WooCommerce Security Checklist for Stores

Originally published on the Bug Circuit blog.

The fastest way to leak customer data on WooCommerce isn't a genius hacker — it's a forgotten plugin update or a stale WordPress core, and you can close both gaps today.

This is for store owners running WooCommerce on WordPress who are worried about a breach hitting customer names, addresses, or order history — not developers looking for a code audit. You'll get a concrete checklist you can work through in one sitting, in the order that actually reduces risk fastest.

The real risk isn't your server holding credit cards

Most WooCommerce owners picture a breach as someone stealing credit card numbers off their server. In a properly configured store, that's not actually where the risk lives — if you use Stripe, PayPal, or another hosted payment gateway, card numbers never touch your database at all; they go straight from the customer's browser to the payment processor.

The real exposure is everything else: names, emails, shipping addresses, order history, and admin credentials, sitting in a WordPress database that's reachable through whichever of your 15 plugins hasn't been updated since last year. WordPress core, WooCommerce, and every plugin you install are all separate pieces of software with separate vulnerabilities — and CISA's Known Exploited Vulnerabilities catalog is full of exactly this pattern: attackers scanning the web for sites still running a patched-months-ago plugin version. CISA KEV Catalog

The checklist: do these in order

Work down this list top to bottom — it's ordered by how much risk each item removes per minute spent.

#	Task	Why it matters	How often
1	Update WordPress core, WooCommerce, theme, and every plugin	Unpatched software is the #1 entry point attackers scan for	Weekly, or auto-update minor versions
2	Delete plugins/themes you're not actively using	Inactive code still runs and still has vulnerabilities	Today, then quarterly
3	Turn on two-factor authentication (2FA) for every admin/shop manager account	Stops stolen passwords from being enough to log in	Today
4	Confirm your payment gateway is hosted checkout / tokenized (Stripe, PayPal, Square)	Your server never stores or sees full card numbers	Verify today
5	Set DISALLOW_FILE_EDIT to true in wp-config.php	Blocks attackers who get admin access from editing theme/plugin code	Today
6	Add strong security headers (HSTS, CSP, X-Frame-Options)	Reduces damage from XSS and clickjacking	Today
7	Confirm off-site, automated backups are running	Lets you recover instead of paying a ransom or rebuilding	Verify today, then weekly checks
8	Rename or remove the default "admin" username; enforce unique logins per staff member	Stops credential-stuffing and makes breach forensics possible	Today
9	Install a WordPress firewall/malware scanner (Wordfence, Sucuri, or your host's WAF)	Blocks known attack patterns before they hit your code	Today, monitor weekly
10	Review user roles — no one has Administrator who only needs Shop Manager	Limits what a compromised account can do	Monthly

Update discipline: the single biggest lever

Open WordPress admin → Dashboard → Updates right now and clear everything queued. Then set a recurring habit:

1. Enable automatic updates for minor WordPress core releases (Settings → this is on by default since WP 3.7 for security releases).
2. Update WooCommerce itself as soon as a new version drops — check the changelog for "security" or "vulnerability" language first.
3. Go through every installed plugin individually. If a plugin hasn't been updated by its developer in over a year, treat that as a red flag even if no known vulnerability is public yet.
4. Delete anything deactivated. A disabled plugin sitting in /wp-content/plugins/ is still a live target if its files are reachable.

This single habit closes more real-world breach paths than almost anything else on this list — most WordPress compromises trace back to a known, already-patched vulnerability in outdated software, which is exactly the pattern OWASP flags under "Vulnerable and Outdated Components" in its Top 10 risks. OWASP Top 10

Lock down who can log in

Your wp-admin login is the front door. Harden it:

• Enforce 2FA for every account with admin or shop manager access — WP 2FA and Wordfence both offer free options.
• Kill the shared "admin" account. Give every staff member and contractor their own login tied to their name, and remove access the day they leave.
• Limit login attempts. Most security plugins add this by default — it stops brute-force password guessing.
• Set roles correctly. A customer service rep processing refunds needs Shop Manager, not Administrator. Fewer people with full access means less damage if one account is compromised.
• Disable XML-RPC if you don't use the WordPress mobile app or Jetpack — it's a common brute-force and DDoS amplification target.

WordPress.org's own hardening guide covers the server-level version of these steps if you manage your own hosting. WordPress.org: Hardening WordPress

Keep card data off your server entirely

This is the one that keeps owners up at night, and it's also the one with the cleanest fix: never let WooCommerce or your server touch a raw card number.

• Use a gateway that tokenizes on the customer's browser — Stripe, Square, and PayPal's hosted fields all do this. WooCommerce's own checkout blocks integrate directly with these.
• If you're on an older, custom-built checkout that stores card fields locally, migrate off it. That configuration puts you in a much heavier PCI DSS assessment category.
• Confirm your gateway plugin settings show "hosted fields" or "tokenized" rather than a raw credit card number field rendered on your own domain.

Done this way, you typically qualify for the simplest PCI compliance self-assessment (SAQ A), because card data never enters your environment. The Payment Card Industry Security Standards Council publishes the official criteria for which SAQ applies to your setup. PCI Security Standards Council

Add security headers your browser already understands

Headers are instructions your server sends telling browsers how to treat your site defensively. Add these via your host, a plugin like Wordfence, or your .htaccess/nginx config:

• Strict-Transport-Security: max-age=31536000; includeSubDomains — forces HTTPS, blocking downgrade attacks.
• X-Frame-Options: SAMEORIGIN — stops your checkout page from being embedded in a malicious iframe (clickjacking).
• X-Content-Type-Options: nosniff — stops browsers from misinterpreting uploaded files as executable scripts.
• Content-Security-Policy — restricts which domains can load scripts on your site, a strong defense against injected skimmer scripts (a real WooCommerce attack pattern known as Magecart-style card skimming).

You can check what's currently set on your live store, free, with our security headers scanner — most WooCommerce sites are missing at least two of these out of the box.

Back it up before anything else breaks

A backup won't stop a breach, but it's the difference between a bad afternoon and losing your store. Confirm you have:

• Automated, scheduled backups (daily for active stores) stored off the same server — UpdraftPlus, host-native backups, or your hosting provider's snapshot system.
• At least one backup you've actually tested restoring, not just one you assume works.
• Database backups included, not just files — WooCommerce order and customer data lives in the database.

Key takeaways

• Outdated WordPress core, WooCommerce, or plugins are the most common way small stores get breached — update weekly and delete what you don't use.
• Use a tokenized checkout (Stripe, PayPal, Square) so raw card numbers never touch your server — this also keeps your PCI compliance burden minimal.
• Turn on 2FA, kill shared admin logins, and match user roles to what each person actually needs.
• Add HSTS, CSP, and X-Frame-Options headers, and confirm off-site backups are actually running and restorable.
• A checklist catches configuration gaps; it won't catch a logic flaw or an exposed endpoint specific to your setup — that takes a person actually testing your live site.

Working through this list yourself fixes the common, well-known gaps. What it can't do is find the issue unique to your store — a misconfigured REST API endpoint, a coupon logic flaw, an exposed staging URL. That's the gap a real manual security audit closes: a person actually testing your checkout and admin, not a scanner running the same generic ruleset every other site gets. If you want a free first read before spending anything, our free website security check will tell you, no card required, whether anything critical is already exposed.