PCI compliance hosting: securely processing payments in your webshop

If you accept credit card payments in your webshop, you must comply with PCI DSS (Payment Card Industry Data Security Standard). This security standard protects cardholder data and is mandatory for all businesses that process, store, or transmit card payments. In this article, we explain what PCI compliance means for your hosting choice.

What is PCI DSS compliance?

PCI DSS is a set of security standards designed to ensure that all companies processing credit card information maintain a secure environment. The standard was created by major card brands (Visa, Mastercard, American Express).

The 12 PCI DSS requirements:

1. Install and maintain a firewall
2. Don't use vendor-supplied defaults
3. Protect stored cardholder data
4. Encrypt transmission of cardholder data
5. Use and update anti-virus software
6. Develop secure systems and applications
7. Restrict access to cardholder data
8. Assign unique IDs to users
9. Restrict physical access to data
10. Track and monitor network access
11. Regularly test security systems
12. Maintain information security policy

Compliance levels

Level 1

• Over 6 million transactions/year
• Annual on-site assessment
• Quarterly network scans

Level 2

• 1-6 million transactions/year
• Annual self-assessment
• Quarterly network scans

Level 3

• 20,000-1 million e-commerce transactions
• Annual self-assessment
• Quarterly network scans

Level 4 (most webshops)

• Under 20,000 e-commerce transactions
• Annual self-assessment
• Recommended quarterly scans

How payment providers simplify compliance

The good news: using payment processors like Mollie, Stripe, or PayPal significantly reduces your PCI burden.

Using hosted payment pages

When customers enter card details on the payment provider's page (not your site):

• Card data never touches your server
• Dramatically reduced compliance scope
• Provider handles most requirements
• You qualify for simpler SAQ A

Using embedded forms (iframes)

Card fields embedded but data goes directly to provider:

• Reduced scope (SAQ A-EP)
• Still need security controls
• More complex than hosted pages

Storing card data yourself

Not recommended for most webshops:

• Full PCI compliance required (SAQ D)
• Complex and expensive
• Only for specific use cases

Hosting requirements for PCI compliance

Even with payment providers handling card data, your hosting should meet certain standards:

Essential features:

• SSL/TLS encryption: Mandatory for all pages
• Firewall protection: Block unauthorized access
• Regular updates: Patched server software
• Access logging: Track who accesses what
• Strong passwords: Enforce password policies
• Regular backups: Protected backup storage

Recommended features:

• Web Application Firewall (WAF)
• DDoS protection
• Intrusion detection
• Two-factor authentication
• Security monitoring

Dutch hosting and PCI compliance

Most standard Dutch hosting providers are not PCI certified. However, this matters less when using payment providers properly.

What you need:

• SSL certificate (included with most hosts)
• Keep WordPress/WooCommerce updated
• Use strong passwords
• Reliable backup system
• Basic firewall protection

Suitable providers:

• Any reputable Dutch host with SSL
• Managed hosting offers more security features
• VPS/dedicated for more control

PCI compliance checklist for webshops

Using Mollie/Stripe/PayPal (hosted pages):

• Valid SSL certificate
• Keep CMS updated
• Strong admin passwords
• Regular backups
• Complete SAQ A annually

Using embedded payment forms:

• All above, plus:
• Vulnerability scanning
• More comprehensive SAQ A-EP
• Consider managed hosting

Common misconceptions

"I need special PCI hosting"

Usually not. Using payment providers properly reduces requirements to what standard hosting provides.

"My hosting provider handles compliance"

They provide infrastructure security. You're still responsible for your application layer.

"It's only for big businesses"

Any business accepting cards must comply. Penalties apply regardless of size.

Our recommendation

For most webshops:

1. Use Mollie, Stripe, or similar payment provider
2. Use hosted payment pages (redirect)
3. Keep your site updated and secure
4. Complete annual SAQ A self-assessment
5. Standard quality hosting is sufficient

Only consider specialized PCI hosting if you have specific requirements to store or process card data directly.

---

Find secure webshop hosting.