Ecommerce Website Security Checklist (2026)
Every online store — Magento, WooCommerce, Shopify or custom — shares the same core risks: an attacker wants your customers' cards and your admin access. This platform-agnostic ecommerce security checklist covers the controls that protect any store, so you can secure the fundamentals regardless of the tech underneath.
Start with a free baseline: run a free MageArgus scan to check patching, TLS, headers, exposed files and skimmer signals.
- Checkout skimmers target every ecommerce platform, not just one — Sansec
- PCI DSS 4.0 now requires payment-page script management and change detection — PCI SSC
Patch & update
- Keep the platform, plugins/extensions and server software current.
- Subscribe to your platform's security advisories.
- Retire end-of-life versions — they receive no patches.
Lock down access
- Unique admin accounts, strong passwords, and 2FA for everyone.
- Least-privilege roles; remove unused accounts and API tokens.
- Restrict or rate-limit the admin login.
Protect the checkout
- Use a hosted/redirect payment gateway where possible — don't store card numbers.
- Enforce a strict CSP script-src allow-list on checkout.
- Add Subresource Integrity to third-party scripts; monitor the payment page for change.
Transport & headers
- HTTPS everywhere with HSTS.
- Security headers: CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy.
- Secure, HttpOnly, SameSite cookies.
See security headers explained.
Detect & recover
- File-integrity monitoring and regular malware scans (remote + on-disk).
- Automated, off-site, tested backups.
- A written incident-response plan and PCI notification path.
Platform-specific deep dives: Magento hardening and WooCommerce security.
Frequently asked questions
Which platform is most secure?
Security depends far more on how a store is maintained than on the platform. A patched, hardened, monitored store is safe on any platform; an out-of-date one is at risk on all of them. See our Magento vs WordPress security comparison.
Do small stores really get targeted?
Yes. Most attacks are automated and indiscriminate — bots scan the whole web for vulnerable versions. A small store running an unpatched platform is just as likely to be hit as a large one.