ChatGPT answers, unedited

For an ecommerce store where PCI compliance and fast cart/checkout performance matter, I’d use a managed cloud architecture with the payment-card environment kept as small as possible.

Recommended setup

Architecture:

Customer → CDN/WAF → Storefront → Cart/API → Database/Cache
↘ Hosted PCI payment provider

• Edge/CDN + WAF: Cloudflare or AWS CloudFront + WAF.
• Application: Managed containers/serverless deployment rather than a single VPS.
• Database: Managed PostgreSQL/MySQL with automated backups and encryption.
• Cache/session layer: Redis/ElastiCache for cart and session data.
• Payments: Use a PCI-validated payment provider's hosted checkout or payment elements, and do not let your servers receive raw card numbers.
• Object storage: S3-compatible storage for product images, downloads, etc.
• Monitoring/logging: Centralized logs, vulnerability scanning, alerting, backups, and audit trails.

For a custom store, an AWS implementation could be CloudFront → WAF → load balancer → ECS/Fargate → ElastiCache → Aurora, with S3 for static assets. AWS specifically documents this kind of ecommerce architecture, and CloudFront, ECS, ElastiCache and related services are included in AWS's PCI service scope. AWS Documentation Amazon Web Services, Inc.

The important PCI design decision

Don't equate "PCI-compliant hosting" with your entire store automatically being PCI compliant. PCI DSS uses a shared-responsibility model.

The biggest scope reduction is outsourcing payment handling. PCI SSC says merchants using an eligible fully outsourced/redirected payment flow can potentially qualify for SAQ A; however, the merchant website can still be in scope and SAQ A has its own requirements, including external vulnerability scanning. PCI Security Standards Council PCI Security Standards Council PCI Security Standards Council

If you embed payment fields, the exact implementation matters. For SAQ A eligibility, PCI SSC says the payment-page elements must originate from the PCI-validated third party; mixing merchant-hosted payment elements can change the applicable SAQ. PCI Security Standards Council PCI Security Standards Council

Making the cart fast

I'd specifically avoid putting the cart itself behind a conventional full-page CDN cache.

Instead:

• Cache product/category pages, images, JS, CSS, and other immutable content aggressively at the edge.
• Keep cart, customer account, inventory, and checkout API responses dynamic.
• Store cart/session state in Redis with appropriate expiration.
• Use database connection pooling and indexes for cart/order queries.
• Keep the application and database in the same region/AZ topology to minimize latency.
• Use CDN cache invalidation/versioned assets rather than repeatedly hitting the origin.
• Monitor p95/p99 cart API latency, not just homepage load time.

Cloudflare's ecommerce architecture similarly separates edge caching from dynamic application traffic, while its Tiered Cache can reduce origin requests and improve cache-hit performance. Cloudflare Docs Cloudflare Docs

What I'd choose

CloudFront is PCI DSS validated, and AWS recommends not caching credit-card information at the edge. AWS Documentation Cloudflare is also a Level 1 PCI DSS service provider, although its certification does not automatically make your application PCI compliant—you still have configuration and application responsibilities. Cloudflare Docs

For most stores, I would start with a managed ecommerce platform rather than building this entire stack yourself if you don't need a highly customized checkout. For a custom/headless store, the AWS architecture above is a strong pattern.

If you tell me your expected monthly orders/traffic, ecommerce platform (Shopify/WooCommerce/custom/etc.), and whether checkout is hosted or custom, I can narrow this to a concrete hosting architecture and approximate monthly cost.

For an ecommerce store where PCI compliance and fast cart/checkout performance matter, I’d use a managed cloud architecture with the payment data kept out of your application servers.

Recommended setup

Customer
   │
   ▼
CDN + WAF
Cloudflare or AWS CloudFront
   │
   ├── Static assets → CDN cache
   │
   ▼
Load Balancer
   │
   ├── App servers × 2–N (autoscaling)
   │       │
   │       ├── Redis/ElastiCache → carts/sessions
   │       └── Managed PostgreSQL/MySQL
   │
   └── Payment provider
           └── Hosted/tokenized checkout

1. Edge: Cloudflare or CloudFront

Put a CDN/WAF in front of the entire store. Cache product/category pages, images, JS, CSS, and other non-personalized content at the edge, while bypassing cache for cart, account, checkout, and other personalized requests.

Cloudflare specifically supports ecommerce caching, WAF, bot protection and traffic-spike handling, while AWS CloudFront provides CDN capabilities and is within AWS's PCI DSS scope. Cloudflare Docs AWS Documentation

My practical choice: Cloudflare in front of an AWS deployment if you want strong edge/security tooling without coupling everything to AWS.

2. Application: AWS ECS/Fargate or EC2 Auto Scaling

I'd avoid putting the store on one VPS.

Use:

• AWS ECS/Fargate for containerized application servers
• 2+ application instances across availability zones
• Auto Scaling based on CPU/request count
• Application Load Balancer
• Infrastructure-as-code with Terraform or CloudFormation

AWS lists ECS, Fargate, EC2, CloudFront, ElastiCache and other relevant services as currently within its PCI DSS scope, but that doesn't make your application automatically PCI compliant—your configuration and responsibilities still matter. Amazon Web Services, Inc. AWS Documentation

3. Cart performance: Redis

For a high-traffic store, put ephemeral/high-read data in Redis/ElastiCache:

• Shopping carts
• Sessions
• Short-lived product/pricing data
• Rate-limit counters
• Frequently accessed configuration

Don't use Redis as the authoritative source for orders. Persist orders and inventory in your relational database.

For the database, I'd use managed PostgreSQL (Amazon RDS/Aurora PostgreSQL) with Multi-AZ and automated backups.

4. Keep card data out of your infrastructure

This is probably the most important architectural decision.

Use a PCI-compliant payment processor's hosted checkout or properly implemented hosted payment fields/tokenization, rather than having your application receive raw card numbers.

PCI SSC says that eligibility for SAQ A can depend on all payment-page elements originating directly from a PCI DSS-compliant third-party provider; other integrations can put you into SAQ A-EP or another scope. PCI Security Standards Council PCI Security Standards Council

So architect the flow approximately as:

Store → Create payment session
          ↓
      Payment provider
          ↓
Customer enters card information
          ↓
Payment provider
          ↓
Store receives payment result/token

Your servers should ideally see payment tokens/statuses, not PAN/card numbers.

Also note that outsourcing payments doesn't eliminate PCI responsibilities: PCI SSC says SAQ A ecommerce merchants can still have requirements such as ASV vulnerability scanning. PCI Security Standards Council

5. Don't cache cart/checkout responses

This is critical for both performance and security.

Cache:

• Product pages
• Category pages
• Images
• CSS/JS
• Public API responses where appropriate

Don't cache:

• /cart
• /checkout
• /account
• Order details
• Personalized pricing
• Payment responses
• Anything containing customer/payment information

AWS explicitly recommends not caching credit-card-related information in CloudFront edge caches. AWS Documentation

The stack I'd deploy

Cloudflare itself is a PCI DSS Level 1 service provider, although its certification doesn't automatically make your particular configuration or application compliant. Cloudflare Docs

One important caveat

PCI compliance is an architecture + operational process, not a hosting product. You need to establish your exact card-data flow, determine the applicable SAQ/assessment, verify each third-party provider's current AOC, and have the resulting environment reviewed appropriately.

If you tell me what ecommerce platform you're using (Shopify, WooCommerce, Magento/Adobe Commerce, custom, etc.), expected monthly orders/traffic, and whether you're currently on shared hosting/VPS/cloud, I can turn this into a concrete architecture and approximate monthly cost.

For an ecommerce store where PCI scope and fast cart/checkout performance are both priorities, I’d use a managed cloud architecture rather than traditional shared hosting.

Recommended setup

AWS + managed ecommerce application + hosted/tokenized payments

Customer
   │
   ▼
Route 53
   │
   ▼
CloudFront CDN + AWS WAF
   │
   ├── Static assets ──► S3
   │
   ▼
Application Load Balancer
   │
   ▼
ECS/Fargate application servers
   │
   ├──► ElastiCache/Redis  ← sessions, cart, frequently-read data
   │
   └──► RDS PostgreSQL/MySQL
              │
              ▼
       Backups / replicas

Payment:
Store ──► PCI-compliant payment provider
             │
             └──► tokenized payment data

AWS currently lists CloudFront, ECS, EC2, ElastiCache, RDS, WAF, CloudWatch and other relevant services as PCI DSS in-scope services. That doesn't make your store automatically PCI compliant—the application, configuration, processes, and shared-responsibility controls still matter. Amazon Web Services, Inc. Amazon Web Services, Inc.

The important PCI decision

Don't put raw card data through your application servers if you don't need to.

Use a PCI-compliant payment provider with either a hosted checkout or properly implemented provider-hosted payment fields. Depending on the exact implementation and other eligibility criteria, this can substantially reduce your PCI scope. PCI SSC specifically distinguishes between payment pages entirely supplied by the payment provider (SAQ A circumstances) and pages where your site participates in the payment page (SAQ A-EP circumstances). PCI Security Standards Council PCI Security Standards Council

Even an SAQ A implementation can have ongoing requirements such as external vulnerability scanning, so outsourcing payments isn't the same thing as having zero PCI responsibilities. PCI Security Standards Council

For fast cart performance

I'd configure it this way:

• CloudFront: Cache product/category/static content at the edge.
• Don't cache personalized cart/checkout responses. A user's cart, account information and payment-related responses should bypass shared caching. AWS specifically recommends not caching credit-card information in CloudFront edge caches. AWS Documentation
• Redis/ElastiCache: Keep cart/session data and other high-frequency reads out of the relational database where appropriate. ElastiCache is itself listed within AWS's PCI scope. Amazon Web Services, Inc. AWS Documentation
• RDS: Use Multi-AZ for the transactional database, automated backups, encryption, and a read replica if read volume eventually warrants it.
• ECS/Fargate: Run multiple application instances behind a load balancer so traffic spikes don't bring down checkout.
• WAF: Put it in front of the application to filter common malicious traffic and reduce unnecessary application load.
• Observability: CloudWatch logs/metrics/alarms plus centralized audit logging.
• Autoscaling: Scale application containers based on CPU/memory and, ideally, application-level metrics such as request latency.

AWS also provides an ecommerce architecture using Route 53, CloudFront, S3 and backend services, which is broadly consistent with this approach. AWS Documentation

One architectural choice I'd avoid

I wouldn't start with:

single VPS + WordPress/WooCommerce + MySQL + Redis + manually configured firewall

if PCI compliance is a serious requirement and the store is expected to grow. It can be secured, but you're taking on substantially more patching, hardening, monitoring, redundancy and compliance work yourself.

Likewise, Kubernetes is unnecessary unless you already have a team experienced with it. ECS/Fargate gives you containerization and horizontal scaling with considerably less operational overhead.

Practical starting configuration

For a small-to-medium store, a sensible initial deployment would be:

• CloudFront + WAF
• ALB
• 2 ECS/Fargate application tasks
• ElastiCache Redis
• RDS PostgreSQL/MySQL, Multi-AZ
• S3 for product/media assets
• Hosted/tokenized payment provider
• CloudWatch + centralized audit logs
• Automated backups
• Infrastructure-as-code (Terraform or CloudFormation)
• Separate production/staging AWS accounts or environments
• Strict IAM with MFA and least privilege

Then load-test cart, login, inventory reservation and checkout separately. Those endpoints should be treated differently from cacheable product pages.

If you tell me your expected monthly orders/traffic, ecommerce platform (Shopify/WooCommerce/Magento/custom), and whether you need US-only or global customers, I can turn this into a concrete architecture with instance/container sizes and an approximate monthly cost.

Likewise, Kubernetes is unnecessary unless you already have a team experienced with it. ECS/Fargate gives you containerization and horizontal scaling with considerably less operational overhead.

Practical starting configuration

For a small-to-medium store, a sensible initial deployment would be:

• CloudFront + WAF
• ALB
• 2 ECS/Fargate application tasks
• ElastiCache Redis
• RDS PostgreSQL/MySQL, Multi-AZ
• S3 for product/media assets
• Hosted/tokenized payment provider
• CloudWatch + centralized audit logs
• Automated backups
• Infrastructure-as-code (Terraform or CloudFormation)
• Separate production/staging AWS accounts or environments
• Strict IAM with MFA and least privilege

Then load-test cart, login, inventory reservation and checkout separately. Those endpoints should be treated differently from cacheable product pages.

If you tell me your expected monthly orders/traffic, ecommerce platform (Shopify/WooCommerce/Magento/custom), and whether you need US-only or global customers, I can turn this into a concrete architecture with instance/container sizes and an approximate monthly cost.

For an ecommerce store where PCI compliance and fast cart/checkout performance are both priorities, I’d recommend a managed commerce platform or a tightly isolated AWS architecture, rather than traditional shared hosting.

My preferred setup: managed commerce

If you don't have a strong reason to build the entire commerce stack yourself, Shopify is the simplest option.

• Storefront: Shopify
• Cart/checkout: Shopify-hosted checkout
• Payments: Shopify Payments or another PCI-compliant payment provider
• Static assets: Shopify CDN
• Custom functionality: Shopify apps/extensions rather than modifying checkout infrastructure
• DNS/CDN/security: handled largely by the platform
• PCI: Shopify is Level 1 PCI DSS compliant and currently publishes its PCI Attestation of Compliance. Shopify Shopify
• Checkout performance: Shopify's checkout runs on Shopify-managed infrastructure and uses sandboxing to limit custom code in the checkout environment. Shopify

This is my recommendation for most stores, because reducing the amount of infrastructure inside your PCI scope is generally much more valuable than squeezing another few milliseconds out of a self-hosted stack.

Importantly, outsourcing payments doesn't make PCI responsibility disappear—you still have obligations around your providers and compliance validation. PCI Security Standards Council

If you need a custom/headless store

I'd use something like:

                    ┌───────────────┐
                    │   Customers   │
                    └───────┬───────┘
                            │
                         HTTPS
                            │
                    ┌───────▼───────┐
                    │ Route 53      │
                    └───────┬───────┘
                            │
                    ┌───────▼───────┐
                    │ CloudFront    │
                    │ CDN + WAF     │
                    └───┬────────┬───┘
                        │        │
                 cached │        │ dynamic
                        │        │
                  ┌─────▼──┐  ┌──▼────────────┐
                  │ S3     │  │ ALB           │
                  │ assets │  │               │
                  └────────┘  └──────┬────────┘
                                     │
                              ┌──────▼──────┐
                              │ App servers │
                              │ ECS/Fargate │
                              └──────┬──────┘
                                     │
                           ┌─────────▼─────────┐
                           │ ElastiCache       │
                           │ Redis             │
                           └─────────┬─────────┘
                                     │
                              ┌──────▼──────┐
                              │ RDS         │
                              │ PostgreSQL  │
                              └─────────────┘

                   Payment card data
                         │
                         ▼
                 PCI payment provider
                 / tokenized checkout

AWS specifically provides a reference architecture for headless ecommerce using CloudFront, WAF, load balancing, Fargate and ElastiCache. AWS Documentation

Why this performs well

CloudFront handles cached product pages, images, JavaScript and CSS close to the customer. It's also PCI DSS compliant, although you should specifically prevent sensitive payment information from being cached at the edge. AWS Documentation AWS Documentation

Redis/ElastiCache handles the expensive, frequently accessed pieces:

• Cart/session state
• Product/pricing lookups
• Inventory reads
• API response caching
• Rate limiting

AWS currently lists CloudFront, ECS, EC2, ElastiCache, RDS-related services and other components in its PCI DSS scope, which gives you a strong foundation for a compliant architecture. Amazon Web Services, Inc.

The critical PCI design decision

Do not let your application handle raw card numbers unless you genuinely need to.

Instead:

Browser
   │
   ├── Storefront/cart ──► Your application
   │
   └── Payment details ──► PCI payment provider
                              │
                              └── token ──► Your application

Your application stores a payment token/reference, not the customer's PAN/CVV.

For an especially low-scope implementation, have the payment page/checkout originate entirely from the PCI-compliant payment provider where your compliance setup permits it. PCI SSC explicitly distinguishes these architectures when determining SAQ eligibility. PCI Security Standards Council

What I'd choose

Bottom line: if this is a normal ecommerce business, I'd choose Shopify with its hosted checkout. If you need a genuinely custom platform, I'd choose AWS CloudFront + WAF → ALB → ECS/Fargate → ElastiCache → RDS, with a PCI-compliant tokenized payment provider. That gives you excellent cart latency without unnecessarily putting payment-card infrastructure into your application.

PCI compliance is ultimately a system/process responsibility, not something you achieve merely by picking a "PCI-compliant host"; the exact scope should be confirmed with your acquirer/QSA. PCI Security Standards Council

For an ecommerce store where PCI scope and cart latency both matter, I’d use a managed AWS architecture with tokenized/hosted payments, rather than putting the entire store on a traditional “PCI hosting” VPS.

Recommended architecture

Customer
   │
   ▼
CloudFront CDN + AWS WAF
   │
   ├── Static assets ──► S3
   │
   └── Dynamic requests
            │
            ▼
      Load Balancer
            │
       ┌────┴────┐
       ▼         ▼
   App servers  App servers
   (containers / ECS)
       │
       ├── ElastiCache Redis
       │      └── cart/session data
       │
       └── Aurora PostgreSQL/MySQL
              └── orders/catalog

Checkout ─────────► Stripe Checkout
                      │
                      ▼
                 Stripe payment

AWS's PCI DSS Level 1 status covers the underlying AWS infrastructure, but your application and configuration remain your responsibility. Amazon Web Services, Inc. Amazon Web Services, Inc.

The key PCI decision: keep card data out of your infrastructure

I'd strongly favor Stripe Checkout (or an equivalent hosted/tokenized payment flow) rather than collecting raw card numbers in your application.

Stripe says Checkout can qualify for the simplest PCI validation path, and its hosted payment components keep card-data collection on Stripe's infrastructure rather than your server. Stripe Stripe

That gives you a much smaller PCI footprint:

• Your app handles cart, customer, inventory, and order IDs.
• Stripe handles the actual card information.
• Your database should never contain PAN/card numbers.
• Store Stripe payment/customer tokens rather than card data.
• Still complete the appropriate PCI validation/SAQ for your actual integration.

For fast carts

Use Redis/ElastiCache for active cart and session state, rather than repeatedly hitting the relational database.

I'd structure it roughly as:

• CloudFront — cache images, JS, CSS, product pages where appropriate.
• S3 — product images and static assets.
• ECS/Fargate — horizontally scalable application containers.
• ElastiCache/Redis — cart/session data and hot catalog data.
• Aurora — authoritative orders, inventory, customers, etc.
• SQS — asynchronous work such as emails, fulfillment events, inventory synchronization.
• CloudFront + WAF — edge delivery plus protection against common web attacks.

AWS's own payment architecture guidance uses CloudFront, WAF, load balancing, ECS/Fargate, and ElastiCache in this general pattern. AWS Documentation AWS Documentation

Important caching rule

Do not blindly cache cart or checkout responses at the CDN.

Product/category content can be aggressively cached, while:

• /cart
• /checkout
• /account
• order status
• personalized pricing
• inventory-sensitive responses

should generally bypass shared caching.

