E-commerce Security Checklist for Store Owners

An ecommerce security checklist gives store owners a simple way to confirm the basics are covered: software kept up to date, admin access locked down, payments handled by a compliant provider, hosting hardened and monitored, backups tested and staff trained to spot scams. You do not need to be technical to use it. You need to know which questions to ask, who is responsible for each item and how often it is checked. Most successful attacks on small and mid-sized stores exploit a basic gap rather than a clever new technique.

Why online stores are targets

Attackers go where the value is. An online store holds customer names, addresses, emails, order histories and sometimes payment details. It also has a checkout page that, if compromised, can quietly copy card numbers as customers type them.

Most attacks on stores are automated. Bots scan the internet for known weaknesses in popular platforms and extensions, then try them on every store they find. That means a small store is not safe just because it is small. It also means that closing known gaps quickly stops most attempts before they begin.

The cost of a breach goes well beyond the immediate clean-up:

• lost sales while the store is offline or flagged as unsafe by browsers;
• fines or penalties under data protection laws and from payment providers;
• the cost of investigating, notifying customers and fixing the damage;
• lasting damage to customer trust, which is the hardest thing to rebuild.

Software updates and patching

Out-of-date software is the most common entry point. Every platform, theme, extension and server component has security fixes released from time to time. When a fix is published, attackers study it to learn what the weakness was, then target stores that have not applied it.

• Know what you run. Keep a list of your platform version, every extension and theme, and the server software, with who supplies each one.
• Subscribe to security notices from your platform and extension vendors.
• Apply critical patches quickly, ideally within days, not months. Test on a staging copy of the store first.
• Remove what you do not use. Disabled extensions and old themes can still contain vulnerable code.
• Plan major upgrades before your version reaches end of support, when security fixes stop.

Magento stores, for example, receive regular security patches. If keeping up is a struggle, our team provides Magento security patch installation and can apply fixes on a regular schedule.

Admin access and passwords

A stolen admin password gives an attacker full control of your store. Protect admin access as carefully as you would the keys to a physical shop.

• Use two-factor authentication on every admin account, including your own.
• Give each person their own account. Never share logins between staff or agencies.
• Grant the least access needed. A customer service agent rarely needs to change payment settings.
• Remove accounts promptly when staff leave or an agency contract ends.
• Change the default admin address if your platform allows it, so bots cannot find the login page easily.
• Limit login attempts, so repeated wrong passwords lock the account for a period.
• Use a password manager so every account has a long, unique password.

Apply the same care to the hosting control panel, the server, the domain registrar, your email and your payment provider dashboard. An attacker who controls your domain or email can take over everything else.

Payments and card data

Card payments are governed by the Payment Card Industry Data Security Standard (PCI DSS), published by the PCI Security Standards Council. Every business that accepts cards must comply, but how much work that involves depends on how you take payments.

Keep card data off your server

The simplest and safest approach is to use a payment provider that collects card details in its own secure form, either as a hosted payment page or an embedded field. The card number goes straight to the provider and never touches your server. This greatly reduces your compliance burden and your risk.

Protect the checkout page itself

Even when the provider handles card data, attackers can try to inject malicious scripts into your checkout page to copy what customers type. Protect against this by:

• limiting the third-party scripts that run on checkout pages to those you truly need;
• using a Content Security Policy that blocks scripts from unknown sources;
• monitoring checkout pages for unexpected changes to their code.

Fraud controls

Use the fraud tools your payment provider offers, such as address checks, card security code checks and 3-D Secure authentication. Review flagged orders before shipping high-value items.

Hosting, servers and the network

The server your store runs on needs as much care as the store software. If your host manages the server, ask them how they handle each of these. If you manage it yourself, make sure someone qualified is responsible.

• HTTPS everywhere, with a valid certificate that renews automatically.
• A web application firewall that blocks common attacks before they reach the store.
• Operating system and server software kept up to date.
• Secure remote access: key-based logins, no direct root login and access restricted by IP address where possible.
• Correct file permissions, so the web server cannot change code files it only needs to read.
• Separate environments: development and staging copies should never use real customer data unless it has been anonymised.
• Monitoring and alerts for downtime, unusual traffic, file changes and failed logins.

Our guide to Magento hosting providers includes security features to look for when you choose a host.

Backups and recovery

Backups are your last line of defence. If an attack, a failed update or a simple mistake damages the store, a good backup lets you recover quickly.

• Back up both files and the database, on a regular schedule that matches how often your data changes. Busy stores may need several database backups a day.
• Store copies off the server, in a separate location an attacker on the server cannot reach.
• Keep several versions, so you can go back to a point before a problem started, even if it went unnoticed for a while.
• Test restoring at least a few times a year. A backup that cannot be restored is not a backup.
• Write a recovery plan that says who does what, in what order, and how long it should take.

Protecting customer accounts

Your customers' accounts need protection too. Attackers often try email and password pairs leaked from other websites, hoping customers reused them. Limit repeated login attempts, add a simple bot check on the login and registration forms, and send customers an email when their password or email address changes. Never store passwords in readable form; modern platforms hash them automatically, but custom code must do the same.

Your complete ecommerce security checklist

Use this table as a quarterly review. For each line, write down who is responsible and when it was last checked.

Staff habits matter as much as software

Many breaches begin with a convincing email: a fake invoice, a request to "verify" a payment account or a message that appears to come from a supplier. Train everyone with store access to pause before clicking links or opening attachments, and to confirm unusual requests by phone. Make it easy and blame-free to report a mistake quickly, because speed limits the damage.

If something goes wrong

Even well-protected stores can be attacked. Having a plan ready turns panic into a sequence of steps.

1. Contain: put the store into maintenance mode if customers are at risk, and change admin, server and hosting passwords.
2. Preserve evidence: take copies of logs and affected files before cleaning anything.
3. Get help: contact your developer, your host and, if cards may be affected, your payment provider.
4. Find the cause: fix the weakness that let the attacker in, not just the visible damage.
5. Restore safely: recover from a clean backup if needed, then apply all patches before going live.
6. Notify: check whether you must inform customers or a regulator. Data protection laws, including those covered in our GDPR guide for stores, often set strict deadlines.
7. Review: once the store is safe, ask what would have prevented the incident and update this checklist.

Frequently asked questions

Not sure how your store measures up? Ask us for a security review. We will check your platform, extensions, hosting and admin setup, and give you a prioritised list of fixes.