PCI DSS 4.0 penetration testing requirements for ecommerce

Penetration testing is mandatory under PCI DSS for any merchant that maintains its own cardholder data environment. PCI DSS 4.0, mandatory since March 2025, tightened the requirements around testing frequency, scope and tester qualifications. If your ecommerce store runs its own checkout infrastructure rather than relying entirely on a hosted payment page, you likely have pen testing obligations.

This article covers what changed in PCI DSS 4.0, how to interpret scope for ecommerce stores, what qualified testing looks like and what to budget.

What PCI DSS requirement 11.4 says

Requirement 11.4 is the primary pen testing requirement in PCI DSS. It has several sub-requirements:

• 11.4.1. A penetration testing methodology is defined, documented and implemented. The methodology must include coverage of the entire CDE perimeter and critical systems, testing from both inside and outside the network, testing to validate segmentation and scope reduction controls, application-layer pen testing, and network-layer pen testing covering operating systems, communication protocols and services.
• 11.4.2. Internal penetration testing is performed at least annually and after any significant infrastructure or application upgrade or change.
• 11.4.3. External penetration testing is performed at least annually and after any significant infrastructure or application upgrade or change.
• 11.4.4. Exploitable vulnerabilities found during pen testing are corrected and testing is repeated to verify that vulnerabilities are resolved.
• 11.4.5. If segmentation is used to isolate the CDE from other networks, pen testing is performed to verify that segmentation methods are operational and effective, and is performed annually and after any changes to segmentation controls.
• 11.4.6. (For service providers only) Internal and external pen testing is performed at least every six months.
• 11.4.7. (For multi-tenant service providers) External pen testing support is provided to customers at least annually.

What changed from PCI DSS v3.2.1

The core pen testing requirements existed in v3.2.1, but 4.0 introduced several meaningful changes:

• Application-layer testing is now explicitly required. Version 3.2.1 required pen testing but was less prescriptive about application-layer coverage. Version 4.0 explicitly requires testing for vulnerabilities as defined in OWASP Top 10 and other application-layer threats. For ecommerce stores, this means your checkout application and admin interface need application-layer testing, not just network-layer testing.
• Authenticated testing is now expected. Version 4.0 guidance emphasizes testing with authenticated access, not just unauthenticated external testing. This means testing the logged-in customer experience, the admin interface and any authenticated API endpoints.
• Segmentation testing requirements are more explicit. If you use network segmentation to reduce your CDE scope, the segmentation testing requirements are clearer about what must be verified: that the segmentation actually prevents access between in-scope and out-of-scope networks.
• The methodology must be documented. You need a written pen testing methodology, not just results. This methodology needs to specify how scope is defined, what testing methods are used and how results are evaluated.

Who needs pen testing

Pen testing requirements under requirement 11.4 apply to merchants who have a cardholder data environment (CDE) that they control. Whether this applies to your ecommerce store depends on your payment integration:

• Full redirect to hosted payment page. If customers leave your site entirely to enter card details on a payment processor's domain, you may have minimal or no CDE. Requirement 11.4 may not apply if your entire payment processing is outsourced. Confirm this with a QSA.
• Iframe-based payment form on your site. Your checkout page is in scope. The page where the iframe loads is part of your CDE's perimeter because scripts on that page execute in the same browser session as the payment form. Pen testing applies.
• Self-hosted checkout with payment tokenization. Your checkout application, servers, databases and network infrastructure are all in scope. Full pen testing requirements apply. Review the CSP header requirements alongside pen testing obligations.
• Shopify Plus merchants. Shopify maintains PCI compliance for its own infrastructure. Merchants are responsible for any custom code, apps and integrations they add. If you use Shopify's standard checkout, your CDE is small but may still require some testing for the components you control.

Scope: what needs to be tested

Defining scope correctly is the most important step in pen testing planning. Testing too broadly wastes money. Testing too narrowly leaves gaps that QSAs and attackers will find.

For a typical ecommerce store with a self-hosted checkout, scope includes:

• CDE systems. Web servers, application servers and databases that process, store or transmit cardholder data. For most ecommerce stores, this is the checkout application and order management system.
• Systems connected to the CDE. Any system that has network connectivity to CDE systems. This often includes marketing analytics platforms, ERP integrations, fraud detection services and customer service tools.
• CDE perimeter. Firewalls, load balancers, WAFs and other network controls that form the boundary of the CDE.
• Segmentation controls. If you use network segmentation to isolate your CDE, the segmentation mechanisms themselves need to be tested.
• Web application layer. The checkout application, customer account portal, admin interface and any APIs used by these applications.

Internal vs external testing

PCI DSS 4.0 requires both internal and external penetration testing:

• External pen testing simulates an attacker with no prior access to your environment. The tester starts from the internet and attempts to reach in-scope systems. For ecommerce, this includes your checkout application, APIs and admin interfaces accessible from the internet.
• Internal pen testing simulates an attacker who has already gained some access to your environment, either through compromised credentials, a compromised third-party system or physical access. The tester starts from inside your network or with limited-privilege access and attempts to reach cardholder data.

For smaller ecommerce stores hosted in cloud environments (AWS, GCP, Azure), "internal" testing often means testing from within the same VPC or network segment as your application servers. The distinction becomes relevant for cloud environments where you need to test whether network security groups and VPC configurations actually prevent lateral movement.

Qualified tester requirements

PCI DSS 4.0 requires that pen testing be performed by "a qualified internal resource or qualified external third party." The standard does not mandate specific certifications but notes that organizational independence is required (the tester cannot test their own work).

