Think in layers
No single measure protects a store. Good security stacks several modest protections so that one failure does not become a disaster: if a password leaks, a second verification step stops the login; if an attacker still gets in, limited permissions restrict the damage; if damage happens anyway, a backup lets you recover. This checklist is organized around that idea. You do not have to do everything in one day, so start at the top and work down.
1. Keep everything updated
Outdated software is a leading cause of compromised sites. Updates often include fixes for known flaws that attackers actively look for.
- Update your store platform, theme, plugins, apps and any scripts you added.
- Turn on automatic updates where they are reliable, and review major updates before applying them.
- Remove plugins, apps and themes you no longer use. Unused code still needs patching and still presents a possible way in.
- Be selective about what you install. Prefer well-maintained tools with recent updates, clear support and a reasonable history of fixing problems.
Owners of self-hosted stores should also keep the server environment current or confirm that their hosting company does. With a hosted store builder, much of this is handled for you, but themes and add-ons usually remain your responsibility.
2. Use strong, unique passwords
- Use a password manager to create long, random passwords for each account.
- Never reuse a password across your store, email, hosting, domain registrar and payment accounts.
- Change a password right away if you suspect it was exposed.
- Avoid sharing logins. Give each person their own account so activity can be traced and access removed individually.
3. Add a second verification step
Two-factor authentication means a stolen password is not enough to log in. Turn it on for your store admin, email, payment provider, domain registrar and hosting. App-based codes or hardware keys are generally considered stronger than text messages, though any second step is better than none. Save your recovery codes somewhere safe and offline.
4. Limit permissions
Apply the principle of least privilege: each person and each connected app should have only the access needed for the job.
- Give staff and contractors limited roles instead of full administrator rights.
- Review the user list on a regular schedule and remove former team members immediately.
- Check which third-party apps are connected to your store and revoke the ones you do not use.
- Keep one or two trusted people as owners, and make sure someone besides you can recover access in an emergency.
5. Back up and test the restore
A backup that has never been restored is an assumption. Keep copies of your store data, product catalog, orders and any custom files, stored separately from the system they protect. Decide how often to back up based on how much recent data you could afford to lose. A store taking orders all day needs more frequent copies than one that updates weekly. Then try a restore at least once so you know how long it takes and what is missing. Store backups and recovery planning are worth treating as a topic of their own.
6. Secure the connection
Make sure the whole site is served over HTTPS, not only the checkout. This encrypts data traveling between your customers and your store, and browsers warn visitors away from sites that lack it. Renew certificates before they expire, and check that no pages load mixed insecure content.
7. Protect the checkout and customer data
- Use a payment provider that handles card details through hosted or embedded fields so numbers do not pass through your own systems. Basic payment security is covered more fully elsewhere, and PCI compliance expectations depend on how you accept cards.
- Do not store card numbers or security codes yourself.
- Collect only the personal data you need, and delete what you no longer need.
- Never accept card details by email, chat or phone notes.
8. Watch for trouble
Prevention is not enough without noticing problems early.
- Turn on notifications for new admin logins, password changes, new staff accounts and changes to payout details.
- Watch for unusual order patterns: sudden spikes, many small failed payments, or lots of orders with mismatched details. Order screening and a sensible response to card testing are useful here.
- Review your payment provider’s dashboard for disputes and unusual activity. Ecommerce fraud and chargeback disputes are easier to manage when caught early.
- Check your site occasionally as a visitor would, looking for pages, links or pop-ups you did not create.
9. Train yourself and your team
People are often the weakest link, but also the easiest to improve. Teach everyone with access to recognize phishing scams, to verify unexpected requests by a separate channel, and to report anything odd without fear of blame. Be skeptical of messages that create urgency, particularly those about payments, account suspensions or changed bank details.
10. Write down a response plan
A short document can save hours in a crisis. Include who to contact at your platform and payment provider, how to reset key passwords, where backups live, and how to tell customers if their data may have been affected. Legal duties after a data incident vary by place, so check the rules that apply to you or ask a professional.
A simple review routine
- Weekly: check notifications, recent orders and any pending updates.
- Monthly: review users and connected apps, apply updates, and glance at your payment dashboard.
- Quarterly: test a restore, review permissions and read through your response plan.
- Yearly: rotate important credentials where appropriate, remove unused tools and review your payment setup.
Security never reaches a finished state, but a short, regular routine keeps the most common risks under control without turning into a second job.