WooCommerce security: protect your checkout and your customers

What attackers want from a store

• Card data, via a skimmer script on the checkout page.
• Customer data: names, addresses and emails, for fraud and phishing.
• Your admin, to change payment settings, add a skimmer or issue refunds to themselves.
• Your reputation and traffic, through spam pages and redirects.

WooCommerce security in layers

Protecting the checkout page

Skimmers hide in the database, theme files and third-party scripts, and often only run for real shoppers on the checkout URL. Keep an inventory of the scripts on checkout, scan for injected JavaScript, and watch for connections to unfamiliar domains. Our guide to WooCommerce card skimmer detection explains each check, including what PCI DSS 6.4.3 and 11.6.1 ask of payment pages.

Shop managers and staff accounts

Stores often have more people with powerful accounts than blogs do: owners, shop managers, support staff and developers. Give each person their own account with the lowest role that works, require 2FA, and remove accounts when people leave. Pro adds Bot Login Detection, Login reCAPTCHA and a Custom Login URL; Agency adds New-Device Login Approval and session controls.

A note on compliance

A security plugin helps you detect changes and block attacks; it doesn’t make a store PCI DSS compliant on its own. Ask your payment provider which requirements apply to how you take payments, and prefer hosted payment fields or a redirect where you can.