In this guide · 8 sections
Short answer
Use hosted or embedded card fields (Stripe, WooPayments, HitPay) so cards never touch your server, turn on MFA for every admin, keep WordPress, WooCommerce and plugins updated, add CAPTCHA or Turnstile at checkout against card testing, and set order data retention in WooCommerce's privacy settings.
Keep card details off your server
The single most important decision is how the card form works. If card numbers are typed into a form hosted by your payment provider, or into fields embedded from the provider's domain, they never pass through your WordPress server. That keeps you out of the most demanding parts of PCI DSS.
| Checkout setup | Card data touches your server? | Typical PCI questionnaire |
|---|---|---|
| Redirect to provider's hosted payment page | No | SAQ A |
| Embedded card fields from the provider's domain (e.g. Stripe Elements, WooPayments) | No | SAQ A, with the 2025 script-protection criterion |
| Your own form that posts card data to the provider via JavaScript | No, but your page controls the form | SAQ A-EP |
| Card numbers sent to or stored on your server | Yes | SAQ D (avoid) |
Our guide to PCI DSS for small merchants explains the SAQ types and the January 2025 change that asks merchants with embedded payment forms to confirm their site resists script attacks. Never install a plugin that offers to "save cards on your site" unless it stores them with the payment provider as tokens.
Lock down admin access
Most WooCommerce break-ins start with a stolen or guessed admin password. Once someone is in, they can add a fake payment script, create admin users or change payout details.
Admin access checklist
WordPress's hardening guide notes that the dashboard's file editor is often the first tool an attacker uses after logging in, because it allows code execution, and recommends disabling it with define( 'DISALLOW_FILE_EDIT', true ).
Plugins, themes and updates
Every plugin and theme is code that can have a vulnerability, and WooCommerce stores tend to collect them over time. WordPress has supported automatic updates since version 3.7, and its hardening guide recommends using them.
Remove what you do not use
Delete, do not just deactivate, unused plugins and themes. Deactivated code can still be exploited.
Turn on automatic updates for minor and security releases
For WordPress core and well-maintained plugins. Test major WooCommerce updates on a staging copy first.
Check plugin sources
Install only from WordPress.org or the vendor's own site. Nulled or pirated premium plugins often contain malware.
Watch for vulnerability alerts
Use your host's scanner or a security plugin that flags known vulnerabilities in installed versions.
Keep daily off-site backups
WordPress recommends regular backups of files and the database. Test a restore at least once.
When a plugin you use has a published vulnerability, our WordPress plugin vulnerability guide explains how to judge urgency and what to do in the first hour.
Stop card testing at checkout
Card testing is when fraudsters run large numbers of stolen cards through your checkout to see which work. WooCommerce's card testing guide says a common sign is a large increase in orders with the Failed status and notes about declined cards. These failed orders are not lost sales, but the attack can lead to transaction fees, disputes and damage to your reputation.
Do
- CAPTCHA or Cloudflare Turnstile on checkout
- Your gateway's fraud rules (for example Stripe Radar or WooPayments fraud protection)
- Minimum price on donation or pay-what-you-want products
- Disabling guest checkout during an attack
Avoid
- Ignoring a spike in Failed orders
- Leaving low-value test-friendly products public during an attack
- Not refunding successful fraudulent orders quickly
- Installing an anti-fraud plugin without configuring it
For the Stripe-specific response, including Radar rules, see our guide to card testing attacks on Stripe.
Order data retention and customer privacy
Old orders hold names, addresses, phone numbers and purchase history. Keeping them forever increases what a breach exposes. WooCommerce's accounts and privacy settings let you set how long each type of record is kept before deletion or anonymisation.
| WooCommerce setting | What it does | Sensible starting point |
|---|---|---|
| Retain inactive accounts | Deletes customer accounts unused for the period | 2 to 3 years |
| Retain pending orders | Removes unpaid or abandoned orders | 30 to 90 days |
| Retain failed orders | Removes failed payment orders | 30 to 90 days |
| Retain cancelled orders | Removes cancelled orders | 6 to 12 months |
| Retain refunded orders | Anonymises personal data after the period | At least 5 years if needed for tax records |
| Retain completed orders | Applies to fulfilled orders | At least 5 years if needed for tax records |
Completed and refunded orders are sales records. IRAS generally expects business records to be kept for at least five years (see our guide to keeping business records digitally), so do not set retention shorter than your accountant advises. Unpaid and failed orders have no tax purpose and can go quickly. WooCommerce runs the clean-up daily once enabled.
Monitoring: know when something changes
Many WooCommerce compromises are found weeks later, when customers report card fraud or a payment gateway flags the site. Simple monitoring shortens that gap.
- New admin user alerts: get an email whenever an administrator account is created.
- File change monitoring: your host or security plugin flags changed core or plugin files.
- Checkout page script review: check which external scripts load on the checkout page after each change.
- Failed order alerts: a sudden rise in failed orders is your early warning of card testing.
- Uptime and SSL monitoring: know before customers do when the store is down or the certificate expires.
Do it yourself or get help?
Store owners comfortable with WordPress admin can work through most of this checklist in a day: MFA, updates, removing plugins, adding Turnstile and setting retention. Changing gateways, cleaning up after a compromise, or confirming your PCI scope are where help is worth it.
Our Website Security Hardening (S$290) covers admin MFA, updates, file editing, firewall rules, backups and checkout protection for WordPress and WooCommerce. If you need to switch to hosted card fields, Online Payment Setup (S$290) configures Stripe, HitPay or WooPayments correctly. IT Sorted is a Singapore-based team of developers with over 10 years of experience. You pay upfront, send your brief in writing through the site chat or contact form, and track progress on your order page.
Frequently asked questions
Yes, if you use a payment gateway with hosted or embedded card fields so card numbers never touch your server, and you maintain the WordPress site with updates, admin MFA and a short list of trusted plugins. Most WooCommerce security problems come from outdated plugins and weak admin logins rather than from WooCommerce itself.
It depends on how the card form works. Redirecting to the provider's hosted page or using embedded fields from the provider's domain, such as Stripe Elements or WooPayments, usually means SAQ A, the shortest form. If your own page controls the card form, it is likely SAQ A-EP. Ask your payment provider to confirm.
WooCommerce says a common sign is a sudden increase in orders with the Failed status and order notes about declined cards, often for low-value products. Refund any successful fraudulent orders quickly, add CAPTCHA or Cloudflare Turnstile to checkout, tighten your gateway's fraud rules and consider disabling guest checkout until the attack stops.
For most small stores, yes for security and minor releases. WordPress has supported automatic updates since version 3.7 and recommends using them. Test major WooCommerce and theme updates on a staging copy first, keep daily off-site backups, and delete plugins you no longer use rather than leaving them deactivated.
Keep completed and refunded orders as long as your accountant needs them for tax records, generally at least five years in Singapore. Pending, failed and cancelled orders have no tax purpose and can be deleted after a few weeks or months. WooCommerce's personal data retention settings let you set each period.