If your WooCommerce checkout has card fields on your own page, like Stripe Elements or a gateway's hosted fields, you need quarterly ASV scans. That puts you under SAQ A-EP, and PCI DSS Requirement 11.3.2 says you need a passing external scan from an Approved Scanning Vendor every three months. If your checkout sends customers off to the payment provider's own page instead, you probably fall under SAQ A, which is simpler. Here is how to tell which one you are, and how to scan a WooCommerce store properly.
Why WooCommerce is different from hosted platforms
WooCommerce runs on your own WordPress install, on a server you or your host manages, and that is the difference from a fully hosted checkout. Your server delivers the checkout page, your configuration decides how secure it is, and your plugins run right alongside the payment code. That is exactly what an external vulnerability scan looks at.
Which SAQ applies to you?
It comes down to how the card data gets collected. If the payment form comes from your site, you are usually looking at SAQ A-EP, and that holds true even when the card data goes straight from the customer's browser to the processor. SAQ A-EP includes the quarterly scan requirement. If customers get redirected to the processor's own payment page, or the form sits in an iframe the processor hosts, you probably qualify for SAQ A, which since the January 2025 update asks you to confirm your site is not vulnerable to script attacks instead of requiring an ASV scan. Our SAQ selection guide covers the full decision, but your acquiring bank gets the final say. Plenty of them ask for quarterly scans either way, because a hacked WordPress site can redirect or skim customers no matter where the card form lives.
What the scan checks on a WooCommerce site
The scan looks at your store from the internet, the same way an attacker would. It checks TLS versions and certificates, what services are open on your public IP, software versions with known holes, and common web app weaknesses. On WooCommerce sites we tend to see the same few problems: old TLS protocols the host left turned on, database ports open to the world, and WordPress or plugin versions with known CVEs. Our guide to the top 10 scan failures covers the usual ones and how to fix each.
How to scope the scan
Scan the public IP address or hostname your store actually resolves to. If your store sits behind Cloudflare or another CDN, read our note on ASV scanning behind Cloudflare first, because scanning the CDN edge instead of your real server is the most common scoping mistake we see. Got a staging copy or a separate admin hostname on the same server? They share the same origin, so think about whether they belong in scope too. There is more detail in which IP addresses to scan.
Staying compliant between scans
A quarterly scan is a checkpoint, not a maintenance plan. Keep WordPress, WooCommerce, and every plugin updated, and delete the plugins you stopped using. Use strong admin passwords, turn on two-factor, and let your host patch the server promptly. Stores that treat updates as routine pass their quarterly scans as routine.
Scanning WooCommerce with ServerScan
ServerScan covers one IP address or domain for $59 a quarter or $188 a year. That includes unlimited rescans while you fix things, help reading the report, and the Attestation of Scan Compliance your bank asks for. Most WooCommerce stores can run their first scan the same day they sign up.