WooCommerce security checklist for small stores

WooCommerce gives you complete control over your store, and that includes the security. Shopify runs its own servers and checkout. With WooCommerce, everything from the hosting and PHP up through WordPress, every plugin and the checkout page itself is yours to keep current. That’s manageable for a small store, as long as someone is actually doing it.

This checklist covers what matters most, in the order we’d check it.

Is WooCommerce secure?

WooCommerce itself is well maintained and patched quickly, and serious fixes are often pushed to stores automatically. Most WooCommerce store compromises come in around it: through plugins, out-of-date software, weak admin access and scripts on the checkout page. Keep the whole stack current and the plugin list short, and you’ve handled most of the risk.

1. Check every version

Start at the bottom of the stack and work up:

• PHP: 8.3 or newer. WooCommerce recommended PHP 8.3 or later when it addressed the October 2026 PHP2Shell flaws, which needed a PHP update and no WordPress or WooCommerce update. Tools → Site Health → Info → Server shows your version.
• WordPress: 7.1.3 was current in late October 2026. It followed an urgent September release, 7.1.2, that fixed a critical flaw anyone could exploit without logging in.
• WooCommerce: 11.2 was the current branch in late October 2026. When WooCommerce patched a Store API flaw in March 2026, it pushed the fix to stores by automatic update. Leave those automatic security updates on.

If PHP is older than 8.2, you’re on a version that no longer gets security fixes at all. Our guide for old PHP versions covers how to upgrade without breaking the store.

2. Shrink and vet your plugin list

Most WordPress vulnerabilities are found in plugins, not in WordPress itself. Every plugin is code you’re trusting, so:

• Delete plugins you don’t use. Deactivated plugins can still be a risk while their files sit on the server.
• Check each plugin’s page on WordPress.org. A warning that it hasn’t been tested with the last three major WordPress releases usually means it’s been abandoned. A red notice that it’s been closed is a reason to replace it now.
• Update the plugins that touch checkout first: payment gateways, subscriptions, funnel and upsell builders. In May 2026, the security firm Sansec reported attackers exploiting a flaw in a popular WooCommerce funnel builder plugin to inject card skimmers into checkout pages.
• Buy premium plugins only from their developers, never from “nulled” download sites, which often bundle malware.

3. Audit admin accounts

In Users, filter by Administrator and Shop Manager. Remove anyone who doesn’t need access today, especially former staff and past developers. Give people the lowest role that does their job; a Shop Manager can run the store without being able to install plugins. Turn on two-step login for every admin account with a reputable security plugin.

4. Check what loads on your checkout

Card skimmers work by adding a little code to your checkout page that copies what customers type. Security researchers have found skimmers hidden in code-snippet plugins, in theme settings and even inside the database, where a quick file scan won’t see them.

• Review any plugin or setting that adds code to your site’s header or footer, and remove anything you can’t explain.
• Prefer payment forms hosted by your processor, such as Stripe’s Payment Element, over fields your theme builds itself. Card details then go straight to the processor. Our plain-English PCI guide explains why that matters.
• Place a test order from a private window now and then, and watch for anything unusual on the page.

5. Set up card testing defenses

Criminals use small stores to check whether stolen cards work, often with waves of tiny orders. WooCommerce’s own guidance is to add a CAPTCHA such as Cloudflare Turnstile or reCAPTCHA to checkout, make sure no product can be bought for nothing, and, during an attack, temporarily turn off saved cards and consider requiring an account to check out. Our card testing guide covers the full response.

6. Make the hosting work for you

Good managed WordPress hosting patches PHP for you, keeps daily backups off the server, and offers a staging copy for testing updates. Ask your host three things: when PHP gets patched, where backups are stored, and when someone last tested a restore. If the answers are vague, that’s your answer.

7. Watch for changes

A security plugin that alerts you to new admin accounts, changed files and failed login waves turns a silent compromise into a same-day email. Pair it with free uptime monitoring and Google Search Console, which emails you if Google finds malware on your site.

Should I move to Shopify for security?

Not for security alone. Shopify takes the server, PHP and checkout off your plate, which is a real advantage if nobody is maintaining your WooCommerce store. A well-maintained WooCommerce store is perfectly safe, though, and switching platforms is a big project. Choose based on how you run the business, and read our Shopify migration playbook if you’re weighing the move.

A Tampa Bay note

A lot of Tampa Bay WooCommerce stores began as a WordPress site with “a shop added later,” often by a developer who has since moved on. Those stores tend to carry years of plugins nobody remembers installing. If that sounds like yours, steps 2 and 3 are the place to start.

Want us to check it?

Our website security audit covers WooCommerce from the server up: PHP and hosting, plugins and their status, admin accounts, checkout scripts, card testing defenses and a real backup restore. Our WordPress development team can make the fixes, and a care plan keeps them in place every month.

Common questions

How often should a WooCommerce store be updated? Security updates as soon as they’re out, with automatic updates on for minor and security releases. Bigger updates can wait a few days for a staging test.

Do security plugins stop everything? No. They’re valuable for alerts, scans and login protection, but they can’t patch PHP or fix an abandoned plugin for you.

What’s the single biggest risk for a small WooCommerce store? Plugins nobody is updating. Cut the list down and keep the rest current.