> For the complete documentation index, see [llms.txt](https://docs.rafflex.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.rafflex.io/helpful-info/pci-compliance-scan.md).

# PCI Compliance Scan

How to schedule the regular PCI compliance scan that Cashflows asks you to complete, and what to do if the scan reports failures.

***

If you take card payments through **Cashflows**, they will ask you to complete a PCI compliance scan of your website every so often. This guide walks you through scheduling the scan, reading the results, and dealing with the "false positive" failures that most Rafflex sites will see.

Don't worry if this sounds technical. You do not need to change anything in your Rafflex admin panel. It is mostly a case of filling in a form and pasting in a ready made response, and this page gives you everything you need.

***

### What is PCI compliance?

PCI compliance (short for the Payment Card Industry Data Security Standard, often written as PCI DSS) is a set of security rules. It is designed to make sure every business that accepts card payments keeps customer card data safe from fraud and theft. Everyone who takes card payments online has to comply.

The scan is an automated check that looks at your website from the outside, the same way a visitor's browser would, and reports anything it thinks could be a weakness. Completing it is part of keeping your [payment gateway](/getting-started/payment-gateway.md) fully set up and in good standing with Cashflows.

***

### When to scan

* **Cashflows will email you** when it is time to complete your scan.
* This happens every few months and is a standard requirement for all merchants.
* Try to complete it promptly when you get the email, so your merchant account stays in good standing.

{% hint style="warning" %}
**If it's your first scan:**

* Cashflows will send you login details for the scan portal.
* The scan portal website is [complywithpci.com](https://complywithpci.com).
* Keep these login details somewhere safe, as you will need them again for future scans.
  {% endhint %}

***

### How to schedule your scan

1. Go to [complywithpci.com](https://complywithpci.com).
2. **Log in** using the details provided by Cashflows.
3. Find the section titled **Be scan compliant** and click **Manage**.
4. Click **Schedule Scan**.
5. Go to the **Domain** tab. In the **Domain/IP Address** field, enter your website address without `https://` or `www.` (for example `yourrafflesite.com`).
6. Choose your preferred scan date, or leave the default date if you want it to run as soon as possible.
7. For the **Load Balancer** question, select **Yes**.
8. For the **System Configuration** question, select **Yes**.
9. Tick the confirmation box at the bottom of the page.
10. Click **Schedule Scan**.

{% hint style="info" %}
Enter the same domain your customers use to visit your site, which is the domain you connected in [Add Your Domain to RaffleX](/getting-started/add-your-domain-to-rafflex.md). If you are not sure which one that is, open your site in a browser and copy the address from the address bar, leaving out the `https://`.
{% endhint %}

***

### What happens after the scan

* The scan usually takes **6 to 12 hours** to complete.
* You will receive an email notification with the results once it has finished.
* If the results say **Pass**, you are done until Cashflows next contact you.

{% hint style="danger" %}
**What to do if your scan fails**

* **Don't panic.** Failed scans are very common, especially with automated tools like this one.
* Rafflex sites sit behind Cloudflare, the security service you set up when you connected your domain. Cloudflare can confuse the scanner, so it often reports problems that do not actually affect your site. These are called **false positives**, and this is expected.
* You deal with them by marking each one as a false positive in the scan portal, using the steps below.
  {% endhint %}

***

### How to deal with a failed scan

Work through these steps for each failed scan. It looks like a long list, but once you have done the first item the rest are quick, because you paste in the same response each time.

1. Log in to [complywithpci.com](https://complywithpci.com).
2. Under **Be scan compliant**, click **Manage**.
3. Select **Review your PCI DSS external vulnerability scans**.
4. Look for scan results marked as **Fail**.
5. From the **Options** dropdown next to a failed scan, select **Review**.
6. Click the **Review Now** button.
7. Use the **PCI Compliant** dropdown menu to filter the results by selecting **No**. This shows you only the items that failed.
8. For each failed item listed:
   1. Click the **three dots** on the right hand side.
   2. Choose **Raise False Positive**.
   3. In the comment box, paste the response from the [Response to paste](#response-to-paste) section below.
   4. Submit the false positive request.
9. Repeat step 8 for every failed item in the list.

