PCI Compliance

The Payment Card Industry Data Security Standard (PCI DSS) applies to every business that accepts, processes, stores, or transmits payment card data. If your website takes card payments, your payment provider or acquiring bank may ask you to show that you meet it, usually through a self-assessment questionnaire and regular vulnerability scans.

This page explains which parts of that work WebGee can help with, which parts remain your responsibility as the merchant, and the limits that apply on shared hosting environments, where many customers use the same servers.

PCI DSS compliance is always the merchant's responsibility. As your hosting provider, we run and maintain the infrastructure your website sits on; you are responsible for your website, your applications, and how your business handles card data.

• WebGeeThe physical datacentre, network, servers and the hosting platform, including keeping the platform updated and secured for all customers.
• YouYour website code, plugins, themes and applications; how card payments are taken; your PCI DSS self-assessment; arranging any required vulnerability scans; and making the changes those scans identify within your account.

Customers on our Premium Hosting plans can ask our support team for help with PCI compliance reports. This is advisory support: we help you understand what a report is telling you and how to resolve the issues it raises.

• Explaining findingsWe go through the items in your scan or compliance report and explain what each one means for your hosting account.
• Guidance on fixesWe advise on how to address the findings that can be resolved within your own account, such as website software, application settings, or account-level configuration.
• Platform questionsWe confirm which findings relate to the shared hosting platform and whether they fall within the limits described below.

On shared and reseller hosting plans, PCI compliance assistance is not included. If PCI reporting matters to your business, choose Premium Hosting or a managed cloud server.

To keep expectations clear, the following are not part of any hosting plan:

• Vulnerability scanningWe do not run PCI vulnerability scans or act as an Approved Scanning Vendor (ASV). Your payment provider or an ASV of your choice can provide these.
• Self-assessment questionnairesWe do not complete or sign a Self-Assessment Questionnaire (SAQ) or Attestation of Compliance on your behalf.
• Making the changes for youChanges needed for compliance within your account are carried out by you or your developer. Premium Hosting customers receive guidance, as described above.
• Server-specific configurationWe cannot apply bespoke technical configurations requested by a scan on shared servers. See the limits below.

Shared, reseller and Premium Hosting plans run many customers' websites on the same servers. A server-wide change made for one account affects every account on that server, so to keep the platform stable and secure for everyone, we cannot make the following changes for an individual customer:

• Custom server configurationServer-level PHP settings, web server settings, or other global configuration files.
• Server-wide softwareInstalling, removing, or changing the version of software that applies to the whole server.
• Resource allocationChanging the resources allocated to the server or to the platform as a whole.
• Global security settingsFirewall rules, TLS protocols and ciphers, or other security settings that apply to all customers on the server.
• Shared libraries and componentsUpgrading, downgrading, or patching libraries and components that other accounts depend on.
• Database server configurationSettings of the shared database server, as opposed to your own databases.

If a scan flags one of these items, our team can explain whether it applies to your account and what your options are, which may include moving to a server you control.

If your compliance requirements call for server-level changes, a WebGee cloud server gives you a dedicated environment with full root access, so the configuration can be tailored to your needs without affecting anyone else.

• Full root accessConfigure the operating system, web server, PHP, TLS settings, and firewall exactly as your assessment requires.
• Management planAdd a management plan and our team will guide you through implementing the changes needed for compliance.

The simplest way to make PCI DSS easier is to keep card data away from your website altogether. These are general good practices; your payment provider can confirm which approach suits your business.

• Use hosted payment pagesSend customers to your payment provider's hosted checkout, or embed their secure payment fields, so card details are entered on the provider's systems rather than your server.
• Never store card dataDo not save card numbers, security codes, or full card data in your database, logs, or email.
• Keep software updatedApply updates to your CMS, plugins, themes, and applications promptly, and remove anything you no longer use.
• Use HTTPS everywhereServe your whole site over HTTPS. Free SSL certificates are included with WebGee hosting.

Premium Hosting customers can open a support ticket from the client area and attach their PCI scan or compliance report. Tell us which items you need help with and our team will review them with you.

Not sure which hosting option fits your compliance needs? Contact our team before you order and we will help you choose between Premium Hosting and a managed cloud server.