In shortA WooCommerce store keeps customer orders and details and takes payments, so it is an attractive target. Protect it with a payment gateway that keeps card details off your site, constant updates to WooCommerce and payment plugins, the Shop Manager role for staff instead of Administrator, checkout protection against fake orders, and daily backups.
What makes stores a target? #
1Customer dataNames, addresses and phone numbers. Read protecting customer data.
2The checkout pageA malicious script there can steal card details. Read types of website malware.
3Card testingBots try stolen card numbers through your checkout, causing fees and trouble with your payment gateway.
4Many pluginsEvery shipping, payment or marketing plugin is another door if not kept updated.
Steps to protect your store #
- A safe payment gateway: Choose one that takes the card on its own page or encrypted form, so card numbers are never stored in your store.
- Update WooCommerce and payment plugins: Flaws in payment and shipping plugins are among the most dangerous. Read updating WordPress safely.
- Staff roles: Use the Shop Manager role for whoever handles orders, so they cannot install plugins or edit files.
- Protect checkout from bots: Add a light CAPTCHA to checkout and registration, and limit payment attempts. Read protecting forms from bots.
- https on the whole store: Not only the checkout. Read SSL certificates.
- Daily backups: Orders change every day, so an old backup means lost orders. Read why backups matter.
- Watch for odd orders: Many failed orders with small amounts in a row are a sign of card testing.
What to do during a card-testing attack #
- Turn on a CAPTCHA at checkout right away.
- Temporarily disable guest checkout and require login to buy.
- Block repeating addresses. Read blocking an IP in cPanel.
- Tell your payment gateway; some offer fraud protection tools.
PCI DSS: this is the card data security standard. The easiest way to meet it is to let an accredited payment gateway take the card.
How Hyyat Host protects your site #
- The CSF firewall, Imunify360 and ModSecurity rules block known attacks on store pages.
- ImunifyAV scans files daily and detects malicious scripts in themes and plugins.
- A free SSL certificate is issued automatically on most plans.
Learn more about Hyyat Host WordPress hosting.
Frequently asked questions #
Can I store card details in WooCommerce?
This is never recommended. Use a payment gateway that stores them, and let your store receive only the result.
What is the difference between Shop Manager and Administrator?
A Shop Manager handles products and orders only. An Administrator controls everything, including plugins and files.
Does a store need special hosting?
It needs more resources than a blog, daily backups and good protection. Pick a plan that fits your traffic and orders.
