Online store security: the minimum

Online store security is a set of simple actions that reduce the chance of the site being hacked and customer data leaking: updates, strong passwords with two-step login, limited access rights, backups and protection from automated attacks. Perfect security doesn't exist, so the goal is to close the most common routes and prepare the rest for recovery.

In plain words

A store holds names, phone numbers, addresses and order history. If a site is hacked, the consequences are usually not a "hacker in a hoodie" but ordinary things: someone else's code is inserted into pages, shoppers are redirected to outside sites, orders vanish, search shows spam. Google describes four typical forms of hacking: inserting malicious JavaScript into existing pages, creating new spam pages, unnoticeable changes to existing content (hidden links, showing different content to people and to the search engine), and redirecting some visitors to malicious pages (Google Search Central). An owner may go years without seeing the problem, because in some cases the malicious code is not shown to all visitors.

What is happening now

• According to the Verizon DBIR 2026 report (incidents from November 2024 to October 2025), software vulnerabilities became the main way in, overtaking stolen passwords; 31% of breaches start with vulnerabilities (Verizon DBIR 2026).
• The human factor (phishing, social engineering, stolen credentials) remains among the most frequent causes. Mobile channels (fake texts, calls) deceive more successfully than email phishing: the click rate is about 40% higher (same source).
• Ransomware is present in 48% of breaches, and ransom payments are getting smaller (same source).
• About 15% of attack techniques are boosted by generative AI (same source).

The report doesn't give separate figures for small businesses on its overview page, so don't transfer these shares to a specific store.

The minimum worth having

CISA (the US cybersecurity agency) boils the basic advice down to four steps: avoid phishing and report it, use strong passwords, turn on multi-factor authentication along with a password manager, and update software (CISA, Secure Our World). For a store this means:

1. Updates. CMS, plugins, themes, libraries. This matches the fact that vulnerabilities are now the main entry for attacks. If a plugin is no longer supported, replace it.
2. Two-step login to the admin and to email. Especially the owner's email: passwords for everything else get reset through it. A separate account for each person, and when someone leaves, close their access the same day.
3. Minimum permissions. A content manager doesn't need access to payment settings. This matches the first item of the OWASP Top 10:2025, "Broken Access Control", when a user can do more than they are allowed to (OWASP Top 10:2025).
4. Correct configuration. In the OWASP list, second place goes to Security Misconfiguration: default passwords left in place, exposed service addresses, unnecessary features. Third is software supply chain failures: other people's plugins and scripts that are trusted without being checked (same source). So every third-party widget (chat, reviews, analytics) is someone else's code on your page; connect only what's needed.
5. HTTPS and payments in a secure form. Accept cards through a payment provider rather than storing them yourself. See PCI DSS in plain words.
6. Backups that can be restored and that are kept separate from the site. See backups. CISA also advises logging on systems, backing up and encrypting data, and having an incident response plan (CISA).
7. Protection from bots and malicious requests at the CDN or firewall level: see bots and scraping.
8. Event logs. OWASP has a separate category, "logging and alerting failures": if events aren't recorded, a breach is noticed late (OWASP Top 10:2025).

Common mistakes

• One shared administrator password for the whole team.
• Forgotten test sites and old accounts with the same data.
• Backups only on the same server.
• Relying on "we won't be touched, we're small". Automated scanners look for vulnerable software versions without caring whose store it is.
• Pasting customer data into public AI services for a quick answer. See AI risks in a store.

What to do if the site seems to be hacked

Change passwords and keys, close the admin, restore from a clean copy, update, check email and other access. If customer data could have leaked, talk to a lawyer: in Europe GDPR applies, in Ukraine the personal data protection law, see personal data in Ukraine. Google has a separate recovery guide (web.dev).

FAQ

Where do I start protecting an online store? Update programs and plugins, turn on two-step login for the admin and email, remove extra accounts, and check that a backup can be restored.

How can I tell that a site has been hacked? Signs: other people's pages in search, redirects to outside sites, new unknown administrators, a browser warning. Google notes that insertions may be invisible to the owner (Google).

Is a separate security audit needed? For a store that accepts cards or has a large customer base, a check is useful. The technical part is covered by a technical audit.

Are "out of the box" platforms safe? It depends on the configuration, updates and your third-party code; responsibility for passwords and access rights stays with you.

Related terms

• PCI DSS in plain words
• Payment fraud and 3-D Secure
• Bots and price scraping in an online store
• Online store backups
• AI risks in an online store: data leaks and prompt injection
• Technical site audit

Sources

• Verizon, 2026 Data Breach Investigations Report — verizon.com/business/resources/reports/dbir
• OWASP, Top 10:2025 — top10.owasp.org/2025
• CISA, Secure Our World — cisa.gov/secure-our-world
• Google Search Central, Spam policies (the section on hacked content) — developers.google.com/search/docs/essentials/spam-policies
• web.dev, Hacked sites — web.dev/articles/hacked