The transition period for PCI DSS 4.0 ended on 31 March 2025. Every organisation that stores, processes or transmits cardholder data now needs to meet all 64 new requirements without exception. More than a year into full enforcement, many mid-market e-commerce operators are still scrambling to close gaps they assumed they could address later.
The Payment Card Industry Security Standards Council first published version 4.0 in March 2022, giving the industry a generous three-year runway. That runway is gone. For UK retailers running platforms such as Magento, Shopware or WooCommerce, the consequences of non-compliance are no longer theoretical.
Compliance now demands tighter control over the entire checkout flow, including the server environment underpinning it. Businesses that rely on hosting for Magento Shops or comparable e-commerce platforms need infrastructure capable of supporting automated patching, web application firewalls and integrity monitoring as standard. A hosting stack that was adequate under PCI DSS 3.2.1 may fall short under the current requirements.
Client-side security moves from optional to mandatory
Among the most consequential additions in PCI DSS 4.0 are requirements 6.4.3 and 11.6.1. The former mandates that businesses inventory and justify every script loaded on payment pages. The latter requires a detection mechanism for unauthorised changes to HTTP headers and payment page content.
Both rules take direct aim at digital skimming attacks, sometimes called Magecart attacks, in which malicious JavaScript is injected into checkout pages to harvest card details. Security researchers at firms such as Sansec have documented thousands of such compromises across Magento-based shops alone. Under PCI DSS 4.0, merchants can no longer treat this as someone else’s problem.
The practical implication is significant. Retailers must now actively monitor what runs inside their customers’ browsers on any page that handles payment data. Script inventories need to be maintained, reviewed and justified in writing. This is a notable shift from earlier versions of the standard, which concentrated almost exclusively on server-side controls.
The hosting layer carries more weight than ever
While client-side controls grab the headlines, the hosting environment remains foundational to PCI compliance. Automated security updates, daily backups, properly configured firewalls and detailed access logging are not optional extras any more. They map directly to multiple control families in version 4.0.
Purpose-built e-commerce hosting providers have a structural advantage here. Hypernode.com, a Netherlands-based specialist that serves over 3,500 e-commerce customers, builds its managed platform around technologies like Varnish, WAF and automated patching specifically for Magento and Shopware environments. That kind of specialisation reduces the compliance burden on merchants and the agencies building their shops, because much of the infrastructure-level control set is handled by default.
Generic shared hosting, by contrast, rarely provides the granular logging, network segmentation or rapid patching cadence that auditors now expect. The gap between hosting built for e-commerce and hosting that merely tolerates it has widened considerably since the 4.0 deadline passed.
What UK enforcement actually looks like
In the United Kingdom, PCI DSS is not enforced through statute. Compliance is contractually required by acquiring banks and card schemes such as Visa and Mastercard. The consequences of failing a compliance assessment range from elevated transaction fees to outright termination of card acceptance privileges.
The exposure is substantial. Office for National Statistics data consistently shows that internet sales account for roughly a quarter of all UK retail transactions. Every one of those card-not-present sales falls within the scope of PCI DSS. The UK remains one of the largest e-commerce markets in Europe, which means the aggregate risk is enormous.
A common misconception among smaller merchants is that outsourcing payments to a provider like Stripe or PayPal eliminates their obligations entirely. PCI DSS 4.0 dispels that notion explicitly. Even merchants using hosted payment pages or iframes must complete a Self-Assessment Questionnaire, and the new client-side script requirements apply to any page that redirects to or contains a payment form.
Practical steps for retailers still closing gaps
The most productive starting point is a gap assessment against the full 4.0 requirement set, conducted by a Qualified Security Assessor or through a detailed self-assessment. Hosting for Magento shops and other open-source platforms deserves particular scrutiny, because these environments typically involve third-party extensions and custom code that expand the attack surface.
Retailers should verify that their hosting provider supports Content Security Policy header enforcement, offers a web application firewall with rulesets tuned for their platform, and maintains audit-quality access logs. These are not niche demands. They are baseline expectations under the current standard.
The three-year grace period gave businesses ample time to prepare. That time has passed. Merchants who treat PCI DSS 4.0 as an administrative formality rather than an operational baseline are exposing themselves to financial penalties, reputational damage and the very real possibility of a breach that could have been prevented.
