PCI Compliant Hosting: What to Ask Your Host Before You Sign

PCI compliant hosting is hosting whose provider has validated its own services against PCI DSS as a service provider and can prove it with a current Attestation of Compliance (AOC). That takes some requirements off your list, physical data centre security above all. It does not make your website or application compliant. You still secure everything the host does not manage, and you still validate your own compliance.

We do not rank or recommend hosts. This checklist shows how to read what a host gives you, where the line usually falls and what to ask.

What makes hosting PCI compliant?

A host is PCI compliant when the services it sells have been assessed against PCI DSS v4.0.1 and the result is documented in an AOC for service providers. Larger providers are assessed by a Qualified Security Assessor (QSA) through a Report on Compliance; smaller ones may be allowed by the card brands to self-assess using SAQ D for Service Providers. Either way, the AOC names the services that were assessed and those that were not.

What a host shows you, and what it actually proves:

If a host has no AOC at all, PCI DSS still lets you use it, but its services must then be reviewed as part of your own assessment. That adds time and cost, and the host must co-operate with your assessor.

Does PCI compliant hosting make my website compliant?

No. The host’s AOC covers the host’s share of the requirements, nothing more. You validate your own compliance separately, by SAQ or Report on Compliance, depending on your level and how you take payments. Our free PCI compliance check suggests which SAQ is likely to apply to you.

The host is a third-party service provider (TPSP) to you, so Requirement 12.8 applies to the relationship. You must list the host, hold a written agreement in which it acknowledges responsibility for the account data it handles (12.8.2), carry out due diligence before you sign (12.8.3), check its compliance status at least once every 12 months (12.8.4) and keep a record of who is responsible for which requirements (12.8.5). A vendor risk assessment is a good way to package that due diligence.

What is a PCI responsibility matrix?

A responsibility matrix lists each PCI DSS requirement and records whether the host, you or both are responsible. Requirement 12.8.5 requires you to maintain this information, and Requirement 12.9.2 requires the host to give it to you on request, along with its compliance status. The PCI SSC’s Third-Party Security Assurance information supplement, in the PCI SSC document library, explains how customers and providers should agree the split. If you are the host preparing one, see PCI DSS compliance for service providers.

An illustrative excerpt for a managed hosting plan, from the customer’s side, looks like this. The real split depends entirely on your contract:

Requirement 12.9.1 asks the host to acknowledge its responsibilities in writing, so the matrix belongs in the contract, not just the sales pack.

How do shared, managed, dedicated and cloud hosting compare?

The less the host manages, the more of the matrix is yours:

Multi-tenant hosts carry extra duties under Appendix A1 of PCI DSS v4.0.1: logical separation between customers, confirmed by penetration testing at least once every six months (A1.1.4), and logging and incident processes for each customer. Under Requirement 11.4.7 they must also support customers’ external penetration testing. A1.1.4 and 11.4.7 have both been mandatory since 31 March 2025. If you sell a platform to other businesses yourself, the same rules may apply to you; our guide to PCI DSS for SaaS companies explains when.

What about PCI compliant WordPress and Drupal hosting?

A WordPress or Drupal host can only cover the infrastructure. Core updates, plugins, modules, themes, administrator accounts and your payment integration remain yours unless the contract says otherwise, and these are common routes into card-taking CMS sites.

Points that apply to both:

• Keep card data off the site. Use a payment provider’s hosted page or hosted fields so card numbers never reach your server.
• Control payment page scripts. Requirements 6.4.3 (authorising and inventorying payment page scripts) and 11.6.1 (detecting unauthorised changes to payment pages) have been mandatory since 31 March 2025. How they apply depends on your integration and SAQ, as our comparison of SAQ A and SAQ A-EP explains.
• Patch on a timetable. Patches for critical vulnerabilities must be installed within one month of release, and other applicable patches within a timeframe you set (6.3.3).
• Lock down the admin area. Named accounts only, MFA and no shared logins for agencies or freelancers.
• Look for stray card data. Contact form plugins, order notes, support tickets and email notifications can quietly store card numbers that bring the whole site into scope.

Specialist WordPress and Drupal platforms differ widely. Some publish a service provider AOC; others state that their platform is not intended for storing card data. Ask which applies before you migrate. For Magento and Adobe Commerce stores, see our guide to Magento PCI compliance.

PCI compliant WordPress hosting

Most card-taking WordPress sites run WooCommerce or a payment plugin from their provider, so the plugin decides your SAQ. A plugin that redirects to the provider’s hosted page, or loads the provider’s card fields in iframes, usually keeps you on SAQ A; one that builds the card form on your own page usually means SAQ A-EP. Check what it actually does in the browser before you choose a host.

WordPress applies minor core security releases automatically by default, but plugin and theme updates are only automatic if you or your host turn them on. Ask a managed WordPress host exactly what it updates, how quickly and whether it tests updates first, because a vulnerable plugin on the checkout page is a common skimming route. Keep the number of plugins on payment pages to the minimum and remove any you no longer use.

PCI compliant Drupal hosting

Drupal shops usually take payments through Drupal Commerce and a payment gateway module, and the same rule applies: the module’s integration method decides your SAQ. The Drupal Security Team publishes security advisories for core and contributed modules; your host or agency should watch them and apply critical fixes within the one-month window.

Check the Drupal version too. Drupal 7 reached end of life in January 2025, so a store still on it needs another source of security fixes and a documented plan under Requirement 12.3.4, or a migration to a supported version.

What are the PCI compliance data centre requirements?

Requirement 9 sets them, and in a hosted environment they are normally the host’s responsibility, provided the data centre holding your systems is named in the host’s AOC. Our summary of Requirement 9 and the other PCI DSS requirements gives the wider context. The physical controls an assessor expects to see include:

What questions should you ask a hosting provider before you sign?

1. Can you send your current AOC for service providers, and was it signed by a QSA or self-assessed?
2. When was it completed, and when is the next assessment due?
3. Which services and data centres does it cover, and is the plan we are buying among them?
4. Will you provide a responsibility matrix for that exact plan?
5. Will the contract acknowledge your responsibility for the account data you handle?
6. Is the platform multi-tenant, and were you assessed against Appendix A1?
7. Who patches the operating system, web server, database and CMS, and how quickly?
8. Who manages firewall rules, and how are our change requests approved and recorded?
9. Can we get our logs, how long are they kept, and how are they protected from alteration?
10. Will you support our ASV scans and penetration tests, and what notice do you need?
11. How is your staff’s administrative access to our servers controlled, and is MFA enforced?
12. How and how quickly will you tell us about a security incident affecting us?
13. Where are backups held, and how is old media destroyed?
14. Will you tell us if your PCI DSS compliance status changes?

Vague answers to the first four questions are the strongest warning sign. A host that genuinely supports PCI DSS customers usually has the AOC and matrix ready to send.

Question 9 matters more than it looks. You must keep audit logs for at least 12 months, with the latest three months immediately available, so a host whose default retention is shorter leaves a gap you have to fill. Our guide to PCI DSS Requirement 10 sets out what the logs must record.

Why Sovereign Secure

We are a PCI SSC-approved Qualified Security Assessor (QSA) company, Qualified PIN Assessor (QPA) and Card Production Security Assessor (CPSA), and a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028, so we read hosts’ AOCs and responsibility matrices the way an assessor will. External ASV scans are delivered through our PCI SSC Approved Scanning Vendor partner, alongside our own penetration testing.

Next step

Before you sign with a host, or if you doubt your current one, our PCI DSS consultancy team can check the host’s AOC and responsibility matrix against your scope as part of scoping or a gap analysis, and tell you exactly what remains on your side.