I'm not sure about the UK but in the US the major credit card companies are requiring merchants to pay for quarterly security scans on their site in order to st

I'm not sure about the UK but in the US the major credit card companies are requiring merchants to pay for quarterly security scans on their site in order to stay PCI compliant. Personally, I think PCI is racket designed to collect more money while deferring losses to merchants but in the US it is another thing to think about when accepting payment. If you go with an off-site processor (like paypal express) you don't need to worry about PCI compliance because the card is not actually handled by your web app.