Good ecommerce website security comes down to layers. Let your payment gateway handle card numbers, watch your checkout page for injected code, lock down admin and customer logins, and block bots that test stolen cards. No single plugin does all of that, so this guide walks a WooCommerce store owner through each layer in plain English.
Key takeaways
- Hosted card fields from Stripe or PayPal keep card numbers off your server, but a hacked site can still add fake card fields of its own.
- Most store break-ins start with an out-of-date plugin or a stolen admin password.
- Two-factor login for every admin and shop manager is the cheapest big win.
- A sudden pile of failed orders usually means bots are testing stolen cards on your checkout.
- Keep less customer data, and you have less to lose.
What are the main security threats to an online store?
A brochure website that gets hacked is embarrassing. A shop that gets hacked can hurt your customers directly. Four threats come up again and again on WooCommerce stores:
- Card skimming: malicious code on the checkout page copies card details as customers type them.
- Account takeover: attackers guess or reuse passwords to get into admin or customer accounts.
- Card testing: bots run stolen card numbers through your checkout to find the ones that still work.
- Data theft: names, addresses, phone numbers and order histories are copied from your database.
The ABS found that 21% of Australian businesses had a cyber security incident in 2024–25 (ABS). Online stores are attractive because the payoff is immediate.
If I use Stripe or PayPal, is card data already safe?
Mostly, but not completely. Modern WooCommerce gateways use hosted card fields. The card number goes from the customer’s browser straight to the processor, never through your server. Stripe describes these low-risk integrations as reducing your PCI obligations, because card data doesn’t pass through your servers (Stripe).
The weak point is the page around those fields. If someone can change your site’s code, they can add their own fake card form. In May 2024 Sucuri found exactly that on a WooCommerce store. Code hidden in a small snippets plugin added extra card fields to the billing form and sent everything typed into them to a third-party domain (Sucuri).
The card industry has noticed. Since April 2025, under PCI DSS v4.0.1, merchants with embedded payment forms who use the simplest self-assessment (SAQ A) must confirm their site isn’t open to script attacks (PCI Security Standards Council). In other words, the security of your website is part of your payment security.
What are the layers of ecommerce security?
Think of your store as a building with several locks. If one fails, the next one still stops most attacks.
How do card skimmers get onto a WooCommerce site?
Usually through a plugin. Patchstack recorded 11,334 new WordPress vulnerabilities in 2025, and 91% were in plugins. The most heavily exploited flaws were attacked at scale within a median of five hours of disclosure (Patchstack). A store running 30 or 40 plugins has a lot of doors to keep shut.
The other common route is a stolen admin password. Once inside, an attacker can edit theme files, install a “helper” plugin or paste code into a snippets tool. None of it shows on the shop front.
What helps:
- Update plugins promptly, and test checkout after each round. Our guide to a safe WooCommerce update shows how.
- Delete plugins you no longer use, rather than just deactivating them.
- Run server-side malware scans and file-change alerts. Skimmers often hide in PHP that an outside scan can’t see.
- Keep third-party scripts on the checkout page to a minimum. Stripe notes that every outside script makes your security depend on someone else’s.
How do I protect admin and customer accounts?
Password attacks never stop. Wordfence blocked more than 55 billion of them against WordPress sites in 2024 (Wordfence). Most are bots trying leaked passwords from other websites.
Staff and admin logins
- Turn on two-factor login for every administrator and shop manager.
- Give staff the Shop Manager role, not Administrator, unless they truly need it.
- Remove accounts for people who have left, including old developers.
- Use a password manager so every login is long and unique.
Customer logins
- Limit failed login attempts and put a firewall in front of the login page.
- Watch for bursts of new accounts, password resets or changed email addresses.
- Only offer saved cards if customers really use them. Saved payment methods are another thing to attack.
How do I stop card testing attacks?
