- Home
- WooCommerce security
WooCommerce security,
in plain English
Six ways online stores actually get compromised — what each attack looks like, what it costs, and the specific thing that stops it. No jargon, no fear-selling, no 90-point hardening checklist you'll never finish.
Brute force on wp-login.php
Automated scripts request your login page thousands of times a day, trying common usernames against leaked password lists. It's not personal and it's not targeted — every WordPress site on the internet gets this traffic, forever.
What it costs you. Even when it fails, the volume burns server CPU and can slow your store during traffic peaks. When it succeeds, the attacker has your entire admin: products, orders, customer data and payment settings.
- The usual advice: limit login attempts, add a CAPTCHA, rename the login URL. All of it slows attackers down. None of it stops them.
- What actually works: make the login page unreachable. If
/wp-login.phpreturns nothing to anyone outside your team, there is no page to attack.
The password that leaked in 2019
Most store compromises don't involve any clever exploitation. Someone reused a password on a forum, that forum was breached, and the credentials ended up in a list that's been resold ever since. Attackers simply log in.
What it costs you. A valid login looks exactly like you. There's no alert, no failed attempt, no anomaly — just a legitimate session doing whatever it likes, often for weeks.
- The usual advice: strong unique passwords and two-factor authentication. Genuinely good — if every person with access follows it, forever.
- What actually works: having no password at all. A credential that doesn't exist can't be reused, phished or found in a breach dump.
Plugins you installed and forgot
The average WooCommerce store runs 20–40 plugins. Each one is code written by someone else with full access to your database. When a vulnerability is disclosed, automated scanners start probing every store on the internet within hours.
What it costs you. Many plugin vulnerabilities are privilege-escalation bugs: they let an attacker create an admin account or execute code through an authenticated endpoint. Your admin layer is the target.
- Do this first: uninstall — don't just deactivate — every plugin you aren't using. Deactivated code is still on disk and still reachable.
- Then: keep updates on, and make sure the admin endpoints those plugins register aren't reachable by anyone outside your team.
- And: log plugin activations, so an unexpected new plugin shows up as an event rather than a surprise.
Card testing through your checkout
Fraud rings buy stolen card numbers in bulk and need somewhere to test which ones still work. A small store with an open checkout and a cheap product is perfect: they push hundreds of tiny transactions through and keep the ones that succeed.
What it costs you. Gateway fees on every attempt, chargebacks on every success, and eventually a risk review or a frozen merchant account. This one hits your bank balance directly.
- At the gateway: turn on your provider's velocity and radar rules — Stripe Radar, PayPal fraud filters. This is your first line and it's usually free.
- At the store: require an account or CAPTCHA for guest checkout on your lowest-priced items, and cap orders per IP per hour.
- Behind the scenes: watch for a sudden spike in failed payments — it's the earliest signal, and it usually starts overnight.
The contractor who still has access
You hired a developer for a theme fix eighteen months ago. The admin account is still there. So is the one for the agency you stopped working with, and the shared login your first VA used. Nobody removed them because nobody was tracking them.
What it costs you. Not usually malice — usually a laptop that got infected, or a password manager that got breached. Either way, the account is a live key to your store held by someone who doesn't work for you.
- Audit today: open
Usersin WordPress and remove every administrator you can't name and justify in one sentence. - Never share logins. One person, one account — otherwise the activity log can't tell you who did anything.
- Make revoking easy. If removing access is a chore, it doesn't happen. It should be one click.
The checkout that broke at 2am
This one isn't an attack, and it's the most common way stores lose money. A plugin auto-updates, throws a fatal error on the payment step, and your storefront keeps looking perfect. Orders simply stop arriving.
What it costs you. Every hour of a broken checkout is a full hour of traffic, ad spend and email campaigns converting to nothing. Most owners find out from a customer email the next morning.
- Monitor the funnel, not just uptime. An uptime checker sees HTTP 200 on your homepage and reports everything is fine.
- Alert on fatal errors the moment PHP breaks, with the file and plugin that caused it.
- Correlate with changes. Nine times out of ten the answer is “the plugin that updated four minutes earlier”.
The 10-minute store checklist
You don't need to do everything. You need to do these, and most of them are free.
- Remove unused admin accounts. Open Users → Administrators. Delete anyone you can't justify in one sentence. Two minutes.
- Delete deactivated plugins. Deactivated is not removed. The code is still on disk and still reachable.
- Turn on gateway fraud rules. Stripe Radar or your provider's equivalent. Usually included, usually off by default.
- Stop sharing logins. One account per person, no exceptions — otherwise no log can tell you who did what.
- Check who can reach wp-admin. Right now, the answer is “the entire internet”. That's the single biggest thing you can change.
- Set up a real backup. Off-site, automated, and — critically — test that you can actually restore it.
- Alert on checkout errors. Not homepage uptime. The payment step is what pays you.
Six risks. One afternoon.
Or three minutes.
WooSecure closes the admin-layer risks on this page automatically — hidden wp-admin, no passwords, full activity logs and checkout error alerts. Install it and move on with your day.