Online stores are attractive targets. They process payment data, store customer information and often run many third-party scripts and extensions. A single weak point can lead to card skimming (also called Magecart attacks), stolen customer data, fraud and lost trust.
This checklist covers what every store owner should have in place, whether you run WooCommerce, Magento, Shopify or a custom platform.
1. Keep the whole stack updated
- Platform: WordPress/WooCommerce, Magento/Adobe Commerce, or your framework
- Extensions, plugins and themes
- Runtime: PHP, Node.js, database, web server. Runtime vulnerabilities like PHP2Shell affect every application on top
- Operating system
Set a fixed patch routine and an emergency process for critical issues.
2. Secure admin access
- Two-factor authentication for every admin account
- Unique accounts per person, no shared logins
- Remove old accounts immediately when someone leaves
- Restrict admin access by IP or VPN where possible
- Use a non-default admin URL on Magento
- Give the minimum role needed (shop manager instead of administrator)
3. Protect payment pages
Most stores use a payment provider (hosted payment page, embedded fields or redirect), which reduces what you handle. But attackers can still inject JavaScript into your checkout to steal card data before it reaches the provider, or to show a fake payment form.
PCI DSS 4.0 added requirements for payment page scripts. Requirements 6.4.3 and 11.6.1 became mandatory on 31 March 2025:
- 6.4.3: keep an inventory of all scripts on payment pages, confirm each is authorised and ensure their integrity
- 11.6.1: detect unauthorised changes to payment page content and HTTP headers
Practical steps:
- List every script on cart and checkout pages, remove what is not needed
- Use a Content Security Policy (CSP) to restrict where scripts can load from
- Monitor checkout pages for changes
- Load as few third-party tags as possible on checkout (no heatmaps or chat widgets there if you can avoid it)
Check with your payment provider and acquirer which PCI DSS validation applies to your store.
4. Control third-party scripts and extensions
- Only install extensions from trusted vendors
- Never use nulled (pirated) themes or plugins. They often contain backdoors
- Review Google Tag Manager access: anyone with publish rights can add scripts to your checkout
- Remove unused tags and pixels
5. Protect customer accounts
- Rate limiting and CAPTCHA on login, registration and password reset to stop credential stuffing
- Strong password rules and optional 2FA for customers
- Notify customers about password and email changes
6. Fraud prevention
- Use your payment provider’s fraud tools and 3-D Secure
- Watch for card testing (many small failed payments)
- Rate limit checkout and add-to-cart endpoints
7. Secure the server and hosting
Firewall, SSH keys, isolated PHP pools, no public databases. See my Linux server hardening checklist.
8. Web application firewall and bot protection
A WAF at the CDN or host level blocks many automated attacks and gives you a place to apply emergency rules when a new vulnerability appears.
9. Monitoring
- File integrity monitoring (new PHP files, changed core files)
- Checkout page change monitoring
- Admin login alerts
- Uptime and error rate monitoring
- Search Console security issues
10. Backups
Off-site, versioned, tested. See my backup strategy guide.
11. Privacy and data minimisation
- Store only the customer data you need
- Delete old data according to a retention policy
- Know where customer data is processed (hosting, email platform, analytics, support tools)
12. Incident response plan
Write down before anything happens:
- Who to call (developer, host, payment provider)
- How to put the store in maintenance mode
- How to preserve logs and evidence
- Legal obligations (for example GDPR data breach notification within 72 hours to the supervisory authority where required)
- How to communicate with customers
Signs your store may be compromised
- Customers report fraud after buying from you
- Your payment provider or bank contacts you about a “common point of purchase”
- Unknown JavaScript on checkout pages
- New admin users or changed payment settings
- Unknown files on the server
If you see these, act quickly and get professional help. My hacked WordPress guide shows the cleanup process.
Platform notes
- Shopify: the platform handles server and checkout security; you are responsible for apps, staff accounts and theme scripts
- WooCommerce: you are responsible for hosting, WordPress, plugins and server security
- Magento / Adobe Commerce: apply security patches quickly; Magento stores are frequent targets of skimming attacks
Frequently asked questions
Is my store PCI compliant if I use a payment provider?
Using a provider reduces your scope, but you still have responsibilities, especially for the pages that load or redirect to the payment form. Ask your provider which self-assessment questionnaire applies.
Do I need a security plugin?
It can help with monitoring and firewall rules, but it does not replace updates, good access control and server security.
How often should I do a security review?
At least yearly, and after major changes such as a new checkout, platform upgrade or new payment method.
Want a security review of your store?
I review and harden online stores and their servers, from admin access and checkout scripts to patching and monitoring. See my servers and backups service or request a security review.