PCI Compliance
PCI compliance means meeting security standards for handling payment card data (cardholder data). These standards are set by the Payment Card Industry Security Standards Council. Compliance is mandatory for any entity that stores, processes, or transmits cardholder data.
If you run an online store that accepts card payments, your site and infrastructure are within PCI scope unless all card processing is fully outsourced to a PCI DSS-compliant provider.
Using third-party processors like Stripe via CMS plugins (e.g. WordPress/WooCommerce) can prevent card data from touching your server, drastically reducing your PCI scope. However, PCI compliance is still required — just at a lower validation level. Other regulations like GDPR apply independently and cover broader privacy concerns beyond payment security.
Our Emerald, Sapphire, Diamond and Tanzanite plans are PCI DSS scan compliant - the servers are regularly scanned by an Approved Scanning Vendor, so the hosting environment itself meets the infrastructure-level requirements. This article is written against PCI DSS v4.0.1, the current version of the standard.
However, you are still responsible for compliance at the application/site level. Depending on how you take payments, that can involve quarterly scans by an Approved Scanning Vendor (ASV). These scans may report issues such as Common Vulnerabilities and Exposures (CVEs), including false positives due to limited scanner visibility into server configurations.
To pass a PCI scan, you must review results, fix real vulnerabilities, and dispute false positives with supporting evidence submitted to your scanning provider.
We’ve compiled a list of frequently asked questions to help you find quick answers. If you don’t see what you’re looking for, reach out directly.
What’s different between regular servers and PCI-compliant servers?
FTP (File Transfers): Regular servers let you connect without encryption. PCI servers require encryption (TLS), so your files are always transferred securely.
Email (Dovecot): Regular servers allow older, less secure connections. PCI servers only allow newer, safer versions (TLS 1.2 or higher) and block outdated or weak settings.
Why has my FTP client stopped working after switching to a PCI-Compliant server?
This is most likely because Plaintext logins have been disabled. Plaintext FTP transmits usernames and passwords without encryption, violating PCI DSS requirements. To remain compliant, support for unencrypted FTP is disabled.
Use FTPS (FTP over TLS) or SFTP (SSH File Transfer Protocol) to connect securely. Most modern FTP clients support both—just update your connection settings.
Why is PCI compliance important?
It’s a mandatory requirement for any business that stores, processes, or transmits credit/debit card information. Non-compliance can result in fines, data breaches, and loss of ability to process payments.
Does moving to a PCI-compliant server make my website PCI compliant?
No. Server compliance reduces your scope, but your site/application must still meet PCI requirements, such as secure coding, regular vulnerability scans, and access controls.
Do I still need to run PCI scans on my website?
That depends on how your site takes payments, and it is not something hosting alone settles. Being on a scan-compliant server never covers your own site or application.
Which requirements apply to you - including whether you need quarterly ASV scans - is determined by the Self-Assessment Questionnaire your business validates under. A shop that hands payment off entirely to a provider like Stripe is assessed differently from one that handles card details on its own pages. Your acquirer or payment provider decides which applies to you, so ask them rather than assuming either way.
How do I dispute a false positive in a PCI scan?
Gather supporting evidence (e.g. config files, headers, software versions), submit it to your ASV, and await their validation or request for further details.
For help with this, refer to our PCI Compliance Scans - False Positives.
