After establishing your eCommerce business on WordPress, it is exciting to think of your profits and sales. However, your business can quickly plummet if you accept credit cards without the proper compliance. Given the nature of online stores, you likely use credit card payments in your business. To protect your clients and business, look into PCI DSS compliance. In this definitive post, we dive into the relationship between WordPress eCommerce websites and PCI DSS compliance (ayment Card Industry Security Standards Council) and how you can achieve compliance for smooth business operations.
What is PCI DSS Compliance?
PCI DSS standards, or Payment Card Industry Data Security Standard, are regulations that seek to ensure the security of credit card information, especially in the online world. Even if you only accept payments through Stripe and PayPal accounts, your WordPress e-commerce store should be compliant.
All merchants, regardless of size and transaction, require PCI DSS compliance as long as they accept, process, store, or transmit card data. Think of it as having a seat belt in your car. Even if no one might force you to wear it, the substantial consequences of non-compliance apply.
The Payment Card Industry Security Standards Council (PCI SSC) oversees compliance regulations. This organization comprises five significant credit card companies: Visa, Mastercard, JCB, Discover, and American Express. The council was established on September 7, 2006, to protect card information and improve online payment security. As a result, it is a great way how to achieve PCI DSS for your shop.
PCI DSS Compliance for WordPress eCommerce Sites
Fortunately, since most WordPress stores use third-party electronic payment systems such as PayPal and Stripe, the compliance process is shorter than usual. However, it’s good to be aware of the regulations and how they may apply to you should you expand or switch the nature of your business. As a WordPress e-commerce store operator, completing the Self Assessment Questionnaire (SAQ) is enough how to achieve PCI DSS (Payment Card Industry Data Security Standard).
What Are The Merchant Levels On PCI DSS Compliance?
The PCI DSS standard lists four levels for merchants.
- 1: More than 6 million card transactions per year.
- 2: 1 to 6 million card transactions per year.
- 3: 20,000 to 1 million card transactions per year.
- 4: Less than 20,000 card transactions per year.
While these levels apply to all transactions, American Express, JCB, and Discover have additional requirements. After determining the level of compliance, you can take the SAQ. So, it is a great way how to achieve PCI DSS for your shop.
What Is The PCI DSS SAQ?
The SAQ is a validation document that helps you, as a merchant, check your compliance. Several formats are available, depending on how you handle your payments. Once you complete the SAQ, you should also complete an Attestation of Compliance. For this step, it’s crucial to have support from an expert who can guide you through the right questionnaire and ensure that you comply with all stages.
What Are The PCI DSS Requirements for a WordPress Site
The PCI SSC released the latest version – PCI DSS 3.2- which replaced version 3.1. The document took effect in January 2018, though there are plans to release version 4.0. As a merchant, looking out for the latest standard is crucial to remain compliant. However, for now, we focus on the current and available version 3.2.
PCI DSS has 12 requirements that fall under six goals, as described below. Keep reading to learn how to achieve PCI DSS (Payment Card Industry Data Security Standard).
Build And Sustain Secure Networks And Systems.
- Installing a firewall that protects cardholder information.
- Changing all default passwords on software, devices, and systems.
Protecting Cardholder Data PCI DSS Compliance For eCommerce
- Protection of cardholder data.
- Encrypting cardholder data on public networks.
Having a Vulnerability Management Program
- Protecting your systems against malware with regular software and antivirus updates.
- Developing and maintaining secure systems and software. Moreover, it is a top way how to achieve PCI DSS for your shop.
Access Control
- Restricting access to cardholder data on a need-to-know basis.
- Use identification and authentication measures to control access.
- Control physical access to cardholder data.
Monitoring and Testing
- Track and monitor all network access to cardholder information.
- Conduct regular tests and screening of systems.
Information Security Policy
- Maintaining a security policy that addresses all measures to protect cardholder data. As a result a good way on how to achieve PCI DSS (Payment Card Industry Data Security Standard).
