They don't provide an AOC. Examples: SiteGround, Nexcess, most managed WordPress hosts. For most small merchants (SAQ A), PCI-ready hosting is sufficient. For Level 1-2 merchants or those handling card data directly, PCI-certified hosting is required.
How much does PCI compliance cost?
Costs vary dramatically by merchant level: Level 4 (SAQ A, <20K transactions): $0–500/year. SAQ A is free to complete yourself. Some payment processors charge $50–200/year for PCI compliance programs. Level 3-4 (SAQ A-EP or C, 20K–1M transactions): $500–5,000/year including quarterly ASV scans ($100–500/quarter), annual SAQ completion, and potentially PCI-ready hosting upgrades. Level 1-2 (>1M transactions or card data handling): $15,000–100,000+/year including QSA audit ($15,000–50,000), quarterly ASV scans, penetration testing ($5,000–30,000), PCI-certified hosting ($200–2,000/month), and ongoing compliance monitoring. The cost of non-compliance is far higher: $5,000–100,000/month in fines, plus breach costs averaging $4.45 million.
Can I be PCI compliant on shared hosting?
Technically possible for SAQ A merchants (hosted payment pages), but with caveats. Shared hosting risks: other tenants on the same server (potential cross-contamination), limited control over server security configuration, no guarantee of network segmentation, and potential for noisy neighbor attacks. Recommendation: Shared hosting is acceptable ONLY if you use SAQ A (Stripe Checkout/PayPal hosted pages where no card data touches your server). For SAQ A-EP or higher: use VPS, cloud, or dedicated hosting where you control the environment. For SAQ C or D: dedicated or PCI-certified hosting is essentially required.
What happens if I'm not PCI compliant and get breached?
Consequences escalate quickly: Immediate fines: $5,000–100,000/month from card brands (Visa, Mastercard) until compliance is achieved. Breach costs: Average $4.45 million (IBM 2025 report) including forensic investigation ($50,000–500,000), notification costs ($1–3 per affected customer), credit monitoring ($10–30 per customer for 12–24 months), legal fees and potential lawsuits, and brand damage (customer trust loss). Additional penalties: Increased processing fees or loss of ability to accept cards entirely, mandatory Level 1 assessment (full QSA audit) regardless of previous merchant level, and PCI Forensic Investigator (PFI) engagement at your expense. Many small businesses close within 6 months of a significant breach.
How often do I need to validate PCI compliance?
Validation frequency depends on your requirements: Annual: Self-Assessment Questionnaire (SAQ) completion, or QSA on-site audit for Level 1 merchants. Review and update security policies and procedures. Quarterly: Approved Scanning Vendor (ASV) external vulnerability scans (required for SAQ A-EP, C, C-VT, D). Internal vulnerability scans (best practice for all, required for SAQ C and D). Ongoing/continuous: Log monitoring and review (daily for SAQ C-VT and D), access control reviews, security awareness training for staff, firewall rule reviews, and patch management (within 30 days of critical patches). After significant changes: Any major system change, new payment channel, or infrastructure migration requires re-validation.
Does PCI DSS v4.0 change anything for hosting?
PCI DSS v4.0 (mandatory March 2025) introduced several hosting-relevant changes: New requirements: Multi-factor authentication (MFA) required for ALL access to the cardholder data environment (not just remote access). Automated technical controls to detect and prevent phishing. Authenticated internal vulnerability scans. Web application firewalls (WAF) required for all public-facing web apps. Stricter encryption: TLS 1.2 minimum (TLS 1.0/1.1 prohibited). Disk-level encryption alone no longer acceptable for stored card data. Enhanced logging: Automated log review mechanisms required. Detection of security control failures. What this means for hosting: Your host must support MFA, WAF, TLS 1.2+, and enhanced logging. Most PCI-certified hosts have already updated. Verify with your provider that their environment meets v4.0 requirements.
How do I handle PCI compliance with a headless/JAMstack architecture?
Headless/JAMstack architectures can simplify PCI compliance significantly: Frontend (static site on CDN): No server-side processing of card data. Use Stripe Elements or PayPal JS SDK (iframed payment fields). This qualifies for SAQ A or SAQ A-EP. API backend (serverless/edge): Never store, process, or transmit card data through your API. Use payment provider webhooks for order confirmation. Token-based: Stripe/PayPal tokenize card data client-side → your backend only receives tokens, never card numbers. Best practice architecture: Static frontend → Stripe Checkout (hosted page) → webhook to your API → order confirmation. Card data flow: User → Stripe servers (PCI Level 1) → token → your server. Your server never sees a card number. This architecture typically qualifies for SAQ A, the simplest compliance level.
Need PCI-Compliant Hosting?
Compare hosting providers with PCI certification, managed security, and the compliance documentation your business needs to accept payments safely.
Find PCI-Compliant Hosting