WooCommerce Security Checklist 2026 (What Actually Matters)

Most WordPress security checklists tell you to change your database prefix, rename wp-login.php and hide your WordPress version. None of that is wrong. It just stops before the parts that make a store different from a blog: the checkout, the payment gateway, the customer data and the API that Block Checkout runs on.

Those are the parts I care about most at Themology, because Bouncer, the CAPTCHA plugin we sell, lives at the checkout. We don’t sell a security plugin, so everything else on this list is someone else’s tool. I picked each one because it does the job.

TLDR

Start with the basics that break stores when they’re missing: isolated hosting, HTTPS, a supported PHP version and backups you’ve actually restored. Then lock down logins with 2FA by role. Then harden what’s specific to WooCommerce: bot protection on checkout, rate limiting, the payment gateway’s AVS and 3D Secure, unused payment methods and REST API keys. Add monitoring, and keep everything updated.

Why WooCommerce security is its own problem#

WordPress security and WooCommerce security overlap, but they’re not the same thing. A blog needs protection against brute force logins and malware. A store needs all of that, plus protection for payment flows, customer data, and the API endpoints a blog doesn’t have.

Payment data attracts a different attacker. Blog hackers want to inject SEO spam or redirect traffic. Store attackers want to test stolen credit cards, skim payment details, or pull customer data. The stakes are higher.

Checkout is a live target. Block Checkout is React-based, so traditional PHP form hooks don’t work the same way. Express payments (Apple Pay, Google Pay, Amazon Pay) run their own flows. WooCommerce PayPal Payments has its own built-in reCAPTCHA. Each of these changes how bot protection has to work, and generic WordPress guides don’t cover any of them.

Part of the API is public on purpose. WooCommerce’s Store API, the one Block Cart and Checkout run on, answers without a login. Visit yourstore.com/wp-json/wc/store/v1/products and you’ll see your product data. That’s by design.

The admin REST API at /wp-json/wc/v3/ is different: it needs an API key or a logged-in user with the right permissions. Attackers poke at both, which is why the Store API’s checkout needs bot protection and the v3 keys need care.

Cart fragments can be a load problem. WooCommerce’s cart fragments request (?wc-ajax=get_refreshed_fragments) skips page caching and hits your server directly.

WooCommerce itself now only loads the cart fragments script with the classic Cart widget, but some themes load it on every page. Storefront does.

On those stores, bots can hammer that endpoint to slow the server down. My guide on why most WooCommerce stores feel slow explains the performance side.

AI-powered carding is a 2026 reality. Generative AI now creates synthetic identities with realistic names, matching addresses and human-like checkout behavior. CAPTCHA still blocks basic bots, but stopping this kind of fraud needs several layers. I covered it in my guide to stopping fake orders.

The checklist#

It’s ordered by priority. Start at the top and work down. The first two sections are the foundation, and everything after them assumes they’re done.

Infrastructure#

These aren’t exciting. They’re also not optional.

Use hosting with server-level isolation. On shared hosting, your store shares a server with hundreds of other sites. If one gets compromised, your store is at risk too. Managed WordPress hosts like Pressable, Cloudways or Kinsta run each site in its own isolated environment. If your host doesn’t mention isolation, it’s probably shared.

Make sure HTTPS is on everywhere and the certificate renews itself. Every page should load over HTTPS, not just checkout. Check for mixed content warnings, where some images or scripts still load over HTTP.

Most hosts include free SSL through Let’s Encrypt with auto-renewal. If you manage certificates by hand, put the renewal date in your calendar, because an expired certificate triggers browser warnings that kill trust instantly.

Then check Settings > General: when your site address starts with https, WooCommerce treats the whole store as secure and hides its old “Force secure checkout” option under WooCommerce > Settings > Advanced. If you still see that option, your site address isn’t on HTTPS yet.

Run PHP 8.3 or higher. WooCommerce 11.2 still installs on PHP 7.4, according to its readme, but that doesn’t make old PHP safe. The PHP project’s supported versions page shows PHP 8.1 is past its end of life, and 8.2 gets security fixes only until December 31, 2026.

PHP 8.3 is covered until the end of 2027, and 8.4 until the end of 2028. Check your version under Tools > Site Health > Info > Server. If your host can’t move you to 8.3 or newer, that’s a reason to switch hosts.

Set up automatic backups with off-site storage. Your backups need to cover WooCommerce data: orders, customer records, subscriptions. A backup that saves files but misses database tables is useless for a store.

Store backups off-site (cloud storage, not the same server) and pick a tool that can restore to a point in time.

