Obviously you failed read a post stating, "Doesnt woo use the Rest API"

It does not matter the commerce package. Without a dissertation on PCI compliance and approval which I was attempting to avoid.

I looked at Woo's explanation of PCI compliance and what they say is right. But they left some things out. PCI compliance means the database server is behind the applications server. PCI compliance means FTP is not accessible at all. It stores 4 digits of data in the WP database. It should be storing none in the front end WP DB.

The explanation of security and PCI compliance is about the smallest I think I have ever saw.

I just did a search through First Data's PDF and in search results found this as well:

http://cart66.com/blog/woocommerce-vs-cart66/

Never heard of the place. But from a brief browse its an interesting read.

Here is a link to PCI Compliance documents: https://www.pcisecuritystandards.org/security_standards/documents.php

There is also a list of verified PCI compliant apps.

Again, I've never used it, never looked at its code. Apparently they just had a security matter few weeks back but I didnt read the article.

We've always put all information on a DB server behind a firewall when it comes to commerce, just a no brainer and thats dedicated hosting. We wont use a shared host and set up a client with eCommerce on it. I dont know how many eCommerce sites we've done, perhaps 80 - 100 since 2000.

Your description of "rampage" is rather ridiculous. I point out the obvious. Wordpress is insecure by nature of plugins. When it comes to eCommerce liability is an issue. If an application takes any card data through the application direct it is vulnerable. In other words if My Commerce application takes card data on its front end (.vs. a backend server) it is vulnerable. Its not specific to Woo or any other. Ecommerce in shared server environments can be vulnerable through the provider security. Many use a shared certificate, this is a way "around" compliance.

Contrary to apparently your beliefs, Woo or this CMS Commerce App or that one are not the best choices on the planet, not due to them, due to the nature of open CMS code.

People are entering private data into a website. Where security holes exist in Wordpress are areas where a hacker can leverage many things. Even have a consumer think they are on the secure platform yet the form they and entering data into is not.

Again, dont believe it? Call the folks who set the standards in PCI compliance. Go right to the source.

Just because there are millions of installs doesnt mean tomorrow it doesnt hit the fan per se.

First Data a leading provider in back end card processing services has been hit BIG twice as an example.

How is it ANY WAY responsible to set up eCommerce atop a platform (wordpress) that is well known as sorta a poster boy for security matters?

Especially when solutions do exist that are focused completely on the task at hand, commerce. Its all they do.