How do you keep a WooCommerce shop secure?

Where shop break-ins usually come from

It is tempting to think of security as a product you install. In practice, small WooCommerce shops are mostly compromised through a handful of ordinary gaps:

• a plugin or theme with a known vulnerability that was never updated
• an administrator account with a reused or guessable password
• old accounts belonging to a former developer, freelancer or staff member
• nulled or pirated premium plugins, which often arrive with hidden code
• a hosting account or email inbox that, once taken over, gives access to everything else

Attacks are almost always automated. Bots scan huge numbers of sites for the same weaknesses, so a shop is not too small to be a target. The good news is that the same few habits protect against most of it.

Updates: the single most important habit

WordPress core, WooCommerce, your theme and every plugin receive security fixes. Once a fix is published, the weakness it repairs becomes public knowledge, and unpatched sites are then scanned for it. Keeping up to date is therefore not optional for a shop that takes payments.

1. Know what you run. Keep a short list of every plugin and theme and where its licence and updates come from.
2. Remove what you do not use. A deactivated plugin can still contain vulnerable files. Delete it.
3. Update on a schedule. At minimum weekly, and promptly when a security release is announced.
4. Test bigger updates. Major WooCommerce releases can affect checkout and payment plugins. Use a staging copy if you have one, or update at a quiet time and place a test order straight after.
5. Avoid abandoned plugins. If a plugin has not been updated in a long time or has been removed from the official directory, look for a maintained alternative.
6. Keep PHP current. Old PHP versions stop receiving security fixes. Your host should be running a supported version.

Only buy premium plugins and themes from the developer or an official marketplace. A "free" copy of a paid plugin from an unofficial download site is one of the most common ways malware gets into WordPress.

Admin accounts and logins

Your WordPress dashboard controls products, prices, customer data and payment settings. Treat access to it with the same care as a bank login.

Account hygiene

• Give every person their own account. Never share one administrator login between staff or with a developer.
• Use the lowest role that does the job. WooCommerce adds a Shop manager role, which can manage orders and products without being able to install plugins or change core settings.
• Remove accounts as soon as someone leaves or a project finishes. Review the user list every few months.
• Do not use "admin" or your shop name as an administrator username.

Passwords and two-factor authentication

Use long, unique passwords stored in a password manager, and switch on two-factor authentication for every account with admin or shop manager access. Several reputable security plugins add two-factor login, and most also limit repeated failed login attempts, which stops bots guessing passwords endlessly. The same advice applies to your hosting control panel, your domain registrar, your payment provider dashboard and the email inbox used for password resets. If someone can take over that inbox, they can reset everything else.

Payments: keep card data off your server

The safest approach for a small shop is never to handle card numbers yourself. Mainstream payment gateways for WooCommerce either take the customer to a hosted payment page or collect card details in a secure field supplied by the payment provider, so card data goes straight to them. This greatly reduces what you are responsible for under the card industry's security rules, known as PCI DSS, although you still have obligations. Ask your payment provider which self-assessment applies to your setup.

Practical points:

• Use a well known, actively maintained gateway plugin, ideally the one published by the payment provider itself.
• Make sure the whole site runs on HTTPS, not just the checkout.
• Protect the payment provider account with two-factor authentication and limit who can issue refunds.
• Watch for unusual patterns: many small failed payments in a row can mean someone is testing stolen cards through your checkout. Your gateway may offer fraud rules or a challenge step to slow this down.

Our guide to WooCommerce payment options in the UK compares the common gateways.

Backups you can actually restore

A backup is only useful if it is recent, stored somewhere separate from the site and known to work. For a shop, "recent" matters more than for a brochure site, because every day contains orders and customer accounts you cannot recreate.

• Back up both the files and the database.
• Keep copies off the server, so a hacked or failed server does not take the backups with it.
• Keep several versions going back in time. Infections are sometimes discovered weeks later.
• Test a restore at least once, onto a staging copy, so you know how long it takes and that it works.
• Take a manual backup before any major update or change.

Personal data and the wider picture

Customer names, addresses, order histories and emails are personal data under UK data protection law. Collect only what you need, delete test and spam accounts, and make sure staff and contractors only see what they must. If you suffer a breach involving personal data, there may be a legal duty to report it. The Information Commissioner's Office (ico.org.uk) explains when and how, so read their guidance or speak to an adviser about your situation. Our UK ecommerce legal checklist covers the other rules a shop needs to follow.

If you think you have been hacked

Signs include unfamiliar admin users, redirects to other sites, spam pages appearing in search results, warnings from your browser or payment provider, or customers reporting strange emails. If you see these:

1. Put the shop into maintenance mode if customers could be harmed.
2. Change every password: WordPress, hosting, database, email and payment provider.
3. Contact your host, who may be able to identify the entry point and restore a clean backup.
4. Restore from a backup taken before the infection, then update everything immediately so the same hole is not used again.
5. Review admin users and remove anything you do not recognise.
6. Consider whether personal data was exposed and whether you need to notify the ICO or customers.

Much of this checklist is routine maintenance that is easy to let slip in a busy month. Shop Start at Retail Web Hosting includes automatic WordPress, WooCommerce and plugin updates, regular backups and SSL, with hosting faults fixed by us, so the most important habits happen whether or not you remember them. Your own part, strong logins and tidy user accounts, still matters just as much.

Frequently asked