ChatGPT answers, unedited

For an ecommerce store that needs PCI DSS compliance plus consistently fast cart/checkout performance, I’d use a managed cloud architecture rather than traditional shared hosting.

Recommended setup

Customers
   ↓
Cloudflare CDN + WAF + DDoS protection
   ↓
Load Balancer
   ↓
2+ application servers (private subnets)
   ├── Redis/Valkey cache
   └── Managed MySQL/PostgreSQL
            ↓
     Object storage for images/files

Checkout/payment
   ↓
PCI-compliant payment provider
   ↓
Tokenized payment data

1. Use AWS as the infrastructure layer

Amazon Web Services is a strong choice because AWS is a PCI DSS Level 1 Service Provider. Importantly, that does not make your store automatically PCI compliant—the application, configuration, processes, and assessment remain your responsibility. Amazon Web Services, Inc.

I'd use:

• ECS/Fargate or EC2 for the application
• RDS for the primary database
• ElastiCache for Redis/Valkey for sessions, carts, inventory lookups, and frequently accessed catalog data
• S3 for product images and other static assets
• Application Load Balancer across at least two Availability Zones
• Private subnets for application/database resources
• AWS IAM, CloudTrail, GuardDuty/Security Hub and centralized logging for security/audit controls

2. Put Cloudflare in front

Cloudflare is a particularly good fit for ecommerce. Its CDN can serve static content from geographically distributed locations, while its WAF and DDoS protection keep malicious traffic away from your origin. Cloudflare Docs Cloudflare Docs

Cache aggressively:

• Product images
• CSS/JS
• Fonts
• Public product/catalog pages
• Other content that isn't personalized

Do not cache cart, account, checkout, or other user-specific responses. Cloudflare explicitly recommends careful cache configuration to avoid cache poisoning and unintended sharing of personalized content. Cloudflare Docs Cloudflare Docs

3. Make the cart Redis-backed

This is one of the biggest performance wins.

Use ElastiCache for Redis/Valkey for ephemeral cart/session state rather than repeatedly hitting the SQL database. AWS describes ElastiCache as providing microsecond latency and specifically lists ecommerce sessions as a use case. Amazon Web Services, Inc. Amazon Web Services, Inc.

For example:

GET /cart
     ↓
Redis → return cart
     ↓
SQL only when persistent order/product data is required

Keep the authoritative order/inventory records in the database; use Redis to make the frequent reads and cart operations fast.

4. Keep payment data out of your infrastructure if possible

For PCI scope, I'd strongly favor hosted/tokenized payment fields from a PCI-compliant payment processor rather than having your servers receive raw card numbers.

That gives you a much smaller cardholder-data environment and reduces what your PCI assessment needs to cover.

Your application should ideally receive something like:

payment_token = "tok_..."

rather than:

card_number = "..."
cvv = "..."

Never put card data into Redis, application logs, analytics, error tracking, or database records.

5. Separate the PCI environment

Use network segmentation:

Internet
   │
Cloudflare
   │
Public ALB
   │
┌───┴──────────────────┐
│ Application tier     │
│ Private subnet       │
└───┬──────────────┬───┘
    │              │
 Redis          Database
 private        private
 subnet         subnet

Restrict security-group rules so that only the application tier can reach the database/cache, and only the load balancer can reach the application servers.

Also maintain centralized logs and audit trails. AWS specifically recommends retaining CloudFront usage logs for PCI workloads for auditing purposes. AWS Documentation

What I'd actually deploy

For a typical mid-sized store:

The key architectural decision: don't try to make the cart fast by simply buying a bigger server. Put the CDN in front of the store, keep the application horizontally scalable, and put high-frequency cart/session operations in Redis/Valkey.

For PCI, minimize the amount of cardholder data your infrastructure ever sees. AWS explicitly notes that using a PCI-compliant AWS service doesn't by itself make the customer compliant—the customer's own controls and assessment still matter. Amazon Web Services, Inc.

If you tell me your platform (Shopify, WooCommerce, Magento/Adobe Commerce, custom), monthly traffic/orders, and approximate budget, I can narrow this down to a concrete architecture and estimated monthly AWS/Cloudflare cost.

For most ecommerce stores, I’d recommend managed commerce hosting rather than self-hosting the entire PCI environment.

My preferred setup

Shopify / Shopify Plus + Cloudflare

• Commerce platform: Shopify
• Checkout/payment: Shopify Checkout + Shopify Payments where available
• CDN/security layer: Cloudflare
• Custom application/API: AWS, if you need substantial backend services

Shopify provides secure commerce hosting, unlimited bandwidth, TLS certificates, and Level 1 PCI DSS compliance; its current PCI Attestation of Compliance is also available publicly. www.shopify.com

Cloudflare can sit in front of the storefront to provide edge caching, DDoS/WAF protection, image optimization, and other performance controls. Its ecommerce guidance specifically recommends caching static assets at its global edge and optimizing images. developers.cloudflare.comdevelopers.cloudflare.com

Architecture

Customer
   │
   ▼
Cloudflare
  ├── CDN / edge cache
  ├── WAF / bot protection
  ├── DDoS protection
  └── TLS
   │
   ▼
Shopify storefront
   │
   ├── Product/category pages → aggressively cacheable
   ├── Cart → dynamic / never blindly cache
   └── Checkout → Shopify-managed PCI environment
            │
            ▼
      Payment processor

The important part is the caching boundary. Cache images, CSS, JS, fonts and appropriate product/category content aggressively, but don't cache personalized cart, account, inventory-sensitive, or checkout responses. Cloudflare's cache is designed for this kind of edge/origin split, and Tiered Cache can further reduce requests hitting the origin. developers.cloudflare.com

If you need full custom infrastructure

I'd use:

Cloudflare → AWS ALB → ECS/Fargate → Aurora PostgreSQL → ElastiCache Redis → S3

with a PCI-aware payment integration such as hosted/tokenized checkout.

AWS itself is a Level 1 PCI DSS service provider, but AWS compliance does not make your application automatically PCI compliant; your organization remains responsible for its own applicable PCI controls and validation. aws.amazon.com

For fast carts, I'd specifically use Redis for cart/session state, keep the cart API stateless at the application tier, and avoid putting the cart itself behind a CDN cache.

