WooCommerce security: protecting your shop and your customers

A WooCommerce shop is a WordPress site with more to lose. It holds customer names, addresses, order histories and accounts, and its checkout is a page people trust with payment details. Attackers know that, so shops get extra attention.

Everything in my hardening checklist applies to shops too. These are the checks that are specific to WooCommerce.

Keep card details off your server

The safest card number is one your site never sees. Use a payment gateway where the card form is hosted or embedded by the payment provider, such as Stripe or PayPal. The card data goes straight to them, which keeps it out of your database and makes PCI compliance far simpler.

Avoid gateways or custom setups that store card numbers on your server. There's almost never a good reason to.

Watch for skimmers on the checkout

A common attack on shops doesn't break anything visible. It injects a small piece of JavaScript into the checkout that copies whatever customers type and sends it to the attacker. The shop keeps working, orders keep coming in, and nobody notices until customers report fraud.

Things that help:

• File-change monitoring, so you hear about modified theme or plugin files
• Checking which scripts load on the checkout page, and knowing which ones should be there
• Keeping the number of plugins that touch the checkout as small as possible

Stop card testing

Card testing is when bots use your checkout to try stolen card numbers, placing hundreds of small orders to see which cards work. You end up with failed orders, payment-provider fees and sometimes a frozen account.

Signs to look for are lots of failed orders in a short time, often from different names, for small amounts. To defend against it:

• turn on the fraud tools your payment provider offers
• add rate limiting or a CAPTCHA to the checkout
• make sure the provider's webhook and fraud settings are configured, not left at defaults

Give staff the right roles

WooCommerce adds a Shop Manager role. It can manage products and orders but can't install plugins or change core settings. Most people who help run a shop need nothing more. Keep administrator accounts to one or two people, and turn on two-factor authentication for every account that can see orders.

Update carefully, but update

Shops are the sites where people are most afraid to update, and the ones that most need it. WooCommerce, its payment extensions and the theme's WooCommerce templates should all stay current. Test updates on a staging copy first, then update the live shop at a quiet time.

Back up orders more often

A daily backup on a shop can mean a lost day of orders after a restore. Back up the database much more often, ideally in near real time, and keep copies off the server.

Clean up what you don't use

Old payment gateways, abandoned extensions and test plugins are still code on your server. If they're not in use, delete them, including the inactive ones.

If the shop is already compromised

Cleaning a shop means removing the infection without touching products, orders or customer accounts. In the Natalia Wuest art shop cleanup, the catalogue stayed intact and the shop reopened as soon as the site came back.

Running a WooCommerce shop and not sure how exposed it is? Ask me for a free audit.