In August, a client forwarded me an email from their card processor's security vendor. It said their website had failed its quarterly PCI scan. If your business takes cards, you've probably gotten an email like this. Here's what it actually meant, what I did about it, and what to ask whoever runs your site.
What a PCI scan is.
If you take card payments, your processor requires a security scan every quarter of anything on the internet connected to your business, and that usually includes your website. A vendor runs the scan automatically and emails you a pass or a fail. If you stay on a fail, many processors start adding a monthly non-compliance fee to your statement.
Why this one failed.
All four findings were about the same thing: the maintenance access I use to log into the server and keep it updated. Customers never touch it, and it has nothing to do with payments. This client's website doesn't take card payments at all, because bookings go through a separate provider.
The scanner also hadn't tested the server for any of the problems it listed. It read the version number the software advertises and assumed the worst. On the kind of server I run, security fixes get applied without changing that number. It's a bit like a mechanic writing up a recall based on your car's model year, without checking whether the recall work was already done.
What I did.
- Checked the server directly. Every issue the scan listed had already been patched. I recorded the exact versions installed and the publisher's own records of when each fix was released.
- Filed a dispute. I sent the scan vendor a "false positive" dispute with that evidence. They accepted it the next day, and the account went back to passing.
- Fixed the cause. Disputes don't carry over from one quarter to the next, so the same false alarm would have come back every three months. I moved the maintenance access onto a private network, where the scanner, and everyone else on the internet, can't see it at all. Future scans have nothing to flag.
- Told the owners in plain English. They got one email explaining what happened, that no customer data was ever at risk, and that nothing was needed from them.
It didn't cost the client anything extra, because it's part of what hosting and care covers.
What to ask whoever runs your site.
- Who sees the scan results? If they only go to you and you're not sure what they mean, that's the gap to close.
- Does my website handle card data at all? If payments happen on Square, Stripe, or a booking provider's page, your site carries much less risk. It can still get scanned and flagged, though.
- When a scan fails, who handles it? Someone needs to dispute the false alarms, and also fix the cause so the same alarm doesn't come back next quarter.
The point.
This is the unglamorous side of running software for a small business, and it's most of what "hosting and care" means to me. Nothing on the website changed. The owners got a scary email from their processor and, the same day, an email from me saying it was handled.