PCI Compliance Failing Due to Shopify Port Open on Port 8443

[MMarquardt]

Hi there, 

Looking for help with this PCI Compliance Issue I am receiving - here is what we are hearing from the company. Can you please share a response that would satisfy this request?

Thank you

It is currently failing due to the Shopify port open on port 8443. You would want to ask them for further information confirming that the port is not used for processing credit card information and therefore does not require HSTS headers.

Normally we would submit a false positive with their statement, but because this scan does not affect your PCI compliance status that false positive would not be necessary. In the future, when the scan is required, that would be the resolution for that scan result.

Because currently you are on PCI Type A 3.2.1, which does not require vulnerability scans. When the the update to PCI Type A 4.0 occurs, those scans would then become necessary for compliance.

You would want to contact Shopify to confirm that port 8443 is not intended for public use. When these scan results become necessary for your account you will want to send that statement to [EMAIL] to have a false positive added for that vulnerability.

[Shay]

Hi @MMarquardt 

I can definitely help with that. I can confirm those cookies are not related to session management and are unrelated to the security of cardholder data. You can report that this is a false positive for their scans.

You can supply your vendor requesting this information with Shopify's PCI Compliance scan which can be found here: Review and access Shopify compliance reports.

[MMarquardt]

Thanks so much for the quick response, we will send this as an answer and let you know if there are more questions.