UpdraftPlus and Jetpack VaultPress Backup both handle WooCommerce data correctly. Then restore one on a staging site. An untested backup isn’t a backup.

Authentication and access#

Enforce strong passwords for admin and shop manager accounts. It sounds obvious, and it’s still the most common weak spot.

WooCommerce adds the Shop Manager role, which can see orders, customers, coupons and settings, so a stolen shop manager login is nearly as bad as a stolen admin one. A plugin like Password Policy Manager can enforce password rules for those roles.

Turn on two-factor authentication for every admin-level user. 2FA adds a second step after the password, usually a time-based code from an authenticator app. Even if a password is phished, the attacker can’t get in without the phone. Require it for Administrator and Shop Manager at minimum.

Free plugins that handle this:

• WP 2FA (100,000+ active installs) is the most popular dedicated option. It supports authenticator apps (Google Authenticator, Authy) and email codes. The part that matters for stores: you can require 2FA by user role, so admins and shop managers must use it while customers don’t. It also supports 2FA setup from the front end, which helps if your shop managers never open the WordPress dashboard.
• Two-Factor (100,000+ active installs) is the plugin built by WordPress contributors. It’s simple with no setup overhead, but it can’t require 2FA by role. Each user has to turn it on.

Earlier versions of this list included Wordfence Login Security, the standalone 2FA plugin from the Wordfence team. WordPress.org closed it on August 17, 2026 at its author’s request, so I’ve taken it off. If you already use the full Wordfence plugin or Kadence Security, both include 2FA in their free versions, and you don’t need a separate plugin.

Limit login attempts. Brute force bots try thousands of username and password pairs. Limiting failed logins per IP address stops them before they get lucky. Wordfence, Kadence Security and Jetpack all include brute force protection. On Cloudflare, you can also add rate limiting rules for your login URL, which blocks attempts before they reach WordPress.

Review user roles every quarter. Stores collect accounts over time: former staff, contractors, seasonal help. Every unused account with high permissions is a liability. Go through Users > All Users and remove or downgrade accounts that don’t need access anymore.

Give each person the least access they need for their work. If shop managers use shared or public computers, add an automatic logout for idle sessions. Plugins like Inactive Logout do this, so nobody can walk up to an open admin session with access to orders and customer data.

WooCommerce-specific hardening#

This is where most security guides stop being useful, because they don’t cover WooCommerce at all.

Lock down REST API keys, and leave the Store API alone. The Store API has to stay public, because Block Cart and Checkout use it. Blocking it breaks your checkout. What you can control are the keys for the admin API, under WooCommerce > Settings > Advanced > REST API.

Delete keys you don’t use. Give the ones you keep the least access they need (Read instead of Read/Write where an integration only reads), and replace them now and then. If you don’t use any external integrations (a headless front end, a mobile app, a sync service), you shouldn’t have any keys at all.

Protect checkout against bots. Add CAPTCHA or a honeypot to your checkout, login and registration forms. In 2026 that means checking compatibility with Block Checkout, express payments and WooCommerce PayPal Payments’ own reCAPTCHA, which can reject the same order as your CAPTCHA plugin if the two aren’t set up to stay out of each other’s way.

I explained how to set that up in how to fix WooCommerce PayPal Payments reCAPTCHA conflicts. I tested 7 options in my WooCommerce CAPTCHA plugin comparison. The short version: Cloudflare Turnstile (free) works well for most stores.

If you use PayPal Payments or want rate limiting built in, our Bouncer - reCAPTCHA & Fraud Protection for WooCommerce supports all five major CAPTCHA providers, includes fraud scoring, rate limiting, an IP blocklist and geo-blocking, and works with Block Checkout and WooCommerce PayPal Payments out of the box.

Rate limit checkout submissions. CAPTCHA stops single bot submissions. Rate limiting stops the volume. Someone who submits 50 checkout attempts from the same IP in 10 minutes isn’t a customer. Some CAPTCHA plugins include this, and you can also set it up at Cloudflare or on the server for /?wc-ajax=checkout requests.

Watch failed orders for card testing. A sudden spike in Failed orders is often the first sign of a card testing attack, where bots try stolen credit cards in bulk on your checkout to see which ones still work.

Most attempts get declined, but the valid cards get sold or used for bigger fraud elsewhere. Don’t ignore failed orders because no money changed hands.

Set up alerts for unusual failure rates in your gateway’s dashboard (Stripe, PayPal and WooPayments all support this). If you use WooPayments, follow its card testing guidance for the response steps.

