Online Store Security and Backups: A Practical Checklist

An online store handles money, addresses, phone numbers and login details. That makes it an attractive target. Most attacks are not sophisticated; they exploit outdated software, weak passwords and missing backups. The good news is that a handful of habits prevent the majority of problems.

Why security matters for a store

A compromised store can mean:

• Stolen customer data, with legal and reputational consequences under privacy law.
• Fraudulent orders or card-testing attacks that cost fees and chargebacks.
• Malicious code injected into checkout pages.
• The store being blacklisted by search engines or browsers, which kills traffic.
• Days of downtime while you recover.

Prevention costs a fraction of clean-up.

1. Let someone else handle the card data

The safest card data is the data you never touch. Use a reputable payment gateway that collects card details on its own secure page or form, so numbers never reach your server. Handling card data yourself carries heavy compliance burdens. Our guide to payment gateways for South African online stores explains what to look for.

2. Keep everything updated

Outdated software is the number one way stores get hacked.

• Update the platform, themes and plugins or apps promptly.
• Remove plugins and themes you do not use. Deactivating is not enough.
• Choose well-maintained, reputable add-ons with recent updates and good support.
• Test updates on a staging copy first for busy stores, so you do not break checkout.

On a hosted platform such as Shopify, much of the core updating is handled for you, but you still manage apps and access. On self-hosted stores such as WooCommerce, it is your responsibility, often through a maintenance plan.

3. Lock down logins

• Use long, unique passwords, stored in a password manager.
• Turn on two-factor authentication for every admin and staff account.
• Give people the lowest level of access they need. Not everyone needs to be an administrator.
• Remove accounts for staff and contractors who leave.
• Do not share logins. Individual accounts leave an audit trail.
• Change the default admin username and limit login attempts to blunt guessing attacks.

4. Use HTTPS and a good host

HTTPS encrypts data between the customer and your store. It should cover every page, not just checkout.

Your hosting also matters. Look for:

• Server-level firewalls and malware scanning.
• Automatic, off-server backups.
• Isolation between accounts, so a neighbour's problem does not become yours.
• Fast, helpful support.

See domains, hosting and business email explained for what to ask a host.

5. Add a web application firewall

A web application firewall (WAF) filters malicious traffic before it reaches your store. Many security and content-delivery services offer one, and it can also reduce bot traffic, spam sign-ups and automated attacks. It is a cost-effective layer for most stores.

6. Defend against bots and fraud

• Add spam protection to forms and account creation.
• Watch for card-testing: bursts of small failed orders. Your gateway may offer fraud screening and rate limiting.
• Use address and payment verification options where available.
• Review unusual orders, such as high-value orders with mismatched details, before shipping.
• Keep an eye on chargebacks, and keep proof of delivery.

7. Back up properly

Backups are your insurance policy, and the only fix when something goes badly wrong.

The rules of good backups

• Automatic. Do not rely on anyone remembering.
• Frequent. A store taking orders all day needs more than a weekly backup. Daily is a minimum, and busy stores often need more.
• Off-site. Backups on the same server as the store disappear with it.
• Complete. Back up the database (orders, customers, products) as well as files and images.
• Retained. Keep several versions, in case you discover a problem days later.
• Tested. Restore a backup to a test environment regularly. A backup you cannot restore is not a backup.

The classic guideline is three copies of your data, on two different kinds of storage, with one off-site. We apply the same thinking to office systems in power outages and your business IT.

8. Protect customer data

• Collect only what you need, and delete what you no longer need.
• Limit who can see customer details.
• Encrypt sensitive data and exports.
• Be careful with spreadsheets of customer information sent by email.
• Keep a list of the apps and services that receive customer data and cover them in your privacy policy.

Your obligations are explained in POPIA and your business website and online store legal requirements in South Africa.

9. Monitor and get alerted

• Uptime monitoring that alerts you when the store is down.
• Security scanning for malware and file changes.
• Alerts for new admin accounts and failed logins.
• Regular checks of Google Search Console for security warnings.

The faster you notice, the less damage is done.

10. Have an incident plan

Write down what to do if something goes wrong, before it does.

1. Contain it. Put the store into maintenance mode if needed, and change all admin passwords.
2. Assess. What was affected? Customer data, orders, payment pages?
3. Restore. Use a clean backup from before the compromise, after fixing how the attacker got in.
4. Notify. If personal information was accessed without authorisation, South African law requires notifying the Information Regulator and affected people. Take legal advice.
5. Learn. Close the gap and record what changed.

Know who to call, whether that is your developer, your host or your payment provider.

A security checklist

• Hosted card payments through a reputable gateway
• Platform, themes and plugins updated
• Unused plugins removed
• Strong passwords and two-factor authentication
• Minimal admin access
• HTTPS on every page
• Firewall and bot protection
• Daily off-site backups, with tested restores
• Uptime and security monitoring
• Written incident plan

Security is not a one-off project; it is routine upkeep. If you do not have the time or skills, make sure someone is responsible for it. A stable, protected store is also faster and ranks better, so the effort pays off twice.