WooCommerce security: cleaning hacked shops and protecting checkout
On a WooCommerce shop the attacker is usually after one page: checkout. Card skimmers, fake payment forms and stolen customer data make a hacked shop more urgent than a hacked brochure site, and the cleanup has to protect your orders as well as your files.
Shop cleanup starts from $199; the final price depends on the shop's size, extensions and condition. Ongoing security from $79/month.
Signs a WooCommerce shop is compromised
Customers report card fraud
Several buyers see fraudulent charges after ordering from you. That pattern points to a skimmer on your checkout, even if the shop looks normal.
Checkout looks different
An extra card form, a payment step you didn't add, or a form that appears before the real payment provider's fields.
Unknown admins or shop managers
New administrator or Shop Manager accounts, or existing ones with changed emails.
Strange orders, coupons or settings
Coupons you didn't create, changed payment settings, new REST API keys or webhooks pointing to unfamiliar addresses.
Redirects or spam on product pages
Visitors sent elsewhere, or product and category pages full of injected links. See redirect hack.
A notice from your host or payment provider
A malware alert, a suspension, or questions from your payment provider about a suspected compromise.
What makes a hacked shop different
Checkout is the target. Payment skimmers are small pieces of JavaScript that copy what customers type into the checkout form and send it to the attacker. They often load only on the checkout page, only for visitors who are not logged in, and sometimes only once per visitor, so the shop owner rarely sees anything wrong.
Hosted payment fields help, but don't make you immune. If your payment provider collects card details in its own embedded fields or on its own page, the card number never reaches your server. A compromised page can still show a fake card form in front of the real one, or send customers to a look-alike payment page.
There is customer data in the database. Names, addresses, emails, phone numbers and order histories sit in the shop's database. If the attacker could read it, that can matter for your obligations to customers and authorities.
Restoring a backup costs you orders. Rolling the whole site back loses every order, customer and stock change since that backup, and may restore the infection too. See why restoring a backup may not fix a hacked site.
What a WooCommerce cleanup covers
Everything in a standard WordPress malware removal, plus the places that matter for a shop.
Checkout and cart pages
Scripts loaded on checkout, including code stored in the database, in theme files, in tag managers and in plugin settings.
Payment extensions
Payment gateway plugins are compared with their official releases to spot modified files.
Users and roles
Administrator and Shop Manager accounts, recently changed emails and passwords, and customer accounts with elevated rights.
REST API keys and webhooks
WooCommerce API keys and webhooks you don't recognise, which give an attacker a quiet way to read orders.
Database and scheduled tasks
Injected scripts in wp_options, widgets and products, and scheduled tasks that put malicious code back.
Extensions and their source
Abandoned or pirated ("nulled") extensions, which are a common way in for shops.
Who you may need to tell
If card data or customer data may have been exposed, the cleanup is only part of the job. Depending on what happened you may need to:
- Tell your payment provider. They can watch for fraud and will tell you what they need. They may also ask about your PCI DSS obligations.
- Check your data protection obligations. Under the GDPR, and in Switzerland under the revised Data Protection Act (nDSG), some breaches have to be reported to the authority and sometimes to the people affected. Get legal advice for your case.
- Inform customers where that is required or sensible, so they can watch their statements.
We give you a written account of what we found: which code, since when as far as we can tell, and what it could reach. That is what your payment provider, lawyer or authority will ask for. We are not a PCI assessor and don't issue compliance certificates.
Keeping checkout safe afterwards
- Two-factor login for every administrator and Shop Manager
- As few administrator and Shop Manager accounts as possible
- WooCommerce, payment extensions and theme kept up to date
- Unused extensions removed, nothing from untrusted sources
- Unused REST API keys and webhooks revoked
- Checkout page scripts reviewed after every change
- Backups that keep orders safe, with a tested restore plan
- File change and login monitoring
See WordPress security hardening and ongoing WordPress security.
WooCommerce security FAQ
Should I keep the shop open while it's being cleaned?
If a card skimmer is likely, the safest option is to switch off card payments or put the shop into maintenance mode until checkout is clean. If the problem is limited to spam pages, the shop can often stay open. We'll tell you which situation you're in.
Can I just restore last week's backup?
You would lose every order and customer since then, and the backup may already contain the infection or the hole that let it in. A targeted cleanup keeps your order data.
Do you need access to my payment provider account?
No. We work on the WordPress site and hosting. Changes in your payment provider account, such as rotating API keys, are made by you, and we tell you which ones.
Is a security plugin enough for a shop?
A plugin helps with login protection and known malware. It rarely sees a skimmer stored in the database or loaded through a tag manager, and it can't tell you how the attacker got in.
Tell us about your site
Send a short message: your website, what you're seeing, and who hosts it. We'll get back to you with next steps.