Which IP Addresses to Scan
Identifying your IP addresses that need external vulnerability scanning performed by an Approved Scanning Vendor (ASV) for your compliance with requirement 11.3.2 of the PCI DSS.
The short answer
Scan every public IP address, and every domain name, at every location that handles card data. That means any place where card data is viewed, received, sent, or stored: a data center, an office, a store, a call center, or a hosted server. ASV scans only look at public addresses, so the devices inside your network are covered through the public IP they sit behind. If you are unsure which IP addresses to configure for ASV scanning, the two steps below will get you a complete list. ServerScan scans each IP address or domain for $59 a quarter, with unlimited rescans.
Step 1: Find the locations that are in scope
Identify all your locations where cardholder data is handled in any way on your network. If cardholder data is viewed, received, transmitted, or stored by any device at a location, then that location is in scope for PCI DSS compliance. Potentially in-scope locations include data centers, offices, stores, call centers, and hosted server environments. A store where the card terminal sends payments over your internet connection usually counts. If the terminal uses its own phone or cellular line, or is part of a validated P2PE solution, that location may not need a scan at all. Your SAQ tells you.
Step 2: List the public IP addresses for each location
Once you know which locations are in scope, identify all the public IP addresses for those locations. The resulting list needs to be scanned by an ASV for compliance with PCI DSS requirement 11.3.2. ASV scans are performed from a public perspective. In other words, ASV scans are only performed on public IP addresses, regardless of the equipment inside your network (point-of-sale devices, database servers, web servers, workstations and so on). Keep in mind that some locations only have a single public IP address, while others have a range of public addresses. Your internet provider's bill or your firewall settings will usually show them. You can also visit a "what is my IP" site from a computer at that location, but that only shows the one address the computer goes out through.
Include your domain names too
One server can host several websites on a single IP address. A scan of the bare IP only reaches whichever site answers first, so the others go unchecked. That's why the ASV rules ask you to list your domain names as well as your IP addresses. Add every domain and subdomain that points at an in-scope server, such as www.example.com, shop.example.com, and mail.example.com.
Web servers: what to put on the list
Your web server is usually the most important address on the list, because it is the one the whole internet can reach. An ASV scan checks every TCP port and the common UDP ports on an address, not just the website, so anything else running on that server gets checked too. Here's what to include for each web server:
- The server's public IP address. This is the real address of the machine, sometimes called the origin. Your hosting company's control panel will show it.
- Every domain the server answers for. That includes
wwwand the bare domain, and any subdomain likeshop,api, oradmin. Don't forget staging or test sites. If they run on a public address in the same environment, they count. - Other services on the same machine. Mail, FTP, SSH, a database port, or a control panel like cPanel or Plesk all show up in the scan. You don't list them separately, but you should know they are there. The easiest way to pass is to close any port you don't need.
- Load balancers and reverse proxies. If traffic reaches your server through one, its public address is in scope too.
If you are on shared hosting, you don't own the IP address, and hundreds of other sites may share it. In that case, list your domain name rather than the IP. The scan still reaches the shared server and every port on it, so check that your host allows scanning first. Findings on services the host runs are theirs to fix or dispute, and you can ask them for their own PCI DSS Attestation of Compliance for the parts they manage.
Sites behind Cloudflare or another WAF
If your site sits behind Cloudflare, Sucuri, Akamai, AWS CloudFront, or any other web application firewall (WAF) or CDN, your domain no longer points at your server. It points at the provider's network. That changes what a scan sees, and it's the most common reason scans fail or come back inconclusive. Here's how to handle it:
- List both your domain and your origin IP. Scanning the domain checks what the public sees at the provider's edge. Scanning the origin IP checks your actual server. If your server accepts connections from the whole internet, it is exposed and in scope, WAF or not. Do not list the provider's own IP addresses as if they were yours. A scan of the bare origin IP may flag a certificate name mismatch, because your certificate is issued for your domain, not the IP. That is expected, and you can mark it as a false positive.
- Let the scanner through. PCI rules say nothing may block or interfere with an ASV scan while it runs. A WAF that challenges or blocks the scanner produces a report that doesn't count. The simplest fix on Cloudflare is to switch your records to "DNS only" (grey cloud) for the scan window, then switch them back. If you can't do that, allow your ASV's scanning IP range in the WAF and pause bot challenges or "under attack" modes until the scan finishes. Our FAQ lists the range our scanners use. If a scan got blocked, fix the setting and run it again. Rescans are included, so that costs nothing extra.
- Lock down the origin. The best setup is an origin firewall that only accepts traffic from your WAF provider's published IP ranges, plus your ASV's range during scans. Then nobody can go around the WAF to reach your server directly.
- Watch for TLS and header findings. Behind a CDN, some findings come from the provider's settings, not your server. Our guide to ASV scan errors behind Cloudflare walks through the usual ones and how to fix them.
Common situations
- Your website runs on a cloud server (AWS, Azure, Google Cloud, DigitalOcean). Scan the server's public IP and any load balancer in front of it. Cloud IP addresses can change when a server is rebuilt, so check your list before each quarterly scan. A reserved or static IP saves you that step.
- Your office has a dynamic IP address. Scan the address you have on the day of the scan, and check it again next quarter. If it changes often, most internet providers will sell you a static IP for a small monthly fee.
- Your checkout is hosted by a payment provider. If your website sends shoppers to a provider's payment page, or shows it in an iframe, the server hosting your own website is usually still in scope. Your SAQ decides this, so check which SAQ you need first.
- You are not sure whether an address is yours. Find out before the scan. You are confirming that your list is complete, and an ASV can only scan addresses you are allowed to scan. Your hosting company or internet provider can tell you which ones belong to you.
How often to scan, and what to keep
An ASV must scan all your public IP addresses for in-scope locations at least once a quarter. After any significant change, you also need an external scan (Requirement 11.3.2.1). That one doesn't have to come from an ASV, but a rescan on your plan covers it. If a scan finds failing issues, fix them and run the scan again until you get a passing report. Assessors typically examine the last 12 months of ASV scan reports (Requirement 11.3.2.a). Keep at least four quarterly passing reports on file, and keeping two to three years of reports is safer.
Internal scanning is a separate requirement
Internal scanning is a different requirement (11.3.1) of the PCI DSS. As the name implies, internal vulnerability scanning is performed from inside a network on internal IP addresses. Unlike external scanning, internal scanning does not need to be performed by an ASV. So most organizations run these internal scans on their own, using a tool such as OpenVAS. Web servers, email servers, VPN servers, and similar devices usually sit on an internal network or DMZ with limited public access. Your ASV scans check the services those devices expose on your public IP addresses. Internal scans also need to run on the same devices, to cover any services that are not publicly reachable.
Scan your list with ServerScan
Once you have your list, each IP address or domain on it is one line on your plan. ServerScan's ASV scanning costs $59 a quarter, or $188 a year (about $47 a quarter), per IP address or domain. Every plan includes unlimited rescans, so you can fix a finding and scan again the same day at no extra charge. You get an Attestation of Scan Compliance with every passing scan, ready to hand to your bank or assessor. And if your site can't pass and our team can't get you there, we refund your order in full, as long as you ask in writing within 30 days of purchase. See the pricing page for the details, or start scanning now.