AWS specifically recommends not caching credit-card-related information in CloudFront edge caches. AWS Documentation

Security baseline

I'd put these controls in place from day one:

• TLS everywhere
• CloudFront → WAF
• WAF managed rules + rate limiting/bot controls
• Private subnets for application/database infrastructure
• No public database
• IAM least privilege
• Secrets Manager rather than credentials in code
• CloudTrail + centralized logging
• Automated vulnerability/dependency scanning
• Regular PCI-required vulnerability scanning/testing
• Infrastructure-as-code so the environment is reproducible
• Strict control and inventory of JavaScript running on checkout/payment pages

The last item is particularly important under PCI DSS 4.x: payment-page scripts and security-impacting headers have specific requirements around authorization, integrity, inventory, and tamper detection. Amazon Web Services, Inc.

What I'd actually deploy

For a typical mid-size store, my default stack would be:

This is the sweet spot I'd recommend: you get cloud scalability and very fast cart operations without building a giant dedicated PCI environment yourself.

One caveat: “AWS is PCI compliant” does not mean your store is automatically PCI compliant. AWS explicitly uses a shared-responsibility model, so have your QSA/compliance team validate the resulting architecture and payment flow. Amazon Web Services, Inc.

If you tell me your expected monthly orders, peak requests/second, ecommerce platform (Shopify/WooCommerce/Magento/custom), and whether you need multi-region, I can size this into a concrete architecture and approximate monthly AWS cost.

For an ecommerce store where PCI scope and fast cart/checkout performance both matter, I’d use a managed AWS architecture with payment processing fully outsourced.

Recommended setup

Customers
   │
   ▼
CloudFront CDN + AWS WAF
   │
   ├── Static assets → S3
   │
   ▼
Application Load Balancer
   │
   ▼
ECS Fargate
   │
   ├── ElastiCache (Redis/Valkey) ← cart/session/cache
   │
   └── Aurora PostgreSQL/MySQL ← orders/products
            │
            ▼
      Payment provider
      (hosted checkout)

1. CDN + WAF: CloudFront

Put Amazon CloudFront in front of the entire storefront, with AWS WAF attached.

CloudFront is PCI DSS validated, and AWS specifically recommends WAF controls for CloudFront distributions. AWS Documentation AWS Documentation

Use caching aggressively for:

• Product/category pages
• Images
• CSS/JS
• Fonts
• Public API responses where appropriate

But don't cache personalized cart, account, or payment responses. AWS specifically cautions against caching cardholder information at CloudFront edges. AWS Documentation

2. Application: ECS Fargate

I'd choose ECS Fargate rather than managing EC2 instances yourself.

Run multiple application containers across at least two Availability Zones behind an Application Load Balancer. Autoscale based on CPU, memory, and—ideally—request/latency metrics.

AWS currently lists ECS Fargate, EC2, CloudFront, ElastiCache, and several other relevant services as PCI DSS in-scope services. Amazon Web Services, Inc.

3. Cart: Redis/Valkey

For the cart specifically, use Amazon ElastiCache for Valkey/Redis OSS.

Store things such as:

cart:{customer_id}
  ├── product_id
  ├── quantity
  ├── price/version
  └── expiration

This keeps cart reads/writes out of your primary database and makes operations like:

• Add item
• Remove item
• Change quantity
• Retrieve cart

extremely fast.

ElastiCache is also within AWS's PCI DSS service scope. AWS Documentation

Don't treat Redis as your system of record, though. Persist completed orders and authoritative inventory/pricing in your database.

4. Database: Aurora

Use Amazon Aurora PostgreSQL (or MySQL if your application requires it), with:

• Multi-AZ deployment
• Automated backups
• Encryption at rest
• TLS in transit
• Read replicas if traffic warrants them
• Connection pooling

For high-volume stores, keep the hot cart/session path in Redis while keeping transactional data in Aurora.

5. Most important PCI decision: don't handle card numbers

I'd strongly recommend a hosted payment page/checkout from a PCI-validated payment provider, rather than having your application collect raw card numbers.

The PCI SSC says that when payment-page elements originate entirely from a PCI DSS-compliant third party and the other eligibility requirements are satisfied, the merchant may qualify for SAQ A. PCI Security Standards Council

That can dramatically reduce your PCI scope.

An embedded payment iframe can still introduce additional requirements around protecting the payment page from script attacks under PCI DSS v4.0.1, so a full redirect/hosted checkout can be an attractive option when UX permits. PCI Security Standards Council PCI Perspectives

6. Network/security architecture

I'd make the application/database tiers private:

• CloudFront → WAF → ALB
• ALB → private ECS services
• ECS → private Aurora/ElastiCache
• No public database
• No public Redis
• Secrets in AWS Secrets Manager
• IAM roles instead of embedded credentials
• KMS encryption
• CloudTrail + CloudWatch logging
• GuardDuty/Security Hub for additional detection

AWS's ecommerce security guidance also recommends restricting the origin to CloudFront and using WAF rate limiting for things such as cart abuse and credential stuffing. AWS Documentation

What I'd actually deploy

The key performance trick

Don't make the cart go through your database on every interaction.

Product page: CloudFront → cache
Add-to-cart: CloudFront/WAF → ECS → Redis
View cart: ECS → Redis
Checkout: ECS → payment provider
Successful payment: payment webhook → ECS → Aurora/order system

That gives you a very fast cart while preserving the database as the authoritative transactional system.

One important caveat: using PCI-compliant AWS services does not automatically make your ecommerce application PCI compliant. AWS explicitly states that customers remain responsible for their own PCI DSS compliance and additional testing/controls. Amazon Web Services, Inc.

If you're building this from scratch, AWS + CloudFront/WAF + ECS Fargate + ElastiCache + Aurora + hosted payments would be my default architecture. For a smaller store, I would simplify it considerably rather than paying for all of these components from day one.

For an ecommerce store where PCI DSS compliance and cart latency matter, I’d avoid conventional shared hosting. My preferred setup is either Shopify for the lowest operational/compliance burden, or AWS managed infrastructure if you need substantial customization.

My recommendation

Option A — Best for most stores: Shopify + headless/custom storefront

Use Shopify for the commerce backend and checkout, with a fast CDN-backed storefront if you need custom UX.

• Commerce/checkout: Shopify
• Payments: Shopify Payments or another PCI-compliant processor
• Frontend: Shopify-hosted storefront or headless frontend
• CDN: Shopify's infrastructure
• Cart: Keep cart operations on Shopify rather than implementing your own payment/card-data infrastructure
• Analytics: Server-side or carefully controlled third-party scripts
• Monitoring: Real-user monitoring + checkout/cart conversion metrics

This is attractive because Shopify's checkout is PCI DSS 4.0 compliant, and Shopify publishes its current PCI Attestation of Compliance. Shopify Shopify

I'd choose this if: you want to minimize PCI scope, infrastructure maintenance, and operational complexity.

Option B — Best for maximum control: AWS

For a custom ecommerce platform, I'd build roughly:

Users
  │
  ▼
Route 53
  │
  ▼
CloudFront + AWS WAF
  │
  ├── Static assets → S3
  │
  └── Dynamic requests
          │
          ▼
   ALB / API Gateway
          │
     ┌────┴────┐
     ▼         ▼
   App       Cart API
  Fargate    / Lambda
                │
                ▼
          ElastiCache
          (Redis/Valkey)
                │
                ▼
          Aurora / RDS

AWS specifically recommends CloudFront for edge caching, WAF for application-layer protection, load balancing across Availability Zones, and ElastiCache for reducing application/database latency. AWS Documentation AWS also has an ecommerce architecture using CloudFront, WAF, Fargate, ElastiCache and managed databases. AWS Documentation

For PCI, AWS has a broad set of PCI DSS–validated services, including CloudFront, ECS/Fargate, RDS, DynamoDB and ElastiCache. Amazon Web Services, Inc. But using PCI-validated AWS services does not automatically make your application PCI compliant; you still have configuration, application-security, access-control, logging, vulnerability-management, and assessment responsibilities.

The important cart-performance design

Don't treat the cart like ordinary cacheable web content.

I'd configure:

• Product/catalog pages: aggressively CDN-cacheable.
• Images/CSS/JS: served from CloudFront/S3 with long-lived immutable caching.
• Product/search APIs: selectively cached.
• Cart: dynamic, low-latency API backed by Redis/Valkey.
• Inventory/pricing: authoritative backend checks at checkout.
• Checkout/payment: never put cardholder data into your own Redis cache, CDN cache, application logs, analytics, or database unless there's a compelling reason.
• Sessions: use secure, short-lived identifiers rather than putting sensitive payment information in session state.
• Checkout responses: explicitly prevent inappropriate CDN caching.

AWS's ecommerce-specific CloudFront guidance distinguishes static assets, dynamic pages, and cart/inventory/pricing APIs because they need different caching behavior. AWS Documentation AWS also explicitly recommends not caching credit-card information in CloudFront edge caches. AWS Documentation

PCI strategy

The biggest architectural win is keeping card data out of your infrastructure altogether.

Use a PCI-compliant payment processor with hosted checkout, redirect, or appropriately implemented tokenization. PCI SSC notes that outsourcing payment processing can substantially reduce the merchant's directly applicable requirements, although the merchant still has responsibilities for the provider and its own environment. PCI Security Standards Council PCI Security Standards Council

So I'd aim for:

Browser → your cart → payment provider's secure payment flow → token/payment result → your order system

rather than:

Browser → your servers → raw card number → your database

What I'd actually deploy

For a serious custom store, my default would be:

This gives you fast edge delivery while keeping the cart and checkout dynamic and close to the application/data layer. AWS's reference ecommerce architectures use essentially these same caching and tiering principles. AWS Documentation AWS Documentation

Bottom line: if PCI compliance is a major concern and you don't need unusual backend requirements, I'd pick Shopify. If you're building a highly customized marketplace/ecommerce platform, I'd pick AWS + CloudFront/WAF + Fargate + Valkey + Aurora + hosted/tokenized payments. The latter gives you much more control, but also substantially more PCI and operational responsibility.

For a PCI-sensitive ecommerce store where cart latency matters, I’d favor a managed cloud architecture over traditional shared hosting or a single VPS.

Recommended setup

Cloudflare → AWS CloudFront/WAF → containerized app → managed database/cache → PCI-compliant payment provider

A practical version:

• CDN/WAF: Cloudflare or AWS CloudFront + AWS WAF
• Application: AWS ECS on Fargate, running your ecommerce application in multiple availability zones
• Database: Amazon RDS (PostgreSQL/MySQL), Multi-AZ
• Cart/session layer: Amazon ElastiCache for Redis
• Assets: Amazon S3 + CDN
• Payments: Stripe/Adyen/Braintree hosted/tokenized payment components
• Secrets: AWS Secrets Manager + KMS
• Monitoring: CloudWatch + centralized audit logging
• Network: Private subnets for application/database resources; only the CDN/load balancer is publicly exposed

AWS currently lists CloudFront, ECS/Fargate, RDS, ElastiCache, WAF, Secrets Manager, S3 and related services as PCI DSS in-scope services. Amazon Web Services, Inc.

The important PCI design choice

Don't put raw card data through your ecommerce application if you don't need to.

Use a PCI-compliant payment provider's hosted checkout/tokenization so your application handles payment tokens rather than card numbers. This can substantially reduce your PCI scope, although it doesn't eliminate your PCI obligations. PCI SSC explicitly notes that merchants outsourcing payment processing still have responsibilities around the provider and their own compliance validation. PCI Security Standards Council

AWS itself is PCI-assessed, but that doesn't make an application deployed on AWS automatically PCI compliant—the AWS/customer shared-responsibility model still applies. Amazon Web Services, Inc. AWS Documentation

Making the cart fast

The biggest mistake is trying to cache the cart itself.

I'd structure traffic roughly like this:

                    ┌───────────────┐
Customer ──────────►│ Cloudflare/CDN│
                    │ WAF + DDoS    │
                    └───────┬───────┘
                            │
                    ┌───────▼───────┐
                    │ Load Balancer  │
                    └───────┬───────┘
                            │
                 ┌──────────▼──────────┐
                 │ ECS/Fargate         │
                 │ App servers         │
                 └─────┬─────────┬─────┘
                       │         │
                ┌──────▼───┐ ┌──▼─────────┐
                │ Redis     │ │ RDS        │
                │ Cart      │ │ Products/  │
                │ Sessions  │ │ Orders     │
                └───────────┘ └────────────┘

Cache product/catalog pages, images, CSS, JS and other public content aggressively at the edge. Keep cart, account, checkout and order information dynamic. Cloudflare specifically recommends this sort of ecommerce architecture and notes that caching product content reduces origin/database load. Cloudflare Docs Cloudflare Blog

For CloudFront, AWS specifically cautions against caching credit-card information in edge caches. AWS Documentation

Why Redis matters

For a busy store, I'd keep ephemeral cart/session state in Redis rather than repeatedly hitting the relational database:

Add to cart
    ↓
API
    ↓
Redis ──────► ~single-digit-ms cart operations
    │
    └──► RDS for durable order/customer data

The database remains the source of truth for orders and inventory, while Redis absorbs the high-frequency cart/session traffic.

What I'd choose by store size

If you're building a custom store, my default choice would be AWS ECS/Fargate + RDS + ElastiCache behind Cloudflare, rather than EC2 instances that you have to patch and administer yourself.

If you're using Shopify, BigCommerce, WooCommerce, Magento/Adobe Commerce, or a custom Node/Python/Java stack, the optimal setup changes quite a bit. Tell me which platform you're using and roughly orders/day + peak concurrent shoppers, and I can give you a concrete architecture and estimated monthly cost.

For a serious ecommerce store, I’d use a managed AWS architecture behind Cloudflare, with a hosted/tokenized payment flow. The key is to keep card data out of your application wherever possible while aggressively caching everything that doesn’t need to be dynamic.

Recommended setup

Customer
   │
   ▼
Cloudflare CDN / WAF / DDoS
   │
   ├── Static assets ───────► Cloudflare Edge Cache
   │
   ▼
Application Load Balancer
   │
   ▼
ECS/Fargate app servers ───► ElastiCache/Redis
   │
   ├── Product/catalog data ─► RDS/Aurora
   │
   └── Orders ───────────────► RDS/Aurora
                 │
                 ▼
          Stripe Checkout

1. Application hosting: AWS ECS/Fargate

I'd favor AWS ECS with Fargate over managing individual EC2 servers.

• Run at least 2 application instances across availability zones.
• Autoscale based on CPU, request count, and latency.
• Put the application behind an Application Load Balancer.
• Keep application servers private; only the load balancer is public.
• Use RDS/Aurora for transactional data.
• Use Redis/ElastiCache for sessions, cart state, frequently accessed catalog data, and other short-lived data.

AWS explicitly supports PCI DSS workloads, but PCI compliance is still a shared responsibility—using PCI-eligible AWS services does not automatically make your particular application compliant. Amazon Web Services, Inc. Amazon Web Services, Inc. Amazon Web Services, Inc.

2. Put Cloudflare in front

Use Cloudflare CDN + WAF + DDoS protection in front of the application.

Cache aggressively:

• Product images
• CSS/JS
• Fonts
• Public product pages
• Category pages where appropriate
• Other immutable/static content

Cloudflare currently provides edge caching, image optimization, asset optimization, bot protection and other ecommerce-specific performance/security features. Cloudflare Docs Cloudflare Docs

I'd also consider Tiered Cache for a high-traffic store, because it reduces the number of edge locations that need to hit your origin. Cloudflare Docs

3. Treat the cart as dynamic

This is the important part for fast cart performance.

Do not cache personalized cart/checkout responses.

Instead:

• Store the cart/session in Redis.
• Give the browser a secure, HttpOnly session cookie.
• Keep cart operations lightweight.
• Return only the data needed to update the mini-cart/cart UI.
• Cache product/catalog data separately from cart state.
• Use optimistic UI updates where appropriate.

Cloudflare specifically warns that careless ecommerce caching can result in one shopper seeing another shopper's cart or private information. Cloudflare Blog

A good architecture therefore looks like:

GET /products/shoes
        ↓
Cloudflare cache
        ↓
Usually never reaches origin

POST /cart/items
        ↓
Cloudflare/WAF
        ↓
Application
        ↓
Redis
        ↓
Fast response

GET /cart
        ↓
Application
        ↓
Redis
        ↓
Personalized response

4. Keep payment-card data out of your infrastructure

This is probably the biggest PCI optimization.

I'd use Stripe Checkout or another PCI-validated hosted/tokenized payment solution rather than collecting raw card numbers in your own frontend/backend.

Stripe says Checkout and Elements can keep card data collection on Stripe's PCI-validated infrastructure, and Checkout can qualify eligible integrations for the simpler SAQ A validation approach. Stripe Stripe

That means your architecture becomes:

Your store
   │
   │ order/cart information
   ▼
Stripe Checkout
   │
   │ card number never touches your servers
   ▼
Stripe
   │
   ▼
Webhook → Your order service

Don't assume this eliminates PCI obligations. Your exact integration, scripts, infrastructure and business volume determine your requirements. Stripe itself notes that the applicable PCI documentation depends on how payment data flows through the integration. Stripe Support

My preferred stack

PCI-specific controls I'd insist on

• No raw PAN/card data in application logs.
• No card numbers in analytics events.
• TLS everywhere.
• MFA for administrative access.
• Least-privilege IAM.
• Separate production and non-production accounts/environments.
• Private database and Redis subnets.
• WAF rules for common web attacks.
• Dependency and OS patch management.
• Centralized immutable/auditable logs.
• Vulnerability scanning and required penetration/security testing.
• Strict controls over third-party JavaScript on checkout/payment pages.
• Document exactly which systems are in PCI scope and why.

For PCI DSS v4, client-side security deserves particular attention; Cloudflare now provides tooling specifically addressing requirements such as 6.4.3 and 11.6.1. Cloudflare Docs

If I were building it today

For a small-to-medium store, I wouldn't over-engineer it. I'd start with:

Cloudflare → ALB → 2+ Fargate tasks → Aurora + Redis → Stripe Checkout

Then add autoscaling, Cloudflare Tiered Cache, read replicas, queues, and additional application instances as traffic warrants.

The biggest performance win isn't making the database or EC2 instance enormously powerful—it's keeping product/catalog traffic at the edge and keeping the dynamic cart extremely small and Redis-backed. Meanwhile, keeping payment-card data entirely with a PCI-validated payment provider dramatically reduces the amount of infrastructure you need to bring into your PCI scope. Cloudflare Docs Stripe

If you tell me your expected monthly orders, peak requests/second, ecommerce platform (custom/Shopify/WooCommerce/etc.), and AWS budget, I can turn this into a concrete architecture with estimated monthly costs and PCI scope.

For a serious ecommerce store, I’d use a managed AWS architecture with the payment-card environment minimized or completely outsourced. That gives you strong performance without turning PCI compliance into a full-time infrastructure project.

Recommended setup

Customers
   │
   ▼
Route 53
   │
   ▼
CloudFront + AWS WAF
   │
   ├── Static assets → S3
   │
   └── Dynamic requests
          │
          ▼
      ALB
          │
          ▼
   ECS/Fargate app tier
      │         │
      │         ├── ElastiCache (Redis/Valkey)
      │         │
      │         └── SQS for async jobs
      │
      ▼
   RDS PostgreSQL/MySQL
          │
          ▼
   Backups → S3

Payments: use a PCI-validated payment processor with hosted/redirected payment collection rather than accepting raw card numbers in your application.