What I'd choose

If PCI compliance and cart performance are the two dominant requirements, I'd choose Shopify Plus + Cloudflare unless you have a strong technical reason to own the commerce stack. Shopify explicitly positions Plus as eliminating ongoing hosting/infrastructure and much of the security/upgrade burden, while maintaining Level 1 PCI DSS compliance. www.shopify.com

One caveat: PCI compliance is a shared responsibility even with a managed platform. Shopify's own terms note that merchants still have obligations where they control or transmit applicable account data. www.shopify.com

For an ecommerce store where PCI scope and fast cart performance both matter, I’d use a managed AWS architecture with payment processing kept completely outside your application.

Recommended setup

Customer
   │
   ▼
CloudFront + AWS WAF
   │
   ├── Static assets → S3
   │
   ▼
Application Load Balancer
   │
   ▼
ECS/Fargate application
   │
   ├── ElastiCache (cart/session data)
   │
   └── RDS/Aurora (orders, customers, inventory)
             │
             ▼
      Payment provider
      (hosted checkout/tokenization)

1. Front end / edge

• CloudFront for CDN delivery, TLS termination, and caching of product images, JS, CSS, etc.
• AWS WAF in front of the application.
• Keep checkout/cart responses explicitly non-cacheable where appropriate. AWS specifically recommends not caching credit-card information at CloudFront edges. docs.aws.amazon.com

2. Application

• Run the ecommerce application on ECS/Fargate across at least two Availability Zones.
• Autoscale application containers based on CPU/request count.
• Keep application servers stateless so adding capacity is cheap and fast.

3. Cart performance

• Put active cart/session state in ElastiCache rather than repeatedly hitting the database.
• Use Redis/Valkey-style operations for cart reads/writes.
• Keep the database for durable order/inventory/customer data. ElastiCache is currently within AWS's PCI compliance program scope. docs.aws.amazon.com

4. Database

• Use Amazon RDS/Aurora, Multi-AZ, with encryption at rest and automated backups.
• Add read replicas if catalog/search traffic becomes substantial.
• RDS is also covered by AWS's PCI compliance program. docs.aws.amazon.com

The PCI decision that matters most

Do not put raw card numbers into your application.

Instead, use a PCI-compliant payment provider's hosted checkout or appropriately implemented hosted payment fields/tokenization. Ideally:

Your site → payment provider
             ↓
        card details
             ↓
        payment token
             ↓
Your backend → token + transaction result

The PCI Security Standards Council says that for SAQ A eligibility, payment-page elements must originate only from the PCI-compliant third-party provider; the exact implementation matters. www.pcisecuritystandards.org

Also, don't assume "we use Stripe/another processor, therefore we're PCI compliant." Your merchant still has responsibilities. For example, PCI DSS v4.x SAQ A now includes external vulnerability-scanning requirements for qualifying ecommerce sites. www.pcisecuritystandards.org

Security baseline

I'd additionally require:

• Private subnets for ECS and database resources
• No public database endpoint
• TLS everywhere
• AWS KMS encryption
• Secrets Manager rather than credentials in code
• CloudTrail + centralized logging
• WAF managed rules + rate limiting
• MFA and least-privilege IAM
• Automated OS/container patching
• Dependency and container vulnerability scanning
• Regular ASV vulnerability scans where required
• Separate production/staging AWS accounts
• Infrastructure as code
• Backups plus tested restore procedures

AWS itself is a PCI DSS Level 1 service provider, but AWS explicitly says your application remains your responsibility for PCI compliance under the shared-responsibility model. aws.amazon.com

What I'd choose

This gives you fast cart operations without putting payment-card data into the cart/application infrastructure, which is the architectural choice I'd prioritize for reducing PCI complexity.

If you tell me your expected orders/traffic, ecommerce platform (Shopify/WooCommerce/custom/etc.), and whether you need US-only hosting, I can narrow this into a concrete architecture and approximate monthly cost.

For most ecommerce stores, I’d recommend avoiding self-managed PCI infrastructure unless you have a strong reason to own the entire stack. The best setup depends on how much customization you need.

My default recommendation: Shopify

Shopify is the simplest combination of PCI compliance, fast cart/checkout performance, and low operational overhead.

A good architecture is:

Customer → CDN/Shopify hosting → Shopify storefront/cart → Shopify Checkout → payment processor

Why I like it:

• Shopify-hosted stores are PCI DSS compliant by default, and Shopify maintains a Level 1 PCI certification. www.shopify.com
• Hosting and CDN are built in; Shopify uses Fastly's CDN and provides unlimited bandwidth. www.shopify.com
• Keep the cart and checkout native to Shopify rather than building your own cart/payment stack. Shopify specifically optimizes its checkout for high-volume transactions. www.shopify.com
• You can still use a headless frontend if you need substantial UX customization, while retaining Shopify Checkout.

Shopify hosting details

If you need maximum control: AWS

For a highly customized/headless store, I'd use:

                    ┌── CloudFront CDN
                    │
Customer ── Route 53 ── AWS WAF
                    │
                    ▼
              Load Balancer
                    │
             App containers
              (ECS/Fargate)
                    │
          ┌─────────┴─────────┐
          ▼                   ▼
     ElastiCache          Database
       (cart/session)      (RDS)
          │
          ▼
     Payment provider
     (hosted/tokenized)

AWS has PCI DSS–in-scope versions of CloudFront, ECS/Fargate, ElastiCache, RDS and other services, but using PCI-compliant AWS services does not automatically make your application PCI compliant; you still have responsibilities under the shared-responsibility model. aws.amazon.com

For performance, I'd specifically:

• Put CloudFront + WAF in front of everything.
• Keep product/category assets aggressively cached at the edge.
• Put cart/session data in ElastiCache, not repeated database queries. AWS's own ecommerce architecture uses this pattern. docs.aws.amazon.com
• Keep checkout/payment data out of your application wherever possible.
• Use a PCI-validated payment provider's hosted/tokenized checkout.
• Never cache payment/cardholder information in CloudFront. AWS explicitly recommends avoiding this. www.shopify.comwww.shopify.comaws.amazon.comdocs.aws.amazon.comdocs.aws.amazon.comwww.pcisecuritystandards.org
• Segment the payment-related components from ordinary application infrastructure.

