How to keep a WooCommerce store secure

The short answer

WooCommerce security comes down to five things: keep card data off your server by using a hosted or embedded payment option, keep WordPress, WooCommerce, your theme and every plugin updated, lock down logins with two-step verification and least-privilege roles, run the store on hosting with a firewall, malware scanning and tested backups, and protect checkout from card testing bots.

WooCommerce itself is not PCI certified, because it does not process payments. In WooCommerce’s own words, PCI DSS compliance is ultimately the responsibility of the store owner. The good news is that most of the work is routine once it is set up.

Start with PCI scope

PCI DSS is the card industry’s security standard. How much of it applies to you depends on how cards are collected at checkout.

• Full redirect to the payment provider. The customer is sent to the provider’s page to pay. Your site never touches card data, and scope is smallest.
• Embedded payment fields (iframes or hosted fields). Common with Stripe, WooPayments and PayPal. Card numbers go straight to the provider, but your site still serves the checkout page, so the scripts on that page matter.
• Card data posted to your server. Avoid this. It puts your whole hosting environment in scope.

In 2025 the PCI Security Standards Council updated the short self-assessment questionnaire, SAQ A. It removed two payment-page script requirements from SAQ A but added an eligibility condition: merchants must confirm their site is not susceptible to attacks from scripts that could affect their ecommerce systems. In practice, that means knowing which scripts run on your checkout page and making sure nobody can quietly add one. Your payment processor decides which questionnaire you complete, so ask them, and keep the answer on file.

Card testing attacks: the most common WooCommerce problem

Card testing is when bots use your checkout to try stolen card numbers with small purchases. You see a sudden burst of failed orders, odd customer names and repeated declines. Even if no fraud succeeds, you can pay transaction fees, face disputes, and have your payment account restricted.

WooCommerce’s own guidance recommends these steps:

1. Monitor failed orders. A sudden rise in Failed orders with repeated decline notes is the warning sign. Filter orders by status daily during busy periods.
2. Add bot protection at checkout. A CAPTCHA plugin or Cloudflare Turnstile blocks most automated attempts.
3. Use fraud rules. Anti-fraud extensions can block or flag orders by email, IP address, country or VPN use.
4. Remove easy targets. Avoid pay-what-you-want or donation products with no minimum, which testers use for small charges.
5. During an attack: refund suspected fraudulent transactions quickly, make low-priced products private, consider turning off guest checkout, and contact your payment provider about stronger fraud controls and fees.

WooCommerce warns that these plugins offer little or no protection if they are not configured correctly. Test the checkout after enabling them, from a normal browser and a phone.

Plugins and updates

Outdated plugins are a common way WordPress sites are compromised. A store typically runs more plugins than a brochure site, so this deserves a written routine:

• Install plugins only from wordpress.org or the developer’s official site. Never use “nulled” copies of paid plugins.
• Delete plugins and themes you do not use. Deactivated code can still be attacked.
• Apply security updates quickly. Apply feature updates on a staging copy first, then test search, cart, checkout, account pages and order emails before updating the live store.
• Keep a list of every plugin, who maintains it and when it was last updated. Replace plugins that have not been updated in a long time.
• Turn off the built-in file editor by setting DISALLOW_FILE_EDIT in wp-config.php, as WordPress’s hardening guide recommends.

Logins and admin access

• Two-step verification for every account that can see orders or change settings. WordPress’s hardening guide calls this out especially for administrators.
• Least privilege. Use the Shop Manager role for staff who handle orders. Keep Administrator for the one or two people who truly need it.
• No shared logins. Each person gets their own account, so activity logs mean something.
• Remove leavers the same day. Including agencies and freelancers who no longer work on the site.
• Customer accounts. Rate-limit login and registration forms so bots cannot brute-force or mass-create accounts.

Worried about your store’s security?

Book a free 30-minute call. We look at your WooCommerce setup with you and tell you what we would fix first. No obligation. Pick a time.

Hosting that fits a store

Checkout, cart and account pages cannot be fully cached, so a store puts more load on hosting than a simple website, and the host carries part of your security. Look for:

• A web application firewall that blocks common attacks and bad bots before they reach WordPress.
• Malware scanning and cleanup, with someone who will actually do the cleanup if it is needed.
• Automatic backups of files and database, kept off the server, with restores you have tested.
• Current, supported PHP and database versions.
• Isolation between sites, so one compromised site on the account cannot reach yours.
• SSL on every page and HTTPS for the admin area.
• SFTP or SSH access only, never plain FTP.

Our hosting and support plans include constant automated monitoring and malware cleanup. For what ongoing care typically involves, see how much website maintenance costs.

Signs your store may already be compromised

Many store owners find out about a breach from a customer, a bank or their payment provider. Check for these signs and act quickly if you see one:

• Customers report card fraud shortly after buying from you. This can point to a skimming script on checkout.
• New administrator accounts, or plugins you did not install.
• Unfamiliar scripts or domains loading on the checkout page when you view the page source or browser developer tools.
• Redirects to spam or pharmacy sites, especially for visitors arriving from Google.
• A warning in Google Search Console or a browser safety warning on your domain.
• Sudden spikes in server load or outgoing email.

If you suspect a compromise, put the store in maintenance mode, change every admin and hosting password, tell your payment provider, and restore from a clean backup or have a professional clean the site. Do not simply delete the visible malware and carry on, because attackers usually leave a back door.

A monthly WooCommerce security checklist

• Updates applied and checkout tested afterwards.
• Failed order trends reviewed for signs of card testing.
• Admin and Shop Manager accounts reviewed; anyone who left removed.
• Scripts on the checkout page reviewed against your approved list.
• Backup restored to a test copy at least once a quarter, to prove it works.
• Security plugin and firewall logs checked for repeated attacks.
• PCI questionnaire or scan requirements from your processor confirmed as current.

If you are deciding whether WooCommerce is still the right platform, our Shopify vs WooCommerce comparison covers how security responsibilities differ. For broader business security beyond the website, see our cybersecurity services.

Related services

• Hosting and support
• Cybersecurity
• Website maintenance costs