Maintaining a PCI DSS Compliant Website
The PCI DSS standard is general for all businesses that process credit card data. Therefore, it’s essential to understand how to implement compliance for your WordPress e-commerce store. The method may vary among different WordPress stores, so a copy-paste move may not work.
Requirement 1: Installing a firewall that protects cardholder information.
The firewall acts as a barrier between your site and visitors. When configuring a firewall for your website, several issues must be considered. First, you must identify all servers, network devices, and services that interact with your website. With a comprehensive list, you can determine where you need the firewalls.
Second, when configuring the firewalls for various devices, you must block both the incoming and outgoing to help you only allow what is necessary. Once you set the firewalls but are unsure if you should allow a user and service entry, first do the research. It would help if you were always sure of any access you allow on your website. Lastly, remember to document all your configurations and continuously update them.
Requirement 2: Changing all default passwords on software, devices, and systems.
Many merchants make the mistake of relying on vendor-supplied passwords for security. However, it would help if you constantly changed the default passwords on all products, regardless of whether you use them on WordPress.
Along with changing the passwords, it is advisable to isolate your services. For example, you can buy and host your domain, set up your DNS, host your website, set up and host email services, and host your tests on different service providers.
It’s also essential to limit your plugins to important ones. When selecting plugins, always check their source and only use trustworthy ones. If you have any unnecessary plugins and themes, disable and remove them immediately. Lastly, after installing any hardware and software that works with your website, find out how to harden their security from the manufacturer or your security provider if you have one.
Requirement 3: Protect cardholder data.
If you run an e-commerce store, you most likely rely on a third-party payment gateway such as Stripe and PayPal; this step may not apply to your business. However, if you manually process your payment information, it’s important to remember to:
- Never manually write down payment information. Instead, input the data directly into the payment gateway.
- Only store cardholder information and delete what you don’t need.
- Inform the person handling the cardholder about the consequences of mishandling the data.
Requirement 4: Encrypting cardholder data on public networks.
First, install an SSL/TLS certificate on your WordPress site so that it’s accessible over HTTPS. Fortunately, many websites provide free certificates. Once the certificate is up and running, all data between your visitors and your website is encrypted. So, a great method on how to achieve PCI DSS (Payment Card Industry Data Security Standard).
However, even if you access cardholder data over HTTPS, ensure your connection is completely secure. For example, when using open public WiFi, always use VPNs for WordPress sites. The VPN encrypts your online movements and protects you from eavesdroppers on public connections by masking your private information, such as IP addresses, search history, and location. As a result, it is an important PCI DSS compliance for eCommerce.
Requirement 5: Protecting your systems against malware with regular software and antivirus updates.
This step ensures that your website is less vulnerable to attacks and protected from malware. Always ensure that you install the latest updates from your software providers. Keep your antivirus, antimalware, firewalls, and any other software you use on devices that interact with your WordPress website up to date. Malware is also software, and attackers usually update their malware to ensure that it’s useful. Updating your system is the best way to protect yourself from new threats.
Requirement 6: Develop and maintain secure systems and software.
In this step, your role as a merchant is to ensure that you use secure software and application for your WordPress site. When downloading software and applications, ensure you do it from trustworthy stores because they pre-approve apps before opening them to the public. For software, only use trusted and approved vendors. The vendor or developer should also have all relevant licenses to operate.
Remember to install any updates released by software and application developers as soon as they’re available. As your website grows, verify the source of any new software. Read reviews and comments about the software before making any purchases. Once installed, change all default settings and passwords and use vendor recommendations to improve security.
Requirement 7: Restricting access to cardholder data to a need-to-know basis.
Ensure that you manage access to your website. The best way to do this is to utilize the “deny all” feature and then allow access for each user, operating system, online services, and network component as you check. When granting access, especially from new users, ensure you research their source and security and determine why they need access to your website. As a result, this is an important PCI DSS compliance for eCommerce.
Requirement 8: Use identification and authentication measures to control access.
Focus on utilizing authentication measures to ensure that only real users can access your website and cardholder data. You can set up 2-factor authentication (2FA) for admin controls and account pages. Remember to use strong passwords and educate your users on the need for strong passwords. You can install a password manager to store your unique passwords and configure policies that force users to create strong passwords for their portals.
