In short
A WooCommerce store has all the risks of WordPress plus one of its own: the checkout, where fake card forms get injected and stolen cards get tested with fake orders. At WebIntacta I (Jose Soriano, working remotely worldwide) start with a free external scan; the security report for stores costs €169, and the Online store maintenance plan, which monitors the checkout and makes a test purchase every month, costs €69/month, excluding VAT.
Reviewed by Jose Soriano ·
WooCommerce inherits the risks of WordPress (outdated plugins, weak passwords) and adds one of its own: the checkout. One vulnerable plugin is enough for someone to inject a fake card form, and a checkout without limits lets others test stolen cards with fake orders.
Data protection. Controller: Jose Soriano Castro. Purpose: to send you the diagnostic PDF, email you for 30 days if a security flaw affecting your site is published (with a follow-up scan on day 30) and reply in writing to your question; offers only if you tick that box. Legal basis: your consent. Recipients: nobody, unless required by law. You can unsubscribe at any time with the link in every email or by writing to me. Rights: access, rectification, erasure, objection, restriction and portability. Privacy policy.
STEP 01
It starts with the external scan: version, visible plugins, exposed files, headers and blacklists.
STEP 02
With the read-only connector I check file integrity, the database and the users, without you giving me FTP access.
STEP 03
I update with a backup first, monitor integrity every day, make a test purchase every month and, if you get attacked, the cleanup is included.
Dozens of small orders, almost all failed, with made-up names and emails: someone is using your checkout to check which stolen cards still work. It doesn't mean you have been hacked, but it costs you fees, can get your payment provider to block you and fills the store with fake customers.
Step by step, in the guide to fake orders in WooCommerce.
A skimmer is a piece of JavaScript that copies what your customers type at checkout and sends it to another server. The store keeps selling as usual; you find out when the bank warns you. In WooCommerce it usually arrives through a vulnerable plugin and stays in the database or in a theme file. How to detect it and what to do, in the guide to credit card skimming in online stores.
You can stop at the free scan. If your store sells every day, the Online store plan is what saves you the scare.
Security grade and the problems visible from the internet, in a few minutes and with no sign-up.
Free
No sign-up, no commitment
Everything in the website report, plus a review of checkout and the store's modules.
€169
excluding VAT$169 outside the EU
PrestaShop or WooCommerce: everything in the business website plan, plus checkout monitoring.
€69/month
excluding VAT$59/month outside the EU
Outside the EU, the Online store plan for a WooCommerce store costs $59/month. All prices
WooCommerce itself is maintained and patched; most problems come from outdated plugins, extra admin users and a checkout nobody watches. It is as secure as the way it is kept: updated, with few plugins, and with someone checking that the checkout hasn't been tampered with.
A plugin helps (firewall, limit on login attempts), but it doesn't replace keeping everything updated or checking that nobody has tampered with the checkout. I compare them in which WordPress security plugin to choose.
Not necessarily: it is usually someone testing stolen cards through your checkout. It is stopped with attempt limits, a bot check at checkout or rules in the payment provider. If there are also users or scripts you don't recognize, then yes, it is an intrusion.
On the Online store plan, yes, from the third month after signing up. If you get infected before that, the cleanup is quoted separately.
Yes. The connector installs like any other plugin and doesn't depend on the hosting. I only need server access if there is something to clean.
Free external scan. No sign-up and nothing to install.
Data protection. Controller: Jose Soriano Castro. Purpose: to send you the diagnostic PDF, email you for 30 days if a security flaw affecting your site is published (with a follow-up scan on day 30) and reply in writing to your question; offers only if you tick that box. Legal basis: your consent. Recipients: nobody, unless required by law. You can unsubscribe at any time with the link in every email or by writing to me. Rights: access, rectification, erasure, objection, restriction and portability. Privacy policy.