You added SSL at launch and assumed the hard part was done. That assumption leaves stores running a plugin with a known exploit for over a year. They find out when the payment processor sends a compliance flag.
The fines that follow aren’t for getting hacked. They’re for not knowing you were exposed.
Every generic security guide hands you a 25-item checklist and stops there. This e-commerce cybersecurity audit checklist skips the 20 items that don’t prevent real breaches. It doesn’t tell you what PCI DSS actually requires from a two-person store.
This post covers WooCommerce and Shopify. It uses free tools. It prioritizes by what actually gets stores breached — not what looks thorough on a slide deck.
What Are the Most Common Vulnerabilities in Shopify and WooCommerce Stores?
The top vulnerability isn’t sophisticated — it’s outdated software. Over 50% of SMB e-commerce breaches trace back to unpatched plugins, themes, or apps with a known CVE. The second most common cause is shared admin credentials: one login, whole team, no 2FA.
Most store owners treat security as infrastructure. You set it up at launch and never revisit it. That model works for hosting.
It fails for software with new CVEs published every week.
The cost of that mindset is specific. CVE-2023-28121 affected WooCommerce Payments directly. Any unpatched store exposed every admin account to full takeover — no password required.
That CVE was public for weeks before mass exploitation began. Automated scanning tools were already hunting for that signature. Stores that hadn’t updated were hit.
The 20% move that actually works: update everything with a pending update before you touch anything else on any checklist. That single action eliminates the vulnerability category responsible for the majority of SMB breaches.
What most store owners do instead: they open a guide, start at item one, hit "implement network segmentation" at item 18, and close the tab. The checklist goes into a folder. It never gets opened again.
A WooCommerce supplement store doing $55k/month found WooCommerce Payments running two versions behind for four months. The owner ran a Sucuri SiteCheck scan after updating. It flagged a second outdated plugin buried in a theme dependency they didn’t know was active.
Both were patched in 40 minutes. The store had been actively scanned by exploit kits during that window. No breach occurred — but only because the timing was lucky, not because the store was protected.
What Are the Essential Security Checks for a Small E-Commerce Store?
Five checks close 80% of your real exposure. The five: software updates, admin access controls, 2FA on every admin account, a current PCI questionnaire, and a tested backup. These correspond to actual breach vectors at stores your size.
Everything else is either lower risk or needs a dedicated security engineer.
The problem with long checklists is psychological. You see 25 items and feel the task is too large to start. You hit a technical item in the middle and close the tab.
Prioritize by breach probability, not by section heading. Shared admin logins and unpatched plugins are your highest-probability vectors. WAF configuration and server hardening are legitimate concerns — but they’re secondary when your payment plugin is 11 versions behind.
For Shopify specifically: go to Settings → Apps and sales channels → review every installed app. Check the last update date on each. Remove any app you haven’t used in 90 days. [INTERNAL LINK: Shopify store setup and app management]
App permissions persist even after you stop using an app. A compromised app vendor still has access to your store data until you revoke it.
For WooCommerce specifically: go to Plugins → Installed Plugins → sort by "Update Available." Update all of them. Then go to Appearance → Themes and do the same.
Theme vulnerabilities are the least-checked attack surface in WooCommerce stores. Most operators audit plugins and leave theme files untouched for years.
A two-person Shopify apparel store doing $120k/year ran an app audit before a Black Friday push. They found seven apps installed by previous developers — all still active, all with full store data permissions. Three hadn’t been updated by their vendors in over 18 months.
The store removed all seven in 20 minutes. One had been acquired by a third party six months earlier. That acquisition is a documented vector for supply chain attacks on Shopify stores.
The store owner didn’t know any of this until they looked.
What Free Tools Can I Use to Scan My E-Commerce Site for Security Vulnerabilities?
Sucuri SiteCheck is the fastest starting point. It’s free, runs in under two minutes, and flags malware, blacklist status, outdated CMS versions, and injected scripts. For WooCommerce sites, WPScan’s free tier adds plugin-level CVE matching that Sucuri doesn’t cover.
Do these four things this week, in order:
Step 1: Run Sucuri SiteCheck now. Go to sitecheck.sucuri.net. Enter your storefront URL. Read the full output.