AWS currently lists CloudFront, WAF-related infrastructure, ECS/Fargate, RDS, ElastiCache, S3 and other relevant services as within its PCI DSS service scope. Amazon Web Services

Why this setup

• CloudFront: puts cached content close to shoppers and reduces load on your application. AWS specifically supports CloudFront for PCI workloads. AWS Documentation
• WAF: blocks common web attacks and abusive/bot traffic before it reaches the app. AWS's own ecommerce architecture uses CloudFront + WAF in this way. AWS Documentation
• ECS/Fargate: gives you horizontally scalable application servers without managing individual VMs.
• ElastiCache: cache product/catalog data, sessions where appropriate, inventory reads, and expensive computed responses. AWS's ecommerce reference architecture uses ElastiCache specifically for caching application responses. AWS Documentation
• RDS: managed relational database with Multi-AZ deployment, encryption and automated backups.
• SQS: keeps things like emails, fulfillment notifications, analytics and webhook processing out of the checkout request path.

The PCI part I'd prioritize

The biggest architectural win is never letting your servers see full card numbers.

Use a payment processor's hosted checkout or appropriately implemented hosted payment fields. PCI SSC says that merchants can qualify for SAQ A when all elements of the payment page originate directly from PCI DSS-validated third-party providers, assuming all other SAQ A criteria are met. PCI Security Standards Council PCI Security Standards Council

There's an important distinction, though: "AWS is PCI compliant" does not mean your application is PCI compliant. AWS's compliance is part of the shared-responsibility model; your configuration, application, access controls, patching, logging, vulnerability management and payment integration still matter. Amazon Web Services AWS Documentation

Also, even merchants using outsourced payment processing can have PCI obligations such as ASV vulnerability scanning under current SAQ A requirements. PCI Security Standards Council

For really fast carts

I would not cache the cart itself at CloudFront.

Instead:

• Cache anonymous product/category pages aggressively at CloudFront.
• Cache product/catalog data in Redis/Valkey.
• Keep carts server-side and keyed to a secure session/customer identifier.
• Don't cache responses containing personalized cart, customer or payment information.
• Use short-lived database transactions for inventory reservation.
• Keep checkout APIs uncached.
• Put slow work—emails, fraud-event processing, fulfillment notifications, analytics—onto SQS.
• Use database connection pooling and proper indexes before simply throwing more CPU at the database.

AWS itself recommends not caching credit-card information in CloudFront edge caches. AWS Documentation

What I'd deploy initially

For a mid-sized store, I'd start with:

I'd also establish separate production, staging and development AWS accounts, restrict production access through IAM/SSO/MFA, encrypt everything, centralize logs, and make infrastructure reproducible with Terraform or CloudFormation.

This is very close to AWS's own current ecommerce reference architecture, which combines CloudFront, WAF, load balancing, Fargate, API services, S3 and ElastiCache for a scalable ecommerce application. AWS Documentation

Bottom line: for PCI + fast checkout, I'd choose AWS + CloudFront/WAF + ECS/Fargate + ElastiCache + RDS + outsourced hosted payments. The key isn't just choosing a PCI-capable host; it's designing the system so that cardholder data barely enters your environment at all.

For an ecommerce store where PCI compliance and fast cart performance both matter, I would avoid a basic shared host and design around two principles:

1. Keep payment card data out of your infrastructure whenever possible (reduces PCI scope and risk). PCI Security Standards Council PCI Security Standards Council
2. Separate the high-speed shopping experience from security-sensitive components (cart, checkout, APIs, databases). DCHost.com

A strong general-purpose setup:

Recommended architecture

Customers
   |
   v
CDN + WAF
   |
   v
Load Balancer
   |
   +----------------+
   |                |
Web/App Servers   Static Assets
   |
   +----------------+
   |
Redis/Memcached (cart + sessions)
   |
Database Cluster
   |
Backups + Monitoring

Payment:
Customer ---> PCI-compliant payment provider
              (card data never touches your servers)

Hosting stack recommendation

1. Application hosting

Use managed cloud infrastructure rather than shared hosting.

Good fits:

• AWS (with PCI-eligible services and a properly designed environment)
• Google Cloud
• Azure
• Managed ecommerce hosting providers for WooCommerce/Magento

Look for:

• Private networking/VPC
• Dedicated or isolated compute
• Automated patching
• MFA access controls
• Firewall/WAF support
• Audit logs
• Backup policies

A host can provide a PCI-ready foundation, but it does not make the entire store automatically compliant; your application, payment flow, access controls, and processes remain part of PCI responsibility. PCI Security Standards Council

2. Payment processing design (most important PCI decision)

Prefer:

• Hosted checkout pages
• Tokenized payment fields
• Payment-provider iframes/components

Avoid:

• Storing card numbers
• Logging payment fields
• Passing raw card data through your backend

Keeping cardholder data away from your servers can significantly reduce PCI scope. DCHost.com

Examples:

• Stripe Checkout
• Adyen Hosted Checkout
• Braintree Hosted Fields
• Shopify Payments (if using Shopify)

Performance layer for fast carts

Cart performance usually suffers from database/session bottlenecks, not raw CPU.

Use:

Redis for:

• Shopping carts
• Sessions
• Frequently accessed catalog data

Database optimization:

• Managed PostgreSQL/MySQL
• Read replicas for large stores
• Proper indexing
• Slow-query monitoring

CDN:

Use a CDN/WAF layer for:

• Images
• JS/CSS
• Product pages
• Bot filtering
• DDoS protection

Application tuning:

• Full-page caching where possible
• Object caching
• Image optimization
• Async jobs for: - emails
• inventory sync
• analytics
• fulfillment integrations

Example setups by store size

Small store (<10k orders/month)

• Managed WooCommerce host or Shopify
• CDN + WAF
• Redis/object cache
• Hosted payment checkout

Simple, low maintenance.

Growing store (10k–100k orders/month)

• Cloud app servers
• Managed database
• Redis cluster
• CDN/WAF
• Separate staging environment
• Automated deployments

High-volume store

• Kubernetes/ECS-style deployment
• Multiple app servers
• Database replication
• Dedicated cache layer
• Queue workers
• Observability stack
• Formal PCI documentation and audits

Minimum security checklist

Require your hosting provider to support:

• TLS everywhere
• MFA for admin access
• Least-privilege permissions
• Network segmentation
• Vulnerability scanning
• Centralized logging
• Encrypted backups
• Regular patching
• Incident response procedures

PCI guidance also emphasizes that ecommerce environments need appropriate scanning, access controls, and ongoing security management rather than treating hosting as a one-time setup. PCI Security Standards Council

My default recommendation

For most serious ecommerce businesses:

Cloud infrastructure + CDN/WAF + managed database + Redis + hosted payment checkout

Specifically:

• Frontend/app: managed cloud compute
• Database: managed relational database
• Cache: Redis
• Assets: CDN/object storage
• Security: WAF + monitoring + MFA
• Payments: tokenized hosted checkout

That gives you fast carts without unnecessarily putting your store into a heavy PCI burden.

If you tell me your platform (Shopify, WooCommerce, Magento/Adobe Commerce, custom, etc.), monthly traffic/orders, and whether you need multi-region uptime, I can suggest a more exact architecture and sizing.

For an ecommerce store where PCI DSS compliance and fast cart/checkout performance both matter, I’d use a managed cloud architecture with tokenized payments, rather than putting the entire store on a traditional VPS.

Recommended setup

Customer
   │
   ▼
CDN / WAF
   │
   ├── Static assets ───────► Object storage + CDN cache
   │
   ▼
Load Balancer
   │
   ├── App server 1
   ├── App server 2
   └── App server N
          │
          ├── Redis ───────► cart/session/cache
          │
          └── Managed SQL ─► orders/products/customers

Payment
   └── Hosted/tokenized checkout ─► Payment processor

My default choice: AWS

I would build it around Amazon Web Services:

• CloudFront — CDN for product images, JS, CSS and other cacheable content.
• AWS WAF — firewall/rate limiting/bot protection in front of the store.
• Application Load Balancer — distributes traffic across application servers.
• ECS/Fargate or Kubernetes — run the ecommerce application without managing individual servers.
• RDS PostgreSQL/MySQL — managed transactional database, preferably Multi-AZ.
• ElastiCache/Redis — extremely fast cart, session and frequently accessed product data.
• S3 + CloudFront — product images and other static assets.
• Secrets Manager + KMS — credentials and encryption keys.
• CloudTrail/CloudWatch/Security Hub — audit logs, monitoring and security evidence.

AWS currently maintains PCI DSS certification for its applicable services, but AWS being PCI compliant does not automatically make your store PCI compliant; your architecture, configuration and operational controls remain your responsibility. Amazon Web Services Amazon Web Services

The most important PCI decision

Don't handle raw card numbers on your servers if you don't need to.

Use something like Stripe Checkout or Elements so card information goes directly to the payment provider rather than through your application. Stripe specifically states that its hosted payment fields can keep card data off your servers and substantially reduce PCI scope. Stripe

That gives you:

Store
  │
  │ cart/order information
  ▼
Your backend
  │
  │ payment intent / token
  ▼
Stripe
  │
  │ card information
  ▼
Stripe's PCI environment

Your application stores a payment/customer token, not the customer's full card number.

You'll still have PCI obligations—using a payment provider does not mean "zero PCI." In particular, PCI DSS 4.0 includes controls around payment-page scripts and tamper detection. Amazon Web Services

Making the cart fast

I'd treat the cart differently from normal ecommerce pages.

Cache aggressively:

• Product pages
• Categories
• Product images
• CSS/JS
• Search results where appropriate

Don't cache:

• Shopping cart
• Customer account pages
• Checkout
• Order/payment responses

Use Redis for the hot path:

Add to cart
   ↓
API
   ↓
Redis ──► immediate cart response
   ↓
Database ──► durable order/cart state

That avoids hitting PostgreSQL/MySQL for every cart operation.

CloudFront itself is PCI DSS validated, but AWS recommends not caching credit-card information at edge locations. AWS Documentation

What I'd actually deploy

For a typical mid-sized/high-growth store, my stack would be:

AWS's current PCI service list includes services such as RDS, API Gateway, S3 and Route 53; you should verify every service you introduce against the current scope and your QSA's interpretation. Amazon Web Services

One important caveat

If this is a small store, I'd actually go one step simpler: use a managed ecommerce platform/payment provider rather than building this infrastructure yourself. The AWS architecture becomes attractive when you need significant customization, traffic, integrations, or control over performance.

If you tell me roughly monthly orders, peak requests/second, ecommerce platform (Shopify/WooCommerce/custom/etc.), and whether you're doing B2C or B2B, I can give you a concrete architecture and approximate monthly AWS cost.

For a PCI-sensitive ecommerce store where cart/checkout latency matters, I’d use a managed AWS architecture rather than traditional shared hosting or a single VPS.

Recommended setup

Customers
   │
   ▼
Route 53
   │
   ▼
CloudFront + AWS WAF
   │
   ├── Static/catalog content → S3
   │
   └── Dynamic requests
          │
          ▼
       ALB
          │
          ▼
   ECS/Fargate application
          │
       ┌──┴─────────┐
       ▼            ▼
   ElastiCache    Aurora/RDS
     (Valkey)      PostgreSQL

• CDN: Amazon Web Services CloudFront in front of everything. Cache product images, CSS/JS, catalog pages and other cacheable responses at the edge. CloudFront is specifically designed to reduce origin requests and latency, and AWS documents an ecommerce architecture using it. AWS Documentation AWS Documentation
• WAF: Put AWS WAF on CloudFront for bot/rate-limit/application attack protection. WAF rules run at AWS edge locations, so malicious traffic can be stopped before reaching your application. Amazon Web Services, Inc.
• Application: Run your store on ECS/Fargate behind an Application Load Balancer. This gives you autoscaling without managing individual servers.
• Database: Use Aurora PostgreSQL or RDS PostgreSQL with Multi-AZ. Keep the database private—no direct Internet access.
• Cart/session cache: Use ElastiCache for Valkey for hot product data, inventory reads and session/cart-related data where appropriate. AWS's ecommerce guidance describes this two-level CloudFront + ElastiCache caching approach, with sub-millisecond cache reads. AWS Documentation
• Payments: Ideally, don't let your infrastructure handle raw card numbers at all. Use a PCI-compliant payment provider's hosted checkout/tokenization so your application receives payment tokens rather than PAN/card data. This can dramatically reduce your PCI scope.
• Secrets/keys: AWS Secrets Manager + KMS; no credentials in application code or container images.
• Logging/security: CloudTrail, GuardDuty, centralized logs, vulnerability scanning, automated patching and continuous configuration monitoring.

The PCI part that's easy to get wrong

AWS itself is PCI DSS Level 1 compliant, and CloudFront is validated for PCI DSS, but that doesn't make your store automatically PCI compliant. AWS explicitly says PCI compliance is shared responsibility and that customers must manage their own PCI DSS certification/validation. Amazon Web Services, Inc. Amazon Web Services, Inc.

So I'd design the architecture around minimizing the cardholder data environment, rather than putting your entire ecommerce stack into a giant "PCI server."

For example:

Best:
Browser → CloudFront/WAF → Store → Payment provider hosted/tokenized payment → payment result

Avoid:
Browser → your servers → raw card number → your database

Also, don't cache checkout/payment responses containing cardholder information at CloudFront; AWS specifically recommends against caching such information. AWS Documentation

Performance priorities

For a fast cart, I'd make these decisions:

1. Cache aggressively everywhere you safely can—especially images, product pages and catalog data.
2. Never cache personalized cart/checkout responses as public CDN content.
3. Keep cart operations geographically close to the database/cache rather than making multiple cross-region calls.
4. Put frequently accessed product/inventory/session data in ElastiCache.
5. Keep the database private and optimize indexes/query patterns before simply throwing bigger hardware at it.
6. Autoscale the application tier based on CPU and request/latency metrics.
7. Use asynchronous queues for things that don't need to block checkout—emails, analytics, recommendation updates, fulfillment notifications, etc.

What I'd choose by store size

My default recommendation: CloudFront + WAF → ALB → ECS/Fargate → Aurora PostgreSQL + ElastiCache, with a third-party tokenized/hosted payment flow and no raw card data stored in your environment.

That gives you a strong combination of PCI scope reduction, fast cart interactions, scalability, and relatively low operational overhead. AWS also publishes a dedicated reference architecture for web stores that follows a similar CloudFront/WAF/origin pattern. AWS Documentation

If you tell me your platform (Shopify/WooCommerce/Magento/custom), monthly orders, peak requests/sec, and whether you're processing cards directly, I can turn this into a concrete architecture with estimated monthly AWS cost and PCI scope.

For a serious ecommerce store, I’d use a managed cloud architecture with the payment-card environment kept outside your infrastructure. That gives you much better performance and a substantially smaller PCI scope than hosting card data yourself.

Recommended setup

Frontend → CDN/WAF → application → cache/database → payment provider

A concrete AWS implementation would look like:

• CloudFront + AWS WAF at the edge - CDN-cache product images, CSS, JS, and other immutable assets.
• WAF handles common web attacks, bots, rate limiting, and other edge controls.
• AWS's own ecommerce reference architecture uses CloudFront, WAF, load balancing, and caching for this pattern. AWS Documentation AWS Documentation
• S3 for static assets/images.
• ECS/Fargate or Kubernetes for the ecommerce application rather than managing individual servers.
• Application Load Balancer across multiple Availability Zones.
• Redis/ElastiCache for extremely fast cart/session access. - Keep carts in Redis with short-lived persistence/backup strategy.
• Don't make the relational database the bottleneck for every cart operation.
• Aurora PostgreSQL/MySQL for orders, customers, inventory, products, etc. - Multi-AZ deployment.
• Read replicas if catalog/order-read traffic becomes substantial.
• SQS/EventBridge for asynchronous work such as emails, inventory synchronization, fulfillment, analytics, and webhooks.
• Secrets Manager + KMS for secrets and encryption keys.
• CloudWatch + centralized audit logs for monitoring and compliance evidence.

Most important PCI decision

Do not let your application receive or store raw card numbers if you can avoid it.

Use a PCI-validated payment provider with a hosted checkout/redirect or properly implemented hosted payment component, and have your store deal with payment tokens rather than PAN/card data.

This distinction matters for PCI scope. PCI SSC says that for SAQ A eligibility, the payment-page elements delivered to the customer's browser must originate directly from PCI DSS-compliant payment providers; if your own site supplies elements of the payment page, you can move into a different scope such as SAQ A-EP. PCI Security Standards Council PCI Security Standards Council

Also, don't interpret "SAQ A" as "PCI doesn't apply." Your web server can still be in scope, and PCI SSC's current guidance includes additional e-commerce security considerations such as external vulnerability scanning. PCI Security Standards Council PCI Perspectives

Cart-performance architecture

For a fast cart, I'd specifically design it like this:

                 ┌───────────────┐
Customer ───────►│ CloudFront/WAF│
                 └───────┬───────┘
                         │
                  ┌──────▼──────┐
                  │ Load Balancer│
                  └──────┬──────┘
                         │
                 ┌───────▼────────┐
                 │ App containers  │
                 │ ECS/Fargate     │
                 └───┬─────────┬───┘
                     │         │
                ┌────▼───┐ ┌──▼────────┐
                │ Redis  │ │ Aurora DB │
                │ Cart   │ │ Orders    │
                └────────┘ └───────────┘
                     │
                     ▼
              Payment provider
              (tokenized/hosted)

The key optimization is not putting the payment processor in the synchronous path for ordinary cart operations. Adding/removing an item should be essentially:

browser → app → Redis → response

rather than:

browser → app → database → payment provider → database → response.

Payment authorization happens when the customer actually checks out.

PCI/security boundaries

I'd put the architecture into separate network/security zones:

• Public edge: CloudFront/WAF only.
• Application tier: private subnets; no direct public access.
• Database/cache: private subnets; accessible only from application security groups.
• Administrative access: VPN/SSM/bastion-controlled, MFA required.
• Payment: third-party PCI-validated provider; your infrastructure receives tokens/webhooks rather than card numbers.
• Logging: immutable/controlled-access audit logs, with no card data or sensitive authentication data in logs.

CloudFront itself has PCI DSS validation, although that obviously doesn't make your entire application PCI compliant; your configuration, code, processes, and payment flow still matter. AWS Documentation

What I'd choose by store size

My default recommendation: AWS CloudFront/WAF → ECS/Fargate → ElastiCache Redis → Aurora, with a PCI-validated hosted payment flow. It's a good balance of PCI scope, cart latency, scalability, and operational complexity. AWS also publishes a dedicated ecommerce reference architecture built around many of these same components. AWS Documentation

One caveat: "PCI-compliant hosting" isn't enough to make the store PCI compliant. The final scope depends heavily on your payment flow, application, integrations, access controls, logging, vulnerability management, and operational procedures. Validate the architecture with your acquirer/QSA before implementation. PCI Security Standards Council

browser → app → Redis → response

rather than:

browser → app → database → payment provider → database → response.

Payment authorization happens when the customer actually checks out.

PCI/security boundaries

I'd put the architecture into separate network/security zones:

• Public edge: CloudFront/WAF only.
• Application tier: private subnets; no direct public access.
• Database/cache: private subnets; accessible only from application security groups.
• Administrative access: VPN/SSM/bastion-controlled, MFA required.
• Payment: third-party PCI-validated provider; your infrastructure receives tokens/webhooks rather than card numbers.
• Logging: immutable/controlled-access audit logs, with no card data or sensitive authentication data in logs.

