I take card payments on my website — what is PCI DSS and what do I need to do?
The short answer
PCI DSS is the card industry’s security standard for anyone who accepts card payments. The simplest way to keep it manageable is to never let card numbers touch your own systems: use a hosted checkout or payment form from a provider such as Stripe, Square or PayPal. Websites that do this can usually complete the shortest self-assessment, called SAQ A.
Applies in Worldwide
- Never store CVV codes, full magnetic-stripe data or PINs after a payment is authorised.
- Mask card numbers on screen and make any stored card number unreadable.
- Payment-page scripts: every script on a page that handles payments must be authorised and monitored for changes.
- Hosted checkout: if customers pay on your provider’s own checkout page, or in the provider’s payment form embedded in your page, you’re usually eligible for SAQ A. With an embedded form you must also confirm your site isn’t open to script attacks; your payment provider’s confirmation can count.
Your payment provider or bank decides which self-assessment questionnaire you complete each year. PCI DSS version 4.0.1 is the current standard; its last “future-dated” requirements became mandatory on 31 March 2025.
SlopDox provides compliance assistance only. This is general information to help you prepare — not legal advice, and no guarantee that a law does or doesn’t apply to you. For decisions, speak to a qualified lawyer.
Words used here
- PCI DSS
- The card industry’s security rules for anyone who handles card numbers. Using a hosted checkout (like Stripe Checkout) keeps most of it off your plate.
- Payment gateway
- The company that takes card payments for you and pays the money into your bank account — like Stripe.
Still have a question?
Ask the SlopDox assistant: it answers from this catalog, any time. Or let SlopDox keep track of your websites for you, free for up to 3 websites.