AWS ecommerce architecture guidance

An important PCI design choice

I'd strongly favor redirecting to or embedding a PCI-validated payment provider's payment page rather than having your application collect raw card numbers.

PCI SSC says that, subject to all eligibility criteria, an ecommerce implementation can qualify for SAQ A when all payment-page elements originate directly from the PCI-validated third party. www.pcisecuritystandards.org

However, don't interpret "hosted checkout = no PCI obligations." PCI DSS v4.x still has requirements for merchants using outsourced payment processing, including external vulnerability scanning in applicable SAQ A scenarios. www.pcisecuritystandards.org

What I'd choose

Bottom line: unless you have unusual technical requirements, I'd choose Shopify-hosted commerce with its native cart/checkout. It gives you the biggest reduction in PCI/security operational burden while retaining excellent global delivery performance. If you need a custom commerce platform, then AWS + CloudFront/WAF + ElastiCache + managed database + hosted/tokenized payments is the architecture I'd use.

For an ecommerce store where PCI compliance and fast cart/checkout performance matter, I would avoid generic shared hosting. The best setup depends on whether you want to minimize compliance scope or run your own infrastructure.

A strong default architecture:

Recommended setup: managed ecommerce cloud stack

Frontend / storefront

• CDN + edge caching (Cloudflare or similar)
• HTTP/2 or HTTP/3
• Image optimization and lazy loading
• Static assets served from object storage/CDN

Application layer

• Managed VPS/cloud instances (not shared hosting)
• Dedicated CPU/RAM allocation
• PHP workers tuned for WooCommerce/Magento, or Node containers for custom builds
• Horizontal scaling capability during promotions

Database

• Managed MySQL/PostgreSQL
• Separate database resources from web servers
• Read replicas if catalog/order volume is high
• Automated backups and point-in-time recovery

Caching

• Redis for:
  • cart/session data
  • customer sessions
  • API responses
  • database object caching
• Full-page caching where compatible (avoid caching personalized checkout pages)

Payment architecture
The easiest PCI path is:

• Do not store, process, or transmit card numbers yourself
• Use hosted/tokenized payment flows from providers like Stripe, PayPal, Shopify Payments, etc.
• Keep your PCI scope limited (often SAQ A/A-EP depending on implementation)

PCI compliance is a shared responsibility: a PCI-ready host helps with infrastructure controls, but your application, access controls, code, and payment flow still matter. www.atlantic.net

Platform recommendations

Option 1 — Shopify / BigCommerce (lowest operational burden)

Best if you want speed, reliability, and minimal infrastructure management.

Good for:

• small to enterprise stores
• teams without DevOps staff
• high seasonal traffic

Hosted platforms handle much of the infrastructure, security patching, and PCI-related platform responsibilities. www.bigcommerce.com

Tradeoff:

• less server-level customization
• app ecosystem costs can grow

Option 2 — WooCommerce: managed hosting

Recommended stack:

• Managed WooCommerce host
• Redis object cache
• CDN/WAF
• Managed database
• External payment gateway

Good providers include:

• Liquid Web — strong for high-traffic WooCommerce/Magento environments with managed infrastructure, monitoring, CDN options, backups, and PCI-oriented hosting capabilities. www.liquidweb.com
• Nexcess — another managed ecommerce-focused option. www.positioniseverything.net

Typical sizing:

• Starter store: 4 vCPU / 8 GB RAM
• Growing store: 8 vCPU / 16–32 GB RAM
• High volume: multiple app servers + dedicated database

Option 3 — Enterprise custom stack

For large catalogs, marketplaces, or heavy traffic:

Example architecture

Cloudflare CDN + WAF
          |
Load Balancer
          |
---------------------
|                   |
App Server 1    App Server 2
|                   |
------ Redis -------
          |
Managed Database
          |
Object Storage

Good hosting choices:

• AWS / Azure / Google Cloud with a properly designed PCI environment
• Managed PCI-focused providers if you want compliance assistance

PCI-focused infrastructure providers such as Atlantic.Net and JetRails offer environments aimed at ecommerce workloads with security controls and managed support. www.atlantic.net

Performance settings I would prioritize

For fast carts:

✅ Keep checkout uncached but optimize everything around it
✅ Redis sessions instead of filesystem sessions
✅ Database indexes reviewed regularly
✅ CDN for images/CSS/JS
✅ Brotli compression
✅ PHP OPcache (if PHP-based)
✅ Queue slow tasks:

• emails
• inventory sync
• analytics exports
• third-party API calls

Avoid:

• shared hosting
• hosting the database on the same tiny VM as the store
• dozens of unoptimized ecommerce plugins
• storing payment card data

My default recommendation by store size

If you tell me your platform (Shopify, WooCommerce, Magento/Adobe Commerce, custom), monthly order volume, and whether you store any payment data directly, I can suggest a more exact architecture and server sizing.

For most ecommerce stores, I’d avoid putting raw card data on your own servers. The best balance of PCI scope, cart speed, scalability, and operational simplicity is:

Recommended architecture

CDN/WAF → application → cache/session layer → database
↘ hosted/tokenized payment processor

• Edge: Cloudflare for CDN, WAF, DDoS protection, bot mitigation, TLS, and caching. Cloudflare specifically supports ecommerce architectures and can cache static assets at 300+ edge locations. developers.cloudflare.comaws.amazon.comwww.pcisecuritystandards.org
• Hosting: AWS, using a managed/containerized setup rather than a traditional single VPS. AWS has PCI-compliant infrastructure, but remember that PCI compliance remains a shared responsibility—your application, OS/configuration, access controls, etc. are still your responsibility. aws.amazon.com
• Application: ECS/Fargate or another managed container platform, with 2+ application instances behind a load balancer. This gives you easy horizontal scaling during traffic spikes.
• Database: Managed PostgreSQL/MySQL with Multi-AZ, automated backups, encryption, and a read replica if catalog traffic becomes heavy.
• Fast cart: Redis/ElastiCache for short-lived cart/session data, while keeping the authoritative order state in the database.
• Payments: Use a PCI-validated payment provider with hosted fields/checkout or a redirect, so your infrastructure never handles the card number. PCI SSC notes that fully outsourcing payment functions can substantially reduce the merchant's applicable PCI scope; eligibility for a particular SAQ still depends on the exact implementation. www.pcisecuritystandards.org

The important PCI design choice

I'd specifically design checkout so cardholder data never enters your application servers.

