E-commerce sites have stricter requirements for PCI DSS, although they have to follow the rules too!

As you can see, any e-commerce merchant processing < 20,000 transactions per year is a Level 4 merchant and must complete the SAQ and a network scan. Any merchant that is processing over 20,000 transactions per year (and less than 1 Million) is a Level 3 merchant (in purple) and was required to be compliant in 2005.