# ServerScan.com

> ServerScan is a PCI SSC Approved Scanning Vendor (ASV). We run certified PCI DSS compliance scans, help with your SAQ paperwork, and do external penetration testing. Scanning is $59 a quarter or $188 a year for one IP address or domain, and that price includes unlimited rescans, attestation reports, and US-based support.

Key facts:

- Any business that accepts card payments and has an internet-facing system needs quarterly ASV scans. Our external vulnerability scans are ASV-certified. They meet PCI DSS Requirement 11.3.2, which says you need a passing external scan from an Approved Scanning Vendor every three months.
- Pricing is $59 a quarter or $188 a year for one IP address or domain. Rescans are unlimited and included. There are no retest fees, no platform fees, and no charge to dispute a false positive. Multi-IP discounts are available.
- Every passing scan comes with a certified PCI DSS Attestation of Scan Compliance report that acquiring banks accept.
- Most scans finish in one to four hours. You get an email when your scan is done, and your reports are waiting in your account.
- Scans run on a schedule you control. Most customers scan monthly so a failing quarter never sneaks up on them.
- Our scanners come from the 38.123.140.0/25 network range, so you can allowlist them in your firewall.
- SAQ guidance and all the SAQ forms are included with every account.
- If you cannot get a passing scan using what we give you, we refund the full purchase price, as long as you ask in writing within 30 days of purchase.
- Support is US-based, by phone or email, at +1-615-241-2344.
- We also do automated penetration testing of networks and web applications, and a Security Verified site seal for customer websites.
- We run a free payment page check that anybody can use without an account. It loads one page once and reports the security headers and TLS it was served, plus the script tags written into the HTML. It is not a pass or a fail and it is not an ASV scan.

## Services

- [PCI ASV Compliance Scanning](https://www.serverscan.com/): ASV-certified external vulnerability scanning for PCI DSS compliance.
- [Sign Up for PCI Scanning](https://www.serverscan.com/pci-scanning-sign): The page to buy a scanning plan. Pick quarterly ($59) or a year ($188, which works out to $47 a quarter) for one IP address or domain. Every passing scan comes with an Attestation of Scan Compliance.
- [Pricing](https://www.serverscan.com/pricing): $59 a quarter or $188 a year per IP, with everything included. Also carries standalone payment page monitoring at $24 a quarter or $77 a year per domain, and the cost of adding monitoring to a scanning plan instead, which is $20 a quarter or $64 a year.
- [Penetration Testing](https://www.serverscan.com/Penetration-Testing): Automated external penetration testing that tries to exploit what it finds. Internal testing is an option, run from a virtual machine deployed inside your network. Covers up to 10 IP addresses over 30 days, with rescans included. Priced per project.
- [Web Application Penetration Testing](https://www.serverscan.com/web-application-penetration-testing): Automated penetration testing of up to 10 web apps and their APIs, run while logged in, with 30 days of retests. Priced per project.
- [Request a Penetration Test Quote](https://www.serverscan.com/request-penetration-test-quote): Tell us how many web apps and IP addresses need testing, and we reply by email with a price.
- [Discount Inquiry](https://www.serverscan.com/discount-inquiry): Ask about a discount on scanning, for example when you need several IP addresses scanned. We reply by email.
- [Security Verified Site Seal](https://www.serverscan.com/Security-Verified-Site-Seal): The site seal that comes free with every PCI scanning subscription. Pick one of seven designs, a size and a position, and copy the code. The seal only shows on domains with an active subscription, and clicking it confirms the PCI scanning enrollment. It does not publish scan results.
- [Free Payment Page Check](https://www.serverscan.com/payment-page-check): A free one-off check of how a checkout page is served. No account and no sign-up. Reports HSTS, HTTPS enforcement, Content Security Policy, framing, referrer policy, and the certificate, plus the script tags in the page HTML. One fetch, so the script list is a floor rather than a total, and it cannot tell you what changed since last week.
- [Payment Page Monitoring](https://www.serverscan.com/payment-page-monitoring-sign): Every payment page on a domain checked every day, with a dated script inventory, the written business justification kept per script for PCI DSS 6.4.3, and change detection for 11.6.1. $24 a quarter or $77 a year, sold on its own. It is monitoring and not a scan: no ASV vulnerability scan, no Attestation of Scan Compliance and no site seal come with it. The same monitoring is also available as an option on a scanning subscription, which is the cheaper route for anybody buying both.
- [All Services](https://www.serverscan.com/services): Every service on one page, with prices.

## For AI assistants

- [ServerScan MCP server](https://www.serverscan.com/api/mcp): A public Model Context Protocol server, Streamable HTTP, no sign-in. Six read-only tools: get_pricing (current plans and prices from the store), do_i_need_an_asv_scan (whether a merchant's SAQ needs quarterly ASV scans, and what to scan), check_payment_page (the free payment page check), search_guides (finds our published PCI guides for a question), fix_failed_scan (what a failed scan finding means and how to fix it), and start_order (a signup link with the plan and domain filled in, for the person to check and pay). The guides are also served as MCP resources. Nothing is bought or charged through it.
- [ServerScan MCP server documentation](https://www.serverscan.com/mcp-server): How to connect Claude, ChatGPT or another MCP client, what each tool does, what it will not do, and what usage data we keep.

