Does a Small Store Need a PCI Penetration Test?

Most small stores that send customers to a hosted checkout (Stripe Checkout, Shopify's checkout) are not required by PCI DSS to commission a penetration test, but stores that handle card data on their own systems are.

This post is for owners running Stripe, Shopify or WooCommerce who keep hearing "PCI" and wonder if they need to buy a pentest. You will learn which merchants are asked for one, why a hosted checkout shrinks your obligations, what a manual test adds, and what to check this week.

What PCI DSS says about penetration testing

PCI DSS (Payment Card Industry Data Security Standard) is the security rulebook set by the card brands. The current version is 4.0.1, published by the PCI Security Standards Council.

A penetration test (pentest) is a controlled attempt to break into your site the way an attacker would, followed by a report. It is different from a vulnerability scan, which is an automated tool checking for known weaknesses.

Penetration testing lives in Requirement 11.4. For merchants whose systems are in scope, it asks for:

• A written testing method (11.4.1).
• Internal and external tests at least every 12 months, and after any significant change (11.4.2 and 11.4.3).
• Exploitable findings fixed, then retested (11.4.4).
• Segmentation testing, only if you use network segmentation to shrink scope (11.4.5).

The tester must be qualified and organizationally independent. They do not have to be a QSA (Qualified Security Assessor, the person who signs off formal assessments). Quarterly external scans are a separate item, and those must come from an ASV (Approved Scanning Vendor).

So the honest answer to "does PCI DSS require penetration testing?" is: yes, for the merchants whose environment falls under Requirement 11.4. Whether that is you depends on how you take payments.

Which merchants are asked for a pentest

Small merchants usually prove compliance with a SAQ (Self-Assessment Questionnaire). Which one you fill in depends on how card data flows. Here is the plain-English version:

A provider's iframe embedded on your page, such as Stripe Elements, is generally treated like a hosted checkout and maps to SAQ A. Linking or redirecting shoppers to a hosted payment page does the same.

Check the current SAQ documents on the PCI SSC site before relying on this table. The questionnaires change between versions.

Your acquirer (the bank or processor that handles your payments) and the card brands decide which validation they need from you. Your own reading of the standard does not settle it. Merchant "levels" also differ by card brand. Most small shops fall in the lowest level, which normally means a self-assessment rather than an on-site audit.

Why a hosted checkout shrinks your scope

With a hosted checkout, the card number goes from the shopper's browser straight to Stripe or Shopify. It never touches your server. Less card data on your systems means fewer PCI requirements for you.

• Shopify runs the checkout itself. See Shopify's payments help documentation and your Payments settings for how it describes its role.
• Stripe Checkout, Payment Links and Elements keep card fields on Stripe-controlled pages or iframes. Stripe explains which integrations map to which SAQ in its security guide.
• WooCommerce depends on the plugin. The official Stripe plugin, "WooCommerce Stripe Payment Gateway", uses Stripe-hosted fields. A plugin that posts raw card numbers to your own server pulls you into a much heavier SAQ.

Scope is not zero, though. If an attacker injects a malicious script into your checkout page, they can skim cards or redirect shoppers even when the form is hosted. PCI DSS 4.0 added Requirements 6.4.3 and 11.6.1 for scripts on payment pages. The SAQ A wording was updated so merchants confirm their site is not susceptible to script-based attacks. Hosted checkout reduces your duties. It does not remove your website from the picture.

When a pentest is still worth it

Even if no rule forces it, a test makes sense when:

1. Your acquirer, bank or a corporate client asks for one. This is a contract demand, not necessarily a PCI rule, but it is real.
2. You are SAQ A-EP or SAQ D. Requirement 11.4 applies to you.
3. You built a custom checkout or custom payment plugin. Custom code is where logic bugs hide.
4. You made a significant change. A new theme, a new payment flow or a move to a new host all count.
5. A questionnaire asks for evidence. A written test report is a strong answer, as covered in our manual vs automated testing guide, which also explains why test prices range so widely.

What a manual test adds beyond a scan

An automated scanner is good at known issues: outdated software, missing headers, open ports. It cannot reason about how your store is meant to work. A human can.

On a small store, a person will try things like:

• Changing a price or quantity in the cart request, to see if the server trusts the browser.
• Viewing another customer's order by editing an order number in the URL (an IDOR, short for insecure direct object reference).
• Stacking or reusing discount codes.
• Finding an exposed admin login, backup file or debug page.
• Listing every third-party script on checkout and judging which ones are risky.

The OWASP Web Security Testing Guide is the public methodology most testers follow for this kind of work.

What Bug Circuit is, and is not

Bug Circuit is not a PCI QSA or ASV, and we do not issue PCI certificates or compliance attestations. Our $49 Circuit audit is a manual audit of a small site with a written report: severity, evidence and exact fixes. It is not a multi-week enterprise pentest.

That report is useful evidence of good security practice and a to-do list for your developer. If your SAQ explicitly requires a Requirement 11.4 test, ask your acquirer or assessor what they accept before you buy anything, from us or anyone else.

Your checklist for this week

1. Find out your SAQ type. Ask your processor or check the PCI section of your Stripe Dashboard. Do not guess.
2. Confirm how checkout works. In Shopify, check Settings > Payments. In WooCommerce, check WooCommerce > Settings > Payments and see which gateway plugin is active.
3. List scripts on your payment page. Open the checkout in your browser, press F12, open the Network tab, filter by JS, and note every domain. Remove any you cannot explain. This is the method to trust, because it shows what really loads. You can also try this command, which follows redirects (-L):

curl -sL https://yourshop.example/checkout | grep -oE '<script[^>]+src="[^"]+"'

The command only works if the checkout URL can be reached without a cart session. On Shopify and WooCommerce, checkout usually needs items in a cart, so it often redirects or prints nothing useful. An empty result does not mean no scripts are loaded. It also misses scripts added by JavaScript after the page loads, and card fields in iframes load their own scripts, so those will not show in the list. In those cases, use the browser Network tab method above.

1. Check your security headers. Run:

curl -sI https://yourshop.example | grep -iE 'content-security-policy|strict-transport-security'

You want a Strict-Transport-Security: max-age=31536000 line at least. A Content-Security-Policy (CSP, a list of which scripts may run) is a bigger win, but introduce it in Content-Security-Policy-Report-Only mode first so you do not break checkout. Our security headers tool shows what you have. Note that Shopify controls headers on its hosted checkout.

1. Tidy WooCommerce. Update WordPress, WooCommerce and every plugin, delete unused plugins, and turn on two-factor login for all admins.
2. Run a free baseline. The free website security check is a passive look at your public site and costs nothing.
3. Keep records. Save your SAQ, the date of the last test and any fix notes in one folder.

Key takeaways

• PCI DSS Requirement 11.4 requires penetration testing only for merchants whose environment falls under it, mainly SAQ A-EP and SAQ D.
• Stripe Checkout, Payment Links and Shopify's hosted checkout usually put you under SAQ A, which does not include the pentest requirement.
• Hosted checkout does not make your website irrelevant. Injected scripts on your pages can still steal cards, so watch what loads at checkout.
• Your acquirer or a client may ask for a test even when PCI does not, so confirm your SAQ and ask what they accept.
• A manual test finds logic flaws a scanner misses, but Bug Circuit is not a QSA and issues no PCI certificates.

Next step

If you want a human to look over your store and tell you plainly what is fixable, the Circuit audit is $49 one-time. You get a full written report with severity, evidence and exact fixes. It will not replace a formal PCI assessment, and we will not pretend it does.