Card testing is when fraudsters push many small orders through your checkout, each with a different stolen card, to see which ones work. WooCommerce says a large increase in orders marked Failed is a common sign (WooCommerce). The failed orders aren’t lost sales, but the attack can bring fees, chargebacks and trouble with your payment provider.
WooCommerce suggests these defences:
- Add bot protection such as a CAPTCHA or Cloudflare Turnstile to checkout.
- Avoid donation or pay-what-you-want products with no minimum amount.
- Consider turning off guest checkout during an attack.
- Ask your payment provider to tighten its fraud settings, and refund any fraudulent orders that went through.
If orders suddenly stop instead, that’s a different problem. Our guide to a WooCommerce checkout not working helps you tell a fault from normal abandoned carts.
How much customer data should an online store keep?
As little as you need. Every old order, guest record and exported spreadsheet is something that could leak. The OAIC received 1,205 notifiable data breach reports in 2025, the most since the scheme began, and 59% came from malicious or criminal attacks (OAIC).
- Never store full card numbers. Your gateway should be the only place they exist.
- Don’t ask for date of birth or other details unless the sale requires them.
- Delete old customer exports from laptops, email and shared drives.
- Know who you’d call, and what you’d tell customers, if data did leak.
What should a store owner check each month?
Security is a routine, not a one-off setup. A short monthly check catches most problems early:
- Update and test. Apply plugin, theme and WooCommerce updates, then place a real test order.
- Review users. Remove old admin and shop manager accounts, and confirm two-factor login is on.
- Read the failed orders. A spike in failures or tiny orders points to card testing.
- Check the scan reports. Look for new files, changed checkout templates or unknown plugins.
- Confirm a recent backup. Make sure it’s stored off the server and that you know how to restore it.
Our WooCommerce maintenance checklist sets out the weekly, monthly and quarterly tasks in full. Hosting matters too: WooCommerce hosting with account isolation and server-level scanning closes gaps a plugin can’t. If you’d rather not run the routine yourself, our WooCommerce maintenance service handles updates, scans and checkout testing for you, and our website maintenance plans include hack-free cover.
Frequently asked questions
Is WooCommerce secure enough for an online store?
Yes, when it’s maintained. WooCommerce itself is widely used and actively patched. Most problems come from out-of-date plugins, weak admin passwords and missing monitoring, not from WooCommerce core. A well-kept store with two-factor login, updates and scanning is a hard target.
Do I need to be PCI compliant if I use Stripe?
Yes. Anyone who accepts card payments must comply with PCI DSS, but hosted card fields make it much simpler. Most small stores complete a short self-assessment. Your payment provider or bank can confirm which questionnaire applies to you.
Does an SSL certificate make my store secure?
It’s essential, but it only encrypts data travelling between the customer and your site. It doesn’t stop a hacked plugin from adding a skimmer to the page. Think of SSL as one layer among several.
How would I know if my checkout has a card skimmer?
Often you won’t, until customers report fraud on their cards. Warning signs include extra card fields on the billing page, unknown plugins or admin users, and files that changed without an update. Server-side scans and file-change alerts are the reliable way to catch it.
Should I turn off customer accounts to stay safe?
Not necessarily. Accounts help repeat customers. Protect them with login limits, a firewall and alerts on unusual activity, and only keep saved payment methods if customers use them. Guest checkout is fine to keep, though you can pause it during a card testing attack.
Sources
- Characteristics of Australian Business, 2024–25, Australian Bureau of Statistics, June 2026
- Integration security guide, Stripe
- Server-side credit card skimmer lodged in obscure plugin, Sucuri, May 2024
- FAQ clarifies new SAQ A eligibility criteria for e-commerce merchants, PCI Security Standards Council, February 2025
- State of WordPress Security in 2026, Patchstack
- 2024 Annual WordPress Security Report, Wordfence, April 2025
- How do I prevent and respond to card testing attacks?, WooCommerce
- Data breach notifications increase to all-time high in 2025, OAIC