CloudFront itself has PCI DSS validation, although that obviously doesn't make your entire application PCI compliant; your configuration, code, processes, and payment flow still matter.

What I'd choose by store size

For an ecommerce store that needs PCI compliance support and fast cart performance, I’d avoid basic shared hosting and design the stack around three goals:

1. Keep the cardholder data environment as small as possible
2. Make cart/session operations fast and reliable
3. Have enough isolation and monitoring for PCI requirements

A strong general-purpose setup would look like this:

Recommended architecture

1. Frontend / storefront layer

• CDN + edge caching: - cloudflare.com or a similar enterprise CDN/WAF provider
• Static assets (images, CSS, JS) cached at the edge
• TLS 1.2+ enforced
• Bot protection and DDoS mitigation enabled

2. Application servers

Use managed cloud instances rather than shared hosting.

Example sizing:

• 2–3 application servers behind a load balancer
• 4–8 vCPU each
• 16–32 GB RAM each
• Auto-scaling during promotions

For platforms like Magento/Adobe Commerce, WooCommerce at scale, or custom carts, use a tuned PHP/Node stack rather than a single server. PCI-ready managed hosting providers commonly separate application, database, and security layers rather than putting everything on one box. Atlantic.Net

3. Cart/session performance layer

The cart is usually where ecommerce sites slow down because it involves dynamic requests.

Use:

• Redis for: - cart sessions
• customer sessions
• frequently accessed product data
• Object caching
• PHP OPcache (for PHP stores)
• Database query optimization

Avoid caching personalized cart pages at the CDN level unless you have a very careful cache strategy.

4. Database layer

Use a managed database:

• MySQL/MariaDB/PostgreSQL depending on platform
• Multi-zone replication
• Automated backups
• Separate read replicas if catalog/order volume is high

Example:

• Primary database: transactions/orders
• Read replica: catalog/search-heavy traffic

5. Search layer (for larger catalogs)

For thousands of SKUs:

• Elasticsearch/OpenSearch
• Dedicated search indexing
• Keep product search away from the transactional database

PCI compliance approach

The easiest path is usually:

Do not store card data yourself.

Use a PCI-compliant payment provider with tokenization/hosted checkout elements so your infrastructure handles as little payment data as possible. PCI guidance recognizes that different ecommerce implementations (such as redirects or embedded payment forms) change the compliance scope. PCI Security Standards Council

Your hosting provider should support:

• Network segmentation
• Managed firewall/WAF
• Vulnerability scanning
• Logging and monitoring
• Encryption
• Access controls/MFA
• Patch management

Remember: a "PCI-compliant host" does not automatically make the store PCI compliant; your application, plugins, policies, and payment flow still matter. Atlantic.Net

Hosting options by store size

Small to mid-size store (up to ~100k visits/month)

Good fit:

• Managed WooCommerce hosting or managed application hosting
• CDN + Redis + managed database

Examples:

• nexcess.net offers managed ecommerce environments with performance and compliance-oriented features. Nexcess
• liquidweb.com provides managed ecommerce hosting options with PCI-oriented infrastructure. Liquid Web

Growing store (100k–1M+ visits/month)

Recommended:

• Managed cloud Kubernetes or VM cluster
• Separate: - app servers
• database
• Redis
• search
• object storage
• Load balancer + autoscaling

Providers commonly used:

• AWS
• Azure
• Google Cloud
• Managed ecommerce specialists such as jetrails.com, which focuses on ecommerce performance, caching, and security operations. JetRails Managed Hosting

Enterprise / high-volume

Architecture:

• Multi-region deployment
• Dedicated database infrastructure
• Real-time monitoring/SIEM
• Disaster recovery environment
• PCI-focused managed services

My default recommendation

For most serious ecommerce businesses:

Cloudflare CDN + WAF
        |
Load Balancer
        |
2-3 App Servers
        |
Redis Cluster
        |
Managed Database (encrypted + backups)
        |
Object Storage for media
        |
PCI-compliant payment gateway

This gives you fast carts, easier scaling, and a smaller PCI footprint.

If you tell me your platform (Shopify, WooCommerce, Magento/Adobe Commerce, BigCommerce, custom) and expected traffic/orders per day, I can narrow this down to a specific hosting stack and server sizes.

For an ecommerce store that needs PCI compliance and very fast cart/checkout performance, I would avoid traditional shared hosting and design the stack so that card data never touches your servers. That reduces PCI scope and lets you optimize the parts that affect customer speed. DCHost.com PCI Security Standards Council

A strong default architecture:

Recommended production setup

Customer
   |
   | HTTPS
   v
CDN + WAF + Bot Protection
   |
   v
Load Balancer
   |
   +----------------+
   |                |
App Servers     Static Assets
(Nginx + app)   (CDN cache)
   |
   v
Private Database
(MySQL/PostgreSQL)
   |
   +--> Redis Cache
   |
   +--> Queue Workers

Payment:
Customer ---> PCI payment provider ---> Token returned to store

Hosting components

1. Managed cloud infrastructure

Use isolated cloud resources rather than shared hosting.

Good options:

• aws.amazon.com — flexible for high-scale stores; use PCI-eligible services and proper segmentation.
• cloud.google.com — strong networking and managed services.
• azure.microsoft.com — common for enterprise environments.

For a smaller store:

• Managed ecommerce hosting can be simpler because much of the infrastructure/security burden is handled for you.
• For example, shopify.com can reduce infrastructure responsibilities because checkout/payment handling is largely managed by the platform. Shopify

2. Edge layer (important for cart speed)

Use:

• CDN for images, JS, CSS, and product pages
• Web application firewall (WAF)
• DDoS protection
• Bot filtering

Examples:

• cloudflare.com
• fastly.com

Keep checkout pages dynamic, but cache everything else aggressively.

3. Application servers

Recommended baseline:

Small/medium store

• 2 application instances
• 4–8 vCPU each
• 16–32 GB RAM each
• Nginx + PHP-FPM, Node, Java, or your chosen stack

Growing store

• Horizontal scaling behind a load balancer
• Separate worker nodes for: - order processing
• email
• inventory sync
• search indexing

Avoid putting background jobs on the same servers handling checkout traffic.

4. Database

Use a managed database where possible:

• Managed PostgreSQL/MySQL
• Multi-zone replication
• Automated backups
• Encryption at rest
• Private network access only

Performance additions:

• Redis for: - sessions
• cart storage
• frequently accessed catalog data

A slow database is one of the most common causes of slow carts.

5. Payment architecture (PCI-friendly)

The best pattern is:

• Your server creates the order/cart.
• Customer enters payment details through a PCI-compliant payment provider.
• Your system receives only: - payment token
• transaction ID
• status
• last four digits (if needed)

Do not store:

• card numbers
• CVV
• magnetic stripe data

Keeping payment data off your infrastructure can significantly reduce PCI complexity. DCHost.com Adobe Experience League

Common providers:

• stripe.com
• braintreepayments.com
• adyen.com

Security controls I would require

• TLS everywhere
• MFA for admin accounts
• Least-privilege access
• Separate staging and production
• Automated vulnerability scanning
• Centralized logging
• Encrypted backups
• Quarterly security scans where applicable PCI Security Standards Council

Performance optimizations specifically for carts

Cart pages should usually not be fully cached, but you can optimize them:

• Store carts in Redis
• Use edge caching for product/catalog pages
• Keep checkout APIs lightweight
• Avoid synchronous third-party calls during checkout
• Use async queues for: - emails
• ERP sync
• analytics
• inventory updates
• Preload payment SDKs
• Monitor: - checkout API latency
• database query time
• payment authorization time

My recommended stacks by store size

Under ~50k orders/month

• Managed WooCommerce / Magento hosting or a small cloud deployment
• CDN + WAF
• 2 app servers
• Managed database
• Redis
• Hosted payment gateway

50k–500k orders/month

• Kubernetes or autoscaling VM setup
• Dedicated database cluster
• Redis cluster
• Queue workers
• CDN edge caching
• Observability stack

Enterprise

• Multi-region deployment
• Active/passive failover
• Dedicated security team
• PCI assessor involvement
• Formal change management

If you tell me your platform (Shopify, WooCommerce, Magento/Adobe Commerce, custom), monthly orders, peak traffic, and budget, I can suggest a more exact architecture and sizing.

For an ecommerce store that needs PCI compliance + very fast cart performance, I would avoid putting card handling on your infrastructure and design the stack around low PCI scope, isolation, caching, and predictable scaling. PCI compliance is a shared responsibility; the hosting provider alone does not make a store compliant. WooCommerce

A strong production setup would look like this:

Recommended architecture

Customer
   |
   v
CDN + WAF + DDoS protection
   |
   v
Load Balancer
   |
   +----------------+
   |                |
App servers      Static assets
   |
   v
Cache layer (Redis)
   |
   v
Database cluster
   |
   +--> Backups
   +--> Monitoring/logging

Payment:
Customer browser ---> PCI-certified payment provider
                         |
                         v
                    Payment token only

Hosting stack recommendation

1. Use managed cloud infrastructure (not shared hosting)

Recommended:

• 2–3 application servers behind a load balancer
• Private database network
• Managed database service
• Managed Redis cache
• CDN in front
• Separate staging environment

Good fits:

• AWS
• Google Cloud
• Azure
• Managed Adobe Commerce/Magento hosting if running Magento
• Managed WooCommerce hosting for smaller stores

Avoid:

• Shared hosting
• Single VPS running web + database + backups together
• Servers that directly process card details

Keeping cardholder data out of your environment significantly reduces PCI scope and risk. DCHost.com Experience League

2. Payment architecture (most important PCI decision)

Use:

• Hosted checkout
• Payment iframe from a PCI provider
• Tokenized payment APIs

Examples:

• Stripe Checkout / Elements
• Braintree Hosted Fields
• Adyen Checkout
• PayPal Checkout

Your servers should store:

• Order ID
• Payment status
• Transaction ID
• Token/reference

Your servers should never store:

• Card number
• CVV
• Magnetic stripe data

This keeps your ecommerce application out of the most sensitive card-data path. DCHost.com

3. Optimize cart performance

The cart is usually the hardest part because it is dynamic.

Use:

Redis

Store:

• Shopping carts
• Sessions
• Product availability lookups
• Frequently used pricing data

Database tuning

Use:

• Read replicas for heavy catalog traffic
• Proper indexes on: - product IDs
• customer IDs
• order tables
• inventory tables

Application caching

Cache:

• Product pages
• Categories
• Search results
• CMS pages

Do not cache:

• Cart pages
• Checkout
• Account pages
• Payment flows

4. Add a CDN + security layer

Use:

• CDN
• Web Application Firewall (WAF)
• Bot protection
• Rate limiting
• DDoS protection

This improves:

• Page speed
• Checkout reliability
• Attack resistance

PCI guidance specifically recommends considering protections such as WAF and intrusion detection technologies for ecommerce environments. PCI Security Standards Council

5. Example setups by store size

Small store (under ~5,000 orders/month)

Good setup:

• Managed WooCommerce host or Shopify/BigCommerce
• CDN
• Redis/object caching
• PCI payment gateway
• Automated backups

Simpler operationally.

Growing store (5,000–100,000 orders/month)

Recommended:

• Cloud load balancer
• 2–4 app servers
• Managed PostgreSQL/MySQL
• Redis cluster
• CDN/WAF
• CI/CD deployment
• Monitoring

Example:

• AWS ECS/EKS + RDS + ElastiCache
• Google Cloud Run/GKE + Cloud SQL + Memorystore

Enterprise/high traffic

Recommended:

• Kubernetes or managed container platform
• Multi-AZ deployment
• Database replication
• Queue workers
• Search cluster (OpenSearch/Elasticsearch)
• Dedicated observability stack

Adobe Commerce reference architectures, for example, use separated scalable components rather than a single server approach. Experience League

My preferred “default” production blueprint

For most serious ecommerce stores:

• Frontend: Next.js or optimized storefront
• Commerce backend: Shopify Plus, Adobe Commerce, WooCommerce at scale, or custom API backend
• Hosting: AWS/GCP/Azure managed services
• CDN/WAF: Cloudflare or cloud-native equivalent
• Cache: Redis
• Database: Managed PostgreSQL/MySQL with backups
• Payments: Stripe/Adyen/Braintree hosted/tokenized checkout
• Monitoring: Datadog, New Relic, Grafana, or cloud-native monitoring
• Security: MFA, least privilege IAM, vulnerability scanning, patch management

The biggest performance wins usually come from:

1. keeping payment processing off your servers,
2. caching aggressively outside checkout,
3. separating application and database resources,
4. using a CDN/WAF edge layer.

If you tell me your platform (Shopify, WooCommerce, Magento/Adobe Commerce, custom build), monthly traffic/orders, and region, I can suggest a more exact hosting topology and sizing.

For an ecommerce store that needs PCI compliance and fast cart performance, I’d avoid a basic shared hosting setup and design around two goals:

1. Keep payment data out of your infrastructure whenever possible (reduces PCI scope and risk).
2. Optimize the application path that affects conversion (cart, checkout, inventory, sessions, APIs). PCI Security Standards Council PCI Security Standards Council

A strong general-purpose setup would look like this:

Recommended architecture

Customers
   |
   v
CDN + WAF (DDoS protection, bot filtering)
   |
   v
Load Balancer
   |
   +----------------+
   |                |
App Servers     Static Assets
   |                |
   v                v
Redis Cache     Object Storage/CDN
   |
   v
Database Cluster
   |
   v
Backups + Monitoring

Hosting stack recommendation

1. Managed cloud infrastructure

Use a managed cloud environment rather than a single server.

Good fits:

• Amazon Web Services with PCI-oriented services and proper segmentation
• Microsoft Azure for enterprise environments
• Google Cloud for cloud-native deployments

The important part is not the vendor name—it is having:

• isolated compute resources
• controlled network boundaries
• audit logging
• patch management
• encrypted storage
• tested backups

PCI compliance is a shared responsibility; a cloud provider’s compliance does not automatically make your store compliant. PCI Security Standards Council

2. Use a PCI-friendly payment flow

Prefer:

• Hosted checkout pages
• Tokenized payments
• PCI-certified payment providers

Avoid storing:

• card numbers
• CVV codes
• raw payment payloads in logs

Keeping cardholder data away from your servers can significantly reduce PCI scope. DCHost.com WooCommerce

3. Performance layer for fast carts

For cart speed, I’d include:

• Redis for sessions, carts, and frequently accessed data
• Database read replicas if traffic is high
• CDN caching for images, CSS, JS, and product assets
• Application-level caching
• PHP/JVM/runtime tuning depending on platform
• Connection pooling for databases

Avoid caching:

• logged-in user pages
• checkout pages
• personalized carts

4. Security controls

Minimum baseline:

• Web Application Firewall (WAF)
• DDoS protection
• TLS 1.2+ / modern HTTPS configuration
• MFA for admin access
• least-privilege roles
• vulnerability scanning
• centralized logs
• malware monitoring
• automated patching

PCI requires more than SSL; operational controls, access management, monitoring, and maintenance matter too. WooCommerce

Platform-specific recommendations

Small to mid-size store (under ~50k orders/month)

A good setup:

• Managed WooCommerce or Shopify-style SaaS platform
• CDN + WAF
• External payment provider
• Managed database
• Redis/object cache where supported

This minimizes PCI workload.

Growing Magento / Adobe Commerce store

Recommended:

• Dedicated cloud environment
• Separate app and database tiers
• Redis
• Search cluster (often Elasticsearch/OpenSearch)
• CDN/WAF
• Automated deployment pipeline

Adobe Commerce cloud environments are designed around isolated infrastructure and shared responsibility controls. Experience League Experience League

Large custom ecommerce platform

Recommended:

• Kubernetes or managed container platform
• Separate checkout/payment services
• Event queue (Kafka/SQS/Pub/Sub)
• Database clustering
• Observability stack
• Dedicated security operations

Example production sizing

For a growing store:

• 2–4 application servers
• 1–2 Redis nodes
• Managed PostgreSQL/MySQL cluster
• CDN + WAF
• Separate staging environment
• Daily encrypted backups
• Monitoring + alerting

Scale horizontally rather than putting everything on one oversized server.

What I would avoid

• ❌ Shared hosting for a serious ecommerce operation
• ❌ One server running web + database + payment integrations
• ❌ Storing payment information “temporarily”
• ❌ No staging environment
• ❌ Relying only on a PCI claim from a host

A practical sweet spot for many stores is: managed cloud hosting + CDN/WAF + Redis caching + managed database + tokenized payments. It gives you strong cart performance without making PCI compliance unnecessarily complicated. DCHost.com

If you share your platform (Shopify, WooCommerce, Magento/Adobe Commerce, custom, etc.), monthly traffic, and order volume, I can suggest a more exact architecture and server sizing.

For an ecommerce store where PCI scope and cart latency both matter, I’d use a managed AWS architecture with the payment card data completely outsourced to a PCI-validated payment provider.

Recommended setup

Customer
   │
   ▼
Route 53
   │
   ▼
CloudFront + AWS WAF
   │
   ├── Static assets ──► S3
   │
   └── Dynamic/API ────► ALB
                              │
                         ECS/Fargate
                              │
                    ┌─────────┴─────────┐
                    ▼                   ▼
              ElastiCache          RDS/Aurora
              (cart/session)       (orders/catalog)
                    │
                    ▼
             Payment Provider
             Hosted Checkout

AWS itself is a PCI DSS Level 1 service provider, but using AWS does not automatically make your store PCI compliant; you remain responsible for the controls in your environment. Amazon Web Services, Inc.

The important design decisions

• CloudFront + WAF at the edge. Put CloudFront in front of everything, cache product images/CSS/JS aggressively, and use WAF for common web attacks and bot protection. AWS specifically recommends CloudFront for ecommerce workloads and supports separate caching behavior for static content, dynamic pages, and APIs. AWS Documentation AWS Documentation
• ECS/Fargate for the application tier. Run stateless application containers across at least two Availability Zones behind an Application Load Balancer. This gives you horizontal scaling without managing servers. AWS's own ecommerce reference architecture uses this pattern. AWS Documentation
• ElastiCache for the hot cart path. Keep active cart/session state in Redis/Valkey rather than repeatedly hitting your database. This is probably the single biggest hosting-level improvement for cart responsiveness. AWS's ecommerce architecture uses ElastiCache specifically for caching application responses and session-related data. AWS Documentation AWS Documentation
• Aurora/RDS for durable transactional data. Keep orders, customers, inventory, and other authoritative data in a relational database. Don't use the cache as your source of truth.
• Never put raw card numbers into your application. Use a PCI-validated payment provider's hosted checkout or appropriately designed tokenization. PCI SSC notes that fully outsourcing payment functions can substantially reduce the merchant's PCI scope, subject to meeting the applicable SAQ criteria. PCI Security Standards Council PCI Security Standards Council
• Keep checkout/cart responses out of shared caches. Product/catalog responses can have meaningful CDN TTLs; personalized cart, pricing, inventory, and checkout responses should generally bypass or tightly control CDN caching. AWS specifically cautions against caching card-related information in CloudFront. AWS Documentation
• Encrypt everywhere and minimize PCI scope. Private subnets for databases/cache, TLS externally and internally where appropriate, KMS-managed encryption, Secrets Manager, IAM least privilege, centralized CloudTrail/CloudWatch logging, vulnerability scanning, backups, and infrastructure-as-code.
• Plan for PCI DSS v4.0.1 rather than treating PCI as a checkbox. Even merchants using outsourced payment pages can retain responsibilities such as vulnerability scanning, and PCI SSC's current guidance has specific requirements around ecommerce payment-page scripts. PCI Security Standards Council PCI Security Standards Council

For especially fast carts

I'd make the cart flow:

Browser → CloudFront/WAF → lightweight API → ElastiCache → async persistence

rather than:

Browser → application → database → multiple external services → response

For example, adding an item should ideally require one fast cache operation and return immediately. Inventory reservation, analytics, email, recommendations, and other secondary work can happen asynchronously through a queue/event bus. AWS's ecommerce guidance similarly uses asynchronous event processing for non-critical work. AWS Documentation

What I would actually deploy

For a typical mid-sized store:

AWS publishes a very similar ecommerce architecture incorporating CloudFront, WAF, ALB, Fargate, ElastiCache, and managed data services. AWS Documentation

One caveat: don't choose the architecture solely because individual AWS services are "PCI compliant." PCI compliance applies to the whole implementation and your operational controls, not merely the hosting provider. I'd have your QSA/acquirer validate the intended payment flow and resulting SAQ before going live. Amazon Web Services, Inc.