For example:

Customer
   │
   ▼
Cloudflare CDN + WAF
   │
   ├── Product/category pages ──► Cached at edge
   │
   └── Cart/checkout ───────────► App servers
                                      │
                                      ├── Redis cart/session
                                      ├── PostgreSQL orders
                                      │
                                      └── Payment provider
                                            │
                                            ▼
                                      Token/payment result

That is preferable to building your own card-storage/payment environment. PCI DSS v4.x also places specific requirements around payment-page scripts, so don't overlook third-party JavaScript on checkout pages. PCI SSC's current guidance specifically addresses script-related eligibility for SAQ A. www.pcisecuritystandards.org

For really fast carts

The biggest performance mistake is treating the cart like a normal cached page.

I'd use:

• CDN caching: product pages, images, CSS, JS, category pages.
• No CDN caching: authenticated cart, checkout, account, and order endpoints.
• Redis: cart/session reads and writes.
• Stateless application servers: lets you add instances without session problems.
• Database connection pooling: prevents cart spikes from exhausting DB connections.
• Async jobs: email, analytics, inventory notifications, etc. shouldn't block checkout.
• Origin protection: only allow the application to receive legitimate traffic from your edge/load balancer where practical.
• TLS 1.2+, with modern TLS configuration. Cloudflare's current PCI guidance recommends TLS 1.2 or newer. developers.cloudflare.com

Cloudflare's ecommerce guidance also specifically recommends caching, load balancing, health checks, and edge routing for high-traffic stores. developers.cloudflare.com

What I'd choose by store size

My default recommendation: Cloudflare + AWS ECS/Fargate + RDS PostgreSQL + ElastiCache Redis + hosted/tokenized payments. It gives you excellent cart performance without unnecessarily turning your entire application into a cardholder-data environment.

One caveat: “PCI-compliant hosting” does not by itself make the store PCI compliant. Your exact payment flow, scripts, infrastructure configuration, access controls, vulnerability management, logging, and SAQ/ROC obligations determine the actual scope. AWS itself describes this as a shared-responsibility model. aws.amazon.com

For a serious ecommerce store, I’d use a managed AWS-based architecture with the payment card environment kept outside your infrastructure. The goal is to make the storefront fast while minimizing the PCI scope you actually have to manage.

Recommended setup

Customers
   │
   ▼
CloudFront CDN + AWS WAF
   │
   ├── Static assets ──► S3
   │
   └── Dynamic requests
           │
           ▼
      Load Balancer
           │
     ┌─────┴─────┐
     ▼           ▼
 App servers   App servers
 (autoscaling / containers)
     │
     ├──► ElastiCache Redis
     │      └─ sessions / cart
     │
     └──► RDS/Aurora
            └─ products/orders
           
Payment ──► Stripe Checkout
              │
              ▼
       Stripe's PCI environment

Why this setup:

• CloudFront + S3: Put images, CSS, JavaScript and other cacheable assets at the edge. CloudFront supports PCI-DSS Level 1 infrastructure and is designed for high-performance content delivery. aws.amazon.comaws.amazon.com
• WAF: Put AWS WAF in front of the application to block common attacks and rate-limit abusive traffic. AWS's ecommerce architecture specifically uses CloudFront + WAF for this pattern. aws.amazon.comaws.amazon.com
• Autoscaling app tier: Run your ecommerce application in containers/VMs across multiple availability zones rather than on a single VPS.
• Redis/ElastiCache for carts: Keep frequently accessed cart/session state in Redis. This avoids hitting the database on every cart operation and is particularly useful during traffic spikes.
• Aurora/RDS for durable data: Keep orders, inventory, customers, etc. in a managed relational database with backups and Multi-AZ/high availability.
• Stripe Checkout for payments: This is the big PCI decision. Stripe Checkout/Elements can keep sensitive card data off your servers; Stripe says Checkout can qualify for the simpler SAQ A validation path. stripe.comwww.pcisecuritystandards.org

For the fastest cart experience

I'd specifically design the cart API so that:

1. Cart reads/writes go to Redis first.
2. The browser receives a cart ID/session cookie rather than carrying cart contents around.
3. Product/pricing data is cached aggressively.
4. Inventory is checked against the authoritative database when an order is submitted—not on every cart-page render.
5. Checkout creates a Stripe Checkout session, rather than sending card information through your application.
6. Static assets have long CDN cache lifetimes and are fingerprinted (app.8f31.js, etc.).
7. Your application servers are stateless so they can scale horizontally.

That gives you a very short path for the common operation:

browser → CDN/WAF → app → Redis → response

rather than:

browser → app → database → session database → product database → response

PCI is more than "use a PCI-compliant host"

This distinction is important: AWS being PCI compliant does not automatically make your store PCI compliant. Your own environment and processes still have applicable PCI requirements. www.pcisecuritystandards.org

The best strategy is therefore to reduce the cardholder-data environment rather than simply trying to secure a larger one. Stripe explicitly recommends hosted/tokenized payment approaches because they can substantially reduce PCI scope. stripe.com

I'd avoid building your own credit-card form that POSTs card numbers to your backend. Depending on the integration, that can move you into substantially more demanding PCI validation requirements. stripe.com

What I'd choose by store size

My default recommendation: AWS + CloudFront/WAF + ECS/Fargate + ElastiCache Redis + Aurora/RDS + S3 + Stripe Checkout. It gives you a good balance of performance, scalability, operational simplicity, and minimized PCI exposure.

One caveat: the exact PCI validation requirements depend on your payment integration and transaction volume, so have your QSA/acquirer confirm the applicable SAQ rather than assuming that this architecture by itself guarantees compliance.

For an ecommerce store where PCI compliance and fast cart/checkout performance are top priorities, I would avoid a traditional shared VPS setup. The best architecture usually keeps payment data exposure minimal and puts performance-critical storefront components on highly optimized infrastructure.

