Keeping your store secure

A WooCommerce store handles real money and customer personal data. That makes security essential — not optional. This guide covers the practical steps you and your team can take to keep your store safe.

Why WooCommerce stores are targeted

Online stores hold valuable data: customer names, email addresses, order history, and a record of the payment method used. WooCommerce itself doesn't store card numbers — the payment gateway handles those. Attackers target stores to steal the data that is there, or to use your site as a base for spam and malware.

The useful thing to know is that WooCommerce runs on WordPress, and WooCommerce's own documentation puts it plainly: a WooCommerce site is "overall exactly as secure as the WordPress installation itself." So everything that makes a WordPress site secure makes your store secure.

The essential security steps

1. Use strong, unique passwords

Every WordPress admin account, hosting account, and payment gateway account needs a strong, unique password. Use a password manager to generate and store them. Never reuse passwords.

See the WordPress user roles explained guide for managing who has access to your store.

2. Enable two-factor authentication (2FA)

Two-factor authentication adds a second step to login — usually a code from your phone. Even if someone gets your password, they can't log in without your device. Enable it on:

• WordPress admin
• Your hosting account
• Your payment gateway account

3. Keep everything updated

WooCommerce names this as a key part of staying secure: keep your site's version of WordPress, and every plugin on it, up to date. Update regularly — at least monthly. See the guide on WordPress updates.

4. Use HTTPS (SSL)

Your store should use HTTPS. This encrypts the connection between customers and your store, protecting data in transit. Many payment gateway plugins require it, and WooCommerce strongly recommends it for every store. Check that your URL starts with https:// — if it shows http://, contact us to set up SSL.

5. Install a security plugin

A security plugin adds protection at the WordPress level. Two widely used options are Wordfence Security (listed as "Firewall, Malware Scan, and Login Security") and Sucuri Security ("Auditing, Malware Scanner and Security Hardening"). Between them, the features you're looking for are:

• Malware scanning
• Login protection, such as limiting failed login attempts
• Hardening recommendations and an audit log
• Email alerts for suspicious activity
• A web application firewall — note that with some plugins the firewall is part of a paid service rather than the free plugin

We can set this up for you if it's not already installed.

6. Use a reputable host

Your hosting provider is your first line of defense. WooCommerce points out that choosing a secure host and hosting package is part of WordPress security, and so part of store security. Managed WordPress hosts typically bundle server-level protection and backups; check what your own host includes, since the details vary a lot between providers and plans.

7. Back up regularly

Backups are your recovery plan. If something goes wrong, a recent backup lets you restore quickly. For backing up a store, WooCommerce's own guidance is to ask your hosting company or use a backup plugin. See the guide on backing up your store.

Protecting customer data

WooCommerce stores customer data — what was ordered and when, the customer's name, email and phone number, their billing (and optionally shipping) address, and a note of the payment method used. Protect it by:

• Limiting admin access — only give store admin access to people who truly need it.
• Reviewing user accounts — periodically check and remove accounts for ex-employees.
• Using a privacy policy — many privacy laws, including the EU's GDPR, expect one. WooCommerce has a Privacy policy section under WooCommerce → Settings → Accounts & Privacy where you choose your privacy policy page and add privacy notices to the registration and checkout forms. The Personal data retention section below it is where you set how long order data is kept.

Common questions

Are customer credit card numbers stored on my site?

No. WooCommerce says that by design your customer's card number and security code are never stored on your website — the gateway passes them straight to the payment processor. If you let customers save a card for next time, what's stored on your site is a token plus harmless details such as the last four digits, the card brand, and the expiry date.

That doesn't mean PCI-DSS stops applying to you: your site still serves the checkout page, so the rules still apply, though the scope is much smaller. See PCI compliance, in plain English.

What should I do if I think my store has been hacked?

Contact us immediately. Also contact your hosting provider. Do not make changes until you understand what happened. See the guide on troubleshooting security issues. Time matters — act quickly.

Someone is running tiny test charges through my checkout. What is that?

That's a card testing attack: criminals validating stolen cards with small, rapid transactions. WooCommerce's advice is to refund the transactions you believe are fraudulent, add anti-fraud and reCAPTCHA protection to your checkout, look at whether particular products (donations, "name your price") are being targeted, consider turning off guest checkout, and work with your payment provider to tighten their own anti-fraud settings. Note that refunding a fraudulent charge doesn't necessarily get the transaction fee back — ask your provider.

Do I need a firewall plugin if my host already has a firewall?

Host-level and application-level firewalls protect different layers. A plugin like Wordfence protects your WordPress application specifically. Using both is a sensible default for a store.

Related guides

• PCI compliance, in plain English
• Store backups
• WordPress security basics
• WooCommerce extensions explained
• I think I was hacked

Learn more

• WooCommerce site and data security FAQ
• Hardening WordPress