Skip to content
Start free trial
Security, privacy and compliance

A security checklist for online store owners

Twenty practical checks for protecting your store, staff accounts, payments, customer data and email, plus what to do in the first hour of an incident.

By Orvexa TeamUpdated 3 min read
Traders and sacks of dry fruits and spices at Khari Baoli market, Delhi
Photo: Christian Haugen from Trondheim, Norway, CC BY 2.0 · All photo credits
Key takeaways
  • Most store compromises start with weak or reused passwords, so turn on multi-factor authentication first
  • Limit access, review apps and verify payment callbacks
  • Have a one-page plan for what to do if something goes wrong

You do not need a security team to be safe online. You need a short list of habits done consistently. Use this one.

Accounts and access

  1. Turn on multi-factor authentication for your platform, email, payment gateway and domain registrar.
  2. Use a password manager and unique passwords everywhere.
  3. Give each person their own login, never a shared one.
  4. Apply least privilege. Staff get only the permissions they need.
  5. Remove access immediately when someone leaves, including agencies and freelancers.
  6. Protect your email account most of all, because it can reset everything else.

Payments

  1. Use a hosted checkout from a certified provider so that card data never touches your site (PCI DSS).
  2. Verify payment callbacks. Check the signature on every payment confirmation before you ship an order, and process each event once.
  3. Keep payment keys secret. Never put secret keys in website code, emails or chat.
  4. Reconcile daily and watch for odd refunds or unusual orders (failed payments).

Your site and apps

  1. Keep the platform and apps updated.
  2. Install only apps you need, from reputable vendors, and check the permissions they request.
  3. Remove unused apps and scripts. They are both a speed and a security risk.
  4. Use HTTPS everywhere with automatic certificate renewal.
  5. Watch for unfamiliar code in your theme or checkout.

Data

  1. Back up regularly, and test that a restore works.
  2. Collect and keep only what you need, and delete the rest (DPDP).
  3. Do not email or chat sensitive exports. Share files through access-controlled storage.

Email and phishing

  1. Set up SPF, DKIM and DMARC for your domain, so criminals cannot easily send mail pretending to be you (DNS basics).
  2. Train your team to spot fake supplier invoices, fake courier emails and login pages that copy your platform.

If something goes wrong: the first hour

  1. Change passwords and revoke sessions for affected accounts, starting with email.
  2. Contact your platform and payment provider.
  3. Disable suspicious apps or staff accounts.
  4. Save logs and screenshots. You may need them later.
  5. Check recent orders and payouts for changes.
  6. Decide who needs to be told, including customers and regulators if personal data was exposed. Privacy laws set notification duties.
  7. Write down what happened and what you changed.

Ask your platform

Does it separate your data from other stores (dedicated databases), log admin actions, and offer multi-factor login? Orvexa is adding two-step login and an admin audit log, which are marked as coming soon on our site.

What to do next

Spend thirty minutes today: turn on multi-factor authentication on your email, platform and payment accounts, and remove one old user or app.

Frequently asked questions

What is the single most useful step?

Multi-factor authentication on your email and platform accounts. It blocks most account takeovers even when a password leaks.

How often should I review access?

Every quarter, and every time someone joins or leaves. A short checklist makes it routine.

Do I need cyber insurance?

It can be worthwhile for larger stores. Read what it covers and requires, because insurers often expect controls such as multi-factor authentication.

Topics:securitychecklistmfabackupsincident response

Keep reading