In this article · 11 sections
Online stores handle orders, addresses, phone numbers and payments, which makes them attractive targets for hackers and fraudsters. A hacked store loses sales, customer trust and sometimes payment gateway access. Use this ecommerce website security checklist to cover the essentials.
1. HTTPS everywhere
- Valid SSL on every page, HTTP redirected to HTTPS
- No mixed content warnings See free vs paid SSL.
2. Keep software updated
- Platform core (WordPress/WooCommerce or your custom code)
- Plugins and themes; remove unused ones
- PHP version. See upgrading PHP safely
3. Lock down admin access
- Unique admin usernames (not "admin")
- Strong passwords stored in a password manager
- Two-factor authentication for all admin accounts
- Limit login attempts
- Separate accounts for each staff member with minimum required permissions
- Remove accounts when staff leave
4. Payment security
- Use a reputable payment gateway so card data never touches your server
- Verify payments server-side via webhooks, never by redirect alone. See UPI payment integration
- Keep gateway API keys secret; never in public code repositories
5. Fraud prevention
- Watch for unusual orders: many orders from one IP, mismatched names and addresses, very high-value first orders
- COD confirmation and limits. See reducing COD returns
- Rate-limit checkout and login forms
- Use bot protection on forms (e.g. Cloudflare Turnstile)
6. Protect customer data
- Collect only what's needed
- Restrict who can view and export customer lists
- Secure exports; don't email customer spreadsheets around
- Privacy policy and data handling aligned with the DPDP Act. See DPDP checklist
7. Backups
- Daily database backups for active stores
- Off-server storage
- Test restores regularly
8. Web application firewall and monitoring
- A WAF from your host or Cloudflare
- Malware scanning
- Uptime monitoring with alerts
- Alerts for new admin users or file changes
9. Secure hosting
- Reputable host, isolated accounts, current server software
- Separate staging site for testing changes. See staging sites
10. Incident plan
Write down what to do if the store is hacked: 1. Put the store in maintenance mode 2. Change all passwords and API keys 3. Restore from a clean backup 4. Find and fix how attackers got in 5. Inform the payment gateway and affected customers if required
See website hacked recovery guide.
FAQs
Is WooCommerce secure?
Yes, when kept updated, with limited plugins, strong admin security and good hosting. Most hacks come from outdated plugins and weak passwords.
How often should I review store security?
Monthly checks of updates, users and backups, with a deeper review every quarter.
Security updates, backups and monitoring are part of Joboo Web's maintenance plans for online stores. Ask us.