If you tell me your platform (Shopify/WooCommerce/custom/Magento), monthly traffic, peak requests/sec, and whether you're using Stripe/Adyen/etc., I can turn this into a concrete architecture with approximate monthly AWS cost and the PCI scope for each component.

For an ecommerce store where PCI scope and fast cart performance both matter, I’d use a managed AWS architecture rather than a single VPS or traditional shared host.

Recommended setup

Customer
   │
   ▼
Route 53
   │
   ▼
CloudFront CDN + AWS WAF
   │
   ├── Static assets ──► S3
   │
   └── Dynamic requests ──► Application Load Balancer
                                │
                                ▼
                         App servers / ECS Fargate
                           │            │
                           ▼            ▼
                     ElastiCache      Aurora/RDS
                       (Redis)        (orders/data)

Checkout ──────────────► PCI-compliant payment processor
                         (hosted/tokenized payment)

AWS specifically recommends this general pattern—CloudFront, WAF, load balancing, ElastiCache, and a managed database—for scalable web applications. AWS Documentation AWS Documentation

1. Keep card data out of your infrastructure

This is the most important PCI decision.

Use a PCI DSS-validated payment provider with hosted checkout or properly implemented hosted payment fields/tokenization, rather than letting your application receive or store raw card numbers.

If you meet the applicable criteria, outsourcing payment processing can substantially reduce your PCI scope. PCI SSC says SAQ A eligibility requires the payment-page elements to originate only from PCI DSS-compliant third-party providers; embedded payment implementations have additional requirements. PCI Security Standards Council PCI Security Standards Council

Don't assume "we use Stripe/PayPal/etc." automatically makes the store PCI compliant, though—you still have responsibilities. For example, PCI DSS v4.x SAQ A can require ASV vulnerability scanning of the ecommerce webpage even when payment processing is outsourced. PCI Security Standards Council

2. Put CloudFront in front of everything

Use aws.amazon.com for:

• Product images
• CSS/JS
• Fonts
• Other immutable static assets
• Cacheable product/catalog content

AWS confirms CloudFront is PCI DSS validated, while also recommending that sensitive payment information not be cached at the edge. AWS Documentation AWS Documentation

For ecommerce, use different cache policies for static content, product pages, and dynamic APIs. AWS's ecommerce guidance specifically distinguishes static assets from dynamic pages and APIs such as cart, inventory, and pricing. AWS Documentation

3. Make the cart fast with Redis/ElastiCache

For the cart itself, I'd use aws.amazon.com (Redis/Valkey) for:

• Cart/session state
• Product availability lookups
• Frequently accessed catalog data
• Short-lived pricing/promotional data
• Rate limiting where appropriate

Don't cache the entire cart response at CloudFront. Cart contents are user-specific and potentially sensitive. Instead, keep the cart dynamic but make the underlying reads extremely fast with Redis and an optimized database.

AWS's ecommerce architecture uses ElastiCache specifically to cache application responses and improve performance. AWS Documentation

4. Use managed compute and database infrastructure

I'd choose:

• ECS Fargate for the application layer
• Application Load Balancer across at least two Availability Zones
• Aurora/RDS for orders, customers, inventory, etc.
• S3 for product media and backups
• Secrets Manager for credentials/API secrets
• WAF for application-layer protection
• CloudWatch/CloudTrail for logging and auditing

AWS's current web-store architecture uses CloudFront, WAF, ALB, Fargate, S3 and ElastiCache, with multi-AZ deployment for resilience. AWS Documentation

AWS also lists CloudFront, ECS, ElastiCache, EC2, RDS-related services and other components as within its PCI DSS service scope, but AWS's compliance does not make your application automatically PCI compliant—PCI remains a shared-responsibility exercise. Amazon Web Services, Inc.

Performance priorities

I'd configure the system roughly like this:

The key architectural principle is: cache everything that is safe to cache, but keep cart/checkout state dynamic and close to the application.

For a small-to-medium store, I'd actually start simpler: CloudFront + WAF → ECS Fargate → RDS/Aurora + ElastiCache → hosted payment provider, rather than jumping immediately to dozens of microservices. That gives you excellent cart latency without creating unnecessary PCI and operational complexity.

For an ecommerce store where PCI scope and cart latency both matter, I’d recommend a managed AWS architecture with hosted/tokenized payments, rather than putting the entire store on a traditional VPS.

Recommended setup

Customer
   │
   ▼
Route 53
   │
   ▼
CloudFront + AWS WAF
   │
   ├── Static assets → S3
   │
   ▼
Load Balancer
   │
   ▼
ECS/Fargate application tier
   │
   ├── Cart/session cache → ElastiCache/Redis
   │
   ├── Product/order DB → RDS or DynamoDB
   │
   └── Payment → PCI-compliant PSP
                         │
                         └── Hosted/tokenized checkout

1. Put CloudFront + WAF in front

Use Amazon Web Services CloudFront as the CDN and AWS WAF for application-layer protection.

CloudFront is included in AWS's PCI DSS compliance program, and AWS's own ecommerce architecture uses CloudFront and WAF at the edge. AWS Documentation AWS Documentation

This gives you:

• Cached product images, CSS, JS and other static assets
• TLS termination close to customers
• DDoS/bot protection
• WAF rules for common web attacks
• Much lower load on your application servers

2. Run the cart/application on ECS Fargate

I'd use ECS/Fargate across at least two Availability Zones rather than managing individual EC2 servers.

Keep the application tier stateless so you can scale it horizontally:

• 2+ Fargate tasks normally
• Autoscaling based on CPU/request count/latency
• Application Load Balancer in front
• No cart state stored on the containers

AWS's current ecommerce reference architecture similarly uses Fargate, load balancing and multiple Availability Zones. AWS Documentation

3. Make the cart extremely fast with Redis

This is the part I'd optimize most aggressively.

Use ElastiCache for Redis/Valkey for:

• Active shopping carts
• Session data
• Inventory/product lookups that can tolerate short caching
• Frequently accessed pricing/configuration data

That keeps the critical operation:

add item → update cart → retrieve cart

out of your relational database wherever possible.

AWS specifically recommends ElastiCache in its ecommerce architecture for caching application responses, and ElastiCache is currently included in AWS's PCI service scope. AWS Documentation AWS Documentation

4. Keep payment-card data completely out of your infrastructure

This is the most important PCI design decision.

Use a PCI-compliant payment provider with a hosted checkout/payment page or appropriately designed tokenization solution. Your application should receive a payment token/reference—not the customer's card number.

The PCI Security Standards Council says that, for SAQ A eligibility, all elements of the payment page must originate from PCI-compliant service providers; simply using a compliant hosting provider doesn't automatically make your implementation eligible. PCI Security Standards Council

So I'd structure checkout roughly as:

Your store
   │
   │ create order / payment intent
   ▼
Payment provider
   │
   │ hosted payment UI
   ▼
Customer enters card
   │
   ▼
Payment provider
   │
   │ token/payment result
   ▼
Your application

Don't build your own card-number collection endpoint just because AWS is PCI-capable. AWS being PCI compliant does not make your application automatically PCI compliant; PCI remains a shared-responsibility exercise. Amazon Web Services, Inc. Amazon Web Services, Inc.

5. Database

For a conventional ecommerce application, I'd start with:

• Amazon RDS PostgreSQL
• Multi-AZ
• Automated backups
• Encryption at rest
• Private subnets
• No public database access

Use Redis for the hot cart path and PostgreSQL for durable transactional data such as:

• Orders
• Customers
• Products
• Inventory
• Promotions
• Payment references

For a very high-scale catalog/session architecture, DynamoDB is another good option; AWS's ecommerce reference architecture uses DynamoDB alongside ElastiCache. AWS Documentation

PCI architecture I'd aim for

The key is minimizing the cardholder-data environment, not merely choosing a "PCI-compliant host."

I'd have:

• Public CDN/WAF layer
• Private application subnets
• Private database/cache subnets
• Strict security groups
• Secrets Manager for credentials
• KMS encryption
• CloudTrail + CloudWatch logging
• Centralized audit logs
• Vulnerability/patch management
• MFA everywhere administrative access is possible
• No card numbers in application logs, analytics, error tracking, or databases
• Hosted/tokenized payment processing

AWS currently lists services including CloudFront, ECS/Fargate, ElastiCache, DynamoDB, EC2 and CloudWatch among its PCI-scoped services. Amazon Web Services, Inc. Amazon Web Services, Inc.

My practical recommendation

If this were my store, I'd choose:

The biggest performance win: keep cart state in Redis and keep the checkout/payment flow asynchronous wherever possible.

The biggest PCI win: never let raw card data touch your servers in the first place.

One caveat: "PCI-compliant AWS architecture" ≠ "your ecommerce business is PCI compliant." Your exact SAQ/ROC obligations depend on the payment integration, card-data flows, and other controls; involve your acquirer or QSA before declaring compliance. PCI Security Standards Council PCI Security Standards Council

If you tell me your expected monthly orders, peak requests/sec, platform (Shopify/WooCommerce/custom), and budget, I can turn this into a concrete architecture with estimated monthly AWS cost and sizing.

For an ecommerce store where PCI compliance and fast cart/checkout performance are both priorities, I’d use a managed AWS architecture with a PCI-compliant payment processor handling card data, rather than putting payment-card data directly into your application servers.

Recommended setup

Customer
   │
   ▼
CloudFront CDN + WAF
   │
   ├── Static assets ──► S3
   │
   └── Dynamic traffic
           │
           ▼
      Load Balancer
           │
           ▼
     App servers
   (ECS/Fargate)
       │       │
       │       └──► ElastiCache Redis/Valkey
       │
       ▼
   RDS PostgreSQL
       │
       ▼
Payment processor
(Stripe/Adyen/etc.)

1. Edge: CloudFront + WAF

Put Amazon CloudFront in front of the entire storefront, with AWS WAF for application-layer protection.

CloudFront is PCI DSS validated, and AWS specifically documents its use in PCI workloads. AWS Docs Amazon Web Services

Cache aggressively:

• Product/category pages
• Images
• CSS/JS
• Fonts
• Public API responses where appropriate

Don't cache:

• Cart contents
• Customer account pages
• Checkout sessions
• Personalized responses
• Anything containing cardholder data

AWS explicitly recommends not caching credit-card information at CloudFront edges. AWS Docs

2. Application: ECS/Fargate

I'd use ECS with Fargate rather than managing EC2 instances yourself.

Run at least two application tasks across availability zones and autoscale based on CPU, memory, and request latency.

This gives you:

• No server patching/management
• Easy horizontal scaling during traffic spikes
• Private application subnets
• Simple blue/green deployments
• Good isolation from the public internet

For a high-volume store, I'd consider Kubernetes/EKS only if you already have a team experienced with it. For most ecommerce businesses, it adds operational complexity without making the cart meaningfully faster.

3. Cart: Redis/Valkey

For fast cart operations, this is one of the most important pieces.

Use Amazon ElastiCache for Valkey/Redis for:

• Active carts
• Session data
• Product availability lookups
• Short-lived pricing calculations
• Rate limiting
• Frequently accessed product data

ElastiCache is included in AWS's PCI compliance program when applicable, although your configuration and use remain part of your PCI responsibilities. AWS Docs

A cart request should ideally be:

CloudFront
   ↓
App
   ↓
Redis/Valkey

rather than hitting PostgreSQL for every cart operation.

Keep the durable order/cart state in PostgreSQL as appropriate, with Redis acting as the high-speed working store rather than your only source of truth.

4. Database: RDS PostgreSQL

Use Amazon RDS PostgreSQL in private subnets with:

• Multi-AZ
• Encryption at rest
• Automated backups
• Point-in-time recovery
• Restricted security groups
• No public database endpoint

Create appropriate indexes around:

cart_id
customer_id
product_id
order_id
sku

and monitor slow queries. A poorly indexed cart/order database will overwhelm an otherwise excellent infrastructure design.

5. Payment: keep card data out of your environment

This is probably the single biggest PCI recommendation I'd make.

Use a PCI-compliant payment provider and have it collect/process the card information rather than your servers.

If your implementation meets the PCI SSC's eligibility requirements, outsourcing payment processing can substantially reduce the PCI scope. For example, SAQ A can apply when the payment-page elements originate exclusively from a PCI DSS-compliant third-party provider, subject to all applicable eligibility criteria. PCI Security Standards Council PCI Security Standards Council

Be careful with embedded payment forms, though. PCI DSS v4.0.1 introduced additional considerations around script attacks for certain SAQ A ecommerce implementations. PCI Security Standards Council PCI Perspectives

I'd therefore favor a hosted checkout/redirect or carefully implemented provider-hosted payment component over having your own server receive raw PAN/card numbers.

Also, outsourcing payments doesn't mean "PCI is completely someone else's problem." Your website can still be in scope, and PCI SSC specifically notes that SAQ A merchants can still have requirements such as external vulnerability scanning. PCI Security Standards Council PCI Security Standards Council

Security layout

I'd separate the AWS environment roughly like this:

Use TLS everywhere, IAM least privilege, Secrets Manager for credentials, centralized CloudTrail logging, security monitoring, vulnerability management, backups, and infrastructure-as-code.

AWS's own PCI guidance maps controls such as HTTPS/TLS, WAF, logging, encrypted origin traffic, and database backups to PCI requirements. AWS Docs

What I'd actually deploy

For a typical store, my starting stack would be:

• CDN: CloudFront
• Firewall: AWS WAF
• Compute: ECS/Fargate
• Load balancing: Application Load Balancer
• Cache/cart: ElastiCache for Valkey
• Database: RDS PostgreSQL Multi-AZ
• Files/images: S3 + CloudFront
• Secrets: AWS Secrets Manager
• Encryption: KMS
• Monitoring: CloudWatch + CloudTrail
• Security posture: AWS Security Hub/GuardDuty
• Payments: PCI-compliant processor with hosted/tokenized payment collection
• Infrastructure: Terraform or AWS CDK

The key architectural principle: keep the cart fast and your application scalable, while keeping raw payment-card data completely outside your infrastructure whenever your payment flow and PCI assessment permit it.

One important caveat: "AWS is PCI compliant" does not automatically make your ecommerce application PCI compliant—AWS operates under a shared-responsibility model, and your configuration, software, processes, and payment flow still have to satisfy the applicable PCI DSS requirements. Amazon Web Services

Use a PCI-compliant payment provider and have it collect/process the card information rather than your servers.

If your implementation meets the PCI SSC's eligibility requirements, outsourcing payment processing can substantially reduce the PCI scope. For example, SAQ A can apply when the payment-page elements originate exclusively from a PCI DSS-compliant third-party provider, subject to all applicable eligibility criteria. PCI Security Standards Council PCI Security Standards Council

Be careful with embedded payment forms, though. PCI DSS v4.0.1 introduced additional considerations around script attacks for certain SAQ A ecommerce implementations. PCI Security Standards Council PCI Perspectives

I'd therefore favor a hosted checkout/redirect or carefully implemented provider-hosted payment component over having your own server receive raw PAN/card numbers.

Also, outsourcing payments doesn't mean "PCI is completely someone else's problem." Your website can still be in scope, and PCI SSC specifically notes that SAQ A merchants can still have requirements such as external vulnerability scanning. PCI Security Standards Council PCI Security Standards Council

Security layout

I'd separate the AWS environment roughly like this:

Use TLS everywhere, IAM least privilege, Secrets Manager for credentials, centralized CloudTrail logging, security monitoring, vulnerability management, backups, and infrastructure-as-code.

AWS's own PCI guidance maps controls such as HTTPS/TLS, WAF, logging, encrypted origin traffic, and database backups to PCI requirements.

What I'd actually deploy

For a typical store, my starting stack would be:

Recommended setup

For a serious ecommerce store, I’d use AWS with a managed, mostly stateless application architecture, while keeping payment-card data out of your infrastructure whenever possible.

Customers
   │
   ▼
CloudFront + AWS WAF
   │
   ▼
Load Balancer
   │
   ├── ECS/Fargate app containers
   │       │
   │       ├── ElastiCache/Redis ── cart/session data
   │       │
   │       └── Aurora PostgreSQL ── orders/products/customers
   │
   └── S3 ── images/static assets

Payment
   └── PCI-validated payment processor
       (hosted checkout / compliant iframe)

The pieces I'd choose

• CDN: aws.amazon.com — cache product pages, images, JS/CSS and other static content at the edge. CloudFront itself is PCI DSS validated. AWS Documentation
• WAF: aws.amazon.com in front of CloudFront for bot, exploit and rate-limit protection.
• Application: ECS with Fargate rather than managing EC2 servers. Run 2+ application instances across availability zones and autoscale based on CPU/request load.
• Cart/session: Redis/ElastiCache. Keep the frequently changing cart state out of the database where practical. Use short-lived session data and make application servers stateless.
• Database: Aurora PostgreSQL/MySQL, with Multi-AZ and automated backups. Keep the database in private subnets.
• Assets: S3 behind CloudFront for product images, downloads and static assets.
• Secrets: AWS Secrets Manager + KMS; don't put database/payment credentials in application configuration or source control.
• Observability: CloudWatch plus centralized audit/security logging. Restrict administrative access with IAM and MFA.

AWS is PCI DSS Level 1 service-provider certified, but using AWS does not by itself make your store PCI compliant. AWS explicitly uses a shared-responsibility model: you remain responsible for your application, configuration, patching, access controls and other applicable controls. Amazon Web Services Amazon Web Services

Most important PCI decision

Don't have your application handle raw card numbers unless there's a compelling reason.