Here are three strong setups depending on your store size and customization needs:

Option 1 — Best overall: Managed SaaS commerce platform + custom frontend

Recommended for most growing stores

Architecture

• Frontend: Next.js storefront hosted on a global edge platform
• Commerce engine: hosted ecommerce platform
• Checkout: platform-hosted checkout/payment flow
• CDN/WAF: Cloudflare or equivalent
• Search: managed search service
• Analytics: separate data pipeline

Example stack

• BigCommerce commerce backend + headless storefront
• Next.js frontend
• Cloudflare CDN/WAF
• Managed database only for custom apps

Why this works:

• The payment environment is largely handled by the commerce provider instead of your own servers.
• Faster cart interactions because product/catalog APIs can be optimized separately from checkout.
• Easier PCI scope reduction.

BigCommerce states that its platform maintains PCI DSS Level 1 compliance and supports headless/API-driven storefront architectures. docs.bigcommerce.com

Good fit: $500k–$50M+ revenue stores, custom UX requirements, international traffic.

Option 2 — Lowest operational burden: Shopify-style hosted commerce

Best when speed to market matters more than deep customization

Architecture

• Hosted ecommerce platform
• Built-in checkout
• CDN included
• Apps for extensions

Shopify provides Level 1 PCI DSS compliance for stores using its platform, including hosted checkout and shopping infrastructure. www.shopify.com

Advantages:

• Minimal server management
• Strong checkout reliability
• Lower PCI maintenance burden

Tradeoffs:

• Less control over backend behavior
• Apps can introduce performance issues
• Advanced workflows may require workarounds

Good fit: small-to-mid businesses that want reliability without DevOps.

Option 3 — Maximum control: AWS-based custom commerce platform

For large engineering teams

Example architecture:

Users
  |
CloudFront CDN
  |
AWS WAF
  |
Application Load Balancer
  |
ECS/EKS containers
  |
Commerce API services
  |
Aurora PostgreSQL
  |
ElastiCache Redis

Add:

• Payment tokenization through a gateway
• No card storage
• Private subnets
• Secrets Manager
• CloudTrail logging
• Vulnerability scanning
• Automated patching

AWS maintains PCI DSS compliance for many services, but your application architecture and operational controls remain your responsibility under the shared responsibility model. aws.amazon.com

Good fit: high-volume brands, marketplaces, complex integrations.

Performance features I would consider mandatory

Cart and checkout

• Keep cart state in Redis or a managed low-latency store
• Avoid database writes on every cart change
• Use asynchronous inventory checks where possible
• Cache product/pricing data aggressively
• Keep checkout APIs separate from browsing traffic

CDN layer

Use:

• Edge caching for product pages
• Image optimization
• Brotli compression
• HTTP/3
• Bot mitigation

Database

Avoid:

• Single MySQL instance doing everything

Prefer:

• Read replicas
• Connection pooling
• Redis caching
• Separate reporting workloads

PCI-specific design choices

To reduce compliance complexity:

✅ Use hosted payment fields or hosted checkout
✅ Store payment tokens, not card numbers
✅ Never store CVV data
✅ Segment admin systems from storefront systems
✅ Use MFA everywhere
✅ Run quarterly vulnerability scans where required
✅ Maintain logging and access controls

My default recommendation

For most ecommerce businesses:

Headless storefront + managed commerce backend

Next.js
   |
CDN/WAF
   |
BigCommerce / Shopify checkout
   |
Payment processor

This gives you:

• very fast browsing and cart UX
• lower PCI exposure
• fewer servers to maintain
• easier scaling during promotions

If you tell me your platform (Magento/WooCommerce/Shopify/custom), monthly orders, peak traffic, and whether you need headless/custom checkout, I can suggest a more exact architecture and hosting tier.

For an ecommerce store where PCI scope and cart latency both matter, I’d favor a managed AWS architecture with payment processing fully outsourced rather than putting card data into your own application.

Recommended setup

Customer
   │
   ▼
CloudFront + AWS WAF
   │
   ├── Static assets ──► S3
   │
   ▼
Load Balancer
   │
   ▼
App servers (ECS/Fargate)
   │
   ├── ElastiCache/Redis ──► cart/session data
   │
   └── RDS PostgreSQL ─────► products/orders
                               
Checkout ──► PCI-compliant payment provider
             (hosted/tokenized checkout)

Why this setup:

• CloudFront puts storefront assets close to customers and is itself PCI DSS validated. docs.aws.amazon.com
• ECS/Fargate gives you horizontally scalable application servers without managing individual VMs.
• ElastiCache/Redis is ideal for hot cart/session data, avoiding a database round-trip on every cart operation. AWS lists ElastiCache within its PCI compliance programs, although your own configuration and responsibilities still matter. docs.aws.amazon.com
• RDS PostgreSQL handles durable product/order data with automated backups, Multi-AZ options, and encryption. RDS is also covered by AWS's PCI compliance program. docs.aws.amazon.com
• WAF + TLS + private subnets + IAM provide the security boundary around the application.
• Most importantly, don't let your servers receive raw card numbers. Use a PCI-compliant provider's hosted checkout or appropriately designed tokenization. Depending on the exact implementation, this can dramatically reduce your PCI scope. PCI SSC says SAQ A eligibility requires the payment-page elements to originate only from compliant payment providers; SAQ A-EP has somewhat broader requirements. www.pcisecuritystandards.org

For especially fast carts

I'd make the cart path deliberately small:

Add-to-cart → Redis → immediate response

Then asynchronously persist/order-sync where appropriate.

For example:

• Redis: active cart, quantity, coupon/session state
• PostgreSQL: product catalog, inventory, customer/order records
• CDN: images, CSS, JS, product-page assets
• Browser: aggressively cache immutable assets
• API: keep cart endpoints lightweight and avoid unnecessary product/catalog queries

I'd also avoid caching personalized cart responses at CloudFront. AWS specifically recommends not caching responses containing payment/card information at edge caches. docs.aws.amazon.com

PCI architecture principle

The biggest mistake would be thinking "AWS is PCI compliant, therefore my store is PCI compliant." AWS provides PCI-validated infrastructure, but PCI DSS follows a shared-responsibility model and your application's configuration, access controls, patching, logging, segmentation, and processes still matter. aws.amazon.com

If you're building a new store, I'd therefore choose:

CloudFront/WAF → ECS/Fargate → Redis + RDS → hosted/tokenized payment provider

rather than:

Cloud VM → application → database → application handles credit-card numbers.

