We have two severs sitting under one load balancer. We run PCI scans on those two servers.

Now, when we started, we only had 2 websites running from these two server. But the business is growing and we have around 10 more sites on these two servers.

Do I have to get the PCI scans of all these websites separately, or will it be sufficient to have the PCI scans of server boxes?


Yes, you need to scan the virtual hosts.

3. Prior to scanning the web site and IT infrastructure, merchants and service providers must: 
• Provide the ASV with a list of all Internet-facing IP addresses and/or IP address ranges 
• Provide the ASV with a list of all domains that should be scanned if domain-based virtual hosting is used 


PCI scans are not just testing the security of your operating system, but your web server configuration and application security among other things.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.