Infrastructure

Security for WooCommerce and Shopify stores

Skimmers, carding bots, vulnerable plugins and customer data you export.

4 guides4 in-depth60 min of reading

Attacks on stores go after money and customer data, and the most damaging ones are designed to stay quiet. A Magecart skimmer is a few lines of JavaScript on the checkout page that copy card details as customers type them, and it often hides from logged-in admins, so the store looks normal to its owner. Card testers use the checkout to check stolen card numbers, which brings authorization fees, disputes and possibly a processor review. A vulnerable plugin is how most of this gets in. A customer export left in a synced Downloads folder can leak data without anyone attacking the site at all. Because none of these show up as downtime, uptime checks don't catch them.

Catching Magecart skimmers uses three layers. It compares every file with WordPress.org's official checksums and a baseline, queries the database for injected scripts, and sends a Content-Security-Policy so the browser won't send card data to unlisted hosts. On a real WordPress 7.1.3 and WooCommerce 11.2.1 install, the script found all 10 planted changes with no false positives, and an enforced CSP blocked all 5 exfiltration channels we tried. Stopping carding bots layers a WAF, origin rate limits on payment endpoints, WooCommerce's checkout limit and gateway velocity rules. It also explains why limits by IP alone fail against testers that rotate addresses.

Prevention starts before deploy. Vulnerability scanning in CI/CD checks every plugin, theme and core version against the free Wordfence Intelligence feed and fails the build on high-severity or unrated issues. It also verifies wordpress.org checksums to catch modified or nulled plugins. Securing customer export files covers the data that leaves the store. Exports should be short-lived, moved into end-to-end encrypted storage straight away, shared by link instead of attachment, and found by a scanner that never prints their contents. Under the GDPR, data that is encrypted and unreadable to whoever took it can spare you from notifying every customer after a breach.

Start here

Store security17 min read

Catching Magecart and card skimmers on WooCommerce: file integrity scripts vs MalCare

A Magecart skimmer is JavaScript injected into your checkout that copies card details as customers type them and sends them to the attacker. On WooCommerce it gets in through a core or plugin file, a theme, a must-use plugin, or a database option, and it often hides from logged-in admins. Catch it in three layers: compare every file with WordPress.org's official checksums and a baseline of everything else, query the database for injected scripts, and send a Content-Security-Policy header so the browser refuses to send card data to hosts you didn't list. Our tested Python script found all 10 planted changes on a real WordPress 7.1.3 and WooCommerce 11.2.1 install with no false positives, and in headless Edge an enforced CSP blocked all 5 exfiltration channels we tried. MalCare does the scanning on its own servers, covers files and database, adds a firewall and cleans up on paid plans: the better choice if nobody will read a nightly report.

Store security14 min read

Stopping bot attacks and carding on WooCommerce: Sucuri vs Cloudflare WAF, with log detection you can run tonight

Stop card testing in layers, as early as possible: a WAF in front of the store (Sucuri as a managed service, or Cloudflare if someone on your team owns the rules), rate limits on the payment endpoints at the origin, WooCommerce's own checkout rate limit, and velocity rules at the payment gateway. Rate limit by IP alone fails against testers that rotate through many addresses, so also watch whole networks and attempts from visitors who never browsed a product. Sucuri suits stores without a security person: one price per site, its team handles the WAF rules and virtual patching, malware cleanup is included, and Protected Pages can put a CAPTCHA on the add payment method page. Cloudflare gives more control and a free tier, but rate limiting on Free is one rule with a 10-second window, and Bot Fight Mode can't be skipped for payment gateway callbacks.

Store security16 min read

Automated vulnerability scanning in CI/CD for WordPress: Wordfence CLI vs manual audits

Add a job to GitHub Actions that lists every plugin, theme and core version in the repository, checks them against Wordfence Intelligence's free vulnerability feed, and fails the build on anything rated CVSS 7 or higher, or not rated at all. The same job compares each wordpress.org plugin with the official checksums for its version, which catches modified or nulled copies, and flags obfuscated code in your own plugin and theme. Run it on every pull request and once a day, and make the deploy depend on it. Wordfence CLI did the vulnerability part, but as of October 2026 it isn't sold to new customers, and the free version reached end-of-life on October 14, 2026. The feed it used is still free with an API key. Keep Wordfence Premium on the live site for what CI can't see: attacks, and vulnerabilities disclosed after your last deploy.

All store security guides

Store security13 min read

Securing customer export files and order data: encrypted storage vs the Downloads folder trap

Every customer or order export from Shopify or WooCommerce is a spreadsheet of names, emails, addresses and phone numbers, and by default it lands in the Downloads folder, often in a cloud-synced Desktop or Documents folder, and then in an email to the accountant. Treat exports as short-lived: export only when needed, move the file into an end-to-end encrypted locker straight away, share it through an encrypted link instead of an attachment, and delete the plain copies. Full-disk encryption protects a laptop that is switched off; it doesn't protect files that sync to the cloud, get attached to email or are read by malware on a running machine. Under the GDPR, data that is encrypted and unreadable to whoever got it can spare you from notifying every affected customer after a breach. NordLocker is the simplest end-to-end encrypted option for non-technical staff; Cryptomator and GPG are free open-source alternatives. Our tested Python scanner finds exports left in plain text without printing their contents.