Running an online shop puts you in a different risk category than most small businesses. You’re handling payment information, customer addresses, email accounts, and order histories. That data has value. And unlike a brick-and-mortar business, your attack surface is the entire internet.
The good news: most e-commerce security for small businesses isn’t complicated. It’s a set of specific, practical things to check and configure. This guide walks through them — for both Shopify and WooCommerce, since they work differently and the risks are different too.
Shopify vs WooCommerce: very different security models
Before getting into specifics, it’s worth understanding the fundamental difference. Shopify is a hosted platform — Shopify handles the servers, the software updates, and (if you use Shopify Payments) PCI DSS compliance for card processing. You can’t misconfigure the infrastructure because you don’t control it.
WooCommerce is a WordPress plugin that runs on a server you (or your hosting provider) manage. That’s more flexibility, but also more responsibility. WooCommerce stores are involved in the vast majority of e-commerce security incidents involving small businesses, not because WooCommerce itself is insecure, but because the hosting environment and plugins often aren’t maintained properly.
Which platform you’re on shapes everything below.
If you’re on Shopify
The platform itself is solid. Shopify is PCI DSS Level 1 certified for their payment processing, which means the card handling is handled to a professional standard. Your responsibility is the account layer on top.
Account security first. Enable two-factor authentication (2FA) on your Shopify admin account and require it for all staff accounts that have admin access. This is the single most important thing you can do. Shopify account takeovers via phishing or credential stuffing happen regularly, and 2FA stops virtually all of them.
Do this: Settings → Users and permissions → click your account → verify 2FA is on. For staff accounts, Settings → Users and permissions → each account.
Audit your app permissions. Shopify apps often request broad permissions — read customers, write orders, access all store data. Merchant app stores can be compromised, and a compromised app with full store permissions is a compromised store. Go through your installed apps and ask: is this still actively used? What does it actually need access to?
Remove apps you’re not using. Review the permissions of apps you are using at Admin → Apps. The “check permissions” link next to each app shows exactly what it has access to.
Staff permissions should be scoped. If you have staff accounts for customer service, fulfilment, or marketing, give them only the permissions their role needs. Someone handling fulfilment doesn’t need access to financial reports or customer payment information. Settings → Users and permissions → permissions for each staff account.
Check your custom code. If you’ve hired a developer to add custom theme code or liquid templates, that code runs in your store and has access to customer data and checkout. Make sure you trust where that code came from, and consider a brief review if it was written by a freelancer you found on a marketplace. Malicious tracking scripts inserted into Shopify themes are a known attack vector.
If you’re on WooCommerce
WooCommerce security requires more active maintenance than Shopify. The core risks are: outdated software with known vulnerabilities, poorly maintained plugins, weak hosting security, and inadequate access controls.
Keep everything updated, automatically. WordPress core, WooCommerce, all plugins, all themes — keep them updated. The majority of WooCommerce site compromises exploit vulnerabilities in outdated plugins, not zero-day flaws. Enable automatic updates for minor WordPress releases (security patches) at minimum: Settings → Updates in your WordPress dashboard, or via your hosting control panel.
For plugins, check Plugins → Installed Plugins and sort by update status. Anything more than a few versions behind is a potential risk. If a plugin hasn’t been updated by its author in over a year, consider replacing it — abandoned plugins with known vulnerabilities are a common entry point.
Uninstall plugins you’re not using. This is different from just deactivating them. Deactivated plugins still live on your server and can still be exploited if they have vulnerabilities. Delete them entirely.
PCI compliance is your responsibility on WooCommerce. If you’re taking card payments through WooCommerce, you need to think about PCI DSS. The simplest way to handle this is to use a payment gateway that handles all card processing off-site — Stripe, PayPal, Worldpay, Opayo (SagePay). When the customer enters card details on Stripe’s hosted checkout page rather than on your WordPress site, you’re not handling card data directly, which drastically reduces your PCI scope.
Avoid card-on-site payment methods that send card details to your server unless you genuinely understand what PCI SAQ-D compliance entails. For most small businesses, it’s far simpler to use a hosted payment page.
Your hosting matters. Cheap shared hosting increases your risk — if another site on the same server is compromised, your site can be affected. For a WooCommerce store with real revenue, managed WordPress hosting (Kinsta, WP Engine, Cloudways) is worth the cost. These providers handle server-level security hardening, automatic malware scanning, and have processes for incident response. They’re not cheap by shared hosting standards, but they’re not expensive relative to what a compromise costs.
Install a security plugin. Wordfence (free tier is meaningful) provides a web application firewall, malware scanner, and login protection for WordPress/WooCommerce. It’s not a substitute for the above, but it’s a valuable additional layer. Sucuri is another solid option.
Limit login attempts. WordPress’s default behaviour allows unlimited login attempts. Every WooCommerce store should have login attempt limiting in place — it’s built into Wordfence or available as a standalone plugin. This prevents brute force attacks on your admin password.
Shared security practices for both platforms
Use a password manager for all shop-related accounts. Your Shopify/WooCommerce admin, your hosting account, your payment gateway dashboard, your domain registrar, your email account. Every single one should have a unique, strong password. Using the same password across accounts is how one breach becomes six.
Secure your email account. Your shop email account can reset passwords for your shop, your hosting, your payment gateway. Whoever controls your email controls everything. Enable 2FA on your email account — this is non-negotiable for any account connected to your business.
Audit who has access. List every person with access to your shop’s admin, hosting, and payment accounts. If staff have left, remove their access. If an ex-contractor still has credentials, change them. Run this audit every six months.
Check your GDPR obligations. Under UK GDPR (retained post-Brexit), you’re a data controller for your customers’ personal data. You need a privacy policy explaining what you collect and why, an SSL certificate on your shop (both platforms include this), and a process for handling data subject access requests. If you haven’t reviewed your privacy policy recently, it’s worth updating it.
What to do if something goes wrong
If you suspect your WooCommerce store has been compromised, take it offline immediately (put it in maintenance mode or contact your host) before investigating. The worst case is serving malware or card-skimming scripts to your customers while you’re still figuring out what happened.
For both platforms, contact your payment gateway if you suspect card data has been exposed — they’ll guide you through the notification process.
Report a cybersecurity incident to Action Fraud (UK national fraud reporting service) if financial loss is involved. Your cyber insurance provider (if you have one) should be notified promptly.
Most incidents involving small e-commerce businesses are preventable with the basics above. Updated software, 2FA on admin accounts, strong and unique passwords, scoped permissions. Start there.