Selling online safely comes down to one idea: don't let raw card numbers touch systems you have to secure yourself. Most stores get there with a payment gateway, plus HTTPS everywhere and up-to-date software.
Let a payment gateway handle cards
The safest and most common setup is to process payments through a gateway like Stripe, PayPal, or a similar provider. The customer enters their card details on the gateway's hosted fields or checkout, the gateway handles the sensitive card data, and your site only ever receives a token or a "paid" confirmation. Raw card numbers are never stored on your hosting.
This is the recommended approach for shared and WordPress hosting, WooCommerce stores included. It keeps the hardest part of payment security, handling and storing cardholder data, with a specialist built and certified for it, and it shrinks your own PCI DSS scope considerably.
Secure the rest of your store
- HTTPS everywhere. Every page, not only checkout, should load over HTTPS. We auto-issue and renew SSL certificates and redirect HTTP to HTTPS by default. See SSL certificates and Forcing HTTPS on your site.
- Keep software updated. Your CMS, store platform, plugins, and themes are the most common way stores get compromised. Patch promptly. For WordPress and WooCommerce, see Securing your WordPress site.
- Strong admin access. Unique passwords and two-factor authentication on every account that can reach your store's admin or the portal.
- Lean on what we run. Imunify360 WAF, Imunify360 malware scanning, DDoS scrubbing, and automatic security patching run on every hosting account. They reduce risk, but they don't replace a gateway.
Where PCI DSS fits
PCI DSS (Payment Card Industry Data Security Standard) is the security standard that applies to anyone who stores, processes, or transmits card data. A few points to be clear about:
- Using a gateway keeps most of PCI scope off your hosting. When card data goes straight to the gateway, your compliance burden is much smaller, usually a simpler self-assessment questionnaire.
- The merchant certifies, not the host. PCI compliance is something you, the merchant, attest to for your business. Flashcloud does not hold or provide a PCI certification on your behalf.
- Dedicated Servers provide infrastructure that supports PCI DSS compliance. If your setup requires you to handle card data directly, a Dedicated Server gives you an isolated environment to build a compliant configuration on. Completing the certification is still yours to do.
A safe default
For almost every store: use a reputable payment gateway, keep HTTPS on across the whole site, and keep your software patched. That combination keeps cardholder data off your hosting and your PCI scope small, on any Flashcloud plan.