PCI DSS: is your booking website compliant for card payments?

The PCI DSS standard applies to every business that accepts payment cards. With GDA Kraft Booking, the guest enters their card on a payment page hosted by Stripe: no card number passes through or is stored on your WordPress site, which greatly reduces your compliance scope. You still need to secure your site, never collect card numbers through any other channel and, if Stripe asks you to, attest to your compliance.

What is the PCI DSS standard?

PCI DSS (Payment Card Industry Data Security Standard) is the data security standard for payment cards, published by the PCI Security Standards Council, a body set up by the card networks. It applies to any entity that stores, processes or transmits cardholder data. The official documents are published on the PCI Security Standards Council website (consulted on 12 October 2026).

Compliance is a shared responsibility: Stripe, certified as a PCI Level 1 service provider, secures card processing; the merchant remains responsible for how they integrate payment and for the security of their own site. This is explained in Stripe's security guide (consulted on 12 October 2026).

What is a hosted payment page and why does it change everything?

A hosted payment page is a page served directly by the payment provider. With Kraft Pay (available with the free Kraft GDA account and a connected site, on your own Stripe account), after choosing their dates or slot, the guest is redirected to Stripe's page, enters their card there or uses Apple Pay or Google Pay, then returns to your site.

For a merchant who fully outsources the payment page to a compliant provider, the shortest self-assessment questionnaire, SAQ A, is generally the one that applies. Stripe itself associates its hosted checkout with this questionnaire in its PCI compliance guide (consulted on 12 October 2026). Version 4.0.1 of SAQ A, revised in 2025, asks the merchant in particular to confirm that their site is not exposed to script attacks that could affect their e-commerce system: check the eligibility criteria in the official document.

What remains your responsibility?

1. HTTPS across the whole site, which is required anyway to connect GDA Kraft Booking.
2. Updates to WordPress, your theme and your plugins, to limit the risk of a malicious script being injected into your pages.
3. Protected administrator accounts: unique passwords, two-factor authentication if your host or a plugin allows it, limited roles for staff (Kraft Console lets people work without access to the admin).
4. No cards through any other channel: never ask for a card number by email, phone, contact form or Kraft Fields custom field. Point the guest to your online booking form or, for a balance, to the "Pay the balance" button in the email they received.
5. Few third-party scripts on booking pages: each one is an additional security dependency.
6. The annual attestation, if Stripe asks for it: your account's documentation requirements appear in your Stripe Dashboard.

GDA Kraft Booking, the plugin by Global Digital Agency, does not itself load any third-party tracker or external script on your pages (see GDPR and personal data).

This article is general information. For an analysis of your situation (transaction volume, other sales channels, card terminal on site), contact Stripe or a qualified assessor.

To enable payments, see Enable Stripe payments; for bank authentication, see Strong customer authentication and 3-D Secure.

Frequently asked questions

Does my WordPress site store card numbers?

No. The card is entered on the page hosted by Stripe; your site only keeps the amounts, references and status of payments, as described in the GDPR and personal data article.

Do I still have PCI DSS obligations?

Yes, like any merchant who accepts cards, but they are reduced: securing your site, not collecting cards through other channels and completing the attestation requested where applicable.

Can a guest give me their card over the phone so I can enter it?

It is not advisable: you would be bringing card data into your own scope. Instead, invite them to book and pay online on your site themselves, entering their card on Stripe's page, or to pay you by bank transfer, which you then record as an offline payment. The guest area does not currently allow payments.

Does automatic balance charging raise a compliance issue?

No, the card is saved and charged by Stripe, with the explicit consent the guest gave when paying the deposit. Your site never sees the card number.