Home > PCI compliance > Failed PCI scan
Failed PCI scan? What it means and how to fix it fast
Your processor emailed a failed scan, or your PCI portal says "non-compliant." It looks technical, but most failures come down to a handful of fixable things on your firewall, router or website. Here is what the scan checks, why it fails, and how we get you to a passing report.
The short answer
- A PCI scan is an outside test of your internet facing equipment, done by an Approved Scanning Vendor (ASV) your processor picked.
- It is pass or fail. One finding scored 4.0 or higher on the standard severity scale (CVSS) fails the whole report.
- Most small business failures are old encryption (TLS 1.0 or 1.1), open ports, remote access left exposed, or outdated router and firewall firmware.
- Until you pass, many processors add a monthly non-compliance fee to your statement.
- We read the report, fix the findings, document what was fixed and handle the rescan or dispute with the scan vendor.
What the scan actually checks
The scan vendor tests the public internet address of your business, the same way an attacker would. It looks at what answers from the outside: your firewall or router, any website or online ordering page, remote access, email servers and anything else reachable. It does not look inside your computers. That is why the fix is usually on the equipment at the edge of your network.
How to read your failed scan report
- Find the summary: it lists each IP address or website scanned and whether it passed.
- Sort by severity: anything Medium (4.0 to 6.9), High (7.0 to 8.9) or Critical (9.0 to 10) must be fixed or disputed. Low items do not fail the scan.
- Read the port and service: each finding names the port, such as 443 for web or 3389 for remote desktop. That tells you which device is answering.
- Check the scope: make sure the addresses scanned are actually yours. Wrong or old addresses are a common cause of failures.
- Note the deadline: processors expect a passing scan every quarter, and a rescan after you fix things.
The fixes, in plain English
| Finding | What it means | Typical fix |
|---|---|---|
| TLS 1.0 or 1.1 supported | Old encryption that attackers can break | Turn on TLS 1.2 and 1.3 only, remove weak ciphers |
| Remote desktop (3389) open | Your computer is reachable from the internet | Close the port, use a secure VPN instead |
| Router or firewall admin page exposed | Anyone can try to log in to your equipment | Turn off remote management from the internet |
| Outdated firmware or software | Known security holes | Update firmware, or replace equipment that no longer gets updates |
| Expired or self signed certificate | Browsers and scanners cannot trust the connection | Install a valid certificate and set up renewal |
| Unknown open service | Something answering you did not know about | Identify the device, close it or move it behind the firewall |
False positives and disputes
Not every finding is real. Scanners sometimes flag a version number that has already been patched, or a service that is protected in other ways. When that happens, the scan vendor accepts a dispute with proof, such as a screenshot of the setting or a vendor note. We write the dispute, attach the evidence and follow it through, so you are not stuck answering technical questions you never asked for.
Why the scan keeps failing every quarter
- The internet provider's router was swapped or reset and the old settings came back.
- A camera system, alarm panel or phone system was installed with ports opened to the internet.
- Firmware was never updated after the last fix.
- The disputes from last time were never saved, so the same findings return.
- Card terminals and guest Wi-Fi share one network, which keeps the scope larger than it needs to be. See card terminal network separation.
How WENO handles a failed scan for you
Questions people ask
Who decides I need a PCI scan?
Your card processor and the type of business you run. Businesses with card data on systems connected to the internet usually need quarterly external scans. Your processor's portal shows which questionnaire and scans apply to you.
Is the scan required if I only use a card terminal?
It depends on how the terminal connects. Many terminals that run over your office internet still bring a scan requirement. Standalone terminals on a cellular connection often do not. Ask your processor, or we can check for you.
How fast can a failed scan be fixed?
Many common findings, like closing a port or turning off old encryption, can be fixed in a day. Firmware updates or equipment replacements take longer. The rescan is usually run as soon as the fixes are in place.
Will passing the scan stop the monthly fee?
Usually the fee stops once the processor receives a passing scan and your completed questionnaire. See PCI non-compliance fees.
Do you replace our internet provider's router?
Not always. Often we put a business firewall behind it and turn off the risky features on the provider's equipment. The goal is the fewest changes that pass the scan and keep you safe.
Sources
- PCI Security Standards Council: PCI DSS and the ASV Program Guide
- Qualys: reasons for PCI compliance status
General information, not legal advice. Your processor and scan vendor set the exact requirements for your account.