Self-hosted Magento and Adobe Commerce stores almost always need quarterly ASV scans. The platform runs on your own infrastructure and usually serves the checkout itself, so most Magento merchants land in SAQ A-EP or SAQ D. Both include PCI DSS Requirement 11.3.2: a passing external scan from an Approved Scanning Vendor every three months.
Why Magento stores get targeted
Magento has been the favorite target for card skimming attacks for close to ten years, and you will see them called Magecart. Here is how it works: someone breaks into the store, drops JavaScript into the checkout, and copies card numbers as customers type them. It works even if you outsource payment processing, because the script runs on your pages. The defenses are regular external scanning, fast patching, and file integrity monitoring, and the ASV scan cycle pushes you to do the first two.
Which SAQ applies
If your checkout has payment fields served from your own pages, which is how most gateway integrations work, that is SAQ A-EP. If your store receives, processes, or stores card data on its own systems, that is SAQ D. Only a full redirect to the processor's hosted payment page gets you SAQ A. Our SAQ selection guide has the details, and when you are not sure, ask your acquiring bank and expect quarterly scans to be part of the answer.
What the scan looks at
The scan checks your store from the outside: open services on your public IPs, TLS and certificate setup, and software versions with known vulnerabilities, including Magento itself. Unpatched Magento is some of the most exploited e-commerce software on the internet, and security patches often land right after a public exploit shows up, so falling a few releases behind is a real risk. The findings we see most are missing security patches, old TLS still enabled, admin panels exposed, and forgotten services like databases, search, or RabbitMQ listening on public interfaces. Our top 10 scan failures guide has the fixes.
Scoping a Magento scan
Scan every public IP address that serves your store, meaning the frontend, any separate admin or API hostname, and anything else reachable from outside. If Varnish, a load balancer, or a CDN sits in front of the application, make sure the scan reaches your actual server and not just the edge. Our Cloudflare scanning guide explains the general problem, and our guide to which IP addresses to scan helps you build the list.
What to do between scans
Apply Magento security patches when they come out, not once a quarter, and get rid of extensions you do not use. Lock down the admin path, turn on two-factor, and keep PHP, your web server, and OpenSSL on supported versions. Stores that slip on any of this usually find out in a failed scan, or worse, in a skimming incident.
Scanning Magento with ServerScan
ServerScan runs ASV-certified quarterly scans for $59 a quarter or $188 a year per IP address or domain. You get unlimited rescans, US-based support to help you read the findings, and the Attestation of Scan Compliance your bank needs. If you have separate frontend and admin origins, we do multi-IP discounts, so just ask us.