Most security advice for online stores is about keeping people out. This one is about the attack that is already inside and produces no symptoms at all, because understanding why it is invisible is what tells you where to look.
Why Skimmers Beat Visual Checks
A Magecart style attack injects JavaScript into your checkout page that reads card numbers, CVVs and billing details as the customer types them, then ships the captured data to a server the attacker controls.
The important property is not the theft. It is that nothing about the page changes. The layout is identical, the fields behave identically, the order completes normally and the customer gets their confirmation email. There is no error, no slowdown and no broken flow to notice. Attacks like this have hit British Airways, Ticketmaster and Newegg, and small stores get targeted more often than large ones precisely because nobody on a small store is watching the page for script changes.
That is why "the checkout looks fine" is not evidence of anything. Any check that a human performs by looking will pass. The only checks that catch this are mechanical: a known inventory of every script that is allowed to load on checkout, and an alert when that list changes.
Tag managers deserve specific attention here. A tag manager is a sanctioned mechanism for injecting script into your most sensitive page while routing entirely around code review, which makes the container one of the softest surfaces on the whole site. Most store owners cannot name every tag in theirs.
Credential Stuffing Is An Arithmetic Problem
The second attack that reliably lands needs no vulnerability in your code at all. Roughly 65 percent of people reuse passwords, so when an unrelated service is breached, every one of your customers who used that same combination is now reachable on your store. Attackers automate the testing of millions of stolen pairs against your login form, and account takeover attempts rose 150 percent in 2024.
Once inside a customer account they buy with saved payment methods, drain loyalty points, read personal data and change the shipping address to redirect the order. None of it requires breaking anything.
Because it is arithmetic rather than cleverness, the defenses are arithmetic too. Rate limit login attempts per account and per address range. Run bot detection on the login endpoint rather than only on checkout. Offer two factor authentication and require it for the actions that matter, such as changing the account email or the shipping address. Notify on new device sign in. None of that is exotic and all of it changes the economics for the attacker.
The Layers That Actually Stop Both
No single control covers this, but a short stack of unglamorous ones covers most of it.
Keep card fields inside the payment processor's iframe so they never render in your DOM. This one boundary means a compromised script on your page has nothing to read, and it collapses most of your PCI scope at the same time.
Serve every page over HTTPS, not just checkout, and treat certificate expiry as an incident rather than a chore.
Patch on a schedule that has an owner. Running outdated software is the single most common way stores are compromised, and WooCommerce stores are especially exposed because one abandoned plugin with a published CVE is full site access.
Put a web application firewall in front of the store. Cloudflare's free tier stops the common automated probing, and dedicated ecommerce providers go further when you are big enough to need it.
Require two factor authentication on every admin account, including your host panel, your processor and the email address that can reset both.
Assume A Breach And Rehearse It
The regulatory floor moved. PCI DSS 4.0 became mandatory in March 2025, GDPR can reach 4 percent of global revenue, and more than fifteen US states now have their own privacy statutes. Enforcement against small businesses has been climbing since 2023.
More to the point, sixty percent of small businesses that suffer a significant breach close within six months, and it is usually the loss of customer trust that does it rather than the direct cost. Nineteen percent of consumers abandon a retailer permanently after a breach and another third stop buying for a long stretch.
So the useful exercise is not proving you will never be breached. It is being able to answer three questions today: who gets paged, how fast can you restore from a backup you have actually tested, and how do you tell customers before they find out somewhere else.
The full guide, including the payment security, fraud detection and incident response detail behind all of this, is at afcommerce.
If you take one thing from this: every control worth having on a checkout page is mechanical, because the attack you are defending against is specifically designed to look normal.
Top comments (0)