Use a PCI-validated payment provider's hosted checkout or appropriately implemented payment iframe. Under PCI DSS, fully outsourced payment flows can substantially reduce your compliance scope; however, the exact SAQ depends on how the payment page is implemented. For example, SAQ A requires the payment-page elements to originate directly from the compliant third-party provider. PCI Security Standards Council PCI Security Standards Council

Even with outsourced payments, don't assume "PCI is someone else's problem": PCI DSS v4.x can still require things such as external vulnerability scanning of the merchant website. PCI Security Standards Council

Making the cart fast

The biggest performance wins I'd prioritize are:

1. Redis for active cart/session state — avoid a database round-trip for every cart operation.
2. Keep cart APIs lightweight — GET /cart, POST /cart/items, etc. should do very little work.
3. Don't CDN-cache personalized cart responses. Cache product/catalog content aggressively, but treat cart/account/checkout responses as private.
4. Use database connection pooling and proper indexes for inventory, product and order queries.
5. Keep the app servers stateless, so another container can immediately handle a request.
6. Put CloudFront/WAF at the edge, so static traffic never reaches your application.
7. Load-test checkout and cart separately from normal product browsing—their traffic characteristics are very different.

A good starting size

For a store doing perhaps hundreds to a few thousand orders/day, I'd start relatively modestly:

• CloudFront + WAF
• ALB
• 2 Fargate tasks across 2 AZs
• Small ElastiCache Redis cluster
• Aurora PostgreSQL Multi-AZ
• S3 + CloudFront
• External hosted payment processor
• Automated backups, monitoring, vulnerability scanning and centralized logs

Then scale horizontally rather than buying a huge server up front.

One caveat: if this is a smaller store and minimizing operational/PCI burden is more important than architectural control, I'd seriously consider a managed ecommerce platform instead of operating the stack yourself. The AWS architecture becomes most attractive when you need custom checkout/cart logic, substantial traffic, integrations, or control over the application.

If you tell me your platform (Shopify/WooCommerce/custom/Medusa/etc.), expected traffic/orders, and whether you need US-only hosting, I can turn this into a concrete architecture with approximate monthly AWS costs.

For an ecommerce store where PCI scope and fast cart/checkout performance both matter, I'd recommend a managed AWS architecture rather than a traditional VPS.

Recommended setup

Customer
   │
   ▼
Route 53
   │
   ▼
CloudFront CDN + AWS WAF
   │
   ├── Static assets → S3
   │
   └── Dynamic requests
          │
          ▼
     Load Balancer
          │
     ┌────┴────┐
     ▼         ▼
  App 1      App 2       ← ECS/Fargate, autoscaling
     │         │
     └────┬────┘
          ▼
    Managed Database
     (RDS/Aurora)
          │
          ▼
     ElastiCache

AWS itself publishes a web-store architecture using CloudFront, WAF, load balancing, Fargate, and ElastiCache, and its currently listed PCI scope includes CloudFront, ECS, EC2, ElastiCache and several other components. AWS Docs Amazon Web Services, Inc.

1. Put CloudFront + WAF at the edge

Use CloudFront for images, CSS, JavaScript and other cacheable storefront content. Put AWS WAF in front of it for bot/rate-limit protection and common web attacks. CloudFront is PCI DSS validated, although you still have to configure your environment correctly. AWS Docs AWS Docs

This gives you fast page loads without putting your application servers directly on the Internet.

2. Keep the cart dynamic—but make it cheap

Don't cache personalized cart responses.

Instead:

• Cache product/catalog data aggressively.
• Cache images and static assets at the CDN.
• Put frequently accessed product/session data in ElastiCache.
• Keep cart operations small and stateless at the application layer.
• Run multiple application instances behind a load balancer.
• Autoscale during traffic spikes.

ElastiCache is currently included in AWS's PCI DSS service scope, subject to the usual shared-responsibility requirements. AWS Docs

3. Outsource card handling

This is probably the most important PCI decision.

Use a PCI-compliant payment processor's hosted payment page or properly implemented hosted payment form/iframe, so your infrastructure doesn't directly handle raw card numbers.

PCI SSC specifically distinguishes a payment page that is fully provided by a PCI-compliant third party from a merchant-built payment form. The latter can put you into substantially greater PCI scope. PCI Security Standards Council PCI Security Standards Council

Even when payment processing is outsourced, you're still responsible for validating your own PCI obligations and ensuring the provider's responsibilities are documented. PCI Security Standards Council

4. Database

For most stores, I'd use Aurora/RDS rather than operating MySQL/PostgreSQL yourself.

Keep it in private subnets, encrypt it, enable automated backups, and restrict access to the application tier. Don't put the database on the same public-facing host as the storefront.

5. Separate payment/checkout concerns

A good design is:

• Browse: heavily CDN-cached and optimized for speed.
• Cart: dynamic API, backed by Redis/ElastiCache where appropriate.
• Checkout: authenticated, uncached, tightly controlled.
• Payment: hosted/tokenized by your PCI-compliant payment provider.
• Order processing: asynchronous where possible using a queue.

Don't allow CloudFront to cache anything containing cardholder data. AWS specifically recommends avoiding caching credit-card information in CloudFront edge caches. AWS Docs

What I'd actually deploy

For a medium-sized store, my default would be:

The big advantage is that PCI compliance becomes an architecture and operational-control problem rather than "find a PCI-compliant web host." AWS can provide PCI-validated infrastructure, but AWS's compliance doesn't automatically make your store PCI compliant—the shared-responsibility model still applies. Amazon Web Services, Inc. Amazon Web Services, Inc.

If your store is relatively small, I'd actually simplify this further and use a managed ecommerce platform + hosted payments rather than operating this entire stack yourself. The right choice depends heavily on whether you're running Shopify/WooCommerce/Magento/custom ecommerce and roughly how much traffic/orders you expect.

5. Separate payment/checkout concerns

A good design is:

• Browse: heavily CDN-cached and optimized for speed.
• Cart: dynamic API, backed by Redis/ElastiCache where appropriate.
• Checkout: authenticated, uncached, tightly controlled.
• Payment: hosted/tokenized by your PCI-compliant payment provider.
• Order processing: asynchronous where possible using a queue.

Don't allow CloudFront to cache anything containing cardholder data. AWS specifically recommends avoiding caching credit-card information in CloudFront edge caches.

What I'd actually deploy

For a medium-sized store, my default would be:

For an ecommerce store where PCI compliance and fast cart performance both matter, I’d avoid a generic shared host and design the stack around two goals:

1. Keep payment card data out of your infrastructure whenever possible (reduces PCI scope).
2. Keep the storefront and cart path extremely low-latency (CDN, caching, optimized database, fast sessions). PCI guidance emphasizes understanding your payment flow and reducing the systems that handle cardholder data. listings.pcisecuritystandards.org

Recommended architecture (best balance for most stores)

Option A — Managed ecommerce platform (lowest PCI burden)

Best for: small-to-mid sized stores, fast growth, teams without dedicated DevOps.

Stack:

• Ecommerce platform: Shopify or similar hosted commerce platform
• Payments: native/hosted payment processing
• CDN: built in
• Security: platform-managed infrastructure
• Custom apps: API-based integrations only

Why it works:

• Card data stays with the payment provider rather than your servers.
• You avoid maintaining OS patches, firewalls, database hardening, and many infrastructure controls yourself. www.shopify.com
• Excellent checkout performance at scale.

Tradeoff: less control over the application stack.

Option B — High-performance self-hosted stack (my preferred setup for larger stores)

Best for: Magento/Adobe Commerce, WooCommerce at scale, custom commerce applications.

Infrastructure

Edge layer

• CDN + WAF:
  • Cloudflare Enterprise or equivalent
  • Bot protection
  • DDoS mitigation
  • TLS termination

Application layer

• Managed Kubernetes or autoscaling VMs:
  • AWS, Google Cloud, or Azure
  • Separate web/app nodes
  • No single server doing everything

Example:

Customer
   |
CDN + WAF
   |
Load Balancer
   |
---------------------
| App Servers        |
| (autoscaling)      |
---------------------
   |
Redis Cache
   |
Database Cluster
   |
Object Storage

Database

• Managed PostgreSQL/MySQL
• Multi-zone replication
• Automated backups
• Read replicas for heavy catalog traffic

Caching

• Redis for:
  • carts
  • sessions
  • product data
  • API responses

Assets

• Object storage + CDN:
  • product images
  • downloads
  • media

PCI design choices

The biggest recommendation:

Do not store or process raw card data yourself

Use:

• Hosted checkout
• Payment iframe/tokenization
• Payment provider APIs that return tokens, not card numbers

This reduces the systems in PCI scope. www.dchost.com

Examples:

• Stripe Checkout
• Adyen Hosted Payment Pages
• PayPal Checkout

Your application should store:

• order ID
• payment token/reference
• payment status

Not:

• card number
• CVV
• magnetic stripe data

Performance tuning specifically for carts

Cart pages are harder because they are usually dynamic.

I would use:

Frontend

• CDN caching for:
  • product pages
  • category pages
  • images
  • JS/CSS

• Do not cache:
  • cart
  • checkout
  • account pages

Backend

• Redis session storage
• Database indexing on:
  • SKU
  • customer ID
  • cart ID
  • order status

Infrastructure

Minimum production setup:

Hosting providers I would consider

Smaller store ($0–$5M/year revenue)

• Hosted commerce platform
• Managed WooCommerce hosting
• Managed cloud VPS

Growing store ($5M–$50M/year)

• AWS/GCP/Azure managed infrastructure
• Managed database
• Dedicated DevOps support

Enterprise

• Adobe Commerce Cloud
• Kubernetes-based commerce stack
• Dedicated security/compliance team

Avoid

❌ Shared hosting
❌ One giant VM running web + database + Redis
❌ Storing card details “temporarily”
❌ Plugins/extensions without security review
❌ Caching authenticated/cart responses
❌ Unmanaged servers without patching processes

If I were building a serious store today, I’d choose:

Cloudflare → Load Balancer → Autoscaling app servers → Redis → Managed database → Hosted payment checkout

It gives you fast carts, easier PCI scope management, and room to scale. www.dchost.com

The ideal setup does depend heavily on your platform (Shopify, WooCommerce, Magento, custom), traffic level, and order volume.

For an ecommerce store that needs PCI DSS compliance plus consistently fast cart/checkout performance, I’d use a managed cloud architecture rather than traditional shared hosting.

Recommended setup

Customers
   ↓
Cloudflare CDN + WAF + DDoS protection
   ↓
Load Balancer
   ↓
2+ application servers (private subnets)
   ├── Redis/Valkey cache
   └── Managed MySQL/PostgreSQL
            ↓
     Object storage for images/files

Checkout/payment
   ↓
PCI-compliant payment provider
   ↓
Tokenized payment data

1. Use AWS as the infrastructure layer

Amazon Web Services is a strong choice because AWS is a PCI DSS Level 1 Service Provider. Importantly, that does not make your store automatically PCI compliant—the application, configuration, processes, and assessment remain your responsibility. Amazon Web Services, Inc.

I'd use:

• ECS/Fargate or EC2 for the application
• RDS for the primary database
• ElastiCache for Redis/Valkey for sessions, carts, inventory lookups, and frequently accessed catalog data
• S3 for product images and other static assets
• Application Load Balancer across at least two Availability Zones
• Private subnets for application/database resources
• AWS IAM, CloudTrail, GuardDuty/Security Hub and centralized logging for security/audit controls

2. Put Cloudflare in front

Cloudflare is a particularly good fit for ecommerce. Its CDN can serve static content from geographically distributed locations, while its WAF and DDoS protection keep malicious traffic away from your origin. Cloudflare Docs Cloudflare Docs

Cache aggressively:

• Product images
• CSS/JS
• Fonts
• Public product/catalog pages
• Other content that isn't personalized

Do not cache cart, account, checkout, or other user-specific responses. Cloudflare explicitly recommends careful cache configuration to avoid cache poisoning and unintended sharing of personalized content. Cloudflare Docs Cloudflare Docs

3. Make the cart Redis-backed

This is one of the biggest performance wins.

Use ElastiCache for Redis/Valkey for ephemeral cart/session state rather than repeatedly hitting the SQL database. AWS describes ElastiCache as providing microsecond latency and specifically lists ecommerce sessions as a use case. Amazon Web Services, Inc. Amazon Web Services, Inc.

For example:

GET /cart
     ↓
Redis → return cart
     ↓
SQL only when persistent order/product data is required

Keep the authoritative order/inventory records in the database; use Redis to make the frequent reads and cart operations fast.

4. Keep payment data out of your infrastructure if possible

For PCI scope, I'd strongly favor hosted/tokenized payment fields from a PCI-compliant payment processor rather than having your servers receive raw card numbers.

That gives you a much smaller cardholder-data environment and reduces what your PCI assessment needs to cover.

Your application should ideally receive something like:

payment_token = "tok_..."

rather than:

card_number = "..."
cvv = "..."

Never put card data into Redis, application logs, analytics, error tracking, or database records.

5. Separate the PCI environment

Use network segmentation:

Internet
   │
Cloudflare
   │
Public ALB
   │
┌───┴──────────────────┐
│ Application tier     │
│ Private subnet       │
└───┬──────────────┬───┘
    │              │
 Redis          Database
 private        private
 subnet         subnet

Restrict security-group rules so that only the application tier can reach the database/cache, and only the load balancer can reach the application servers.

Also maintain centralized logs and audit trails. AWS specifically recommends retaining CloudFront usage logs for PCI workloads for auditing purposes. AWS Documentation

What I'd actually deploy

For a typical mid-sized store:

The key architectural decision: don't try to make the cart fast by simply buying a bigger server. Put the CDN in front of the store, keep the application horizontally scalable, and put high-frequency cart/session operations in Redis/Valkey.

For PCI, minimize the amount of cardholder data your infrastructure ever sees. AWS explicitly notes that using a PCI-compliant AWS service doesn't by itself make the customer compliant—the customer's own controls and assessment still matter. Amazon Web Services, Inc.

If you tell me your platform (Shopify, WooCommerce, Magento/Adobe Commerce, custom), monthly traffic/orders, and approximate budget, I can narrow this down to a concrete architecture and estimated monthly AWS/Cloudflare cost.

For most ecommerce stores, I’d recommend managed commerce hosting rather than self-hosting the entire PCI environment.

My preferred setup

Shopify / Shopify Plus + Cloudflare

• Commerce platform: Shopify
• Checkout/payment: Shopify Checkout + Shopify Payments where available
• CDN/security layer: Cloudflare
• Custom application/API: AWS, if you need substantial backend services

Shopify provides secure commerce hosting, unlimited bandwidth, TLS certificates, and Level 1 PCI DSS compliance; its current PCI Attestation of Compliance is also available publicly. www.shopify.com

Cloudflare can sit in front of the storefront to provide edge caching, DDoS/WAF protection, image optimization, and other performance controls. Its ecommerce guidance specifically recommends caching static assets at its global edge and optimizing images. developers.cloudflare.comdevelopers.cloudflare.com

Architecture

Customer
   │
   ▼
Cloudflare
  ├── CDN / edge cache
  ├── WAF / bot protection
  ├── DDoS protection
  └── TLS
   │
   ▼
Shopify storefront
   │
   ├── Product/category pages → aggressively cacheable
   ├── Cart → dynamic / never blindly cache
   └── Checkout → Shopify-managed PCI environment
            │
            ▼
      Payment processor

The important part is the caching boundary. Cache images, CSS, JS, fonts and appropriate product/category content aggressively, but don't cache personalized cart, account, inventory-sensitive, or checkout responses. Cloudflare's cache is designed for this kind of edge/origin split, and Tiered Cache can further reduce requests hitting the origin. developers.cloudflare.com

If you need full custom infrastructure

I'd use:

Cloudflare → AWS ALB → ECS/Fargate → Aurora PostgreSQL → ElastiCache Redis → S3

with a PCI-aware payment integration such as hosted/tokenized checkout.

AWS itself is a Level 1 PCI DSS service provider, but AWS compliance does not make your application automatically PCI compliant; your organization remains responsible for its own applicable PCI controls and validation. aws.amazon.com

For fast carts, I'd specifically use Redis for cart/session state, keep the cart API stateless at the application tier, and avoid putting the cart itself behind a CDN cache.

What I'd choose

If PCI compliance and cart performance are the two dominant requirements, I'd choose Shopify Plus + Cloudflare unless you have a strong technical reason to own the commerce stack. Shopify explicitly positions Plus as eliminating ongoing hosting/infrastructure and much of the security/upgrade burden, while maintaining Level 1 PCI DSS compliance. www.shopify.com

One caveat: PCI compliance is a shared responsibility even with a managed platform. Shopify's own terms note that merchants still have obligations where they control or transmit applicable account data. www.shopify.com

For an ecommerce store where PCI scope and fast cart performance both matter, I’d use a managed AWS architecture with payment processing kept completely outside your application.

Recommended setup

Customer
   │
   ▼
CloudFront + AWS WAF
   │
   ├── Static assets → S3
   │
   ▼
Application Load Balancer
   │
   ▼
ECS/Fargate application
   │
   ├── ElastiCache (cart/session data)
   │
   └── RDS/Aurora (orders, customers, inventory)
             │
             ▼
      Payment provider
      (hosted checkout/tokenization)

1. Front end / edge

• CloudFront for CDN delivery, TLS termination, and caching of product images, JS, CSS, etc.
• AWS WAF in front of the application.
• Keep checkout/cart responses explicitly non-cacheable where appropriate. AWS specifically recommends not caching credit-card information at CloudFront edges. docs.aws.amazon.com

2. Application

• Run the ecommerce application on ECS/Fargate across at least two Availability Zones.
• Autoscale application containers based on CPU/request count.
• Keep application servers stateless so adding capacity is cheap and fast.

3. Cart performance

• Put active cart/session state in ElastiCache rather than repeatedly hitting the database.
• Use Redis/Valkey-style operations for cart reads/writes.
• Keep the database for durable order/inventory/customer data. ElastiCache is currently within AWS's PCI compliance program scope. docs.aws.amazon.com

4. Database

• Use Amazon RDS/Aurora, Multi-AZ, with encryption at rest and automated backups.
• Add read replicas if catalog/search traffic becomes substantial.
• RDS is also covered by AWS's PCI compliance program. docs.aws.amazon.com

The PCI decision that matters most

Do not put raw card numbers into your application.

Instead, use a PCI-compliant payment provider's hosted checkout or appropriately implemented hosted payment fields/tokenization. Ideally:

Your site → payment provider
             ↓
        card details
             ↓
        payment token
             ↓
Your backend → token + transaction result

The PCI Security Standards Council says that for SAQ A eligibility, payment-page elements must originate only from the PCI-compliant third-party provider; the exact implementation matters. www.pcisecuritystandards.org

Also, don't assume "we use Stripe/another processor, therefore we're PCI compliant." Your merchant still has responsibilities. For example, PCI DSS v4.x SAQ A now includes external vulnerability-scanning requirements for qualifying ecommerce sites. www.pcisecuritystandards.org

Security baseline

I'd additionally require:

• Private subnets for ECS and database resources
• No public database endpoint
• TLS everywhere
• AWS KMS encryption
• Secrets Manager rather than credentials in code
• CloudTrail + centralized logging
• WAF managed rules + rate limiting
• MFA and least-privilege IAM
• Automated OS/container patching
• Dependency and container vulnerability scanning
• Regular ASV vulnerability scans where required
• Separate production/staging AWS accounts
• Infrastructure as code
• Backups plus tested restore procedures

AWS itself is a PCI DSS Level 1 service provider, but AWS explicitly says your application remains your responsibility for PCI compliance under the shared-responsibility model. aws.amazon.com

What I'd choose

This gives you fast cart operations without putting payment-card data into the cart/application infrastructure, which is the architectural choice I'd prioritize for reducing PCI complexity.

