Handling payment card data comes with real compliance obligations. This guide covers the technical SSL/TLS foundation and general PCI DSS awareness relevant to running an online store on a VPS — not a substitute for formal compliance consultation.
Important Disclaimer
This article covers general technical practices, not formal legal or compliance advice. PCI DSS compliance requirements depend on your specific payment processing setup and transaction volume — consult your payment processor and, where appropriate, a qualified compliance professional for your specific obligations.
The Simplest Path: Avoid Handling Card Data Directly
Using a hosted payment page or client-side tokenization (where your payment processor's own JavaScript collects card details, never touching your server) dramatically reduces your compliance scope compared to directly processing raw card numbers on your own infrastructure — most modern payment gateways (Stripe, PayPal, and others) support this pattern.
Step 1 — Enforce HTTPS Everywhere, No Exceptions
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.comSee HTTP to HTTPS Redirect: Forcing SSL on Nginx & Apache to ensure absolutely no page (not just checkout) is reachable over plain HTTP.
Step 2 — Use Modern TLS Only
See TLS 1.2 vs TLS 1.3: Understanding and Configuring Modern TLS on Nginx & Apache — disable legacy TLS/SSL versions entirely, a standard PCI requirement.
Step 3 — Add HSTS
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;Prevents any accidental downgrade to HTTP for repeat visitors.
Step 4 — Never Log or Store Full Card Numbers
If using a tokenization-based payment flow (recommended), your application should never see or need to store raw card numbers at all — audit your logging configuration to ensure no card data accidentally ends up in application or web server logs.
Step 5 — Keep the Platform and Plugins/Extensions Updated
Outdated e-commerce software and extensions are a common source of security vulnerabilities in payment-handling applications — apply updates promptly, especially anything flagged as security-relevant.
Step 6 — Restrict Admin Panel Access
location /admin {
allow YOUR_TRUSTED_IP;
deny all;
}Limiting admin access reduces the attack surface for the part of your store with the most sensitive access.
Step 7 — Implement a Web Application Firewall
See How to Set Up ModSecurity Web Application Firewall for Nginx/Apache — an additional layer of protection against common web application attacks targeting e-commerce platforms specifically.
Step 8 — Regular Security Scanning
Periodic vulnerability scanning of your store (many payment processors require this for certain compliance levels) helps catch issues before they're exploited — consult your payment processor about specific scanning requirements applicable to your setup.
Understanding PCI DSS Compliance Levels
Compliance requirements scale with transaction volume — smaller merchants typically complete a simpler self-assessment questionnaire, while larger volumes require more extensive validation. Your payment processor can clarify which level applies to your specific business.
Common Errors
Mixed content warnings on the checkout page — verify all resources (images, scripts) load over HTTPS, not HTTP, even on third-party embedded payment widgets.
Continue Reading
- TLS 1.2 vs TLS 1.3: Understanding and Configuring Modern TLS on Nginx & Apache
- E-commerce Security Checklist: Protecting Customer Data on a VPS
- HTTP to HTTPS Redirect: Forcing SSL on Nginx & Apache
Browse more articles in E-commerce Platform Deployment.