Use a PCI-compliant payment gateway with built-in fraud protection. Never store card numbers on your server. Use a gateway that handles card data on its own PCI-compliant systems and replaces card details with tokens, so the real numbers never touch your site.

Beyond PCI compliance, the major gateways include real-time fraud detection that catches what store-level plugins can’t:

• WooPayments is built on Stripe and includes Stripe Radar for real-time fraud scoring on every transaction. Radar uses machine learning trained on billions of transactions across the Stripe network to flag suspicious payments before they go through. You can set risk thresholds in WooPayments settings and add your own rules (block certain countries, require 3D Secure above a set amount). For most WooCommerce stores, I think WooPayments has the strongest fraud protection out of the box, because it pairs Stripe’s detection with a WooCommerce-native setup.
• Stripe for WooCommerce gives you the full Stripe dashboard with Radar, custom fraud rules, and a detailed risk breakdown for each transaction. If you want finer control than WooPayments gives you, this is the one.
• PayPal includes its own fraud protection and the Seller Protection program, which covers eligible transactions against unauthorized payments and item-not-received claims. It also has built-in reCAPTCHA on its payment endpoints.

Whichever gateway you use, turn on Address Verification System (AVS) and 3D Secure (SCA). AVS checks whether the billing address matches what the card issuer has on file. 3D Secure adds a check with the cardholder’s bank that a bot can’t complete with only a card number. Both live in your gateway’s settings.

Turn off unused payment methods. Every active payment method is one more way in. If you don’t use Cash on Delivery, Bank Transfer or Check Payments, turn them off. COD in particular is a favorite for spam bots because it skips all payment checks.

Defer or turn off cart fragments where you don’t need them. If your theme loads cart fragments on every page, that request skips page caching and hits your server each time, and bots can abuse it as a cheap way to add load.

Turn it off on pages that don’t need it, or defer it until the shopper interacts. Performance plugins like WP Rocket and our own SpeedForge handle this for you.

Monitoring and detection#

Security without monitoring is just hoping nothing goes wrong.

Run automatic malware scans. Install a security plugin that scans your files, themes and plugins on a schedule. Wordfence (its free version checks core files, themes and plugins against the WordPress.org copies) and Sucuri (remote and server-side scanning) are both good choices. The schedule is what matters. A manual scan only happens when you remember, which is never often enough.

Turn on file integrity monitoring. It tracks changes to your site’s files and alerts you when something changes unexpectedly. If an attacker injects a card skimmer into your checkout template, this is what catches it. Wordfence includes it. So does the free Sucuri Security plugin.

Keep an activity log. Track who logs in, what they change and when. This matters most for stores with several admin users. If a plugin gets deactivated, a role changes or a setting moves, you need to know who did it.

WP Activity Log (free) and Jetpack’s activity log both work well. After a breach, an activity log is often the only record of what happened and when.

Set up uptime monitoring. If your store goes down, you want to know right away, not when a customer emails you. Free services like UptimeRobot or Better Stack check your site every few minutes and alert you by email, SMS or Slack when it’s unreachable. Downtime can mean a DDoS attack, a crashed plugin or a compromised server.

Maintenance and hygiene#

The boring stuff that prevents most incidents.

Keep everything updated. WordPress core, WooCommerce, plugins, themes. This is the single most useful security habit, because most WordPress vulnerabilities come from outdated plugins. Turn on auto-updates for plugins you trust.

For WooCommerce itself, test updates on staging first (checkout and payment flows can break with minor updates), then update production. My HPOS and Block Checkout guide covers what to watch when WooCommerce’s core features change.

Remove unused plugins and themes. Every installed plugin is something an attacker can try, deactivated ones included. A deactivated plugin with a known vulnerability can still be exploited. If you’re not using it, delete it. The same goes for themes: keep your active theme and one default theme for troubleshooting, and remove the rest.

Purge old customer data you don’t need. GDPR (EU), CCPA (California) and similar laws require you to handle customer data responsibly. Beyond the law, data you don’t need is a liability.

If you don’t need addresses from orders placed three years ago, remove them. WooCommerce has built-in settings for anonymizing old order data under WooCommerce > Settings > Accounts & Privacy.

Test your backups by restoring them. Having backups means nothing if they don’t work. At least once a quarter, restore a backup to a staging site and check that orders, customer data, products and settings all come through. This is the step everyone skips, and it’s the one that matters most on the day you need a backup.

Tools I’d recommend#

None of these tools are ours. They’re here because I’ve seen them work on WooCommerce stores, not because I’m pushing them.

