WooCommerce i PCI DSS: Šta e-prodavnica mora da ispuni

← Blog

Šta je PCI DSS?

PCI DSS (Payment Card Industry Data Security Standard) je standard koji je uspostavio PCI Security Standards Council — konzorcijum Visa, Mastercard, American Express, Discover i JCB. Primenjuje se na svaku organizaciju koja prihvata, obrađuje, čuva ili prenosi podatke platnih kartica.

Važno: PCI DSS nije zakon u pravnom smislu, ali ga banke i payment procesori nameću ugovorom. Kršenje može rezultovati kaznama ($5.000–$100.000 mesečno), povećanim transakcijskim naknadama, a u najgorem slučaju — gubitkom sposobnosti prihvatanja kartica.

Kako vaša WooCommerce prodavnica obrađuje plaćanja?

Odgovor na ovo pitanje određuje koji nivo PCI compliance se od vas zahteva:

Scenario A: Hosted payment page (Stripe Checkout, PayPal redirect)

Kupac klikne "Plati" i bude preusmeren na stranicu payment procesora. Podaci kartice NIKADA ne prolaze kroz vaš server. Ovo je SAQ A — najjednostavniji upitnik, oko 22 kontrole.

Scenario B: iFrame ili embedded forma

Stripe Elements, Braintree Drop-in UI — forma se prikazuje na vašem sajtu ali je hostovana od procesora (iFrame). Vaš server ne vidi podatke kartice. Ovo je SAQ A-EP ili SAQ A zavisno od implementacije.

Scenario C: Direktna forma na vašem sajtu

Kupac upisuje podatke kartice direktno u formu na vašem sajtu, a podaci prolaze kroz vaš server pre slanja procesoru. Ovo je SAQ D — 329 kontrola, ekvivalent pune PCI revizije. Izbjegavajte po svaku cenu.

SAQ A zahtevi za WooCommerce

Čak i sa najjednostavnijim SAQ A pristupom, imate obaveze prema vašem sajtu:

• HTTPS sa važećim sertifikatom (TLS 1.2 minimum, TLS 1.3 preporučeno)
• Zabrana TLS 1.0 i TLS 1.1
• Redovna ažuriranja WordPress core, plugin-ova i PHP
• Jake admin lozinke i 2FA
• Ograničen pristup administracionom interfejsu
• Anti-skimming mere (Magecart napadi)

Magecart: Web Skimming napadi

Magecart je vrsta napada gde napadač ubacuje maliciozni JavaScript koji "skimuje" podatke kartice direktno iz payment forme u korisnikovom browseru — čak i kad koristite hosted payment processor. Ubacivanje se dešava kroz kompromitovane plugin-ove ili CDN resurse.

Zaštita: Subresource Integrity (SRI) za sve externe JS resurse, CSP koji ograničava connect-src, regular integrity monitoring ekstirnih skripti, log review za neočekivane promene fajlova.

PCI DSS 4.0 (aktivan od 2024)

PCI DSS verzija 4.0 uvodi nove zahteve relevantne za web prodavnice:

• Obavezno upravljanje eksternim skriptama (SRI, CSP) — direktan odgovor na Magecart
• Multi-Factor Authentication za sve non-consumer naloge koji pristupaju payment sistemima
• Targeted risk analysis za određivanje frekvencije testiranja
• Poboljšani zahtevi za pentest i vulnerability scanning

Shieldome Scout proverava TLS konfiguraciju, security headers (CSP, SRI), izložene admin putanje i SSL greške koje su direktno relevantne za PCI DSS compliance vašeg checkout flow-a.

← Blog

What Is PCI DSS?

PCI DSS (Payment Card Industry Data Security Standard) is a standard established by the PCI Security Standards Council — a consortium of Visa, Mastercard, American Express, Discover, and JCB. It applies to every organization that accepts, processes, stores, or transmits payment card data.

How Does Your WooCommerce Store Process Payments?

The answer to this question determines which level of PCI compliance is required from you:

Scenario A: Hosted payment page (Stripe Checkout, PayPal redirect)

The customer clicks "Pay" and is redirected to the payment processor's page. Card data NEVER passes through your server. This is SAQ A — the simplest questionnaire, around 22 controls.

Scenario C: Direct form on your site

The customer enters card data directly in a form on your site, and the data passes through your server before being sent to the processor. This is SAQ D — 329 controls, equivalent to a full PCI audit. Avoid at all costs.

Magecart: Web Skimming Attacks

Magecart is a type of attack where an attacker injects malicious JavaScript that "skims" card data directly from the payment form in the user's browser — even when using a hosted payment processor. Injection occurs through compromised plugins or CDN resources.

Protection: Subresource Integrity (SRI) for all external JS resources, CSP restricting connect-src, regular integrity monitoring of external scripts.

PCI DSS 4.0 (Active Since 2024)

PCI DSS version 4.0 introduces new requirements relevant to web stores:

• Mandatory management of external scripts (SRI, CSP) — a direct response to Magecart
• Multi-Factor Authentication for all non-consumer accounts accessing payment systems
• Improved pentest and vulnerability scanning requirements

Shieldome Scout checks TLS configuration, security headers (CSP, SRI), exposed admin paths, and SSL errors that are directly relevant to PCI DSS compliance for your checkout flow.