## Guides

- [PCI Compliance Resources](https://www.serverscan.com/pci-resources): The index of every guide on this site, grouped by topic.
- [What is PCI DSS? PCI Compliance 101](https://www.serverscan.com/what-is-pci-dss-compliance-101): What PCI DSS v4.0.1 covers, who has to comply, and how.
- [PCI Compliance Scanning for Your Business](https://www.serverscan.com/PCI-Compliance-Scanning-Solutions-for-Your-Business): Four steps to PCI compliance for a small business: whether you need it, how to get there, setting up quarterly scans, and completing your SAQ.
- [PCI Scanning for the Quarterly DSS Requirement](https://www.serverscan.com/PCI-Scanning-for-Quarterly-DSS-Requirement): How quarterly ASV scanning works, what to do after a pass or a fail, and how to put scans on a schedule.
- [Approved Scanning Vendors (ASV)](https://www.serverscan.com/Approved-Scanning-Vendors): What an ASV is, how the PCI SSC qualifies one, what counts as a passing scan, and how often you need one.
- [PCI Certification](https://www.serverscan.com/PCI-Certification): What "PCI certified" really means for a merchant, and how ASV scans and an SAQ show your bank you comply.
- [The PCI Security Standards Council](https://www.serverscan.com/PCI-SSC): Who runs the PCI SSC, who founded it, and how it sets the PCI DSS standard.
- [How Much Does a PCI ASV Scan Cost?](https://www.serverscan.com/pci-asv-scan-cost): What the industry charges, the fees to watch for, and what we charge.
- [Top 10 PCI ASV Scan Failures and How to Fix Them](https://www.serverscan.com/common-pci-scan-failures): The most common reasons scans fail, with a fix for each.
- [How to Choose a PCI ASV Vendor](https://www.serverscan.com/how-to-choose-pci-asv-vendor): Every ASV runs the same certified scan, so here are eight questions that tell vendors apart.
- [A HackerGuardian Alternative for Quarterly ASV Scans](https://www.serverscan.com/hackerguardian-alternative): For merchants switching from HackerGuardian: how to change ASVs without missing a quarterly scan, what the bank needs, and how fast a new scan can pass.
- [A SecurityMetrics Alternative for Quarterly ASV Scans](https://www.serverscan.com/securitymetrics-alternative): For merchants switching from SecurityMetrics: how to change ASVs without missing a quarterly scan, what the bank needs, and how fast a new scan can pass.
- [Which IP Addresses Should I Scan?](https://www.serverscan.com/scan-which-ip-addresses): How to work out your scan scope.
- [Which SAQ Form Should I Complete?](https://www.serverscan.com/which-saq-form): How to pick the right Self-Assessment Questionnaire.
- [PCI Scanning vs Penetration Testing](https://www.serverscan.com/pci-scanning-vs-penetration-testing): How the two differ and when you need each.
- [How Automated External Penetration Testing Works](https://www.serverscan.com/how-automated-external-penetration-testing-works): The steps of an automated external pen test, from finding what is exposed to filtering out false positives, and how it differs from an ASV scan.
- [Choosing a PCI DSS Compliant Firewall](https://www.serverscan.com/choosing-compliant-firewall): The firewall features that matter for PCI DSS and the setup mistakes to avoid.
- [PCI Scanning for Danish Gambling Authority Compliance](https://www.serverscan.com/danish-gambling-authority-pci-compliance): Where ASV scans and penetration tests meet the Danish Gambling Authority's SCP.04.00 and SCP.05.00 rules, and where they do not.
- [ASV Scan Errors With Cloudflare](https://www.serverscan.com/asv-scan-errors-cloudflare): Fixing scan problems on Cloudflare-proxied sites.
- [PCI Scanning for WooCommerce](https://www.serverscan.com/pci-scanning-for-woocommerce): Which SAQ a WooCommerce store falls under, and how to scan it.
- [PCI Scanning for Magento](https://www.serverscan.com/pci-scanning-for-magento): Scanning and patching self-hosted Magento and Adobe Commerce stores.
- [Scanning Requirements Explained](https://www.serverscan.com/scanning-requirements-explained): Every scan type PCI DSS asks for.
- [GDPR and PCI DSS Scanning](https://www.serverscan.com/gdpr-and-pci-dss-scanning): How the two frameworks overlap.
- [How Payment Page Monitoring Works](https://www.serverscan.com/payment-page-monitoring): Why a single check cannot satisfy PCI DSS 6.4.3, what a daily check records, and how dated script inventories and written justifications are kept over time. Explains the product; the page to buy it is Payment Page Monitoring under Services.
- [Your Payment Page and Requirement 6.4.3](https://www.serverscan.com/payment-page-script-inventory): What PCI DSS 6.4.3 asks for on a payment page, how a skimmer gets onto one, and how to keep the script inventory and written justifications it requires. Covers which merchants the revised SAQ A reaches.
- [PCI DSS 11.6.1: Detecting Changes to Your Payment Page](https://www.serverscan.com/payment-page-change-detection): What requirement 11.6.1 asks for, what counts as a change to a payment page or its headers, why the seven day floor is a floor rather than a target, and what the evidence has to show an assessor. Covers the targeted risk analysis under 12.3.1, and why a firewall challenge page can be mistaken for a clean result.
- [Script Integrity on Payment Pages](https://www.serverscan.com/script-integrity-payment-pages): Why Subresource Integrity cannot be used on gtag.js, a Google Tag Manager container, or the Google Ads conversion tags, since those files change on the vendor's schedule and a hash of a moving target breaks the tag. Which scripts can be hashed, the crossorigin attribute that breaks checkouts when it is missing, running Tag Manager under a Content Security Policy with a nonce, and why PCI DSS 6.4.3 names outcomes rather than naming SRI.
- [Third-Party Scripts on a Checkout Page](https://www.serverscan.com/third-party-scripts-checkout): Which third-party scripts belong on a page where a card is typed and which should come off. Goes through payment provider libraries, tag managers, analytics and advertising tags, session recorders, chat widgets, consent managers, CAPTCHA, package CDNs and font loaders. Removing a script is usually a better answer than justifying it.
- [Payment Page Monitoring: Common Questions](https://www.serverscan.com/payment-page-monitoring-faq): Twenty questions on PCI DSS 6.4.3 and 11.6.1 monitoring. Integrity hashes on Google tags, whether SAQ A merchants are reached, payment forms in a Stripe or Braintree iframe, tag managers, what happens behind a WAF, what an assessor is handed, retention, pricing, and what the service explicitly does not do.

