PCI DSS 4.0 e-commerce: risks and how to comply
· 5 min read
If your online store accepts card payments, there is a deadline that concerns you, even if you are a small store: from March 31, 2025 the new PCI DSS 4.0 rules on the payment page become mandatory. In short: you must know what runs on the page where customers enter their card and notice right away if someone tampers with it.
Informative article, not a security assessment: for your specific case, check with your bank or payment provider.
What PCI DSS is (and why it is not a law)
It is the security standard of the card networks (Visa, Mastercard and the others). It is not a law, but a contractual obligation: it is required by the bank or payment provider you have an agreement with to accept cards.
The risk: "invisible attacks" on the checkout
Criminals no longer attack only databases: they attack the page where the customer types the card. Malicious code slips in unnoticed, often through an outdated external tool (a chat, an advertising pixel, a third-party module), and copies the data while the customer types it. It is called e-skimming or Magecart. The sale goes through and nobody sees anything: you find out months later, when banks and customers report fraud.
The consequences depend on the contract with your bank or payment provider: from additional costs to liability for the stolen data and, in the most serious cases, suspension of the ability to accept cards. On top of that comes reputation damage.
The two rules that apply from March 31, 2025
- Know and authorize every script. You must have a list of all the scripts on the payment page, with the reason each one is there, and allow only authorized ones.
- Notice changes. You need a control that detects and reports unauthorized changes to the page, with periodic checks (normally at least once a week).
Does it really concern you? It depends on how you take payments
| How you take payments | What it means for you |
|---|---|
| The customer pays on a provider's page (leaves your site) | Fewer requirements, but you must ensure your site is not exposed to malicious scripts. Ask your provider to confirm. |
| The provider's card fields are inside your page | Your page's code can affect security: controls matter more. |
| Card data passes through your site | The highest level of responsibility, with more controls. |
For the first case the standard provides lighter rules, provided you declare that the site is not exposed to these attacks (details from the PCI Security Standards Council). Ask your bank or provider which self-assessment questionnaire you must complete: it is the fastest way to understand your level.
Where to start
- Find out how you take payments (external page, embedded fields or data on your site).
- List the external tools on the payment page (chat, analytics, pixels, widgets) and remove the unnecessary ones.
- Ask your provider for written confirmation of what they cover and what remains your responsibility.
- Set up change monitoring with automatic alerts.
- Keep everything updated and have the result checked by an expert.
The Magento case: why the checkout matters
If you use Magento 2 or Adobe Commerce, everything revolves around the checkout. The traditional one (the Luma theme) relies on dated technologies and many third-party modules: checking every script can become long and costly.
That is why many merchants choose Hyvä, a more modern and lightweight checkout. According to the official documentation, from version 1.3 the browser runs only explicitly authorized code and blocks the rest, in line with the spirit of the new rules. The advantage is also practical: less code to check, usually a faster checkout and easier maintenance.
Be careful though: no theme makes you compliant by itself. Third-party modules must be compatible, and the list of scripts and change monitoring still have to be put in place. And security is not a one-off job: every new module or marketing tool changes what runs on the payment page, which is why periodic updates and checks are needed, that is, ongoing maintenance.
Frequently asked questions
Is PCI DSS a law?
No. It is a card network standard that banks and payment providers impose by contract on anyone who accepts cards.
If I use PayPal, Stripe or another provider, am I exempt?
You are greatly relieved, but not exempt: you must complete the relevant questionnaire and ensure your site is not exposed to script-based attacks. Ask your provider what they cover and what remains your responsibility.
Do I have to switch to Hyvä?
No. It is one of the most straightforward paths for a Magento store, but the goal is to control scripts and detect changes, with any technology.
Want to know if your store is in order?
If you have an e-commerce on Magento 2 or Adobe Commerce, I can do a free technical audit: we look at how you take payments, which tools are on the payment page and what the quickest path is to secure it, including with a modern checkout and periodic maintenance. Write to me to talk about it: the quote is free and non-binding.
See also: B2C e-commerce development and replatforming and migrations.