01
Payment-Page Architecture Review
Map redirects, iframes, JavaScript, hosted payment forms and any merchant-controlled elements that can influence the payment transaction.
PCI DSS for Ecommerce
PCI DSS for Ecommerce Is Now About More Than Outsourcing the Payment Form
Even when a payment processor handles the card data, your ecommerce website can still affect payment security. PCI DSS v4.x places specific responsibilities on merchants around website security, SAQ eligibility, scanning and the scripts that can influence the payment page.
2-sec helps ecommerce businesses work out which PCI validation route actually fits their payment implementation, what remains in scope, and what must be secured or evidenced before submission.
Ecommerce Changes the Decision
Your Payment Integration Determines Much of Your PCI DSS Work
For ecommerce merchants, PCI DSS scope and SAQ eligibility depend heavily on how the website interacts with the payment page: full redirection, an embedded provider form, merchant-originated payment-page elements or other browser-side scripts can lead to different validation requirements.
PCI SSC's current guidance distinguishes redirect and embedded-payment implementations and adds specific v4.x obligations around merchant ecommerce webpages. SAQ A merchants, including those that redirect to a third party, can still have ASV scanning responsibilities for the merchant website.
Ecommerce PCI Support
Map the Website Payment Flow Before Choosing the SAQ
The goal is to match the real browser and payment architecture to the correct validation route rather than selecting an SAQ by assumption.
02
SAQ Eligibility Review
Assess likely eligibility for SAQ A, SAQ A-EP or another route and identify where the current implementation does not meet the criteria.
03
Script and Website Security
Review the controls protecting merchant ecommerce pages from script-based attacks that could affect payment security.
04
ASV Scanning Readiness
Identify ecommerce webpages that require external vulnerability scanning and prepare them for Approved Scanning Vendor activity.
05
Third-Party Responsibility Mapping
Clarify what the payment processor or other TPSPs cover and what responsibilities remain with the merchant.
06
Gap and Remediation Support
Close website, configuration, process and evidence gaps before the SAQ or other validation is completed.
Ecommerce Payment Models
Different Implementations Create Different PCI Questions
These are decision patterns, not automatic SAQ assignments. All eligibility criteria and reporting expectations still need to be confirmed.
Redirect to a TPSPThe browser leaves the merchant page for payment, but the merchant website still has PCI responsibilities.
Embedded TPSP IframeThe merchant page embeds the provider's payment form, creating specific SAQ A eligibility and script-security questions.
Merchant-Originated Payment ElementsWhere payment-page elements originate from the merchant website, SAQ A-EP or a broader validation route may apply.
Browser-Side ScriptsJavaScript and other scripts that can affect ecommerce payment security need to be understood and controlled.
Third-Party ScriptsAnalytics, chat, tag managers and other scripts need to be assessed for whether they can impact payment security.
Multiple Payment JourneysCheckout, saved cards, subscriptions and alternative payment flows can create different scope paths.
Website Hosting and CloudHosting, CDN, WAF and cloud administration can affect the security of merchant ecommerce pages.
ASV ScanningSAQ A v4.x includes ASV scanning requirements for merchant ecommerce webpages, including redirect and embedded-iframe models.
How 2-sec Approaches It
A PCI Review Built Around the Ecommerce Checkout
01
Map the Customer Journey
Document exactly what the browser loads, where payment data goes and which party controls each element.
02
Test SAQ Eligibility
Compare the implementation with current PCI SSC eligibility criteria and confirm the reporting expectation.
03
Define Merchant Responsibilities
Separate provider-covered controls from the requirements that remain with the merchant.
04
Assess Website Security
Review scanning, script protection, patching, authentication and other applicable website controls.
05
Remediate and Evidence
Fix gaps and collect the evidence behind the final PCI responses.
06
Complete Validation
Prepare the relevant SAQ, attestation or wider assessment route.
Outsourcing card processing can reduce PCI scope. It does not make the ecommerce website irrelevant to payment security.
Review Your Ecommerce PCI Scope ↗Ecommerce PCI Questions
Frequently Asked Questions About PCI DSS for Ecommerce
If our checkout redirects to a payment processor, do we still have PCI DSS responsibilities?
Yes. PCI SSC confirms that outsourcing payment processing does not remove a merchant's PCI DSS responsibilities. Eligible SAQ A ecommerce merchants also have requirements that apply to their own webpages.
Does SAQ A require ASV scanning now?
Yes. PCI SSC states that SAQ A for PCI DSS v4.x includes external vulnerability scanning by an Approved Scanning Vendor for merchant ecommerce webpages, including redirect and embedded-iframe implementations.
What is the new SAQ A script eligibility requirement?
For ecommerce merchants using an embedded TPSP payment page or form, current SAQ A eligibility includes confirming that the merchant webpage is not susceptible to attacks from scripts that could affect the ecommerce system.
What is the difference between SAQ A and SAQ A-EP for ecommerce?
Broadly, SAQ A requires all payment-page elements to originate only from compliant service providers, while SAQ A-EP can apply where payment-page elements originate from the merchant website or compliant service providers, provided all other eligibility criteria are met.
Can 2-sec help us redesign checkout to reduce PCI scope?
Yes. 2-sec can review the current payment architecture and advise on defensible scope-reduction options, including outsourcing and segmentation where appropriate.
Continue Your PCI DSS Journey
Related PCI DSS Services
PCI DSS SAQ SupportConfirm the right questionnaire and evidence route, whether that is an SAQ, a targeted assessment or a wider validation path.PCI DSS Scope ReductionReduce unnecessary payment-data exposure by reviewing the checkout architecture, segmentation and what genuinely needs to stay in scope.PCI DSS Gap AnalysisFind website, configuration and process gaps before validation, with a clear remediation plan for closing each one.