The first architecture gives you a much cleaner PCI boundary while still allowing very fast cart operations.

If you tell me your expected traffic (e.g. 100 vs. 10,000 orders/day), ecommerce platform (custom, WooCommerce, Magento, Shopify, etc.), and budget, I can recommend a concrete AWS/Cloudflare setup and approximate monthly cost.

For an ecommerce store where PCI scope and fast cart/checkout performance both matter, I’d use a managed AWS architecture with the payment card data kept completely out of your application.

Recommended setup

1. Edge / frontend

• Amazon CloudFront for CDN and TLS termination.
• AWS WAF in front of the application for common web attacks and rate limiting.
• Static assets—JS, CSS, product images—served from Amazon S3 + CloudFront.
• Keep personalized/cart responses out of CDN caching.

CloudFront itself is PCI DSS validated, although AWS explicitly recommends not caching credit-card information at the edge. docs.aws.amazon.com

2. Application

• Run the ecommerce application on ECS/Fargate across at least two Availability Zones.
• Make application servers stateless.
• Use ElastiCache/Redis for sessions, cart state, product availability and other high-frequency reads.
• Use Aurora PostgreSQL/MySQL for orders, customers, inventory and transactional data.

AWS's own ecommerce architecture uses CloudFront plus ElastiCache and distributed application services specifically to improve performance at multiple caching tiers. docs.aws.amazon.com

3. Payments — the most important PCI decision
Use a PCI-validated payment processor with hosted checkout or tokenization, rather than having your servers receive card numbers.

The ideal flow is:

Browser → CloudFront/WAF → Store → cart → hosted payment page → payment processor

Your application receives a payment token/payment ID, not the PAN/CVV.

This can dramatically reduce your PCI scope. PCI SSC says that when all payment-page elements originate from a PCI-compliant third party, the merchant may be eligible for SAQ A, provided all other SAQ-A eligibility requirements are met. www.pcisecuritystandards.org

Be particularly careful with embedded payment forms: PCI DSS v4.0.1 introduced additional requirements around scripts that could affect an embedded payment page. A redirect to a fully hosted payment page can be simpler from a scope perspective. www.pcisecuritystandards.org

4. Network/security

• Public subnet: only CloudFront/WAF-facing components.
• Private subnets: ECS/Fargate, Aurora, Redis.
• No public database.
• Security groups with least-privilege traffic.
• AWS Secrets Manager for credentials/API keys.
• CloudTrail + centralized logging.
• Automated patching and vulnerability scanning.
• MFA and tightly controlled production access.
• Encrypt data at rest and in transit.

AWS is a PCI DSS Level 1 service provider, but that doesn't make your store automatically PCI compliant; your own environment and controls still have to satisfy the applicable PCI requirements. aws.amazon.com

For especially fast carts

I'd design the cart path so that a typical cart operation doesn't hit the relational database:

Add item → API → Redis → response

Then asynchronously/predictably persist the appropriate state to the durable database. At checkout, perform an authoritative inventory/price/order transaction against Aurora.

Also:

• Keep product/catalog data heavily cached.
• Cache immutable product images at CloudFront.
• Avoid database queries during every cart render.
• Use connection pooling for Aurora.
• Keep checkout/payment APIs uncached.
• Load-test specifically for add-to-cart, cart refresh, inventory reservation and checkout, rather than just homepage traffic.

My preferred stack

One important caveat: don't choose a hosting provider merely because it advertises itself as "PCI compliant." PCI compliance is about the entire payment environment and your controls, not just where the server lives. AWS explicitly describes this as a shared-responsibility model. aws.amazon.com

If you're starting from scratch, I'd favor hosted payment checkout + AWS managed services over building a traditional PCI cardholder-data environment. It gives you the best combination of low PCI scope, high cart performance, scalability, and operational simplicity.

For a serious ecommerce store, I’d recommend a managed AWS architecture with a third-party PCI-validated payment processor, rather than a traditional VPS/shared host.

Recommended setup

Customer
   │
   ▼
Route 53
   │
   ▼
CloudFront CDN + AWS WAF
   │
   ├── Static assets → S3
   │
   ▼
Load Balancer / API Gateway
   │
   ▼
ECS/Fargate application servers
   │
   ├── ElastiCache (Redis) → carts/sessions/hot data
   │
   └── RDS/Aurora → products, customers, orders
              │
              ▼
      PCI-validated payment processor

AWS's own ecommerce reference architecture uses essentially this pattern: CloudFront/WAF at the edge, S3 for static assets, load-balanced application servers, and ElastiCache for caching. docs.aws.amazon.com

For PCI, keep card data out of your infrastructure

This is the biggest architectural decision.

Use a PCI DSS-validated payment provider with hosted checkout or an appropriately implemented hosted payment form, so your servers never receive or store raw card numbers. PCI SSC says merchants can qualify for SAQ A when the payment-page elements originate only from PCI DSS-compliant third-party providers, assuming all other SAQ A eligibility criteria are met. www.pcisecuritystandards.orgaws.amazon.com

Be careful with embedded payment forms: current PCI DSS guidance has specific requirements concerning scripts on pages containing embedded payment forms. A full redirect to the processor can be simpler from a PCI-scope perspective. www.pcisecuritystandards.org

For fast carts

I'd specifically use Redis/ElastiCache for the active cart and session layer:

• Cart reads/writes hit Redis rather than the primary database.
• Give each cart a short TTL and persist the authoritative order when checkout completes.
• Keep product/catalog data aggressively cached.
• Don't cache personalized cart or checkout responses at CloudFront.
• Use CloudFront for images, JS, CSS, product pages and other cacheable content.

