WooCommerce Security Checklist for Store Owners

A shop is different from a blog. If a blog goes down, you lose some readers. If a shop goes down, you lose sales, customer trust and sometimes your payment account. That is why a WooCommerce security checklist deserves its own page.

You do not need to be technical to work through this one. Each item is a decision or a setting, in an order that puts the biggest risks first. Some items need an expert or your host, and we will say so.

Why a WooCommerce Security Checklist Matters

Attackers like shops for three reasons. Stores hold customer details, so there is something to steal. Stores take money, so there is something to abuse. And stores run many plugins, such as payments, shipping, memberships and marketing tools, so there is a lot of code that might have a flaw.

None of that means your store will be attacked tomorrow. It means the cost of a lapse is higher, so the sensible thing is to close the common doors. This WooCommerce security checklist does that.

1. Keep Card Data Off Your Site: Payments and PCI

The single best security decision a store owner makes is to never handle card numbers at all. Use a payment gateway that collects the card on its own hosted page, or inside its own secure fields on your checkout, so the number goes from the customer to the gateway without touching your server.

The official WooCommerce guide on PCI DSS compliance is clear about this. It says gateways that process payments off-site or through hosted fields, such as Stripe, PayPal or WooPayments, mean your site does not directly handle raw card data. It also says the core WooCommerce plugin is not PCI certified, because it does not handle card data itself.

PCI in Plain Words

PCI DSS is a set of security rules for anyone who accepts card payments. The PCI Security Standards Council develops the standard, and it says it does not enforce compliance. Your payment provider or bank decides how it applies to you.

Here is the useful bit. With a hosted gateway, your scope is smaller. Scope is simply the list of things you must secure and prove. WooCommerce's guide notes that your site still falls within PCI DSS scope because it serves the checkout page, and that compliance is ultimately the store owner's responsibility. It also lists the everyday duties: keep software updated, use HTTPS on checkout and account pages, limit admin access with roles and strong passwords, and log admin activity.

So this part of the WooCommerce security checklist is short:

1. Use a hosted gateway or hosted card fields, never a plugin that posts card numbers to your own server.
2. Never store card details in notes, spreadsheets or order fields.
3. Ask your payment provider which self-assessment questionnaire applies to you, and complete it each year.
4. Keep the rest of this checklist in good shape, because much of PCI is about exactly these basics.

Key takeaway: A hosted gateway shrinks your PCI workload. It does not remove it. Your site, your staff accounts and your updates are still your job.

2. Give Staff the Right Shop Roles

Every extra administrator is an extra way in. Most people who help with a shop do not need to change plugins or themes. They need to process orders.

WooCommerce adds a Shop Manager role for this. A shop manager can run the store, see orders and edit products without having the keys to the whole WordPress site. Customers get the Customer role, which has no dashboard access.

A tidy roles routine:

• Give each person their own account. Never share one login.
• Use Shop Manager for people who handle orders and products. Keep Administrator for the one or two people who really manage the site.
• Remove accounts for people who have left, and for old agency or freelancer logins.
• Review the list every few months, and look for accounts nobody recognises.

Our article on WordPress user roles explains what each role can do and how to choose.

3. Turn On Two-Factor for Everyone Who Runs the Shop

A stolen or guessed password is the most common way into a store. Two-factor sign-in adds a second step, such as a code from an authenticator app, so a password alone is not enough.

For a shop, turn it on for administrators and shop managers at least. They can see customer addresses and order details, and they can change prices or payment settings.

With Stack Guard Free, you can use an authenticator app or an email code, keep backup codes for emergencies and require two-factor for administrators. Requiring it by role, which is how you cover shop managers, or for named people is part of Pro. See two-factor authentication for the detail, or our guide to setting it up.

Two-factor stops an attacker with the password, but it does not stop all guessing, so keep brute force protection and a limit on failed sign-ins in place too.

4. Protect Customer Accounts

Many shops let customers register, which gives attackers a new target. A takeover of a shopper's account can expose their address, their order history and any saved details, and your name is on the mess.

Refuse Passwords That Have Already Leaked

Customers reuse passwords across sites. When one site is breached, those passwords end up on lists that attackers try everywhere. A password that appears in a known breach is weak, however complex it looks.

Stack Guard Free can refuse such passwords when someone sets or changes one, on registration, on their profile or through a reset link. It checks the password without sending the password itself anywhere. The check applies when a password is set, so existing passwords stay as they are until they change. The password rules page explains the options, including minimum length and passphrase rules.

Do not make the rules so hard that shoppers abandon registration. A decent minimum length plus the breach check is better than a pile of symbol requirements. Offering guest checkout also reduces how many accounts exist to be attacked.

Add CAPTCHA to Registration and Sign-In

Robots create fake accounts and try stolen passwords on shop login forms. A CAPTCHA is a small test that people pass easily and robots do not.

Stack Guard's CAPTCHA is part of Pro and works with Cloudflare Turnstile or Google reCAPTCHA. On a WooCommerce site it covers the store's login and registration forms, as well as the WordPress sign-in page, password reset and comments. Read how it works in login protection. Whatever you use, open the shop's login page in a private window afterwards to check that real customers can still get in.

5. Card Testing Attacks on Checkout

This one hurts quietly, so it needs plain talk. In a card testing attack, criminals have a list of stolen card numbers and do not know which still work. They use a real store's checkout to try them, often with tiny purchases, because a successful payment tells them the card is live.

The signs are a flood of small orders or failed payments in a short time, odd email addresses, sudden fees from your gateway and sometimes a warning from your payment provider.

