Which PCI self-assessment are you — and do you still qualify for the short one?
If you take cards, your bank expects a PCI DSS self-assessment questionnaire (SAQ) each year. Most small businesses on Stripe, Square or Shopify qualify for SAQ A, the shortest — but since 2025 it comes with a new condition about your website's scripts, and our scan can check part of it. Free, about three minutes, nothing stored.
PCI DSS v4.0.1 (SAQ A revised January 2025). Checked October 7, 2026. Not a QSA, not a validation — your acquirer decides which form you file.
1. How do you take card payments?
Tick every one that applies.
The SAQ is about cards. The rest of your security matters too.
The free security baseline check covers what insurers and bigger customers ask about — MFA, backups, updates, email spoofing — and checks what it can against your website.
Check your security baseline→A free guide to help you prepare — not a PCI DSS assessment or validation, and we are not a Qualified Security Assessor (QSA). Your acquirer or payment provider decides which self-assessment you file. The scan reads only the security header your homepage sends; a policy set in a <meta> tag, or only on your checkout page, isn't visible to it.