If your online store takes cards through Stripe, PayPal or WooPayments, PCI compliance is far lighter than most owners fear. Usually it means answering a short self-assessment questionnaire each year, never storing card numbers yourself and keeping your website secure. This guide explains which questionnaire applies, what changed in 2025, and what to do this week.
Key takeaways
- Anyone who accepts card payments must comply with PCI DSS, including small online stores.
- How your checkout collects card details decides which self-assessment questionnaire (SAQ) you complete.
- With hosted or embedded card fields, most small stores qualify for SAQ A, the shortest form.
- Since 2025, stores with embedded card fields must confirm their site is protected against script attacks.
- Your payment provider’s dashboard is usually where you complete and file the questionnaire.
What is PCI DSS, and does it apply to a small business?
PCI DSS (the Payment Card Industry Data Security Standard) is a set of security rules for anyone who stores, processes or sends card data. It’s run by the PCI Security Standards Council, which the major card brands set up. It’s an industry standard rather than an Australian law, and it reaches you through your agreement with your payment provider.
Size doesn’t exempt you. Stripe’s guidance is plain: compliance is shared between Stripe and your business, and a business accepting payments must attest to its compliance each year (Stripe). The good news is that the work scales with how much card data you touch.
Which self-assessment questionnaire do I need?
Small merchants usually prove compliance with a self-assessment questionnaire, or SAQ. There are several versions, and the right one depends on how your checkout collects card details.
- SAQ A: card details are entered on the provider’s own page, or in their fields embedded in your checkout. Stripe says Checkout and Elements qualify, because the card inputs sit in a frame served from Stripe’s domain, not yours (Stripe PCI guide).
- SAQ A-EP: your own web page builds the card form, then passes the details to the provider.
- SAQ D: card numbers pass through your server. Stripe notes this can mean meeting more than 300 security controls, plus external audits.
WooCommerce itself isn’t PCI certified, because the core plugin doesn’t handle card data. With a hosted-field gateway such as Stripe, PayPal or WooPayments, WooCommerce says your compliance scope “may be significantly reduced” (WooCommerce).
What changed for SAQ A in 2025?
In January 2025, the PCI Security Standards Council revised SAQ A. It removed two technical requirements about payment page scripts, but added an eligibility condition. Merchants must now confirm their site is not susceptible to attacks from scripts that could affect their e-commerce systems. The revised form took effect on 31 March 2025 (PCI SSC).
A follow-up FAQ explains that this applies when the provider’s payment form is embedded in your page, for example in an iframe. It doesn’t apply if you redirect customers to the provider’s page. You can meet it by protecting the payment page against malicious scripts yourself, or by getting written confirmation from your PCI-compliant payment provider that its solution includes those protections (PCI SSC FAQ).
Why the fuss? Card skimmers inject fake forms or code into checkout pages. Our guide to ecommerce website security explains how they get in and how to keep them out.
What do I actually need to do?
- Find out how your checkout collects cards. Note your gateway plugin and whether customers stay on your site or are sent to the provider’s page. Your developer can confirm.
- Open your payment provider’s compliance section. Stripe, for example, lists your documentation requirements in the Dashboard and offers pre-filled questionnaires for smaller businesses.
- Complete the questionnaire every year. Answer honestly. Revalidate if you change how you take payments.
- Never store card numbers. Don’t accept card details by email, and don’t write them down. Stripe says the card type, last four digits and expiry date are out of scope and safe to keep.
- Keep the site itself secure. Update plugins promptly, turn on two-factor login for admins and remove unused accounts.
- Keep scripts on the checkout to a minimum. Stripe warns that JavaScript from other sites makes your security depend on theirs. Fewer scripts also help your WooCommerce checkout speed.
- Run vulnerability scans if asked. Your provider may require regular scans by an approved scanning vendor.
Payment pages must also use HTTPS with TLS 1.2 or above, and every script, stylesheet and image should load over HTTPS too (Stripe security guide). Free SSL from your host covers this.
Where does my hosting fit in?
Your host doesn’t fill in your questionnaire, but it shapes how easy the answers are. WooCommerce notes that many PCI requirements cover the wider environment, including the host, plugins and admin access, and suggests asking your host about firewalls and malware protection. Good WooCommerce hosting provides those as standard, along with current PHP versions and isolation between accounts.
Capacity matters too. A checkout that stalls when WooCommerce is slow during a sale tempts owners to bolt on quick fixes, and that’s when security slips. Our guide to WooCommerce hosting in Australia covers what a store needs that a brochure site doesn’t.
What about phone and email orders?
Taking card details by phone and typing them into your provider’s dashboard counts as a separate kind of card handling. Stripe says manual entry is for exceptional circumstances only, and it uses its own questionnaire (SAQ C-VT). Never ask customers to email card numbers, and never keep them on paper or in a spreadsheet. Send a payment link instead.
What happens if I get it wrong?
Stripe warns of significant penalties, fines and costs for businesses that don’t meet the standards. A card breach also hurts customers directly and can cost you your payment account. If your business is covered by the Privacy Act’s Notifiable Data Breaches scheme, a breach likely to cause serious harm must be reported (OAIC).
Most of the protection is routine: updates, strong logins and malware scans. If you’d rather not handle that yourself, WooCommerce maintenance covers it, including checkout and payment checks after updates. And if you’re comparing providers, our hosting plans run in Australian data centres with free SSL on every plan.
Frequently asked questions
Is PCI compliance mandatory for small businesses in Australia?
If you accept card payments, yes. PCI DSS is an industry standard, not a law, but your payment provider’s terms require it. For most small online stores using hosted card fields, compliance means a short yearly self-assessment and keeping the site secure.
Does using Stripe make me PCI compliant?
Not on its own. Stripe is a certified PCI Level 1 service provider, which greatly reduces your work, but you still complete your own yearly attestation. You also need to keep your website secure, because a hacked checkout page can still capture card details.
What is SAQ A?
SAQ A is the shortest PCI self-assessment questionnaire. It’s for merchants who fully outsource card handling to a PCI-compliant provider, through a redirect or embedded card fields. Since March 2025, merchants with embedded fields must also confirm their site is protected against script attacks.
What merchant level is a small online store?
Stripe’s guide describes merchants with fewer than 20,000 online transactions a year as Level 4. In practice, your payment provider tells you which level applies and what you need to submit each year.
Does my web host need to be PCI compliant?
If card data never touches your server, your host isn’t handling card data. But your site’s security still matters for SAQ A, so choose a host with firewalls, malware protection, free SSL and current software, and keep your plugins updated.
Sources
- Integration security guide, Stripe
- A guide to PCI compliance, Stripe
- PCI DSS compliance and WooCommerce, WooCommerce
- Important updates announced for merchants validating to Self-Assessment Questionnaire A, PCI Security Standards Council, 30 January 2025
- FAQ clarifies new SAQ A eligibility criteria for e-commerce merchants, PCI Security Standards Council, 28 February 2025
- Quick reference guide for responding to data breaches, OAIC