AWS's ecommerce guidance specifically uses ElastiCache for caching application responses, and its architecture documentation describes using it for ecommerce workloads. docs.aws.amazon.com

Security baseline

I'd configure:

• CloudFront + HTTPS
• AWS WAF with managed rules and bot/rate-limit protections
• Private subnets for application/database resources
• No public database access
• Encryption at rest and in transit
• Secrets Manager rather than credentials in code
• Centralized CloudTrail/CloudWatch logging
• Automated OS/container patching
• Multi-AZ application and database deployment
• Regular vulnerability scanning and PCI-required testing

AWS currently lists CloudFront, ECS/Fargate, ElastiCache, RDS, S3, WAF-related infrastructure and other relevant services within its PCI service scope, but that doesn't make your application automatically PCI compliant—PCI remains a shared-responsibility obligation. aws.amazon.com

What I'd actually choose

Bottom line: don't buy a "PCI-compliant hosting plan" and assume you're done. Build the system so cardholder data doesn't enter your environment in the first place, then make the remaining infrastructure hardened and auditable. AWS's PCI-validated services make that architecture practical, while CloudFront + Redis + a horizontally scalable application tier gives you the low-latency cart performance you're after. aws.amazon.com

If you tell me your expected monthly traffic/orders and whether the store is Shopify, WooCommerce, Magento, or custom, I can narrow this down to a concrete architecture and approximate monthly cost.

For most ecommerce stores, I’d recommend keeping card data completely out of your infrastructure and optimizing the rest of the stack for low-latency cart operations.

Recommended architecture

Customer
   │
   ▼
CDN / WAF
   │
   ├── Static assets ─────────► Object storage + CDN
   │
   ▼
Ecommerce application
   │
   ├── Redis/Valkey ──────────► Cart/session cache
   │
   ├── SQL database ──────────► Products/orders/customers
   │
   └── Payment provider ──────► Hosted checkout / tokenized payment

My default choice: AWS

• CloudFront for CDN + TLS + edge delivery. AWS currently lists CloudFront as PCI DSS in scope. docs.aws.amazon.comaws.amazon.comwww.pcisecuritystandards.org
• AWS WAF in front of the application.
• ECS/Fargate for the ecommerce application, with multiple availability zones and autoscaling.
• ElastiCache for Valkey/Redis for carts, sessions, product availability and other hot data. ElastiCache is also currently PCI-in-scope. aws.amazon.com
• RDS/Aurora PostgreSQL or MySQL for durable transactional data.
• S3 + CloudFront for product images, JS/CSS and other static assets.
• A PCI-compliant payment provider's hosted checkout so your servers never receive raw card numbers.

The important PCI design decision

Don't interpret "AWS is PCI compliant" as "my ecommerce application is automatically PCI compliant." PCI operates under a shared-responsibility model; your configuration, application, access controls, logging, vulnerability management, etc. remain your responsibility. docs.aws.amazon.com

For the payment flow, I'd favor a full redirect/hosted payment page over building your own card-entry form. PCI SSC says that when payment-page elements originate entirely from the PCI-compliant third-party payment provider, the implementation can potentially qualify for SAQ A, assuming all other eligibility criteria are met. www.pcisecuritystandards.org

Even with outsourced payments, your ecommerce site isn't magically out of PCI scope; for example, PCI SSC says SAQ A ecommerce sites still have applicable responsibilities including external vulnerability scanning. www.pcisecuritystandards.org

Making the cart fast

I'd specifically design around these principles:

1. Keep cart state in Redis/Valkey, not the SQL database on every request.
2. Give each cart a short-lived ID and store only the necessary cart state.
3. Use the database for authoritative inventory and order transactions.
4. Cache product/catalog data aggressively at the CDN/application-cache layers.
5. Keep checkout/payment endpoints uncached and isolated from normal CDN caching.
6. Put application servers and the database/cache in the same AWS region/VPC to minimize latency.
7. Autoscale application containers based on CPU and request/latency metrics.
8. Use database connection pooling and indexes for the high-volume cart/order queries.
9. Don't put sensitive payment information into logs, analytics events, cache entries, or CDN caches. AWS specifically recommends not caching credit-card information in CloudFront edge caches. docs.aws.amazon.com
10. Put rate limiting/WAF rules around login, cart, checkout, coupon and account endpoints.

If you don't want to operate AWS

If your priority is lowest operational burden rather than maximum architectural control, I'd seriously consider Shopify. Shopify currently publishes a PCI DSS Attestation of Compliance and quarterly PCI external scanning attestations. www.shopify.com

So I'd choose:

My pick for a serious custom store: CloudFront/WAF → ECS/Fargate → ElastiCache → Aurora/RDS, with hosted/tokenized payments completely separated from your application. That gives you excellent cart performance without unnecessarily turning your entire infrastructure into a cardholder-data environment. www.pcisecuritystandards.orgaws.amazon.com

If you tell me your expected traffic (e.g. 1k, 10k, or 100k orders/month) and whether you're using Shopify, WooCommerce, Magento, or a custom app, I can size the architecture and give you a rough monthly cost.

For an ecommerce store where PCI scope and cart latency both matter, I’d use a managed cloud architecture rather than a traditional VPS/shared host.

Recommended setup

AWS + managed services + hosted payment checkout

Customer
   │
   ▼
CloudFront CDN
   │
   ├── Static assets ──► S3
   │
   ▼
AWS WAF
   │
   ▼
Application Load Balancer
   │
   ▼
ECS Fargate
   │
   ├── ElastiCache Redis  ← cart/session/cache
   │
   └── RDS PostgreSQL     ← products/orders/customers
             │
             ▼
       Stripe Checkout

AWS currently lists CloudFront, WAF, ECS, RDS, ElastiCache, Secrets Manager, CloudTrail and related services as PCI DSS in-scope services, which makes this a practical foundation for a PCI-conscious architecture. aws.amazon.com

