Skip to main content
If your website accepts card payments, you need to make sure payment information is handled securely. This is where PCI compliance comes in. PCI DSS stands for Payment Card Industry Data Security Standard. It is a set of security requirements for businesses that accept, process, store, or transmit payment card information. The important question is where the card information is handled. If a payment provider handles the card details for you, less payment information passes through your own systems. If your website or server handles card details directly, your business takes on more responsibility for protecting that information. PCI compliance is therefore not simply a setting you turn on. It depends on how your payment process and hosting environment are set up.

​
Keep card details away from your server

For many businesses, the simplest approach is to use a third-party payment provider that handles the card details. The customer enters their payment information through the payment provider, while your website handles the order and receives confirmation of the payment. This keeps card information away from your hosting environment and reduces the amount of payment data your website needs to protect. Hosting.com supports third-party payment and shopping cart integrations that can be used with your website. The existing Hosting.com documentation lists providers such as PayPal, 2Checkout, Stripe, and CDGcommerce as examples of PCI-compliant payment solutions. Using a payment provider does not make your entire website automatically PCI compliant. You are still responsible for keeping your website, accounts, software, and payment integration secure.

​
When your server is part of the payment environment

Some businesses have requirements that go beyond keeping card details away from their server. If your application or payment environment needs PCI-compliant infrastructure, the hosting environment itself becomes part of the decision. This is where the type of server you choose matters. That does not mean the server makes your entire business PCI compliant. Your website, payment software, access controls, security practices, and payment process still need to meet the requirements that apply to your business. The important distinction is between PCI-compliant infrastructure and your overall PCI compliance.

​
What will work for you?

You want to keep payment processing simple. Use a third-party payment provider that handles the card details. This can keep payment information away from your server and reduce the amount of payment infrastructure you need to manage. Your application needs PCI-compliant infrastructure. Consider a PCI-compliant hosting environment, such as an Enhanced Dedicated Server. This gives you an infrastructure option designed for workloads with PCI requirements. Your website handles card information directly. Make sure you understand the security and compliance requirements before building the payment system. Handling card information yourself creates significantly more responsibility than using a third-party payment provider.

​
What this costs you

The cost of secure payments is not limited to payment processing fees. A third-party payment provider may charge transaction or service fees. A PCI-compliant server can also cost more than a standard hosting environment because additional infrastructure requirements may apply. There is also the cost of maintaining the systems involved. Software updates, security controls, monitoring, testing, and access management all require time and attention. The right setup is therefore the one that meets your payment requirements without taking on more complexity than you need.

​
What we offer

Hosting.com supports websites using third-party payment providers, and Enhance Dedicated Servers provide a PCI-compliant hosting option for businesses that require PCI-compliant infrastructure. The first decision is to understand where your payment card data is handled. If a payment provider can handle it for you, that is often the simpler approach. If your application requires PCI-compliant infrastructure, the hosting environment becomes part of the decision.