In practice, the following credentials are widely recognized for PCI pen testing engagements:

• CREST CPEN or CREST CPSA. CREST (Council of Registered Ethical Security Testers) certifications are widely recognized for PCI pen testing. CREST-certified firms are listed on the CREST website and are generally preferred by QSAs and acquirers.
• OSCP (Offensive Security Certified Professional). A hands-on certification from Offensive Security, recognized as evidence of practical pen testing ability. Many QSAs accept OSCP as qualification evidence.
• CEH (Certified Ethical Hacker). Less technically rigorous than OSCP or CREST but widely recognized. Accepted by many QSAs for lower-complexity environments.
• PCI QSA with pen testing practice. A Qualified Security Assessor who specializes in pen testing can conduct both the test and the compliance assessment. Useful if you want a single engagement that covers both.

The key requirement is that the tester can demonstrate competence and has organizational independence from the systems being tested.

Ecommerce-specific test scenarios

A PCI pen test for an ecommerce store should include scenarios specific to the ecommerce attack surface:

• Payment form tampering. Testing whether an attacker can modify the checkout form to redirect card data, add hidden fields or override payment processor endpoints. Our guide on payment page security covers the full set of controls that pen testers will evaluate.
• Order manipulation. Testing whether authenticated customers can modify order amounts, access other customers' orders or manipulate pricing through API calls or parameter tampering.
• Admin interface security. Testing the store admin (Shopify Admin, WooCommerce admin, Magento Admin) for authentication weaknesses, insecure direct object references and privilege escalation.
• API security. Testing storefront APIs, headless commerce APIs and third-party integration APIs for authentication bypass, injection vulnerabilities and data exposure.
• Payment processor integration. Testing the integration between your checkout and your payment processor for vulnerabilities such as replay attacks, amount manipulation and webhook verification bypass.
• Third-party script injection. Testing whether an attacker with access to GTM or another tag management system could inject malicious scripts onto payment pages without detection.
• Authenticated session security. Testing whether customer sessions can be hijacked, whether session tokens are securely handled and whether authentication mechanisms resist brute force attacks.

Vulnerability scanning vs penetration testing

These terms are often confused. The distinction matters for PCI compliance:

• Vulnerability scanning uses automated tools to identify known vulnerabilities in systems. It is required by PCI DSS requirement 11.3 (internal scans quarterly, external scans quarterly by an Approved Scanning Vendor). It does not involve manual exploitation and does not test whether vulnerabilities are actually exploitable in your specific environment.
• Penetration testing involves a human tester attempting to actually exploit vulnerabilities to gain unauthorized access. It tests not just for known vulnerabilities but for logic flaws, configuration weaknesses and vulnerability combinations that automated scanners miss. It is required by requirement 11.4.

Vulnerability scanning is not a substitute for penetration testing. Both are required. Merchants sometimes believe they have satisfied pen testing requirements with automated scanning. They have not.

Cost ranges

PCI pen testing costs vary significantly based on scope, environment complexity and tester credentials:

• Simple ecommerce (hosted platform, limited custom code). $5,000 to $10,000 for an external web application pen test covering checkout and admin interfaces.
• Mid-market ecommerce (self-hosted, custom integrations). $10,000 to $25,000 for combined internal and external testing covering application and network layers.
• Complex ecommerce (custom platform, multiple environments, segmentation testing). $25,000 to $60,000 for comprehensive testing including segmentation verification and authenticated application testing.
• Remediation retesting. Most vendors charge $1,500 to $5,000 to retest specific vulnerabilities after remediation. This is required by requirement 11.4.4.

These are annual costs. The annual cadence is the minimum; testing is also required after significant changes. A major checkout redesign, a platform migration or a new payment processor integration should trigger a new pen test.

Practical preparation steps

Before engaging a pen testing firm, take these steps to maximize value from the engagement:

• Define and document your CDE scope. List every system that processes, stores or transmits cardholder data, plus every system connected to those systems.
• Prepare test credentials at multiple privilege levels: guest/unauthenticated, standard customer, high-value customer (if different permissions apply) and admin.
• Create a test environment that mirrors production as closely as possible, or arrange testing during low-traffic periods in production with appropriate change freeze windows.
• Brief your security and operations teams on the testing schedule so they do not respond to testing activity as a real attack (while also not giving them advance notice of specific test scenarios).
• Review your vulnerability management process so you can respond quickly to findings. The faster you can remediate and retest, the sooner the engagement closes.
• Request a test plan from your vendor before work begins. The plan should document scope, methodology and deliverables. This becomes part of your required pen testing methodology documentation.

Frequently asked questions

Does PCI DSS 4.0 require penetration testing for ecommerce?

Yes, if your store maintains its own cardholder data environment. Merchants using iframe-based payment forms or self-hosted checkout need annual internal and external pen testing under Requirement 11.4. Stores using full redirect to hosted payment pages may be exempt.

How much does PCI DSS penetration testing cost?

Costs range from $5,000 to $10,000 for simple hosted platform stores, $10,000 to $25,000 for mid-market self-hosted stores and $25,000 to $60,000 for complex custom platforms. Remediation retesting adds $1,500 to $5,000.

What is the difference between vulnerability scanning and penetration testing?

Vulnerability scanning uses automated tools to identify known vulnerabilities. Penetration testing involves a human tester manually attempting to exploit vulnerabilities, test logic flaws and find configuration weaknesses that automated scanners miss. Both are required by PCI DSS.

What changed in PCI DSS 4.0 penetration testing requirements?

Version 4.0 explicitly requires application-layer testing (including OWASP Top 10), authenticated testing with logged-in access, documented methodology and more explicit segmentation verification.