# WooCommerce security: a monitored checkout and no more fake orders.

> WooCommerce security: I audit plugins, checkout and users, stop card testing (fake orders) and monitor the store. Online store plan, €69/month.

URL: https://webintacta.com/en/woocommerce-security
Language: English (Spanish version: see the hreflang alternate of the HTML page)
Last updated: 2026-10-24

**In short:** A WooCommerce store has all the risks of WordPress plus one of its own: the checkout, where fake card forms get injected and stolen cards get tested with fake orders. At WebIntacta I (Jose Soriano, working remotely worldwide) start with a free external scan; the security report for stores costs €169, and the Online store maintenance plan, which monitors the checkout and makes a test purchase every month, costs €69/month, excluding VAT.


WooCommerce inherits the risks of WordPress (outdated plugins, weak passwords) and adds one of its own: the checkout. One vulnerable plugin is enough for someone to inject a fake card form, and a checkout without limits lets others test stolen cards with fake orders.

## What I check in a WooCommerce store

- WooCommerce version and every payment, shipping and invoicing plugin against published vulnerabilities
- Third-party scripts loaded on the cart and checkout pages
- Fake orders in bulk (card testing) and customer accounts created by bots
- Core and plugin files that don't match the originals
- Users with the administrator or shop manager role
- Backups, logs or order exports reachable from the internet

## How I do it

1. **Free scan.** It starts with the external scan: version, visible plugins, exposed files, headers and blacklists.
2. **Inside report.** With the read-only connector I check file integrity, the database and the users, without you giving me FTP access.
3. **Online store maintenance.** I update with a backup first, monitor integrity every day, make a test purchase every month and, if you get attacked, the cleanup is included.

## The two attacks I see most in WooCommerce

## Fake orders and card testing

Dozens of small orders, almost all failed, with made-up names and emails: someone is using your checkout to check which stolen cards still work. It doesn't mean you have been hacked, but it costs you fees, can get your payment provider to block you and fills the store with fake customers.

- A limit on payment attempts per IP and per session
- A bot check at checkout (your payment provider's, or a CAPTCHA)
- Risk rules in the payment provider (Stripe Radar, for example)
- Disabling account creation without an order if you don't need it

Step by step, in the [guide to fake orders in WooCommerce](https://webintacta.com/en/guides/woocommerce-fake-orders).

## Skimmers: the card form you didn't put there

A skimmer is a piece of JavaScript that copies what your customers type at checkout and sends it to another server. The store keeps selling as usual; you find out when the bank warns you. In WooCommerce it usually arrives through a vulnerable plugin and stays in the database or in a theme file. How to detect it and what to do, in the [guide to credit card skimming in online stores](https://webintacta.com/en/guides/credit-card-skimming-online-store).

## Price

You can stop at the free scan. If your store sells every day, the Online store plan is what saves you the scare.

### External scan — Free
Security grade and the problems visible from the internet, in a few minutes and with no sign-up.
- Platform and version (WordPress, PrestaShop, WooCommerce, Shopify…)
- Visible plugins and modules with published flaws
- Files that should not be public (backups, .git, configuration files)
- HTTPS, certificate and security headers
- Domain email (SPF, DKIM, DMARC) and blocklists
- AI agent readiness (scored separately)

### Security report · online store — €169 (excluding VAT)
Everything in the website report, plus a review of checkout and the store's modules.

$169 outside the EU.
- Everything in the business website report
- Skimmers: scripts that copy cards at checkout
- Modified overrides and payment modules
- Database: scripts injected into content and settings

> Fully credited if you hire a cleanup or maintenance within 30 days.

### Maintenance · Online store — €69/month (excluding VAT)
PrestaShop or WooCommerce: everything in the business website plan, plus checkout monitoring.

$59/month outside the EU.
- Everything in the Business website plan
- Daily scan and file integrity monitoring with the connector
- Module review before updating (on a staging copy when possible)
- Monthly test purchase
- 1 hour of technical work a month
- Cleanup included if it gets infected (from the 3rd month)

> No minimum term. Annual payment: 10 months.

**+ Priority add-on: +€25/month** (+$19/month outside the EU). Your issues go to the front of the work queue and, if you get hacked, the cleanup gets priority at no extra cost.

Outside the EU, the Online store plan for a WooCommerce store costs $59/month.

## Frequently asked questions

### Is WooCommerce secure?

WooCommerce itself is maintained and patched; most problems come from outdated plugins, extra admin users and a checkout nobody watches. It is as secure as the way it is kept: updated, with few plugins, and with someone checking that the checkout hasn't been tampered with.

### Which security plugin do I need?

A plugin helps (firewall, limit on login attempts), but it doesn't replace keeping everything updated or checking that nobody has tampered with the checkout. I compare them in [which WordPress security plugin to choose](https://webintacta.com/en/guides/best-wordpress-security-plugin).

### I'm getting fake orders. Have I been hacked?

Not necessarily: it is usually someone testing stolen cards through your checkout. It is stopped with attempt limits, a bot check at checkout or rules in the payment provider. If there are also users or scripts you don't recognize, then yes, it is an intrusion.

### Does the maintenance include the cleanup?

On the Online store plan, yes, from the third month after signing up. If you get infected before that, the cleanup is quoted separately.

### Does it work with any hosting provider?

Yes. The connector installs like any other plugin and doesn't depend on the hosting. I only need server access if there is something to clean.

Hire or ask (email and chat): https://webintacta.com/soporte?lang=en