Basic WooCommerce security: 12 measures that work

An online store holds customer data, orders and, through the gateway, the flow of money. That makes it a target. Most attacks on WooCommerce stores are not sophisticated: they exploit outdated plugins, weak passwords or forgotten access. That is why the measures that protect the most are basic and can be applied today.

Security is not a tool you install once: it is a routine. The stores that get hacked almost always failed at the basics.

1. Keep everything updated

WordPress, WooCommerce, the theme and the plugins receive security fixes frequently. A pending update is a known open door. Update in a test environment when possible and check that payments and checkout still work.

2. Remove what you do not use

Deactivated plugins and themes are still on the server and can have vulnerabilities. Delete what you do not use, and be wary of abandoned plugins or ones downloaded from unofficial sources.

3. Strong passwords and two-factor authentication

• Long, unique passwords for administrators, hosting and database.
• Two-factor authentication (2FA) for every user with admin permissions.
• Do not use the "admin" username.

4. Limit who can do what

Give each person the minimum role they need. Whoever uploads products does not need to be an administrator. Review users often and remove those of people who no longer work with you.

5. Protect access to the panel

• Limit failed login attempts.
• Consider changing or restricting the login path to the panel.
• Restrict access by IP if your team works from fixed locations.

6. HTTPS across the whole site

A valid SSL certificate is mandatory in a store: it protects data between the customer and your site and is a requirement of payment gateways. Make sure everything loads over HTTPS, including checkout. See how it is configured in SSL, backups and firewall.

7. Backups that can actually be restored

• Automatic, frequent copies (the store receives orders all day).
• Stored outside the store's server.
• Test restoring a copy from time to time; a copy that cannot be restored is not a copy.

8. Firewall and monitoring

A web application firewall filters malicious traffic before it reaches your store. Change and availability monitoring tells you if something is modified or goes down. The server covers part of this; we explain it in server maintenance.

9. Payments: do not store card data

Use a gateway that handles card data and avoid storing it on your site. Protect the gateway's production keys and limit them to the proper environment. For the integration, see Datafast, PayPhone or Kushki payments in WooCommerce.

10. Protect the database and files

• Change the table prefix if you install from scratch.
• Disable file editing from the admin panel.
• Adjust file and folder permissions.
• Keep configuration files out of public access.

11. Look after your customers' personal data

Collect only what is necessary, explain how you use it with a clear privacy policy and limit who can see it. If you export data or share it with third parties (for example, to invoice), do it with trusted providers.

12. Have a plan for when something fails

Define in advance:

1. Who is responsible and whom to call.
2. How to put the store into maintenance mode.
3. Where the backups are and how to restore.
4. What to change immediately: passwords, gateway keys, site secrets.
5. Whom to notify: gateway, hosting and, if customer data was exposed, those affected as appropriate.

Signs you may have been hacked

• Strange redirects when opening your site or browser warnings.
• Administrator users you did not create.
• New or modified files nobody remembers.
• Spam emails sent from your domain.
• Strange orders or payments.
• A sudden traffic drop or Google warnings about your site.

If it happens, do not improvise: put the store into maintenance, restore from a clean backup, change all credentials and find out how they got in to close that door.

Security and performance go together

An updated store, clean of unnecessary plugins and well served, is also a faster store. If you notice slowness, review checkout mistakes that cost sales and VPS vs shared hosting.

How we do it at Codegea

We review your store's security, apply the missing measures and, if you prefer, handle ongoing maintenance with a retainer plan. Learn about our WooCommerce service or request a review from contact.