WooCommerce Security: Protecting Your Store & Customer Cards
WooCommerce turns a WordPress site into a store — which means it inherits all of WordPress's attack surface and adds a checkout that handles customer and card data. This guide covers the WooCommerce-specific security that matters: protecting the payment page, plugin hygiene, PCI basics and skimmer detection.
Check your store's exposure now: run a free MageArgus scan for versions, headers, exposed files and skimmer signals.
- WooCommerce runs a large share of all online stores — BuiltWith / W3Techs
- Ecommerce checkouts are prime Magecart targets across every platform — Sansec
Start with WordPress fundamentals
A WooCommerce store is a WordPress site first. Everything in the WordPress security guide applies — updates, fewer plugins, 2FA login, wp-config hardening, HTTPS and backups. Get those right before anything WooCommerce-specific.
Protect the checkout / payment page
Checkout is where the money is, so it's where skimmers go. Use a gateway that keeps card entry off your page where possible (hosted fields / redirect), enforce a strict Content Security Policy on checkout, and add Subresource Integrity to third-party scripts. Watch the payment page for unauthorised change — this is also a PCI DSS 4.0 requirement.
Payment plugin & extension hygiene
Payment and shipping extensions handle sensitive flows and are frequent vulnerability sources. Keep them current, buy from reputable vendors, delete unused gateways, and rotate any API keys after staff changes or an incident.
PCI basics for WooCommerce
If you use a hosted/redirect gateway and never store card numbers, you're typically in the lighter SAQ A/A-EP scope — but you still owe patching, access control, and payment-script management. See the parallel PCI guide; the ecommerce requirements are platform-agnostic.
Detect skimmers early
Scan files and the database for injected scripts, and monitor checkout for change:
grep -rIl 'atob(\|eval(\|document.forms\|api.telegram.org' wp-content/ 2>/dev/null
wp db query "SELECT option_name FROM wp_options WHERE option_value LIKE '%<script%';"See the platform-agnostic ecommerce security checklist.
Frequently asked questions
Does WooCommerce store credit card numbers?
Not when you use a hosted or redirect gateway (Stripe hosted fields, PayPal, etc.) — card entry happens on the processor's side and no PAN is stored on your site. Avoid any setup that stores raw card data; it pulls you into full PCI scope.
What's the biggest WooCommerce-specific risk?
A skimmer on the checkout page, usually planted via a vulnerable plugin or stolen admin login. Enforce a strict CSP on checkout, keep plugins updated, and monitor the payment page for change.