PCI Compliance Impossible Because Micfo Refuses to Upgrade PHP

[Lis]

If you are hosting an online store on your Micfo account and you want to start accepting or continue accepting credit cards -- BEWARE. Your credit card processor will eventually require you to verify that you are PCI Compliant under the new standards implemented by Visa and Mastercard and you will fail the PCI Compliance test because Micfo has not upgraded to PHP 5.2.9.

I just got scanned for PCI Compliance and was told that I needed my host to upgrade to PHP 5.2.9. I contacted Micfo about this and they refuse to upgrade. They said "if you want to use php 5.2.9 then you will need to upgrade your hosting plan to VPS/semi-dedicated hosting or dedicated server hosting with us."

I am so annoyed by this. I paid them $200 for a "lifetime" hosting account a little over a year ago and I also pay for a dedicated IP. Now they want me to pay them an additional $34.95 per month if I want my site to be hosted on a server that meets basic levels of security.

I will be forced to move my site to a new host because of this. If I do not become PCI compliant, I will be fined by my credit card processor. It is completely ridiculous that Micfo is putting its customers in this position.

[AlMighty]

Hi Lis..

Your account is hosted on a Linux shared hosting server, which hosts multiple sites along with yours. It's not possible to upgrade the PHP version for a single account.. & the only method is to upgrade it for the entire server. PHP 5.2.9 is the latest PHP release which may have unknown bugs still hidden & may cause unnecessary problems for the rest of the accounts hosted on the same server..

You were suggested to upgrade your account to a VPS/SD as doing so you'd get complete root access to your own server keeping your data & settings to yourself. Anything you need can be installed either by us or by your own..hence complete freedom. But yes, there's a price included in this upgrade process.

The upgrade would consist in moving your entire account from the shared server to your private server, where you'd have the complete liberty to install any application & of any release/version..

Let us know how you'd like to proceed with this..

[GhostRider2110]

In the first place, you should not be doing any kind of serious e-commerce on a shared hosting account. Only way I will do do that is if my site does not handle ANY CC processing. Let 3rd party like paypal or someone do it. I don't want the risk. A VPS is better but not 100%. Dedicate server is really the only way you should go if you are going to accept CC's directly and process.

And as SecurityAdvisor has stated, upgrading the server to a new, bleeding edge version of PHP is a disaster waiting to happen if not handled properly. And that is testing and lots of notification to the all the users on the server to they can research application currently running to make sure they will not break or if so, can be fixed.

--Mitch