Blog · What is X · 2026-11-09

Stripe Checkout PCI: What Small Online Stores Must Know

You want to accept cards and get paid without turning your site into a security project. If you are a small store, PCI can feel like a maze. The good news: sending customers to Stripe Checkout keeps card data off your site and shrinks your PCI scope. Here is how that works, what you still have to handle, and a dead-simple way to add a cart and Stripe payments to any site.

How Stripe Checkout reduces your PCI scope

Stripe Checkout is a hosted payment page. When a shopper clicks to pay, they are sent to a Stripe domain or a Stripe-hosted modal, enter their card there, and then return to your site. Because cardholder data never passes through your servers, Stripe takes on the heavy technical controls required by PCI DSS.

What this means in practice:

• No raw card data on your domain. Your site never collects, stores, or transmits the PAN (primary account number). Stripe tokenizes card data and returns only non-sensitive references to your system.
• Stripe carries the processor obligations. Stripe is a PCI DSS Level 1 service provider and maintains the infrastructure, audits, and controls for secure card processing.
• You usually qualify for a shorter SAQ. If all payment capture is on Stripe’s page and you do not embed card fields, you can typically complete SAQ A instead of SAQ A-EP. Your acquirer has the final say, but Checkout is designed to minimize your scope.

If you instead host any payment inputs on your own pages, even via client-side JavaScript, your scope increases. That can require stricter controls and a longer assessment. Using a pure redirect or hosted modal keeps things simpler.

Your responsibilities: the minimum you still must do

Hosted checkout does not remove you from PCI entirely. You still need sensible security on your site and account. Focus on the areas below to stay within the intended scope and avoid preventable fraud or data issues.

Security on your website

• Use HTTPS everywhere. Serve your whole site over TLS, redirect HTTP to HTTPS, and renew certificates automatically. Turn on HSTS if your platform supports it.
• Keep software current. Patch your CMS, framework, themes, and plugins. Remove anything you do not use. Outdated add-ons are a common way attackers inject scripts or redirects.
• Be deliberate with third-party scripts. Limit analytics and widgets, especially on cart pages. A lean page is faster and gives attackers fewer places to hide malicious code. If you use a Content Security Policy, allowlist only the scripts you need.
• Do not collect card details anywhere. Never ask customers for card data over chat, email, or support forms. That would pull you out of the hosted scope and create data you must protect.

Security on your Stripe and store accounts

• Enable 2FA for every user. Protect your Stripe login, AddTheShop login, and email accounts. Use an authenticator app, not SMS, where possible.
• Handle API keys carefully. Keep secret keys on the server or in your platform’s secret manager. Never commit keys to a repo or expose them in client-side code. Rotate keys if you suspect exposure.
• Use least-privilege roles. Give teammates only the access they need. Review access when people change roles or leave.

Compliance housekeeping

• Complete the right SAQ. With a fully hosted checkout and no card data on your systems, you will usually complete SAQ A. Your acquirer can confirm what they expect and how often.
• Document the flow. Keep a short note that explains how your checkout works, what data you store, and what Stripe stores. This helps when banks ask questions or your team grows.
• Reduce chargebacks with clarity. Show clear prices, shipping terms, refund policy, and contact info. Good communication prevents disputes.

SCA and 3D Secure: what your shoppers will see

Strong Customer Authentication (SCA) is required for many European online card payments. Banks often use 3D Secure to meet that requirement. During 3DS, a bank may ask the buyer to confirm in their app or enter a one-time code. Stripe Checkout supports these flows out of the box, and only prompts when the bank says it is needed.

Ways to keep conversions healthy when SCA shows up:

• Set expectations. A short note like “Your bank may ask you to confirm this payment” reduces confusion. Add it near the pay button.
• Trim pre-checkout friction. Keep the cart page light with only the fields you truly need before sending the customer to pay. Fewer steps means fewer drop-offs when a 3DS challenge appears.
• Test with SCA test cards. Run a few end-to-end tests in test mode so you know what the prompts look like and your emails and receipts line up.

For subscriptions or saved cards, off-session charges may also trigger 3DS. Stripe can handle those with follow-up emails or retries when required, but expect some customers to need to re-authenticate now and then.

AddTheShop: one-line cart that sends buyers to Stripe

If you want to add ecommerce to an existing site without building a backend, AddTheShop gives you a one-line install and routes checkout to Stripe. You paste a single script tag, your site gets a cart that opens Stripe Checkout for payment, and funds settle to your own Stripe account on Stripe’s payout schedule.

How it fits with PCI and day-to-day operations:

• Hosted payment, minimal scope. Card entry happens on Stripe’s page, not on your domain, so you avoid handling card data.
• Works on any HTML site. Use it with builders and frameworks like Lovable, Bolt, Cursor, Webflow, Framer, Astro, Next, Replit, or plain HTML. It is a clean fit for headless ecommerce on static sites.
• Cart and product grid. Drop an embeddable product grid on a /shop page with prices and Buy buttons. It acts like a buy button snippet but includes cart logic and a grid layout.
• Manage products and orders your way. Add products, prices, photos, and stock via chat with your AI or in the dashboard. Orders appear in your AddTheShop dashboard and you get email notifications.
• AI-managed store support. Claude, Cursor, ChatGPT, and MCP clients can add products, change prices, and read orders with your secret key. Treat that key carefully and rotate it if it is exposed.
• Machine-readable catalog. Your catalog is available in a format shopping assistants can read, which helps future agents find your products and prices.
• Stripe direct payouts. Payments land in your Stripe account. AddTheShop is not the seller of record.
• Simple pricing. Free to start. AddTheShop takes 2% per sale on top of Stripe’s fee.

Quick security checklist when you install:

• Serve your site over HTTPS and redirect HTTP to HTTPS.
• Keep your site’s dependencies up to date. Remove unused plugins and scripts.
• Store your AddTheShop secret key in environment variables or your platform’s secret manager. Do not commit it to a repo or paste it client-side.
• Enable 2FA on your Stripe and AddTheShop accounts.
• Test a full order, refund, and receipt flow before going live. Include an SCA test.

Quick examples:

• Static portfolio selling prints. A photographer on Astro pastes the AddTheShop script, adds a /shop grid, and ships prints. Checkout opens on Stripe, which keeps PCI scope simple.
• Webflow landing selling a course. The creator drops a Buy button grid onto /shop. Cart routes buyers to Stripe Checkout. Orders show up in the dashboard, with no card data on their site.
• Next.js docs site selling add-ons. One line adds cart and products. An AI agent updates prices during a sale using the secret key stored in server-side env vars, never in the browser.

Key takeaways

• Stripe Checkout hosts the payment page, so Stripe handles card data and the technical PCI controls.
• You still secure your site, protect keys, use HTTPS, and complete the right SAQ for your setup.
• SCA and 3D Secure are built into Stripe Checkout, which lowers friction when banks ask for extra checks.
• AddTheShop adds a cart and sends buyers to Stripe Checkout with one script, works on any HTML site, and pays out to your own Stripe account.

stripe checkout pci compliance ecommerce payments static sites