An honest note about Stack Guard here: its CAPTCHA does not cover the checkout. It covers the sign-in, registration, password reset and comment forms. If someone tells you a login plugin stops card testing, be sceptical. Stopping it is mainly the job of your payment gateway, which sees the card details and has the best data on what is suspicious.

What to do instead:

1. Turn on the fraud tools in your payment gateway. Most gateways offer rules for blocking risky payments and limits on repeated failed attempts. Their dashboards explain which ones exist.
2. Require accounts or email verification if you can bear the friction, because anonymous guest checkout is what testers love.
3. Watch for the pattern. Check your orders list and gateway dashboard for bursts of failed or tiny payments, and consider email alerts from the gateway.
4. Talk to your host about rate limiting requests to the checkout address, or use a service in front of your site that can do it.
5. Act quickly. If an attack is running, tell your payment provider. They have seen it before.

Stack Guard still helps around the edges. Its firewall lets you ban addresses and ranges, and the login protection tools keep the shop's own sign-in quiet. Just do not treat them as a checkout shield. One caution: if you block countries in WordPress or use firewall rules, add your payment provider's server addresses to the allow list first. Providers confirm orders by calling your site from their own servers, and a rule that blocks those calls leaves paid orders looking unpaid. Stack Guard warns you about this on WooCommerce sites. The WooCommerce page has the details, and you should place a test order after any firewall change.

6. Back Up Before You Update, and Plan for Orders

Backups are the part of any WooCommerce security checklist that people skip, and they matter more for shops, with one wrinkle that other sites do not have.

A site's database holds its orders. When you restore a backup, you bring back the database as it was at the time of that backup. Orders placed after that moment are not in the backup. On a blog, losing an hour of comments is annoying. On a shop, losing an hour of paid orders is a real problem.

So think before you restore:

• Back up before every update of WooCommerce, your payment plugin or your theme. A fresh backup right before means almost nothing is lost if you have to go back.
• Know which parts you are restoring. If the problem is bad code from an update, a files-only restore may fix it without rolling the order records back. Stack Guard lets you choose database and files, database only or files only when you restore, and a restore checks the backup before anything live changes.
• Keep a record of recent orders, for example by email notifications or the gateway's own dashboard, so you can recreate any that a restore removes.
• Pause the shop for the short time a restore takes, if you can.

Stack Guard Free makes full or database-only backups that are verified before they count, restores them with one click, and gives you 7 days to keep the restore or roll back. Backups are manual for now, and schedules are coming soon, so make one by hand before each update. Our guide to restoring WordPress from a backup walks through the process and its traps.

7. The Basics: HTTPS, Updates and Logs

The last three items on the WooCommerce security checklist are the basics every site needs, with a shop twist on each.

Use HTTPS Everywhere

HTTPS encrypts the connection between your customer and your site, so details typed at checkout cannot be read along the way. Browsers also warn people away from shops without it, and WooCommerce's PCI guide lists SSL on checkout and account pages among its basics.

Most hosts include a free certificate now. The common mistakes are mixed content (a page that loads some images or scripts over plain HTTP), an old HTTP address left in the site settings, and a certificate that quietly expires. Set up a redirect so every visit ends up on the secure address. Our guide to forcing HTTPS in WordPress covers that step by step.

Keep Everything Updated

Most hacked stores are not hit by clever new attacks. They are hit by a weakness in an old plugin that already had a fix available. WooCommerce stores usually run more plugins than average, so this matters more.

A routine that keeps the WooCommerce security checklist honest:

1. Update on a quiet day, not Black Friday.
2. Back up first.
3. Update one thing at a time, and place a test order afterwards.
4. Delete plugins and themes you do not use. Deactivated is not deleted.
5. Replace plugins whose authors have stopped maintaining them.

If you can, try updates on a copy of the shop first. Our guide to the WordPress staging site shows how, including the trap of pushing a test database over live orders. For background on why old plugins are the main danger, see WordPress plugin vulnerabilities.

Stack Guard Pro also flags plugins and themes that are several versions behind, which helps you see where to start. It compares version numbers, so it is a prompt to look, not a promise that something is vulnerable.

Keep Logs and Know What Normal Looks Like

When something goes wrong, the first question is "what changed, and who did it?" A log answers it. Without one, you guess.

Stack Guard's activity log records sign-ins, failed attempts, lockouts, user and role changes, password resets and settings changes. Free keeps core events for 7 days, and Pro keeps the full catalogue for 90 days. That helps with the PCI habit of logging admin activity, though it is not a full compliance programme by itself.

Pair the log with email alerts. Free sends lockout alerts, and Pro adds the full alert catalogue and digests, so more of what happens reaches your inbox. Your hosting provider's own logs are worth knowing about as well.

Your One-Page WooCommerce Security Checklist

Copy this list and tick items off as you go:

• A hosted payment gateway, with no card data stored anywhere on the site
• Payment provider's questionnaire completed
• Each staff member has their own account and the lowest role that works
• Old staff and agency accounts removed
• Two-factor on for administrators and shop managers
• Breached-password check on for customers and staff
• CAPTCHA on store sign-in and registration
• Gateway fraud tools switched on for card testing
• Backup made before every update, and a plan for orders placed after it
• HTTPS everywhere, with a working redirect
• Updates applied on a schedule, unused plugins deleted
• Activity log and email alerts switched on

If that feels like a lot, start with three items: two-factor for staff, the right roles and a fresh backup. They take an afternoon and shut the doors attackers use most. The rest can follow week by week.