PCI DSS for small online stores: what the checkout script rules mean for you

If you take card payments on your website, the card industry’s security standard, PCI DSS, applies to you. Most small store owners meet it by filling out a short yearly questionnaire their payment processor asks for, and rarely think about it again. Two rules that took full effect on March 31, 2025 changed that a little, because they’re about the scripts that load on your payment page, and scripts are exactly what card skimmers use.

This is general information from a web team, not compliance advice. Your payment processor or acquiring bank decides which questionnaire you file and what it requires.

Does PCI DSS apply to my small online store?

Yes, if you accept card payments. Most small online stores qualify for the shortest self-assessment questionnaire, called SAQ A, because their payment processor handles the card data. Your processor or acquiring bank tells you which questionnaire applies, and it depends mainly on how your checkout collects card details.

What changed in 2025?

Version 4 of PCI DSS added two requirements aimed at web skimming, the attack where criminals slip code onto a checkout page to copy what customers type:

• Requirement 6.4.3: keep an inventory of every script on your payment page, authorize each one, and check that it hasn’t been altered.
• Requirement 11.6.1: have a way to detect unauthorized changes to the payment page and its security settings.

Both became mandatory on March 31, 2025. Just before that, in January 2025, the PCI Security Standards Council revised SAQ A for small merchants. It took those two requirements out of SAQ A and added an eligibility condition instead: the merchant has to confirm its site isn’t susceptible to attacks from scripts that could affect its e-commerce systems.

In plain terms, small stores don’t have to run a full script-monitoring program to file SAQ A, but they do have to be able to say their checkout is protected from malicious scripts.

Redirect or embedded form: which do you have?

How you meet that condition depends on how your card form works. There are three common setups:

• Redirect. The shopper leaves your site for the processor’s own payment page, then comes back. The PCI Council’s FAQ 1588 says the new script condition doesn’t apply to this setup.
• Embedded form. The card fields appear on your page, but they’re served by the processor inside a frame. Stripe’s Payment Element and Braintree’s Hosted Fields work this way. This is the setup the condition applies to.
• Your own form. Your site’s code collects card details and passes them along. That usually moves you to a longer questionnaire, SAQ A-EP, with more requirements.

For the embedded setup, FAQ 1588 gives two ways to meet the condition. You can protect the page with techniques like those in requirements 6.4.3 and 11.6.1, yourself or through a vendor. Or you can get confirmation from your PCI-compliant processor that its embedded form protects against script attacks when you set it up according to its instructions.

What if I’m on Shopify?

Shopify is certified PCI DSS Level 1, and that certification covers stores on its platform. In February 2025, Shopify told its partners that its checkout provides compliance with PCI DSS version 4, with no extra work required, because it locks down which scripts can run there.

That covers the checkout. It doesn’t cover the rest of your store. This October, hijacked third-party apps sent some shoppers from Shopify storefronts to fake checkout pages before they ever reached Shopify’s real one. Keeping your apps, staff accounts and scripts tidy is still your job. Our Shopify security checklist covers it.

What if I’m on WooCommerce?

It depends on your payment plugin. Check its documentation for whether it redirects shoppers, embeds the processor’s hosted fields, or builds its own card form, then confirm with the processor which questionnaire that means for you. If your gateway offers a hosted or embedded option, it’s usually the simpler path. Our WooCommerce checklist covers the rest of the store.

Do I still need security scans?

Probably. The Council’s FAQ 1604, from June 2026, says SAQ A includes external vulnerability scans of your e-commerce pages by an Approved Scanning Vendor, whether you redirect or embed. The standard calls for those scans at least once every three months. Many processors arrange them or point you to one.

Questions to ask your payment processor

Send these in writing and keep the answers with your PCI records:

1. Which self-assessment questionnaire should my store file?
2. Is my checkout a redirect, an embedded form or a direct form, based on how I’ve set it up?
3. If it’s embedded, will you confirm in writing that your form protects against script attacks when set up per your instructions?
4. Do you provide or require quarterly external scans, and with which vendor?
5. What do you need from me if I ever suspect a skimming attack?

Why this matters beyond the paperwork

Skimming attacks hit small stores precisely because nobody’s watching their checkout. Florida’s data breach law also generally requires notice to affected people within 30 days when card numbers and their security codes are exposed, so a skimmer is a legal problem as well as a fraud problem. Plenty of Tampa Bay businesses added online ordering or gift card sales in the last few years without anyone looking at the checkout since. That’s the gap worth closing.

Want help with your checkout?

Our website security audit inventories every script on your checkout, identifies how your card form is set up, and gives you the questions and documentation to settle it with your processor. It isn’t a PCI certification, and we’ll say so. It’s the technical groundwork that makes your questionnaire honest.

Common questions

Who enforces PCI DSS? The card brands, through your acquiring bank or payment processor. It isn’t a federal law, but your processing agreement almost always requires it.

What happens if I ignore it? Usually nothing, until there’s a breach. Then fines, higher fees or losing the ability to take cards can follow, on top of the cost of the breach.

Is PayPal or Stripe responsible for my compliance? They’re responsible for their part. How your site collects and hands off card details is still yours to set up correctly.