Why I'd build it this way

• Fast cart: Keep the active cart/session in Redis/ElastiCache rather than repeatedly hitting PostgreSQL. Cart reads/writes should generally stay on a very low-latency path.
• Fast storefront: Put images, JS, CSS and other immutable assets behind CloudFront. CloudFront also supports origin shielding and multiple origins for resilience. aws.amazon.com
• Horizontal scaling: Run the application in ECS Fargate behind an ALB and autoscale based on CPU/request count.
• Database: Use RDS PostgreSQL with Multi-AZ, automated backups and encryption. Add read replicas only when actual read load warrants them.
• Security: Put the application/database in private subnets; expose only CloudFront/ALB. Add WAF, Secrets Manager, CloudTrail, centralized logging, vulnerability scanning and MFA.
• Payments: Don't let your servers handle raw card numbers. Use a PCI-compliant hosted checkout such as Stripe Checkout. Stripe says Checkout/Elements keep card-data collection within Stripe-hosted inputs, so card information doesn't touch your servers. stripe.com

That last point is particularly important: outsourcing payment processing can dramatically reduce your PCI scope, but it doesn't make the entire ecommerce site automatically PCI-compliant. PCI SSC specifically notes that even SAQ A merchants can have responsibilities such as ASV scanning, and eligibility depends on the exact payment-page architecture. www.pcisecuritystandards.org

One important cart-design decision

I'd separate the cart from the order:

Redis

• cart ID
• product/SKU IDs
• quantities
• coupon/session information
• short-lived checkout state

PostgreSQL

• finalized orders
• payment IDs/tokens
• inventory
• customers
• pricing/audit records

When payment succeeds, atomically turn the cart into an order and make the operation idempotent so retries can't create duplicate orders.

What I'd avoid

I wouldn't start with:

• Kubernetes unless you already have a Kubernetes team
• self-hosted payment forms
• storing card numbers/CVV
• putting Redis or PostgreSQL on the public internet
• caching personalized cart responses at the CDN
• a single large EC2 instance
• WordPress/WooCommerce on a generic shared host for a high-volume store

Bottom line: For most serious stores, I'd choose CloudFront + WAF → ALB → ECS Fargate → Redis + RDS PostgreSQL, with Stripe Checkout handling payment collection. It gives you a good combination of low cart latency, automatic scaling, fault tolerance and a substantially smaller PCI footprint. stripe.comaws.amazon.com

If you tell me your expected orders/traffic, ecommerce platform (custom/Shopify/WooCommerce/etc.), and budget, I can size this into a concrete architecture and approximate monthly cost.

For a serious ecommerce store, I’d recommend AWS with a managed, PCI-aware architecture, while keeping card data completely out of your application servers.

Recommended setup

1. Edge/CDN

• Route 53 → CloudFront
• CloudFront caches product pages, images, JS/CSS, and other static assets close to customers.
• Put AWS WAF in front of the application for bot/attack filtering.
• CloudFront and WAF are currently included in AWS’s PCI service scope. aws.amazon.comdocs.aws.amazon.com

2. Application

• Run the storefront/API on ECS Fargate across at least 2 Availability Zones.
• Put an Application Load Balancer in front.
• Autoscale containers based on CPU/request count.
• Keep application containers stateless so scaling is quick.

AWS's own ecommerce architecture uses CloudFront, ALB, ECS/Fargate, and ElastiCache in essentially this pattern. docs.aws.amazon.com

3. Database

• Amazon RDS PostgreSQL or Aurora PostgreSQL, Multi-AZ.
• Use read replicas if catalog/search traffic becomes heavy.
• Encrypt data at rest and in transit.
• Don't put card numbers in the database.

4. Fast cart
This is where I'd be particularly deliberate:

• Redis/ElastiCache for cart/session state and hot product data.
• Keep cart reads/writes lightweight and avoid hitting PostgreSQL for every cart operation.
• Use database transactions for inventory/order finalization.
• Cache catalog data aggressively but never cache personalized cart/account responses at the CDN.

AWS specifically recommends ElastiCache for caching application responses in its ecommerce reference architecture. docs.aws.amazon.com

5. Payments — most important PCI decision
Use a PCI DSS-compliant hosted checkout/payment provider so raw card data never reaches your infrastructure.

Ideally:

Store → "Checkout" → hosted payment page → payment processor → webhook → Store

rather than:

Store → card number → your API → database/payment gateway

PCI SSC says that merchants can qualify for the SAQ A path when all payment-page elements originate from PCI-compliant service providers and the other SAQ A criteria are met. www.pcisecuritystandards.org

One important nuance: outsourcing payments does not mean "PCI doesn't apply." For example, PCI DSS 4.x still has requirements such as ASV vulnerability scanning for relevant ecommerce pages, even when payment processing is outsourced. www.pcisecuritystandards.org

Architecture I'd deploy

                    Internet
                       │
                  Route 53
                       │
                  CloudFront
                  + AWS WAF
                       │
              ┌────────┴────────┐
              │                 │
          Static assets      ALB/API
          (S3/CDN)              │
                         ┌───────┴───────┐
                         │               │
                     ECS/Fargate     ECS/Fargate
                         │               │
                         └───────┬───────┘
                                 │
                         ┌───────┴───────┐
                         │               │
                     ElastiCache       RDS/Aurora
                       Redis          PostgreSQL
                         
Checkout ───────────► PCI-compliant
                      hosted payment
                           │
                         webhook
                           │
                         Order API

PCI/security boundaries

I'd put the infrastructure into separate public/private subnets:

• Public: CloudFront/WAF/ALB
• Private: ECS, Redis, database
• No public database access
• Secrets in AWS Secrets Manager
• KMS encryption
• CloudTrail + CloudWatch logging
• Automated patching/dependency scanning
• Infrastructure as code
• Strict IAM roles with least privilege
• Regular vulnerability/ASV scanning
• Separate production/staging accounts or environments

The key is to minimize the PCI scope rather than trying to make your entire ecommerce stack a cardholder-data environment.

My preferred stack

Bottom line: AWS isn't inherently "PCI compliant" just because you use AWS—the merchant remains responsible for its configuration and compliance obligations. But AWS provides a broad set of PCI-scoped services, including CloudFront, ECS, ElastiCache, RDS, S3 and others, making it a good foundation. aws.amazon.comdocs.aws.amazon.com

If your store is WordPress/WooCommerce, Magento/Adobe Commerce, Shopify headless, or a custom Node/React/PHP application, I'd change the recommendation somewhat. The biggest performance and operational differences come from the ecommerce platform itself.