04
Online shop security: what to check
Security problems in a small online shop rarely look like something out of a film. Often it is something more ordinary: someone sends emails in the shop's name, an abandoned extension leaves a door open, or a script nobody remembers loads on the checkout page. This is what is worth checking, and almost all of it can be checked without changing anything.
Your domain's email
If your domain does not publish a DMARC record, it is easier for a third party to send emails that appear to come from your shop: fake order confirmations, bank-detail change notices, invoices. Your customers will find it hard to tell them apart.
How to check: look up your domain in any public DMARC lookup tool. If no record appears, or it shows “p=none”, the domain is only monitoring: it does not reject forged emails. It is fixed in the DNS without touching the website, and it is done in stages. SPF and DKIM must be set up properly first, including the services that send email on your behalf, or your own emails may end up in spam.
Third-party scripts
Over the years a shop collects scripts: chat widgets, advertising pixels, heatmaps, apps that were uninstalled but left their code behind. Each one runs with the same permissions as your own website.
If one of them loads on the checkout page, it can read what is typed into fields on that same page; card fields hosted by the payment provider in an iframe are out of its reach. It is worth knowing what loads on each page, who added it and whether it is still needed. Removing what is surplus usually also makes the shop load faster.
Access to the admin panel
Check who has an administrator account and whether they all still need one: former employees, agencies, developers you no longer work with. Every surplus account is one more password that can leak.
If your platform allows it, turn on two-factor authentication for the admin panel. It is one of the measures that takes the least effort.
Extensions and versions
In WooCommerce and PrestaShop a large part of the code comes from plugins and modules. One that its author has abandoned stops receiving fixes. Check what you have installed, what is deactivated but still on the server and what has not been updated for a while.
On Shopify and other hosted platforms, the provider maintains the core. Your part is what you add on top: apps, theme and scripts.
Backups and rolling back
Before changing anything, check that you have a recent backup, that it is stored on a different server and that you know how to restore it. A backup that has never been tested is of little use on the day you need it.
What this list is not
It covers what can be seen from outside and from the admin panel. It does not replace a security review, which is carried out with the scope and the merchant's permission agreed in writing and, if the platform belongs to a provider, with that provider's authorisation.