PCI Compliant Hosting Explained
What the Term PCI Compliant Hosting Means
PCI compliant hosting is a hosting service whose infrastructure has been assessed against PCI DSS requirements, usually documented in an Attestation of Compliance (AOC). The phrase is common in marketing, but it does not mean that a shop hosted there is compliant. PCI DSS applies to the whole environment that handles card data, including the shop's software, configuration and staff practices.
A host can meet the standard for its own part of the stack, such as the data center, the network and the underlying servers. The shop remains responsible for everything it runs on top of that infrastructure.
How Responsibility Is Shared
Card payments involve three parties with separate duties. The host secures the infrastructure it provides, which should be set out in its responsibility matrix. The payment provider secures the payment page or API it supplies. The shop owner secures the website application, its plugins and themes, administrator access, and any card data that reaches its own systems.
Problems usually appear in the gaps between these duties. A host may apply operating system patches, while the shop leaves an outdated plugin running. A hosted payment page may be secure, yet a script added to the shop's own checkout page can still interfere with the payment. Reading each provider's responsibility matrix shows who owns which control.
When Hosting Compliance Matters for a Shop
If a shop only redirects customers to a fully hosted payment page, it may have few server-side obligations, and its host's compliance matters less. If the shop's servers store, process or transmit card data, or if the checkout runs on infrastructure the shop manages, the host's environment becomes part of the compliance scope. A host with a current attestation is then useful evidence.
Hosting type also shapes what is possible. Shared environments give limited control over security settings, which is why many shops that handle card data choose dedicated or cloud setups. General requirements are discussed in ecommerce hosting requirements.
Frequently asked questions
Do I need PCI compliant hosting for my online store?
Not always. If you use a hosted payment page and never handle card data on your own servers, the host's compliance matters less. If your servers handle card data, or your checkout runs on infrastructure you manage, a host with a current attestation becomes part of meeting your obligations. Ask your acquirer which requirements apply, and see PCI SAQ types.
Does a host's PCI attestation make my shop compliant?
No. An attestation from a host covers only the services in its assessed scope. It does not cover your website code, plugins, passwords or staff procedures, and it does not replace your own self-assessment. Read the attestation's scope and the host's responsibility matrix to see exactly what it covers.