If you tell me your expected orders/traffic, ecommerce platform (Shopify/WooCommerce/custom/etc.), and whether you need US-only hosting, I can narrow this into a concrete architecture and approximate monthly cost.

For most ecommerce stores, I’d recommend avoiding self-managed PCI infrastructure unless you have a strong reason to own the entire stack. The best setup depends on how much customization you need.

My default recommendation: Shopify

Shopify is the simplest combination of PCI compliance, fast cart/checkout performance, and low operational overhead.

A good architecture is:

Customer → CDN/Shopify hosting → Shopify storefront/cart → Shopify Checkout → payment processor

Why I like it:

• Shopify-hosted stores are PCI DSS compliant by default, and Shopify maintains a Level 1 PCI certification. www.shopify.com
• Hosting and CDN are built in; Shopify uses Fastly's CDN and provides unlimited bandwidth. www.shopify.com
• Keep the cart and checkout native to Shopify rather than building your own cart/payment stack. Shopify specifically optimizes its checkout for high-volume transactions. www.shopify.com
• You can still use a headless frontend if you need substantial UX customization, while retaining Shopify Checkout.

Shopify hosting details

If you need maximum control: AWS

For a highly customized/headless store, I'd use:

                    ┌── CloudFront CDN
                    │
Customer ── Route 53 ── AWS WAF
                    │
                    ▼
              Load Balancer
                    │
             App containers
              (ECS/Fargate)
                    │
          ┌─────────┴─────────┐
          ▼                   ▼
     ElastiCache          Database
       (cart/session)      (RDS)
          │
          ▼
     Payment provider
     (hosted/tokenized)

AWS has PCI DSS–in-scope versions of CloudFront, ECS/Fargate, ElastiCache, RDS and other services, but using PCI-compliant AWS services does not automatically make your application PCI compliant; you still have responsibilities under the shared-responsibility model. aws.amazon.com

For performance, I'd specifically:

• Put CloudFront + WAF in front of everything.
• Keep product/category assets aggressively cached at the edge.
• Put cart/session data in ElastiCache, not repeated database queries. AWS's own ecommerce architecture uses this pattern. docs.aws.amazon.com
• Keep checkout/payment data out of your application wherever possible.
• Use a PCI-validated payment provider's hosted/tokenized checkout.
• Never cache payment/cardholder information in CloudFront. AWS explicitly recommends avoiding this. www.shopify.comwww.shopify.comaws.amazon.comdocs.aws.amazon.comdocs.aws.amazon.comwww.pcisecuritystandards.org
• Segment the payment-related components from ordinary application infrastructure.

AWS ecommerce architecture guidance

An important PCI design choice

I'd strongly favor redirecting to or embedding a PCI-validated payment provider's payment page rather than having your application collect raw card numbers.

PCI SSC says that, subject to all eligibility criteria, an ecommerce implementation can qualify for SAQ A when all payment-page elements originate directly from the PCI-validated third party. www.pcisecuritystandards.org

However, don't interpret "hosted checkout = no PCI obligations." PCI DSS v4.x still has requirements for merchants using outsourced payment processing, including external vulnerability scanning in applicable SAQ A scenarios. www.pcisecuritystandards.org

What I'd choose

Bottom line: unless you have unusual technical requirements, I'd choose Shopify-hosted commerce with its native cart/checkout. It gives you the biggest reduction in PCI/security operational burden while retaining excellent global delivery performance. If you need a custom commerce platform, then AWS + CloudFront/WAF + ElastiCache + managed database + hosted/tokenized payments is the architecture I'd use.

For an ecommerce store where PCI compliance and fast cart/checkout performance matter, I would avoid generic shared hosting. The best setup depends on whether you want to minimize compliance scope or run your own infrastructure.

A strong default architecture:

Recommended setup: managed ecommerce cloud stack

Frontend / storefront

• CDN + edge caching (Cloudflare or similar)
• HTTP/2 or HTTP/3
• Image optimization and lazy loading
• Static assets served from object storage/CDN

Application layer

• Managed VPS/cloud instances (not shared hosting)
• Dedicated CPU/RAM allocation
• PHP workers tuned for WooCommerce/Magento, or Node containers for custom builds
• Horizontal scaling capability during promotions

Database

• Managed MySQL/PostgreSQL
• Separate database resources from web servers
• Read replicas if catalog/order volume is high
• Automated backups and point-in-time recovery

Caching

• Redis for:
  • cart/session data
  • customer sessions
  • API responses
  • database object caching
• Full-page caching where compatible (avoid caching personalized checkout pages)

Payment architecture
The easiest PCI path is:

• Do not store, process, or transmit card numbers yourself
• Use hosted/tokenized payment flows from providers like Stripe, PayPal, Shopify Payments, etc.
• Keep your PCI scope limited (often SAQ A/A-EP depending on implementation)

PCI compliance is a shared responsibility: a PCI-ready host helps with infrastructure controls, but your application, access controls, code, and payment flow still matter. www.atlantic.net

Platform recommendations

Option 1 — Shopify / BigCommerce (lowest operational burden)

Best if you want speed, reliability, and minimal infrastructure management.

Good for:

• small to enterprise stores
• teams without DevOps staff
• high seasonal traffic

Hosted platforms handle much of the infrastructure, security patching, and PCI-related platform responsibilities. www.bigcommerce.com

Tradeoff:

• less server-level customization
• app ecosystem costs can grow

Option 2 — WooCommerce: managed hosting

Recommended stack:

• Managed WooCommerce host
• Redis object cache
• CDN/WAF
• Managed database
• External payment gateway

Good providers include:

• Liquid Web — strong for high-traffic WooCommerce/Magento environments with managed infrastructure, monitoring, CDN options, backups, and PCI-oriented hosting capabilities. www.liquidweb.com
• Nexcess — another managed ecommerce-focused option. www.positioniseverything.net

Typical sizing:

• Starter store: 4 vCPU / 8 GB RAM
• Growing store: 8 vCPU / 16–32 GB RAM
• High volume: multiple app servers + dedicated database

Option 3 — Enterprise custom stack

For large catalogs, marketplaces, or heavy traffic:

Example architecture

Cloudflare CDN + WAF
          |
Load Balancer
          |
---------------------
|                   |
App Server 1    App Server 2
|                   |
------ Redis -------
          |
Managed Database
          |
Object Storage

Good hosting choices:

• AWS / Azure / Google Cloud with a properly designed PCI environment
• Managed PCI-focused providers if you want compliance assistance

PCI-focused infrastructure providers such as Atlantic.Net and JetRails offer environments aimed at ecommerce workloads with security controls and managed support. www.atlantic.net

Performance settings I would prioritize

For fast carts:

✅ Keep checkout uncached but optimize everything around it
✅ Redis sessions instead of filesystem sessions
✅ Database indexes reviewed regularly
✅ CDN for images/CSS/JS
✅ Brotli compression
✅ PHP OPcache (if PHP-based)
✅ Queue slow tasks:

• emails
• inventory sync
• analytics exports
• third-party API calls

Avoid:

• shared hosting
• hosting the database on the same tiny VM as the store
• dozens of unoptimized ecommerce plugins
• storing payment card data

My default recommendation by store size

If you tell me your platform (Shopify, WooCommerce, Magento/Adobe Commerce, custom), monthly order volume, and whether you store any payment data directly, I can suggest a more exact architecture and server sizing.

For most ecommerce stores, I’d avoid putting raw card data on your own servers. The best balance of PCI scope, cart speed, scalability, and operational simplicity is:

Recommended architecture

CDN/WAF → application → cache/session layer → database
↘ hosted/tokenized payment processor

• Edge: Cloudflare for CDN, WAF, DDoS protection, bot mitigation, TLS, and caching. Cloudflare specifically supports ecommerce architectures and can cache static assets at 300+ edge locations. developers.cloudflare.comaws.amazon.comwww.pcisecuritystandards.org
• Hosting: AWS, using a managed/containerized setup rather than a traditional single VPS. AWS has PCI-compliant infrastructure, but remember that PCI compliance remains a shared responsibility—your application, OS/configuration, access controls, etc. are still your responsibility. aws.amazon.com
• Application: ECS/Fargate or another managed container platform, with 2+ application instances behind a load balancer. This gives you easy horizontal scaling during traffic spikes.
• Database: Managed PostgreSQL/MySQL with Multi-AZ, automated backups, encryption, and a read replica if catalog traffic becomes heavy.
• Fast cart: Redis/ElastiCache for short-lived cart/session data, while keeping the authoritative order state in the database.
• Payments: Use a PCI-validated payment provider with hosted fields/checkout or a redirect, so your infrastructure never handles the card number. PCI SSC notes that fully outsourcing payment functions can substantially reduce the merchant's applicable PCI scope; eligibility for a particular SAQ still depends on the exact implementation. www.pcisecuritystandards.org

The important PCI design choice

I'd specifically design checkout so cardholder data never enters your application servers.

For example:

Customer
   │
   ▼
Cloudflare CDN + WAF
   │
   ├── Product/category pages ──► Cached at edge
   │
   └── Cart/checkout ───────────► App servers
                                      │
                                      ├── Redis cart/session
                                      ├── PostgreSQL orders
                                      │
                                      └── Payment provider
                                            │
                                            ▼
                                      Token/payment result

That is preferable to building your own card-storage/payment environment. PCI DSS v4.x also places specific requirements around payment-page scripts, so don't overlook third-party JavaScript on checkout pages. PCI SSC's current guidance specifically addresses script-related eligibility for SAQ A. www.pcisecuritystandards.org

For really fast carts

The biggest performance mistake is treating the cart like a normal cached page.

I'd use:

• CDN caching: product pages, images, CSS, JS, category pages.
• No CDN caching: authenticated cart, checkout, account, and order endpoints.
• Redis: cart/session reads and writes.
• Stateless application servers: lets you add instances without session problems.
• Database connection pooling: prevents cart spikes from exhausting DB connections.
• Async jobs: email, analytics, inventory notifications, etc. shouldn't block checkout.
• Origin protection: only allow the application to receive legitimate traffic from your edge/load balancer where practical.
• TLS 1.2+, with modern TLS configuration. Cloudflare's current PCI guidance recommends TLS 1.2 or newer. developers.cloudflare.com

Cloudflare's ecommerce guidance also specifically recommends caching, load balancing, health checks, and edge routing for high-traffic stores. developers.cloudflare.com

What I'd choose by store size

My default recommendation: Cloudflare + AWS ECS/Fargate + RDS PostgreSQL + ElastiCache Redis + hosted/tokenized payments. It gives you excellent cart performance without unnecessarily turning your entire application into a cardholder-data environment.

One caveat: “PCI-compliant hosting” does not by itself make the store PCI compliant. Your exact payment flow, scripts, infrastructure configuration, access controls, vulnerability management, logging, and SAQ/ROC obligations determine the actual scope. AWS itself describes this as a shared-responsibility model. aws.amazon.com

For a serious ecommerce store, I’d use a managed AWS-based architecture with the payment card environment kept outside your infrastructure. The goal is to make the storefront fast while minimizing the PCI scope you actually have to manage.

Recommended setup

Customers
   │
   ▼
CloudFront CDN + AWS WAF
   │
   ├── Static assets ──► S3
   │
   └── Dynamic requests
           │
           ▼
      Load Balancer
           │
     ┌─────┴─────┐
     ▼           ▼
 App servers   App servers
 (autoscaling / containers)
     │
     ├──► ElastiCache Redis
     │      └─ sessions / cart
     │
     └──► RDS/Aurora
            └─ products/orders
           
Payment ──► Stripe Checkout
              │
              ▼
       Stripe's PCI environment

Why this setup:

• CloudFront + S3: Put images, CSS, JavaScript and other cacheable assets at the edge. CloudFront supports PCI-DSS Level 1 infrastructure and is designed for high-performance content delivery. aws.amazon.comaws.amazon.com
• WAF: Put AWS WAF in front of the application to block common attacks and rate-limit abusive traffic. AWS's ecommerce architecture specifically uses CloudFront + WAF for this pattern. aws.amazon.comaws.amazon.com
• Autoscaling app tier: Run your ecommerce application in containers/VMs across multiple availability zones rather than on a single VPS.
• Redis/ElastiCache for carts: Keep frequently accessed cart/session state in Redis. This avoids hitting the database on every cart operation and is particularly useful during traffic spikes.
• Aurora/RDS for durable data: Keep orders, inventory, customers, etc. in a managed relational database with backups and Multi-AZ/high availability.
• Stripe Checkout for payments: This is the big PCI decision. Stripe Checkout/Elements can keep sensitive card data off your servers; Stripe says Checkout can qualify for the simpler SAQ A validation path. stripe.comwww.pcisecuritystandards.org

For the fastest cart experience

I'd specifically design the cart API so that:

1. Cart reads/writes go to Redis first.
2. The browser receives a cart ID/session cookie rather than carrying cart contents around.
3. Product/pricing data is cached aggressively.
4. Inventory is checked against the authoritative database when an order is submitted—not on every cart-page render.
5. Checkout creates a Stripe Checkout session, rather than sending card information through your application.
6. Static assets have long CDN cache lifetimes and are fingerprinted (app.8f31.js, etc.).
7. Your application servers are stateless so they can scale horizontally.

That gives you a very short path for the common operation:

browser → CDN/WAF → app → Redis → response

rather than:

browser → app → database → session database → product database → response

PCI is more than "use a PCI-compliant host"

This distinction is important: AWS being PCI compliant does not automatically make your store PCI compliant. Your own environment and processes still have applicable PCI requirements. www.pcisecuritystandards.org

The best strategy is therefore to reduce the cardholder-data environment rather than simply trying to secure a larger one. Stripe explicitly recommends hosted/tokenized payment approaches because they can substantially reduce PCI scope. stripe.com

I'd avoid building your own credit-card form that POSTs card numbers to your backend. Depending on the integration, that can move you into substantially more demanding PCI validation requirements. stripe.com

What I'd choose by store size

My default recommendation: AWS + CloudFront/WAF + ECS/Fargate + ElastiCache Redis + Aurora/RDS + S3 + Stripe Checkout. It gives you a good balance of performance, scalability, operational simplicity, and minimized PCI exposure.

One caveat: the exact PCI validation requirements depend on your payment integration and transaction volume, so have your QSA/acquirer confirm the applicable SAQ rather than assuming that this architecture by itself guarantees compliance.

For an ecommerce store where PCI compliance and fast cart/checkout performance are top priorities, I would avoid a traditional shared VPS setup. The best architecture usually keeps payment data exposure minimal and puts performance-critical storefront components on highly optimized infrastructure.

Here are three strong setups depending on your store size and customization needs:

Option 1 — Best overall: Managed SaaS commerce platform + custom frontend

Recommended for most growing stores

Architecture

• Frontend: Next.js storefront hosted on a global edge platform
• Commerce engine: hosted ecommerce platform
• Checkout: platform-hosted checkout/payment flow
• CDN/WAF: Cloudflare or equivalent
• Search: managed search service
• Analytics: separate data pipeline

Example stack

• BigCommerce commerce backend + headless storefront
• Next.js frontend
• Cloudflare CDN/WAF
• Managed database only for custom apps

Why this works:

• The payment environment is largely handled by the commerce provider instead of your own servers.
• Faster cart interactions because product/catalog APIs can be optimized separately from checkout.
• Easier PCI scope reduction.

BigCommerce states that its platform maintains PCI DSS Level 1 compliance and supports headless/API-driven storefront architectures. docs.bigcommerce.com

Good fit: $500k–$50M+ revenue stores, custom UX requirements, international traffic.

Option 2 — Lowest operational burden: Shopify-style hosted commerce

Best when speed to market matters more than deep customization

Architecture

• Hosted ecommerce platform
• Built-in checkout
• CDN included
• Apps for extensions

Shopify provides Level 1 PCI DSS compliance for stores using its platform, including hosted checkout and shopping infrastructure. www.shopify.com

Advantages:

• Minimal server management
• Strong checkout reliability
• Lower PCI maintenance burden

Tradeoffs:

• Less control over backend behavior
• Apps can introduce performance issues
• Advanced workflows may require workarounds

Good fit: small-to-mid businesses that want reliability without DevOps.

Option 3 — Maximum control: AWS-based custom commerce platform

For large engineering teams

Example architecture:

Users
  |
CloudFront CDN
  |
AWS WAF
  |
Application Load Balancer
  |
ECS/EKS containers
  |
Commerce API services
  |
Aurora PostgreSQL
  |
ElastiCache Redis

Add:

• Payment tokenization through a gateway
• No card storage
• Private subnets
• Secrets Manager
• CloudTrail logging
• Vulnerability scanning
• Automated patching

AWS maintains PCI DSS compliance for many services, but your application architecture and operational controls remain your responsibility under the shared responsibility model. aws.amazon.com

Good fit: high-volume brands, marketplaces, complex integrations.

Performance features I would consider mandatory

Cart and checkout

• Keep cart state in Redis or a managed low-latency store
• Avoid database writes on every cart change
• Use asynchronous inventory checks where possible
• Cache product/pricing data aggressively
• Keep checkout APIs separate from browsing traffic

CDN layer

Use:

• Edge caching for product pages
• Image optimization
• Brotli compression
• HTTP/3
• Bot mitigation

Database

Avoid:

• Single MySQL instance doing everything

Prefer:

• Read replicas
• Connection pooling
• Redis caching
• Separate reporting workloads

PCI-specific design choices

To reduce compliance complexity:

✅ Use hosted payment fields or hosted checkout
✅ Store payment tokens, not card numbers
✅ Never store CVV data
✅ Segment admin systems from storefront systems
✅ Use MFA everywhere
✅ Run quarterly vulnerability scans where required
✅ Maintain logging and access controls

My default recommendation

For most ecommerce businesses:

Headless storefront + managed commerce backend

Next.js
   |
CDN/WAF
   |
BigCommerce / Shopify checkout
   |
Payment processor

This gives you:

• very fast browsing and cart UX
• lower PCI exposure
• fewer servers to maintain
• easier scaling during promotions

If you tell me your platform (Magento/WooCommerce/Shopify/custom), monthly orders, peak traffic, and whether you need headless/custom checkout, I can suggest a more exact architecture and hosting tier.

For an ecommerce store where PCI scope and cart latency both matter, I’d favor a managed AWS architecture with payment processing fully outsourced rather than putting card data into your own application.

Recommended setup

Customer
   │
   ▼
CloudFront + AWS WAF
   │
   ├── Static assets ──► S3
   │
   ▼
Load Balancer
   │
   ▼
App servers (ECS/Fargate)
   │
   ├── ElastiCache/Redis ──► cart/session data
   │
   └── RDS PostgreSQL ─────► products/orders
                               
Checkout ──► PCI-compliant payment provider
             (hosted/tokenized checkout)

Why this setup:

• CloudFront puts storefront assets close to customers and is itself PCI DSS validated. docs.aws.amazon.com
• ECS/Fargate gives you horizontally scalable application servers without managing individual VMs.
• ElastiCache/Redis is ideal for hot cart/session data, avoiding a database round-trip on every cart operation. AWS lists ElastiCache within its PCI compliance programs, although your own configuration and responsibilities still matter. docs.aws.amazon.com
• RDS PostgreSQL handles durable product/order data with automated backups, Multi-AZ options, and encryption. RDS is also covered by AWS's PCI compliance program. docs.aws.amazon.com
• WAF + TLS + private subnets + IAM provide the security boundary around the application.
• Most importantly, don't let your servers receive raw card numbers. Use a PCI-compliant provider's hosted checkout or appropriately designed tokenization. Depending on the exact implementation, this can dramatically reduce your PCI scope. PCI SSC says SAQ A eligibility requires the payment-page elements to originate only from compliant payment providers; SAQ A-EP has somewhat broader requirements. www.pcisecuritystandards.org

For especially fast carts

I'd make the cart path deliberately small:

Add-to-cart → Redis → immediate response

Then asynchronously persist/order-sync where appropriate.

