PCI Compliant Magento Hosting? How We Help You Meet PCI DSS
No hosting company can make a Magento store compliant with PCI DSS on its own. Compliance belongs to the merchant, who confirms it with their own assessment or Self-Assessment Questionnaire (SAQ). What a host can do is run the server side well, so that it helps you meet PCI DSS. This page sets out what the standard asks of your host and of you, why most Magento stores use a hosted payment form, what EveryHost provides on the server, and what stays with you.
Card details go to your payment provider, not your server.
What PCI DSS asks of your host, and what it asks of you
PCI DSS is the card industry's security standard, and it applies to any business that takes card payments. Responsibility is shared, but it does not move. Even on Adobe's own cloud, Adobe says "Merchants are responsible for the compliance of their custom code, system and network processes, and organization".
In practice, the split for a hosted Magento store looks like this:
| Area | Your host | You, the merchant |
|---|---|---|
| Server hardware, network and data centre | Yes | |
| Operating system and server stack security updates | Yes | |
| Server firewall and security monitoring | Yes | |
| Magento application and extension patches | On Fully Managed, Magento security patches | Extensions, theme and custom code, with your developer |
| Payment integration and payment-page scripts | Yes | |
| Admin users, passwords and two-factor authentication | Yes | |
| Your PCI DSS assessment or SAQ | Answers about the server side | Yes |
Confirm your own scope with your payment provider or acquirer. They are the ones who tell you which questionnaire applies to your store.
Why most Magento stores use a hosted payment form
Most Magento stores never handle raw card numbers on their own server. The card details are entered on a page or form run by the payment provider, through a redirect, a hosted payment page or an embedded form. That keeps card data off your server and reduces what you are responsible for.
It does not remove your duties. Under PCI DSS v4.0.1, a merchant whose checkout embeds the payment provider's form must confirm that their site "is not susceptible to attacks from scripts that could affect the merchant's e-commerce system(s)". The PCI Security Standards Council gives two routes: use techniques such as those in Requirements 6.4.3 and 11.6.1, or get confirmation from your PCI DSS-compliant payment provider. That particular criterion does not apply to checkouts that redirect to the payment provider.
Redirect checkouts are not outside the risk, though. Card skimmers on Magento have shown a fake card form before the redirect, so the checkout still needs watching. For bots testing stolen cards at your checkout, see our guide to stopping card testing on Magento 2.
What we provide on the server
Every EveryHost plan runs your store on its own server, with the server side looked after by our UK engineers:
- Isolated servers, never shared hosting. A Managed VPS with dedicated CPU and RAM from £119 a month + VAT, or a dedicated server from £249 a month + VAT.
- A server firewall and Sentinel. Sentinel, our Magento-tuned security monitoring, reads your server's logs, blocks abusive sources at the server firewall, and our engineers review the blocks. Managed VPS plans include Sentinel Plus, and dedicated and high availability plans include Sentinel Pro.
- A patched stack, matched to your Magento version. Operating system and server stack security updates are applied on every plan.
- Free SSL certificates that renew automatically for every store domain.
- A staging environment, so changes are tested before they reach the live store.
- Our London data centre, so your store is hosted in the UK.
Our management plans add more. Managed (£85 a month + VAT) adds server-side fixes for findings from your ASV scans and help with false positives. Fully Managed (£169 a month + VAT) adds Magento security patching, staging first, then coordinated to production, and Bastion off-site backup up to 50 GB.
What stays with you
These parts of PCI DSS stay with the merchant, whoever hosts the store:
- completing your assessment or SAQ, and keeping it current with your acquirer;
- choosing your payment integration, and managing the scripts that run on your payment pages;
- arranging any vulnerability scans your SAQ requires, such as external scans by an Approved Scanning Vendor (ASV);
- extension, theme and custom code updates, with your developer or agency, and Magento application patches unless you are on Fully Managed;
- admin accounts, strong passwords and two-factor authentication for everyone with access to the store.
Do you need a web application firewall?
Sentinel is not a web application firewall (WAF), a CDN or a proxy, and EveryHost does not provide or manage one. If you want a WAF, we recommend putting Cloudflare in front of your store, on your own Cloudflare account. Sentinel keeps working on the server alongside it.
For the wider picture, see our Magento security page, and for patching, Magento upgrades and security patching.
Frequently asked questions
Talk to us about your store
Tell us how your checkout takes payments, and we will explain what we cover on the server and what stays with you.