Quarterly scans, and whether you actually need one.
If something in your payment environment faces the internet, it has to be scanned quarterly by an approved vendor. If nothing does, you do not need a scan at all, and plenty of merchants are paying for one they never required.
What this page settles.
Three questions, in the order most people ask them.
What the scan actually does
An external vulnerability scan probes your internet-facing systems the way an attacker would, looking for known weaknesses: unpatched software, weak configuration, exposed services, expired certificates.
It is run by an Approved Scanning Vendor — a company accredited by the PCI Security Standards Council — and where it applies, it is required quarterly.
It is automated. You provide the addresses to scan, it runs, and you get a report. Nobody visits.
Who needs one
The test is whether anything in your card data environment is reachable from the internet.
Generally not needed:
- A standalone terminal connecting directly to the processor, with nothing internet-facing in the payment path.
- An online store where the checkout belongs entirely to your gateway and card data never touches your server.
Generally needed:
- A payment page on your own website that receives or influences card data.
- A point-of-sale system or server in your card environment that is reachable from outside.
- A virtual terminal running on a machine inside a network with internet-facing services in scope.
The questionnaire you complete tells you. Which SAQ applies and whether scanning is required are answered together, which is why the two pages belong side by side.
If you are unsure, ask your acquirer rather than guessing. Both wrong answers cost: scanning you do not need is wasted money, and not scanning when you should leaves an attestation that is not accurate.
What a failed scan means
Not a penalty. A list.
A scan reports findings by severity. Anything above a threshold has to be remediated and the scan re-run until it passes. For a typical small business site the findings are mundane — an out-of-date software version, a weak cipher still enabled, a certificate configuration.
Three practical points:
Your web host usually fixes most of it. Send them the report. A decent host handles patching and TLS configuration as a matter of course.
Allow time before your validation date. Remediating and rescanning takes longer than people plan for, particularly if a third party has to act.
A finding is not a breach. It is a weakness that could be exploited. Finding them is the point of the exercise.
Where it goes wrong
Paying for a scan that was never required. Bundled into a PCI program fee for a merchant with a single standalone terminal. Worth checking what you are paying for.
Scanning the wrong addresses. A scan pointed at a marketing site while the actual checkout lives somewhere else proves nothing. Make sure the vendor has the right targets.
Scanning once and forgetting. It is quarterly. A single pass in January does not cover the year, and lapsed scanning is one of the quieter routes to a non-compliance fee.
Nobody reads the report. It arrives, it is filed, and the findings sit there until next quarter finds them again. If something is worth scanning for it is worth fixing.
Assuming hosted means exempt without checking. Some integrations that look hosted still put your site in scope, because your page can affect the payment. The detail matters and your gateway can tell you.
What we charge
Interchange + 0.50% + 10¢ in person, interchange + 0.75% + 25¢ keyed. No PCI program fee and no non-compliance fee.
Where your setup genuinely requires scanning we will point you at an approved vendor and tell you what it costs. Where it does not, we will tell you that too — which is the more common answer for the merchants who ask us.
While we are on the subject
Who runs the scan?
An Approved Scanning Vendor. Your processor’s compliance portal usually includes one, which is part of what a PCI program fee pays for.
What if the scan fails?
You fix what it found and rescan. A failed scan is not a penalty, it is a to-do list, and most findings on a small business site are routine patching or configuration.
Does it scan my website or my payment system?
It scans the internet-facing systems in your card data environment. For most small merchants that means the web server that hosts or touches the checkout.
Do I need one for a Shopify or hosted store?
Generally not, if the payment page is entirely the provider’s and card data never reaches your systems. Confirm it rather than assume, because integration details matter.