If your WooCommerce store has been hacked, assume card details may be at risk until you know otherwise. Take the checkout offline, keep a copy of the infected site, change every password and call your payment provider the same day. Then clean the site properly, because card skimmers hide in places a quick scan misses, and they come back if the way in stays open.
Key takeaways
- Card skimmers copy what shoppers type at checkout and send it to the attacker. Shoppers usually notice nothing.
- Hosted card fields from Stripe or similar reduce the risk, but a hacked site can still show a fake card form.
- The first sign is often customers reporting fraud on cards they used in your store.
- Your payment provider, your customers and possibly the OAIC need to hear from you. Don’t wipe the site before you have a copy.
How does a card skimmer work on a WooCommerce store?
A card skimmer is malicious code added to an online store to capture payment details at checkout. The PCI Security Standards Council describes “Magecart” as an umbrella term for several criminal groups that run these attacks. It lists the usual ways in as vulnerable plugins, password-guessing and phishing (PCI Security Standards Council).
Skimmers come in two broad types:
- Browser skimmers. A script on the checkout page reads what the shopper types and sends it to another server.
- Fake checkout forms. Extra card fields appear where they shouldn’t. In one case Sucuri found code hidden in a snippets plugin’s database setting. It added card fields to the WooCommerce billing form, switched off browser autofill and sent everything entered to an outside site (Sucuri).
That second type is why “we use Stripe” isn’t a full defence. Hosted card fields keep card numbers off your server, but if attackers can change your site, they can put their own form in front of the real one. Our guide to ecommerce website security covers how to make that harder.
What are the signs of a hacked WooCommerce store?
- Customers tell you their card was used fraudulently soon after buying from you.
- Your bank or payment provider contacts you about a possible “common point of purchase”.
- Card fields appear on the billing step, or twice at checkout.
- Shoppers report a payment “failing” once, then working on the second try.
- The checkout looks slightly different from usual, or loads a script from a domain you don’t recognise.
- New admin users, unfamiliar plugins or code you didn’t add in a snippets plugin.
- Your security plugin, host or Google flags malware.
Any one of these deserves a proper look. Two together is enough to act as if the store is compromised.
What should I do in the first few hours?
- Stop taking card payments on the site. Put the store in maintenance mode or switch off the payment methods. Every order placed now could be skimmed.
- Keep a copy before changing anything. Take a full backup of the infected files and database. You, your payment provider or an investigator may need it as evidence.
- Write down what you know. When you noticed, what you saw, and any recent plugin or theme changes.
- Change every password. WordPress admin users, hosting control panel, FTP or SFTP, the database and your payment gateway account. Change them again once the site is clean.
- Call your payment provider. Tell Stripe, PayPal, Square or your bank what’s happened and follow their instructions.
- Get the clean-up started. A professional hacked website repair service should find the skimmer, every backdoor and the way in.
If your host has already taken the site offline, our guide for when your website suspended for malware walks through getting it back.
Who do I need to notify after a card skimming attack?
| Who | Why |
|---|---|
| Your payment provider or bank | They need to protect affected cards and may have their own requirements for investigation. |
| Affected customers | So they can watch their statements and cancel cards. Tell them plainly what happened and when. |
| The OAIC, if the scheme covers you | The Notifiable Data Breaches scheme applies to businesses with turnover over $3 million and some others. |
| ReportCyber | Report the crime at cyber.gov.au/report or on 1300 CYBER1 (1300 292 371). |
| Your insurer | Many policies have notice requirements, so check yours early. |
Under the Notifiable Data Breaches scheme, a covered business must assess a suspected breach within 30 days and notify serious-harm breaches “as soon as practicable” (OAIC). Stolen card details are the kind of data that can cause real financial harm, so get advice early. Many small stores fall under the $3 million threshold. Telling customers is still the right thing to do, and it protects your reputation better than silence.
The ASD received over 84,700 cybercrime reports in 2024–25, and the average reported cost for a small business was $56,600 (ASD Annual Cyber Threat Report). Acting fast keeps your own costs down.
How do I clean up a hacked WooCommerce store?
The clean-up follows the same principles as any hacked WordPress site, with extra care around checkout:
- Check where skimmers hide. Theme files, plugin folders, snippets plugins, and settings stored in the database. Replace WordPress, WooCommerce, your theme and plugins with fresh copies.
- Remove rogue users and backdoors. Delete admin accounts you didn’t create, and anything that could let the attacker back in.
- Find the entry point. Update or remove the vulnerable plugin. Patchstack found 91% of new WordPress vulnerabilities in 2025 were in plugins (Patchstack).
- Review checkout scripts. Remove any third-party script on checkout that you can’t explain or don’t need.
- Test a real order. Place an order, check the card form is the gateway’s own, and view the page source for unknown domains.
Skipping any of these is the usual reason a website keeps getting hacked after a clean-up. For blocklist warnings and Google review requests, see our website hacked recovery guide.
How do I stop it happening again?
Keep plugins updated, and test checkout after each round of updates. Use two-factor login for every admin account. Scan for malware daily and alert on file changes. Keep checkout scripts to the minimum.
Hosting matters too. Secure web hosting with account isolation and a server firewall stops many attacks before they reach WordPress. Our website maintenance plans add checkout and payment gateway checks on Elite, with “hack-free or we fix it free” on every plan.
Frequently asked questions
Can my WooCommerce store be skimmed if I use Stripe?
Yes. Hosted card fields keep card numbers off your server, but if attackers can edit your site, they can add a fake card form or a script that runs before the real one. Your website’s security is part of your payment security.
How do I know if customers’ cards were stolen?
You often find out from customers or your payment provider first. A security specialist can check when the skimmer was added, using file dates, logs and backups. That tells you which orders fall inside the risk window.
Do I have to report a card skimming attack in Australia?
If you’re covered by the Notifiable Data Breaches scheme, you may have to notify the OAIC and affected customers. Your payment provider will also expect to hear from you. Even if neither applies, reporting to ReportCyber and telling customers is good practice.
Should I delete the hacked site and start again?
Not before taking a full copy. That copy is evidence, and it shows how long the skimmer was active. Rebuilding is rarely needed. Replacing core files and plugins with clean copies and cleaning the database usually does the job.
How long should the checkout stay offline?
Until the skimmer, backdoors and entry point are dealt with and a test order shows a clean checkout. For most small stores that’s hours to a couple of days, depending on how deep the infection goes.
Sources
- The threat of online skimming to payment security, PCI Security Standards Council, 1 August 2019
- Server-side credit card skimmer lodged in obscure plugin, Sucuri, May 2024
- Quick reference guide for responding to data breaches, OAIC
- Annual Cyber Threat Report 2024–25, Australian Signals Directorate, October 2025
- State of WordPress Security in 2026, Patchstack