It flags malware, blacklist status, and outdated software. The scan runs in under two minutes. If anything shows red, fix that first.
Step 2: Force-update every plugin, theme, and app with a pending update. In WooCommerce: Plugins → select all with updates → bulk update. In Shopify: check version status on each installed app’s App Store page. Do this before any other check.
This step alone closes the majority of your exposure.
Step 3: Enable 2FA on every admin account. In Shopify: Settings → Users and permissions → each user → enable two-step authentication. In WooCommerce: install the free "Two Factor Authentication" plugin by David Anderson. Assign Google Authenticator or Authy to every account with admin or shop manager access.
This eliminates credential-stuffing as a viable attack vector. Credential-stuffing — trying admin logins from leaked password databases — is the most common account takeover method for small stores. 2FA stops it completely.
Step 4: Verify your PCI compliance questionnaire is current. Log into your payment gateway dashboard — Stripe, PayPal, Authorize.net, or your processor. Find the PCI compliance section. If your SAQ-A or SAQ-A-EP is lapsed or missing, you are non-compliant today.
Most processors send renewal reminders that get buried in email. Don’t rely on the reminder. Go look manually.
These four steps take three to four hours total. They close the vulnerabilities responsible for the majority of small e-commerce breaches. Run them before opening any longer checklist.
For WooCommerce users who want to go further: WPScan (wpscan.com) offers 25 free API calls per day. Run it against your site. It cross-references WPVulnDB and flags exactly which plugins have known exploits, with CVE IDs you can look up directly.
This is the same tool a paid consultant runs in hour one. You can run it yourself in 15 minutes.
How Do I Know If My E-Commerce Site Meets PCI DSS Compliance Requirements?
PCI compliance for small stores comes down to one question. Does card data touch your server, or does checkout hand off to a hosted payment page? Stripe Checkout, Shopify Payments, and PayPal’s hosted flow all qualify for SAQ-A — the simplest form.
If card data touches your own server or page, you need SAQ-A-EP or higher.
Most small store owners qualify for SAQ-A and don’t know it. Your compliance obligation is lighter than you think. A completed, current questionnaire still needs to be on file with your processor.
A lapsed SAQ is non-compliance regardless of your actual security posture.
Non-compliance at the time of a breach triggers fines from $5,000 to $100,000. That range depends on transaction volume and how long the SAQ was lapsed. It also triggers a mandatory forensic audit.
Your processor assigns the investigator at $200–$400/hour — not you. That audit runs for weeks. Chargeback liability from the breach period accumulates on top of it.
Stores have had 60–90 days of operating margin wiped out during the investigation window alone.
The realistic timeline for getting compliant:
SAQ-A takes 30–45 minutes if your checkout uses a hosted payment page. SAQ-A-EP takes 2–4 hours plus a quarterly scan from an Approved Scanning Vendor. SecurityMetrics offers a free entry-level scan for qualifying small merchants.
If you’re on Shopify Payments, Shopify handles the bulk of PCI scope for you. Your obligation is completing the SAQ and confirming you aren’t storing card data outside Shopify’s infrastructure.
Your processor’s merchant support line tells you exactly which SAQ type applies to your integration. Call them. They want you compliant — it’s easier than managing a breach investigation on your account.
A WooCommerce store doing $200k/year got a compliance flag after 14 months with a lapsed SAQ-A-EP. The owner had assumed the questionnaire renewed automatically. It didn’t.
Getting compliant required completing the questionnaire, running a free SecurityMetrics scan, and submitting both within 30 days. Total time: six hours spread across two days. No fine — they responded immediately and no breach had occurred during the lapsed period.
That outcome was luck. The right version of this story ends before you get the flag.
Your store’s security posture isn’t the result of intentional neglect. It’s the result of never having a four-hour afternoon dedicated to checking it.
Run the Sucuri scan. Update everything with a pending update. Enable 2FA on every admin account.
Open your payment gateway and confirm your PCI questionnaire status. That’s the audit. That’s the whole thing for a store your size.
The stores that get breached aren’t the ones that tried and failed. They’re the ones that put the checklist in a folder. Don’t put this one in a folder.