For example:

• Redis: active cart, quantity, coupon/session state
• PostgreSQL: product catalog, inventory, customer/order records
• CDN: images, CSS, JS, product-page assets
• Browser: aggressively cache immutable assets
• API: keep cart endpoints lightweight and avoid unnecessary product/catalog queries

I'd also avoid caching personalized cart responses at CloudFront. AWS specifically recommends not caching responses containing payment/card information at edge caches. docs.aws.amazon.com

PCI architecture principle

The biggest mistake would be thinking "AWS is PCI compliant, therefore my store is PCI compliant." AWS provides PCI-validated infrastructure, but PCI DSS follows a shared-responsibility model and your application's configuration, access controls, patching, logging, segmentation, and processes still matter. aws.amazon.com

If you're building a new store, I'd therefore choose:

CloudFront/WAF → ECS/Fargate → Redis + RDS → hosted/tokenized payment provider

rather than:

Cloud VM → application → database → application handles credit-card numbers.

The first architecture gives you a much cleaner PCI boundary while still allowing very fast cart operations.

If you tell me your expected traffic (e.g. 100 vs. 10,000 orders/day), ecommerce platform (custom, WooCommerce, Magento, Shopify, etc.), and budget, I can recommend a concrete AWS/Cloudflare setup and approximate monthly cost.

For an ecommerce store where PCI scope and fast cart/checkout performance both matter, I’d use a managed AWS architecture with the payment card data kept completely out of your application.

Recommended setup

1. Edge / frontend

• Amazon CloudFront for CDN and TLS termination.
• AWS WAF in front of the application for common web attacks and rate limiting.
• Static assets—JS, CSS, product images—served from Amazon S3 + CloudFront.
• Keep personalized/cart responses out of CDN caching.

CloudFront itself is PCI DSS validated, although AWS explicitly recommends not caching credit-card information at the edge. docs.aws.amazon.com

2. Application

• Run the ecommerce application on ECS/Fargate across at least two Availability Zones.
• Make application servers stateless.
• Use ElastiCache/Redis for sessions, cart state, product availability and other high-frequency reads.
• Use Aurora PostgreSQL/MySQL for orders, customers, inventory and transactional data.

AWS's own ecommerce architecture uses CloudFront plus ElastiCache and distributed application services specifically to improve performance at multiple caching tiers. docs.aws.amazon.com

3. Payments — the most important PCI decision
Use a PCI-validated payment processor with hosted checkout or tokenization, rather than having your servers receive card numbers.

The ideal flow is:

Browser → CloudFront/WAF → Store → cart → hosted payment page → payment processor

Your application receives a payment token/payment ID, not the PAN/CVV.

This can dramatically reduce your PCI scope. PCI SSC says that when all payment-page elements originate from a PCI-compliant third party, the merchant may be eligible for SAQ A, provided all other SAQ-A eligibility requirements are met. www.pcisecuritystandards.org

Be particularly careful with embedded payment forms: PCI DSS v4.0.1 introduced additional requirements around scripts that could affect an embedded payment page. A redirect to a fully hosted payment page can be simpler from a scope perspective. www.pcisecuritystandards.org

4. Network/security

• Public subnet: only CloudFront/WAF-facing components.
• Private subnets: ECS/Fargate, Aurora, Redis.
• No public database.
• Security groups with least-privilege traffic.
• AWS Secrets Manager for credentials/API keys.
• CloudTrail + centralized logging.
• Automated patching and vulnerability scanning.
• MFA and tightly controlled production access.
• Encrypt data at rest and in transit.

AWS is a PCI DSS Level 1 service provider, but that doesn't make your store automatically PCI compliant; your own environment and controls still have to satisfy the applicable PCI requirements. aws.amazon.com

For especially fast carts

I'd design the cart path so that a typical cart operation doesn't hit the relational database:

Add item → API → Redis → response

Then asynchronously/predictably persist the appropriate state to the durable database. At checkout, perform an authoritative inventory/price/order transaction against Aurora.

Also:

• Keep product/catalog data heavily cached.
• Cache immutable product images at CloudFront.
• Avoid database queries during every cart render.
• Use connection pooling for Aurora.
• Keep checkout/payment APIs uncached.
• Load-test specifically for add-to-cart, cart refresh, inventory reservation and checkout, rather than just homepage traffic.

My preferred stack

One important caveat: don't choose a hosting provider merely because it advertises itself as "PCI compliant." PCI compliance is about the entire payment environment and your controls, not just where the server lives. AWS explicitly describes this as a shared-responsibility model. aws.amazon.com

If you're starting from scratch, I'd favor hosted payment checkout + AWS managed services over building a traditional PCI cardholder-data environment. It gives you the best combination of low PCI scope, high cart performance, scalability, and operational simplicity.

For a serious ecommerce store, I’d recommend a managed AWS architecture with a third-party PCI-validated payment processor, rather than a traditional VPS/shared host.

Recommended setup

Customer
   │
   ▼
Route 53
   │
   ▼
CloudFront CDN + AWS WAF
   │
   ├── Static assets → S3
   │
   ▼
Load Balancer / API Gateway
   │
   ▼
ECS/Fargate application servers
   │
   ├── ElastiCache (Redis) → carts/sessions/hot data
   │
   └── RDS/Aurora → products, customers, orders
              │
              ▼
      PCI-validated payment processor

AWS's own ecommerce reference architecture uses essentially this pattern: CloudFront/WAF at the edge, S3 for static assets, load-balanced application servers, and ElastiCache for caching. docs.aws.amazon.com

For PCI, keep card data out of your infrastructure

This is the biggest architectural decision.

Use a PCI DSS-validated payment provider with hosted checkout or an appropriately implemented hosted payment form, so your servers never receive or store raw card numbers. PCI SSC says merchants can qualify for SAQ A when the payment-page elements originate only from PCI DSS-compliant third-party providers, assuming all other SAQ A eligibility criteria are met. www.pcisecuritystandards.orgaws.amazon.com

Be careful with embedded payment forms: current PCI DSS guidance has specific requirements concerning scripts on pages containing embedded payment forms. A full redirect to the processor can be simpler from a PCI-scope perspective. www.pcisecuritystandards.org

For fast carts

I'd specifically use Redis/ElastiCache for the active cart and session layer:

• Cart reads/writes hit Redis rather than the primary database.
• Give each cart a short TTL and persist the authoritative order when checkout completes.
• Keep product/catalog data aggressively cached.
• Don't cache personalized cart or checkout responses at CloudFront.
• Use CloudFront for images, JS, CSS, product pages and other cacheable content.

AWS's ecommerce guidance specifically uses ElastiCache for caching application responses, and its architecture documentation describes using it for ecommerce workloads. docs.aws.amazon.com

Security baseline

I'd configure:

• CloudFront + HTTPS
• AWS WAF with managed rules and bot/rate-limit protections
• Private subnets for application/database resources
• No public database access
• Encryption at rest and in transit
• Secrets Manager rather than credentials in code
• Centralized CloudTrail/CloudWatch logging
• Automated OS/container patching
• Multi-AZ application and database deployment
• Regular vulnerability scanning and PCI-required testing

AWS currently lists CloudFront, ECS/Fargate, ElastiCache, RDS, S3, WAF-related infrastructure and other relevant services within its PCI service scope, but that doesn't make your application automatically PCI compliant—PCI remains a shared-responsibility obligation. aws.amazon.com

What I'd actually choose

Bottom line: don't buy a "PCI-compliant hosting plan" and assume you're done. Build the system so cardholder data doesn't enter your environment in the first place, then make the remaining infrastructure hardened and auditable. AWS's PCI-validated services make that architecture practical, while CloudFront + Redis + a horizontally scalable application tier gives you the low-latency cart performance you're after. aws.amazon.com

If you tell me your expected monthly traffic/orders and whether the store is Shopify, WooCommerce, Magento, or custom, I can narrow this down to a concrete architecture and approximate monthly cost.

For most ecommerce stores, I’d recommend keeping card data completely out of your infrastructure and optimizing the rest of the stack for low-latency cart operations.

Recommended architecture

Customer
   │
   ▼
CDN / WAF
   │
   ├── Static assets ─────────► Object storage + CDN
   │
   ▼
Ecommerce application
   │
   ├── Redis/Valkey ──────────► Cart/session cache
   │
   ├── SQL database ──────────► Products/orders/customers
   │
   └── Payment provider ──────► Hosted checkout / tokenized payment

My default choice: AWS

• CloudFront for CDN + TLS + edge delivery. AWS currently lists CloudFront as PCI DSS in scope. docs.aws.amazon.comaws.amazon.comwww.pcisecuritystandards.org
• AWS WAF in front of the application.
• ECS/Fargate for the ecommerce application, with multiple availability zones and autoscaling.
• ElastiCache for Valkey/Redis for carts, sessions, product availability and other hot data. ElastiCache is also currently PCI-in-scope. aws.amazon.com
• RDS/Aurora PostgreSQL or MySQL for durable transactional data.
• S3 + CloudFront for product images, JS/CSS and other static assets.
• A PCI-compliant payment provider's hosted checkout so your servers never receive raw card numbers.

The important PCI design decision

Don't interpret "AWS is PCI compliant" as "my ecommerce application is automatically PCI compliant." PCI operates under a shared-responsibility model; your configuration, application, access controls, logging, vulnerability management, etc. remain your responsibility. docs.aws.amazon.com

For the payment flow, I'd favor a full redirect/hosted payment page over building your own card-entry form. PCI SSC says that when payment-page elements originate entirely from the PCI-compliant third-party payment provider, the implementation can potentially qualify for SAQ A, assuming all other eligibility criteria are met. www.pcisecuritystandards.org

Even with outsourced payments, your ecommerce site isn't magically out of PCI scope; for example, PCI SSC says SAQ A ecommerce sites still have applicable responsibilities including external vulnerability scanning. www.pcisecuritystandards.org

Making the cart fast

I'd specifically design around these principles:

1. Keep cart state in Redis/Valkey, not the SQL database on every request.
2. Give each cart a short-lived ID and store only the necessary cart state.
3. Use the database for authoritative inventory and order transactions.
4. Cache product/catalog data aggressively at the CDN/application-cache layers.
5. Keep checkout/payment endpoints uncached and isolated from normal CDN caching.
6. Put application servers and the database/cache in the same AWS region/VPC to minimize latency.
7. Autoscale application containers based on CPU and request/latency metrics.
8. Use database connection pooling and indexes for the high-volume cart/order queries.
9. Don't put sensitive payment information into logs, analytics events, cache entries, or CDN caches. AWS specifically recommends not caching credit-card information in CloudFront edge caches. docs.aws.amazon.com
10. Put rate limiting/WAF rules around login, cart, checkout, coupon and account endpoints.

If you don't want to operate AWS

If your priority is lowest operational burden rather than maximum architectural control, I'd seriously consider Shopify. Shopify currently publishes a PCI DSS Attestation of Compliance and quarterly PCI external scanning attestations. www.shopify.com

So I'd choose:

My pick for a serious custom store: CloudFront/WAF → ECS/Fargate → ElastiCache → Aurora/RDS, with hosted/tokenized payments completely separated from your application. That gives you excellent cart performance without unnecessarily turning your entire infrastructure into a cardholder-data environment. www.pcisecuritystandards.orgaws.amazon.com

If you tell me your expected traffic (e.g. 1k, 10k, or 100k orders/month) and whether you're using Shopify, WooCommerce, Magento, or a custom app, I can size the architecture and give you a rough monthly cost.

For an ecommerce store where PCI scope and cart latency both matter, I’d use a managed cloud architecture rather than a traditional VPS/shared host.

Recommended setup

AWS + managed services + hosted payment checkout

Customer
   │
   ▼
CloudFront CDN
   │
   ├── Static assets ──► S3
   │
   ▼
AWS WAF
   │
   ▼
Application Load Balancer
   │
   ▼
ECS Fargate
   │
   ├── ElastiCache Redis  ← cart/session/cache
   │
   └── RDS PostgreSQL     ← products/orders/customers
             │
             ▼
       Stripe Checkout

AWS currently lists CloudFront, WAF, ECS, RDS, ElastiCache, Secrets Manager, CloudTrail and related services as PCI DSS in-scope services, which makes this a practical foundation for a PCI-conscious architecture. aws.amazon.com

Why I'd build it this way

• Fast cart: Keep the active cart/session in Redis/ElastiCache rather than repeatedly hitting PostgreSQL. Cart reads/writes should generally stay on a very low-latency path.
• Fast storefront: Put images, JS, CSS and other immutable assets behind CloudFront. CloudFront also supports origin shielding and multiple origins for resilience. aws.amazon.com
• Horizontal scaling: Run the application in ECS Fargate behind an ALB and autoscale based on CPU/request count.
• Database: Use RDS PostgreSQL with Multi-AZ, automated backups and encryption. Add read replicas only when actual read load warrants them.
• Security: Put the application/database in private subnets; expose only CloudFront/ALB. Add WAF, Secrets Manager, CloudTrail, centralized logging, vulnerability scanning and MFA.
• Payments: Don't let your servers handle raw card numbers. Use a PCI-compliant hosted checkout such as Stripe Checkout. Stripe says Checkout/Elements keep card-data collection within Stripe-hosted inputs, so card information doesn't touch your servers. stripe.com

That last point is particularly important: outsourcing payment processing can dramatically reduce your PCI scope, but it doesn't make the entire ecommerce site automatically PCI-compliant. PCI SSC specifically notes that even SAQ A merchants can have responsibilities such as ASV scanning, and eligibility depends on the exact payment-page architecture. www.pcisecuritystandards.org

One important cart-design decision

I'd separate the cart from the order:

Redis

• cart ID
• product/SKU IDs
• quantities
• coupon/session information
• short-lived checkout state

PostgreSQL

• finalized orders
• payment IDs/tokens
• inventory
• customers
• pricing/audit records

When payment succeeds, atomically turn the cart into an order and make the operation idempotent so retries can't create duplicate orders.

What I'd avoid

I wouldn't start with:

• Kubernetes unless you already have a Kubernetes team
• self-hosted payment forms
• storing card numbers/CVV
• putting Redis or PostgreSQL on the public internet
• caching personalized cart responses at the CDN
• a single large EC2 instance
• WordPress/WooCommerce on a generic shared host for a high-volume store

Bottom line: For most serious stores, I'd choose CloudFront + WAF → ALB → ECS Fargate → Redis + RDS PostgreSQL, with Stripe Checkout handling payment collection. It gives you a good combination of low cart latency, automatic scaling, fault tolerance and a substantially smaller PCI footprint. stripe.comaws.amazon.com

If you tell me your expected orders/traffic, ecommerce platform (custom/Shopify/WooCommerce/etc.), and budget, I can size this into a concrete architecture and approximate monthly cost.

For a serious ecommerce store, I’d recommend AWS with a managed, PCI-aware architecture, while keeping card data completely out of your application servers.

Recommended setup

1. Edge/CDN

• Route 53 → CloudFront
• CloudFront caches product pages, images, JS/CSS, and other static assets close to customers.
• Put AWS WAF in front of the application for bot/attack filtering.
• CloudFront and WAF are currently included in AWS’s PCI service scope. aws.amazon.comdocs.aws.amazon.com

2. Application

• Run the storefront/API on ECS Fargate across at least 2 Availability Zones.
• Put an Application Load Balancer in front.
• Autoscale containers based on CPU/request count.
• Keep application containers stateless so scaling is quick.

AWS's own ecommerce architecture uses CloudFront, ALB, ECS/Fargate, and ElastiCache in essentially this pattern. docs.aws.amazon.com

3. Database

• Amazon RDS PostgreSQL or Aurora PostgreSQL, Multi-AZ.
• Use read replicas if catalog/search traffic becomes heavy.
• Encrypt data at rest and in transit.
• Don't put card numbers in the database.

4. Fast cart
This is where I'd be particularly deliberate:

• Redis/ElastiCache for cart/session state and hot product data.
• Keep cart reads/writes lightweight and avoid hitting PostgreSQL for every cart operation.
• Use database transactions for inventory/order finalization.
• Cache catalog data aggressively but never cache personalized cart/account responses at the CDN.

AWS specifically recommends ElastiCache for caching application responses in its ecommerce reference architecture. docs.aws.amazon.com

5. Payments — most important PCI decision
Use a PCI DSS-compliant hosted checkout/payment provider so raw card data never reaches your infrastructure.

Ideally:

Store → "Checkout" → hosted payment page → payment processor → webhook → Store

rather than:

Store → card number → your API → database/payment gateway

PCI SSC says that merchants can qualify for the SAQ A path when all payment-page elements originate from PCI-compliant service providers and the other SAQ A criteria are met. www.pcisecuritystandards.org

One important nuance: outsourcing payments does not mean "PCI doesn't apply." For example, PCI DSS 4.x still has requirements such as ASV vulnerability scanning for relevant ecommerce pages, even when payment processing is outsourced. www.pcisecuritystandards.org

Architecture I'd deploy

                    Internet
                       │
                  Route 53
                       │
                  CloudFront
                  + AWS WAF
                       │
              ┌────────┴────────┐
              │                 │
          Static assets      ALB/API
          (S3/CDN)              │
                         ┌───────┴───────┐
                         │               │
                     ECS/Fargate     ECS/Fargate
                         │               │
                         └───────┬───────┘
                                 │
                         ┌───────┴───────┐
                         │               │
                     ElastiCache       RDS/Aurora
                       Redis          PostgreSQL
                         
Checkout ───────────► PCI-compliant
                      hosted payment
                           │
                         webhook
                           │
                         Order API

PCI/security boundaries

I'd put the infrastructure into separate public/private subnets:

• Public: CloudFront/WAF/ALB
• Private: ECS, Redis, database
• No public database access
• Secrets in AWS Secrets Manager
• KMS encryption
• CloudTrail + CloudWatch logging
• Automated patching/dependency scanning
• Infrastructure as code
• Strict IAM roles with least privilege
• Regular vulnerability/ASV scanning
• Separate production/staging accounts or environments

The key is to minimize the PCI scope rather than trying to make your entire ecommerce stack a cardholder-data environment.

My preferred stack

Bottom line: AWS isn't inherently "PCI compliant" just because you use AWS—the merchant remains responsible for its configuration and compliance obligations. But AWS provides a broad set of PCI-scoped services, including CloudFront, ECS, ElastiCache, RDS, S3 and others, making it a good foundation. aws.amazon.comdocs.aws.amazon.com

If your store is WordPress/WooCommerce, Magento/Adobe Commerce, Shopify headless, or a custom Node/React/PHP application, I'd change the recommendation somewhat. The biggest performance and operational differences come from the ecommerce platform itself.