It would help if you also used unique credentials to verify the identity of every user. With a unique credential for your website, admin controls, client portals, network devices, and business data, you can also track and receive alerts for attempted logins.
Requirement 9: Control physical access to cardholder data.
Limit all access to laptops, smartphones, servers, and any other devices within your network. First, do not allow random users to access your business WiFi and work devices. If you operate in a physical office, install the right locks and do not allow visitors to roam freely. Lastly, always destroy all physical evidence of passwords and cardholder data.
Requirement 10: Track and monitor all network access to cardholder information.
Maintain an audit history of all your activities for at least one year, always ready for analysis. You should store this information for compliance purposes and to help you manage your website’s security. Remember to switch on their logging capabilities when installing new devices such as routers to help you track their activity. You can also find WordPress plugins to track all your activities.
Requirement 11 PCI DSS Compliance For eCommerce: Conduct regular tests and screening of systems.
Information security controls are never a one-off activity. You must continuously monitor your security systems for loopholes and install new updates to boost security. You must also set up penetration tests for your network and servers, conduct perimeter network scans, ask for internal vulnerability scans, and use WordPress vulnerability scans. It’s also crucial to introduce an IDS or IPS solution that helps you check and prevent possible hacks. With the right plugin, you can ensure your website is always screened.
It’s also essential to update your IT inventory to ensure checks. Without this list, it’s easy to have software and plugins without the right security patches running in the background. Keep an updated list to track what needs to be updated or uninstalled.
Requirement 12: Maintaining a security policy that addresses all measures to protect cardholder data.
This requirement focuses on documenting all the steps required to enforce security in your WordPress Store. Once you establish the measures needed to maintain security, document them, and circulate them to relevant users. Ensure that your policies clearly outline each person’s roles in ensuring safety and the consequences of non-compliance.
It should also include instructions on using devices and other technologies for your website store. It would help to list your personnel’s education and awareness programs. The policy should also include a risk assessment to identify all threats and their impacts and an incident response plan in case of a data breach.
What Are The Risks Of Non-Compliance?
There are several risks of non-compliance.
Fines and Losses PCI DSS Compliance For eCommerce
Credit card companies can fine you from $5,000 to $100,000 for every month of non-compliance. The fines vary depending on the volume of transactions in your e-commerce store, which also determines the level of compliance your business should be at.
The monetary expenses of non-compliance and a breach are hefty for any business. First, the cost of replacing and issuing cards is $3-$5 for every client who transacts with your e-commerce store. Banks and payment processors may increase their charges even after clearing the issue. The affected brands may also pass on the costs of monitoring all breached credit card information for further consumer protection.
Payment Bans
The relevant credit card companies can restrict your business’s ability to accept card payments. If you fail to obtain compliance, credit card brands may also terminate all future services with your business.
Data Breaches
While PCI DSS compliance does not protect your website from potential data breaches, it softens the blow of a violation. If an investigation reveals that you took all measures to be compliant, the card brands may choose to lower or eliminate the monetary fines. A data breach could cause revenue loss, especially if clients lose trust in your business. You must also spend more money cleaning your systems and upgrading security before continuing business.
Forensic Audits
If your business gets hacked, you must undergo a mandatory forensic audit. In this audit, you supply your PCI DSS documents for examination so that the credit card companies can determine if the data breach results from your non-compliance. First, the audit is intrusive and costly for your business since all the costs are on you. Second, if you’re not compliant, the forensic auditor also examines your controls to determine your compliance status.
Legal Action PCI DSS Compliance For eCommerce
Class action suits may be against your business, especially if the data breach is massive. In 2007, TJX faced an enormous data breach that exposed more than 45 million card details. The company revealed that only 12 months into the breach, it spent more than $250 million to cover the damage and compensate affected banks and customers.
Damaged Business Reputation
Exposing a client’s credit card information is enough to mistrust your business and ruin your brand’s image through bad reviews. It also becomes increasingly hard for clients to trust you again or for new clients to shop.
