Cybersecurity for e-commerce stores: A small shop checklist

An online store is a website, a payment system and an email sender all at once. Each of those can be attacked, and each has a few settings that do most of the protecting.

This guide covers the basics for small stores on Shopify, WooCommerce, Squarespace, Wix and similar platforms.

Why are online stores a target?

Stores have things criminals want: a checkout that can test stolen cards, admin accounts that control payouts and customer lists, and an email reputation they can borrow. Small stores are attractive because they often have one owner managing everything and several apps added over the years.

Your next step: list everyone with admin or staff access to your store, payment dashboard and domain registrar.

How do I keep card data off my site?

The simplest protection is a hosted checkout, where your platform or payment provider collects card details on its own payment page or embedded form. Shopify Checkout, Stripe Checkout and similar options work this way.

That matters for PCI DSS, the card industry's security standard, which the PCI Security Standards Council says applies to every business that accepts cards. When card details never touch your site, far less of it applies to you.

• Use your platform's hosted or embedded checkout rather than building your own card form.
• Don't ask customers to email or message card numbers, and don't store them in notes or spreadsheets.
• Ask your payment provider or acquirer which self-assessment questionnaire applies to you.

How do I protect admin and staff accounts?

Whoever controls your store admin controls your payouts, prices, customer list and checkout settings.

• Turn on two-step sign-in (MFA) for the store owner and every staff account. Use an authenticator app rather than text messages where you can.
• Give staff only the permissions they need. Someone packing orders doesn't need access to payouts or apps.
• Remove staff and freelancer accounts as soon as the work ends.
• Protect the accounts around your store, too: your payment dashboard, domain registrar and the email address that receives password resets.

Which apps, plugins and scripts should I keep?

Every app, plugin, theme and tracking script can read or change parts of your store. Each one is a supplier you're trusting.

• Remove apps and plugins you no longer use, including ones you only tried once.
• Keep your platform, theme and plugins updated. On WordPress, turn on automatic updates where you can.
• Before adding a new app, check who makes it, how recently it was updated, and what access it asks for.
• Be especially careful with anything that runs on the checkout or payment pages.

For platform-specific steps, see the Shopify security checklist or the WordPress security checklist. Security headers can also limit which scripts are allowed to run on your site. Check yours with the free security headers checker.

How do I spot and stop card testing?

Card testing is when criminals run stolen card numbers through your checkout to see which ones work. Stripe's card testing guide lists the usual signs:

• A sudden spike in failed or declined payments.
• Many small orders, often with nonsense names and email addresses.

Card testing leads to disputes, fees and a worse reputation with card issuers, which can mean more declines for real customers. If you see the signs, refund the suspicious payments that succeeded, turn on your platform's fraud or bot protection, and contact your payment provider. Stripe notes that its recommended checkout integrations include built-in card testing protection.

How do I make sure order emails arrive?

Order confirmations, shipping updates and receipts are part of your customer experience. If they land in spam, customers contact support or dispute the charge.

• Publish SPF and DKIM for every service that sends email as your store, including your platform, email marketing tool and help desk.
• Add a DMARC record. Google's email sender guidelines require SPF, DKIM and DMARC from bulk senders, and DMARC makes it harder for criminals to send fake order or refund emails in your name.
• Start with a monitoring policy and tighten it once every service passes. Our free DMARC record generator walks you through it.

Check your store's website and email

Run a free outside-in check of your store's HTTPS, certificate, security headers and email records. It doesn't log in to your store or touch your checkout.

• Free check
• No signup
• No changes to your website

Get your free report in seconds.

Your website address

Check my website

What's on an e-commerce security checklist?

What should you do next?

Start with the steps that protect your payouts and your checkout.

1. Run the free website security scan to check your store's HTTPS, headers and email records.
2. Turn on two-step sign-in for every admin and staff account.
3. Remove one app or plugin you no longer use.
4. Ask your payment provider which PCI questionnaire applies to you.