1

I am considering using Wordpress, WooCommerce, third party payment processor and different plugins for an ecommerce store.

I have trouble figuring out if it is possible to do all that and to be PCI DSS compliant and SAQ A eligible.

PCI DSS glossary defines service provider as follows: “ Business entity that is not a payment brand, directly involved in the processing, storage, or transmission of cardholder data on behalf of another entity. This also includes companies that provide services that control or could impact the security of cardholder data. Examples include managed service providers that provide managed firewalls, IDS and other services as well as hosting providers and other entities.” From the definition above it is clear that the payment processor is a service provider.

From the payment gateways listed on WooCommerce, only Paypal Checkout, PayPal Powered by Braintree and Stripe offers payment processing for companies registered in my country.

It is stated in PCI Data Security Standard SAQ-A that in order to be a SAQ A merchant: “merchants confirm that, for this payment channel: ▪ All processing of cardholder data is entirely outsourced to PCI DSS validated third-party service providers; ▪ Your company does not electronically store, process, or transmit any cardholder data on your systems or premises, but relies entirely on a third party(s) to handle all these functions.”

As far as I understand, in order to be eligible for PCI DSS SAQ A (not collecting, storing, processing or transmitting cardholder data) I need to use URL redirection method from my website to a third-party page or iFrame method.

Question 1: Are in this case WooCommerce, my website’s host, third party security, backup and other plugin providers considered as service providers in case I use URL redirection method or iFrame for payments? Meaning that they should be PCI DSS validated? Or does that apply only to the payment processor/gateway as others are not involved in collecting, storing, processing and transmitting cardholder data?

What confuses me is that as it is stated in WooCommerce website Paypal Checkout, Paypal Powered by Braintree and Stripe plugins are developed by WooCommerce. As I understand WooCommerce is not PCI DSS validated.

Question 2: Does it mean that if I use any of these plugins as a payment gateway, I cannot be SAQ A eligible?

I checked the documentation provided in WooCommerce website for Paypal Checkout, Paypal Powered by Braintree and Stripe and I do not really understand how can they be set up for WooCommerce.

Question 3: Can any of these 3 payment gateways be set up using URL redirection or iFrame method? So that all collecting, storing, processing and transmitting of cardholder data is done by the payment gateway enabling me to be SAQ A eligible? For me it seems that PayPal Checkout allows only API that would not be compatible with SAQ A requirements for my company.

Question 4: Has the payment processor/ payment gateway such as Paypal Checkout or PayPal powered by Braintree be PA-DSS validated? On the list of validated payment applications available on the website of PCI Council, I cannot find PayPal or Braintree. Does it mean that to be PCI compliant I cannot use any of these two payment gateways?

1
  • 1
    In the future, please refrain from using excessive formatting. Highlighting random words or whole passages in bold does not make your question more appealing. Furthermore, please ensure that you write one question per question. If you have multiple related questions, please ask them seperately and possibly link them together for better context.
    – user163495
    Commented Aug 17, 2019 at 18:59

1 Answer 1

2

Question 1: Are in this case WooCommerce, my website’s host, third party security, backup and other plugin providers considered as service providers in case I use URL redirection method or iFrame for payments? Meaning that they should be PCI DSS validated? Or does that apply only to the payment processor/gateway as others are not involved in collecting, storing, processing and transmitting cardholder data?

If you're using URL redirection or iFrame for payments, then you are ensuring the cardholder data flow stays outside WooCommerce and related providers. Your last sentence is correct, the PCI validated part does not apply to them as they aren't touching the cardholder data.

Question 2: Does it mean that if I use any of these plugins as a payment gateway, I cannot be SAQ A eligible?

As long as those plugins are correctly doing URL redirection or iFrame payments, you're fine. You're just taking advantage of someone writing a plugin to integrate what you'd have to do yourself if the plugin wasn't there.

Question 3: Can any of these 3 payment gateways be set up using URL redirection or iFrame method? So that all collecting, storing, processing and transmitting of cardholder data is done by the payment gateway enabling me to be SAQ A eligible? For me it seems that PayPal Checkout allows only API that would not be compatible with SAQ A requirements for my company.

"Stripe Developed by WooCommerce" boasts "PCI-DSS compliance with Stripe Elements," and Stripe Elements supports SAQ A with Hosted Fields, so look into Hosted Fields and make sure you use it.

"PayPal Powered by Braintree for WooCommerce" can "Achieve PCI DSS v3.0 SAQ-A compliance using Hosted Fields functionality for card detail collection," again note the focus on Hosted Fields.

I believe "PayPal Checkout" also supports SAQ A compliance via Hosted Fields, but can't find a succinct reference.

Question 4: Has the payment processor/ payment gateway such as Paypal Checkout or PayPal powered by Braintree be PA-DSS validated? On the list of validated payment applications available on the website of PCI Council, I cannot find PayPal or Braintree. Does it mean that to be PCI compliant I cannot use any of these two payment gateways?

I suspect these plugins are not covered by PA-DSS, which is kind of a shaky standard that's going away. These plugins are basically ensuring that the data PA-DSS is concerned with stays far away from your site. But caveat lector, IANAQSA.

3
  • Thanks! What confuses me is this sentence in service provider definition – “This also includes companies that provide services that control or could impact the security of cardholder data.” Doesn’t the host and different plugins on my website impact the security of cardholder data that is being processed by third party processor? Isn’t my host involved in URL redirection or that iFrame? And how can I be sure that these WooCommerce developed payment gateway plugins are correctly doing URL redirection or iFrame payments?
    – elievi
    Commented Aug 18, 2019 at 11:49
  • @elievi your host is still involved, which is why SAQ A still requires a minimal number of questions from you. Some find the gap between A and A-VT to be specious, and A-VT comes much closer to having the same concerns you do, but PCI SSC chose to elevate iFrame above other, similar, technologies. At the end of the day, they probably feel WooCommerce (and similar) developed gateways are more likely to do it right than hundreds of bespoke gateways by developers of wildly varying knowledge and skill, and so it is in their best interest to allow them without friction.
    – gowenfawr
    Commented Aug 18, 2019 at 18:11
  • @elievi to test these plugins yourself, walk through your shopping cart with a debugger (e.g. F12 in Chrome). It will not be easy :) but the proof is in the pudding.
    – gowenfawr
    Commented Aug 18, 2019 at 18:12

Not the answer you're looking for? Browse other questions tagged .