Security plugins:

• Wordfence (the free version is excellent for malware scanning, firewall and brute force protection).
• Sucuri Security (free plugin for file integrity and remote scanning; the paid WAF service is for bigger needs).
• Kadence Security (a good all-around option with 2FA, file change detection and login hardening).

Backup:

• UpdraftPlus (free with off-site storage; premium for incremental backups and more scheduling options).
• Jetpack VaultPress Backup (real-time backups that keep WooCommerce order data).

Two-factor authentication:

• WP 2FA (role-based enforcement, front-end setup, WooCommerce-aware).
• Two-Factor (built by WordPress contributors, simple per-user setup).

Payment gateways with fraud protection:

• WooPayments (Stripe Radar built in, WooCommerce-native, strong fraud protection out of the box).
• Stripe for WooCommerce (full Stripe dashboard access with custom Radar rules).
• WooCommerce PayPal Payments (Seller Protection, built-in reCAPTCHA on payment endpoints).

CAPTCHA: see my full comparison of 7 WooCommerce CAPTCHA plugins for the test results.

Firewall:

• Cloudflare’s free plan (DNS-level protection, Bot Fight Mode, basic WAF rules).
• Sucuri WAF (paid, but it handles malware cleanup if you get hacked).

Monitoring:

• WP Activity Log (free activity tracking for user actions).
• UptimeRobot (free uptime monitoring with 5-minute checks).

Frequently asked questions#

Is WooCommerce secure out of the box?#

WooCommerce follows WordPress coding standards and gets regular security updates. The core plugin is well maintained. But secure out of the box doesn’t mean secure without setup. A default store has guest checkout on, a public Store API (by design, for Block Checkout) and no form-level bot protection. You still need to harden it.

Do I need a security plugin for WooCommerce?#

For most stores, yes. A security plugin automates the tasks you’d otherwise forget: malware scanning, file integrity monitoring, brute force protection and firewall rules. Wordfence’s free version covers the basics. You only need to pay for premium security if you want things like real-time threat intelligence, a WAF or priority malware cleanup.

How do I stop carding attacks on my WooCommerce checkout?#

Stack your defenses: CAPTCHA on checkout to block basic bots, rate limiting to stop the volume, fraud scoring to catch the smarter attempts, and 3D Secure on your payment gateway for a check at the card level. I wrote a full guide on how to stop fake orders in WooCommerce that covers each method step by step.

Is WooCommerce PCI compliant?#

WooCommerce doesn’t store credit card data when you use a gateway that tokenizes cards (Stripe, PayPal, WooPayments). Card numbers are processed and stored on the gateway’s PCI-compliant servers, never on yours.

Your site stores tokens: strings that only work for that customer, your store and your payment processor. Even if someone stole the tokens from your database, they’d be useless anywhere else.

That shrinks your PCI scope a lot, but PCI-DSS still applies because your store serves the checkout page where card data is entered. You’re responsible for securing that page: SSL, access controls and server security. WooCommerce has a detailed guide on PCI-DSS compliance that covers what’s required at each level.

Which WooCommerce payment gateway has the best fraud protection?#

For most stores, I’d pick WooPayments, because it runs on Stripe with Radar turned on by default. Radar scores every transaction with machine learning trained on billions of payments, and you can adjust risk thresholds and blocking rules from WooCommerce settings. If you want finer control, the Stripe plugin gives you the full Stripe dashboard with advanced Radar rules.

PayPal has its own fraud filters plus Seller Protection for eligible disputes. Many stores run WooPayments (or Stripe) as the main gateway and PayPal as a second option, which gets them fraud protection from both networks.

How often should I update WooCommerce?#

Apply security fixes right away. For feature updates, test on staging first and update production within a week. WooCommerce updates can change checkout behavior, payment gateway hooks or REST API endpoints, and staging lets you catch problems before customers do.

Turn on auto-updates for WordPress core and for security-only plugin updates. For WooCommerce and the plugins that touch checkout, test first.

Where I’d start this week#

The generic advice (strong passwords, update your plugins) still matters. It’s just not where stores get hurt most. If I had one afternoon, I’d restore a backup on staging, turn on 2FA for every admin and shop manager, and check the Failed orders from the last week.

If checkout spam and carding are your biggest worry, my CAPTCHA comparison breaks down which plugins work with Block Checkout, HPOS and WooCommerce PayPal Payments in 2026. For a hands-on setup, see how to add CAPTCHA to WooCommerce checkout.