Online Store Security and Customer Data Protection

Online store security is not a product you buy once. It is a set of habits that prevent the usual mistakes: a password shared between staff, an old plugin nobody updated, a customer file sent in a chat. A store is an attractive target because it puts money, people's data and powerful admin accounts in one place. This guide covers the principles specific to stores; the basics that apply to any website are in website security essentials for every site owner. It describes good practice in general terms and is not legal advice.

What attackers look for in a store

Knowing the target clarifies your priorities:

• Card data, if it passes through or is stored on your servers.
• Customer data: names, phone numbers, addresses and order history, used for fraud, spam and impersonating your store to its own customers.
• Admin accounts: whoever holds one can change prices, steal data or swap your checkout for a fake one.
• Codes and balances: gift cards, discount codes and digital products, because they turn into cash quickly.
• The payment process itself: testing stolen cards with small repeated transactions, or fake cash-on-delivery orders.

Card data: never store it

The most important rule: keep card numbers from passing through your store if you can, and never store them. The Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements created by the major card networks, and it applies to anyone who stores, processes or transmits card data. The further card data stays from your systems, the less you have to comply with and the less there is to steal. In practice:

• Use a hosted payment page or embedded payment fields supplied by your gateway, so customers type their card details into the gateway's environment, not onto your server.
• Saved cards for faster repeat checkout are held by the gateway as a token, not in your database.
• Never ask for a card number or security code (CVV) over WhatsApp, email or a contact form, and don't keep it if a customer sends one; delete the message and gently let them know.
• The security code must never be stored after a transaction is authorized, even encrypted.
• Ask your gateway what compliance validation it needs from you. A store that relies entirely on a hosted payment page is usually asked for a short self-assessment questionnaire.

For how gateways work and the different ways to connect them, see payment gateways explained.

HTTPS on every page

The whole store must run over an encrypted connection (HTTPS) with a valid SSL/TLS certificate, not only the checkout, because login, account and cart pages carry sensitive data too. Check that:

• Every http address redirects automatically to https.
• There is no mixed content, meaning images or scripts loaded over an unencrypted connection inside an encrypted page.
• The certificate renews automatically before it expires, with an alert if renewal fails.

Hosted platforms usually handle this for you; on a self-hosted store it is your job. For certificates and hosting, see choosing hosting, a domain and an SSL certificate.

Admin accounts and permissions

Many incidents at small stores start with a weak or leaked password, not a sophisticated attack. Firm rules:

• One account per person. No shared staff logins, so you know who did what and can remove one person without changing everyone's password.
• Long, unique passwords kept in a password manager, not a notebook or a note on a phone.
• Two-factor authentication (2FA) required on every admin account. Prefer an authenticator app or security key over SMS codes.
• Least privilege: a customer service agent can view orders and update their status but cannot export the customer list or change payment or shipping settings, and whoever uploads products doesn't need financial reports.
• Temporary accounts for freelancers and agencies, with limited permissions and an end date, removed as soon as the work ends.
• Immediate removal of a departing employee's account, on their last day.
• Log review: alerts for logins from new devices and a regular look at the activity log if your platform offers one.

Protect the email address tied to the owner account, your domain registrar account and your payment gateway account to the same standard. Whoever controls that email can reset passwords everywhere.

Updates and plugins

On hosted platforms such as Shopify, Salla or Zid, the platform updates the core system; you remain responsible for the apps and plugins you install and the permissions you grant them. On a self-hosted store such as WooCommerce, every layer is yours:

• Update the core, theme and plugins regularly, and apply security updates quickly.
• Delete unused plugins and themes rather than just deactivating them.
• Install plugins only from official sources. Never use modified or "free" copies of paid plugins; they are a well-known way to plant malicious code.
• Test major updates on a staging copy of the store before applying them to the live site.
• Review the permissions each plugin or app requests and remove what you no longer need.

To compare the responsibilities that come with each type of platform, see choosing an e-commerce platform.

Backups

A backup is what gets you running again after a breach, a human error or a failed update. The well-known 3-2-1 rule means three copies of your data, on two different types of storage, with at least one copy away from your hosting provider. Match the frequency to your order volume: a store taking orders every hour needs more frequent backups than one taking a few orders a week.

Two things to remember. A backup contains the same customer data as the store, so encrypt it and restrict access to it just as carefully. And a backup you have never restored may not work when you need it, so test a restore on a staging environment every few months. On hosted platforms, find out what the platform backs up and what it doesn't, and export your important data regularly.

Customer data privacy

Data protection starts with a question: do I need this information at all? Practical principles:

• Collect the minimum. Don't ask for date of birth or ID numbers unless you need them to fulfill the order.
• Set retention periods. Delete or anonymise data you no longer need, in line with your accounting and legal obligations.
• Share narrowly. A courier needs the name, address and phone number for specific orders, not your whole customer file. Don't post order sheets in group chats with drivers.
• Get consent for marketing messages. Separate essential order messages from promotional ones, get explicit consent for the latter and make unsubscribing easy.
• A clear privacy policy that explains what you collect, why, who you share it with, and how customers can access or delete their data.
• Team devices: don't keep customer files on unprotected personal devices or in open shared folders.

Order fraud

Beyond data theft, stores face fraud in the orders themselves: stolen cards tested with small repeated transactions, fake cash-on-delivery orders, and discount codes abused through multiple accounts. Ways to limit it: cap failed payment attempts, add a human-verification check to checkout when unusual activity appears, use your gateway's risk-scoring tools, and attach clear conditions to discount codes, such as one use per customer and a minimum order value. Digital products are among the most targeted items; see selling digital products for specific measures.

An incident response plan

Write the plan before you need it; decisions made under pressure are worse:

1. Contain: change admin passwords, end active sessions, revoke API keys and disable any suspicious plugin.
2. Contact your partners: your host or platform and your payment gateway, who may have useful logs and tools to stop the damage.
3. Assess: what data was affected, since when, and how many customers?
4. Notify: inform customers and the relevant authorities as the applicable laws require, in plain language, with steps customers can take to protect themselves.
5. Recover and learn: restore from a clean backup, close the hole that was exploited and document what happened so you can improve your procedures.

Practical checklist

Security is part of the day-to-day operation described in the complete guide to starting an online store, not a one-off project.

Every month

• Review admin accounts and disable any that are unused.
• Apply updates and remove unused plugins.
• Confirm backups are succeeding and the SSL certificate is valid.
• Scan declined payments and failed attempts for unusual patterns.

Every year, or after any major change

• Test a full backup restore.
• Review permissions against current team roles.
• Review your privacy policy and the list of data you collect.
• Update the incident response plan and its contact numbers.
• Confirm with your payment gateway which compliance requirements apply to you.