You do not need to be a developer to find the most common problems in an online store. This checklist takes about half an hour and covers the issues behind most of the incidents we see. Do it once now and once a quarter.
1. Versions (5 minutes)
- Which version of the platform (WooCommerce/WordPress, OpenCart, PrestaShop, Magento) are you running, and is it still receiving security updates?
- Which PHP version does your hosting use? Anything below the currently supported branches means known vulnerabilities with public exploits.
- When was the last update applied? If the answer is “I don’t remember”, that is your first task.
2. Plugins, modules and themes (10 minutes)
- Count them. Then count how many you actually use.
- For each one you keep: when was it last updated by its author? Anything untouched for more than a year is a liability.
- Delete, do not just deactivate. Inactive code is still on the server and still exploitable.
3. Accounts (5 minutes)
- List all administrator accounts. Remove former employees, agencies and “temporary” users.
- Is two-factor authentication enabled for every admin?
- Is the admin login reachable from the whole internet, or restricted to your office and VPN?
- Are the database, FTP/SFTP and hosting panel passwords unique and stored in a password manager?
4. Checkout and third-party scripts (5 minutes)
- Open the checkout page, view the source, and list every external script domain. Do you recognise all of them?
- Does the site set a Content Security Policy? (Check the response headers with a free online header checker.)
- Is the payment form served by your payment provider (redirect or iframe) rather than collecting card numbers on your own page?
5. Backups and monitoring (5 minutes)
- Where are backups stored, how often, and when did someone last restore one to check that it works?
- Who receives an alert if the site goes down, if files change or if disk space runs out?
- Is there a log of admin logins you could review after an incident?
How to read your result
If you answered “no” or “don’t know” to more than three items, your store is likely to be compromised at some point through no fault of your own: the automated scanners will get there eventually. None of the fixes above are expensive. Most are a day or two of work plus a routine.
If you would rather have us do it
Our security check goes deeper than this list: configuration review, dependency audit, header and TLS check, permission review, a look at the logs, and a test of the backup. You get a short prioritised report and a fixed quote for the fixes. Ask for a security check, and mention which platform you run.