{% hint style="info" %}
Most failed items will be about **TLS/SSL** (the technology behind the padlock in your browser), **cipher suites**, or **ports** such as 2053, 2083, 2087, 2096 and 8443. The response below covers all of these. If you see a failed item about a **cookie** called `_fbp`, use the separate response on the [Cookie Vulnerability (Facebook Pixel) False Positive](/helpful-info/pci-compliance-scan/pci-scan-cookie-false-positive.md) page instead.
{% endhint %}

***

### Response to paste

This response covers the TLS/SSL, cipher suite and port findings. Copy the whole response below (use the copy button in the top corner of the box) and paste it into the comment box for each failed item.

{% code overflow="wrap" %}

```
The TLS/SSL vulnerabilities reported (TLS 1.0/1.1 support, SSLv2/SSLv3 identifiers, weak cipher suites, BEAST/CBC vulnerability, etc.) are false positives caused by the use of Cloudflare as our reverse proxy and CDN.

Our domain does not expose the ports referenced in the findings (e.g., 2053, 2083, 2087, 2096, 8443). These ports belong to Cloudflare's global edge network, not our origin server. They do not route to our environment, do not interact with cardholder data, and are outside our control and PCI scope.

For port 443, Cloudflare terminates all HTTPS traffic before forwarding it to our origin server. Although Cloudflare may advertise legacy protocol identifiers (SSLv2/SSLv3/TLS1.0/TLS1.1) for compatibility, these protocols are not actually negotiable or accepted when "Minimum TLS Version = TLS 1.2" is enabled. Handshake testing confirms that insecure protocols cannot be used to connect to our service.

Our origin server itself accepts only TLS 1.2 and TLS 1.3, fully satisfying PCI DSS requirements. No deprecated protocols or weak ciphers are enabled at the origin.

Because all detected issues relate to Cloudflare's edge infrastructure rather than our hosted environment, and because insecure protocols cannot be negotiated in practice, these findings are false positives and should be marked accordingly.
```

{% endcode %}

{% hint style="success" %}
**Tip: check your Cloudflare minimum TLS version.** The response above mentions that your minimum TLS version is set to TLS 1.2. It is worth making sure this is the case in your own Cloudflare account, as it is a good security setting to have on anyway.

1. Log in to Cloudflare and click your domain.
2. Click **SSL/TLS** in the left hand menu, then **Edge Certificates**.
3. Find **Minimum TLS Version** and make sure it is set to **TLS 1.2**.

This does not affect your customers, as all modern browsers support TLS 1.2 and above.
{% endhint %}

***

### Other known false positives

Some scans also flag a "Cookie Vulnerability" against a cookie named `_fbp`. This comes from the Facebook (Meta) advertising pixel, sits outside our servers, and is safe to mark as a false positive. The page below explains why and gives you a ready made response to paste in.

{% content-ref url="/pages/iGxdPEt8p5Qr2hWGiv26" %}
[Cookie Vulnerability (Facebook Pixel) False Positive](/helpful-info/pci-compliance-scan/pci-scan-cookie-false-positive.md)
{% endcontent-ref %}

***

### After you submit your false positives

The scan provider reviews each false positive request. Once they are accepted, your scan should show as compliant. If the portal or Cashflows asks you to run the scan again, follow [How to schedule your scan](#how-to-schedule-your-scan) above.

{% hint style="warning" %}
**Responding to follow up questions**

* After you submit the false positives, the PCI compliance team might email you asking you to confirm that the site is secure.
* Please reply to them confirming: **Yes, it is secured on all ports.**
  {% endhint %}

{% hint style="info" %}
If a false positive request is rejected, or you see a failed item that does not match anything on this page, [contact Rafflex support](https://rafflex.io/contact-us) with a screenshot of the failed item and we will help you respond.
{% endhint %}