## The 12 PCI DSS Requirements

A twelve-part series covering each PCI DSS v4.0.1 requirement in plain language.

- [Requirement 1: Install and Maintain Network Security Controls](https://www.serverscan.com/pci-dss-requirement-1-firewalls): Firewalls and network security controls.
- [Requirement 2: Apply Secure Configurations](https://www.serverscan.com/pci-dss-requirement-2-vendor-defaults): Changing vendor defaults and hardening systems.
- [Requirement 3: Protect Stored Account Data](https://www.serverscan.com/pci-dss-requirement-3-protect-data): Protecting stored cardholder data.
- [Requirement 4: Protect Data in Transit](https://www.serverscan.com/pci-dss-requirement-4-data-encryption): Encrypting cardholder data on open networks.
- [Requirement 5: Protect Against Malware](https://www.serverscan.com/pci-dss-requirement-5-anti-virus-malware): Anti-malware software and processes.
- [Requirement 6: Develop and Maintain Secure Systems](https://www.serverscan.com/pci-dss-requirement-6-secure-systems): Patching and secure development.
- [Requirement 7: Restrict Access by Need to Know](https://www.serverscan.com/pci-dss-requirement-7-restricting-data-access): Limiting who can reach cardholder data.
- [Requirement 8: Identify Users and Authenticate Access](https://www.serverscan.com/pci-dss-requirement-8-authenticating-access): User IDs, passwords, and MFA.
- [Requirement 9: Restrict Physical Access](https://www.serverscan.com/pci-dss-requirement-9-restrict-physical-access): Physical security for systems and media.
- [Requirement 10: Log and Monitor Access](https://www.serverscan.com/pci-dss-requirement-10-tracking-data-access): Logging and tracking access to data.
- [Requirement 11: Test Security Regularly](https://www.serverscan.com/pci-dss-requirement-11-testing-security-systems): Scans, penetration tests, and the ASV requirement.
- [Requirement 12: Maintain a Security Policy](https://www.serverscan.com/pci-dss-requirement-12-maintaining-secure-policies): Policies, training, and incident response.

## Support

- [Frequently Asked Questions](https://www.serverscan.com/Frequently-Asked-Questions): Scan duration, scheduling, reports, and the money-back guarantee.
- [Support](https://www.serverscan.com/Support): How existing customers reach us.
- [About ServerScan](https://www.serverscan.com/about-server-scan): Company background.

## Policies

- [Refund Policy](https://www.serverscan.com/Refund-Policy): If you cannot pass our scan and we cannot get you there, we refund your order in full, as long as you ask in writing within 30 days of purchase.
- [Subscriber Agreement](https://www.serverscan.com/subscriber-agreement): The terms of service for scanning subscriptions, including acceptable use, billing and cancellation.
- [Data Processing Addendum](https://www.serverscan.com/data-processing-addendum): How we handle personal data we process for customers.
- [Privacy Policy](https://www.serverscan.com/Privacy-Policy): What personal information we collect, why, and how we protect it.