Small ecommerce stores are not too small to be attacked. They are often easier to attack because one person manages the store, apps, ads, email, fulfillment, refunds, and passwords. The security checklist starts with boring controls: MFA, access limits, updates, backups, payment hygiene, app reviews, and an incident plan.
This is practical security guidance, not a substitute for PCI, legal, insurance, or incident-response advice. Use it to tighten the store before something breaks, then review it again before peak season.
1. Turn On MFA Everywhere
CISA says strong passwords are no longer enough on their own and recommends multifactor authentication wherever possible, starting with admin accounts and sensitive systems. Shopify says two-step authentication adds protection even if someone learns your password, and warns that Shopify Payments requires it.
Require MFA for Shopify admin, email, domain registrar, payment processor, ad accounts, helpdesk, shipping software, accounting, cloud storage, and password manager. Admin accounts deserve the strongest method available, ideally a security key or phishing-resistant option.
2. Clean Up Staff And App Access
Every staff account should have only the permissions needed for the job. Remove old contractors, agencies, seasonal staff, and unused collaborator accounts. Shared admin logins are a gift to attackers and a nightmare during an investigation.
Review app permissions monthly. If an app can edit orders, customer data, products, discounts, theme code, or checkout behavior, treat it like a sensitive vendor. The FTC recommends assessing cybersecurity risks from suppliers and third parties before formal relationships, and documenting expectations in contracts where appropriate.
Keep a short access register: owner, purpose, permissions, date granted, and review date. It sounds fussy until a former freelancer still has theme access six months later.
3. Protect Payments And Checkout
PCI SSC says PCI DSS provides a baseline of technical and operational requirements to protect payment account data. Shopify says all stores powered by Shopify are PCI compliant by default and that its certification covers the store, shopping cart, and hosting. That is helpful, but it does not mean every app, script, staff process, or third-party payment workflow is automatically safe.
Use hosted or platform-native payment methods where possible. Do not store card data in notes, email, chat, spreadsheets, or support tickets. Watch for checkout script changes, suspicious theme edits, and card-testing patterns. Our guide on card-testing bots covers that specific abuse pattern.
4. Patch Themes, Apps, And Devices
The FTC tells small businesses to update software and turn on automatic updates where possible. For ecommerce, that includes computers, browsers, operating systems, POS devices, router firmware, apps, themes, plugins, and integrations.
If you use Shopify, the core platform is managed, but theme code, custom apps, tracking scripts, employee devices, and connected systems still need attention. If you use WordPress or WooCommerce, patching becomes even more central.
5. Back Up What You Cannot Rebuild Quickly
CISA lists business-data backups as a key practice for small and medium businesses. Back up theme code, product catalog exports, order exports, customer-service macros, policy pages, automation workflows, DNS records, ad account exports, and critical app settings.
A backup you have never restored is a hope, not a plan. Test restores before peak season.
Also keep recovery contacts outside the store admin: domain registrar, Shopify or host support, payment processor, bank, developer, insurer, and legal counsel if you have one.
6. Authenticate Email
The FTC recommends email authentication tools such as SPF, DKIM, and DMARC to make domain spoofing harder. This matters for ecommerce because attackers impersonate order confirmations, refund notices, support teams, wholesale invoices, and password-reset emails.
Check the sending domains for your store email, Klaviyo or Omnisend account, helpdesk, transactional email provider, and support domain. If deliverability is also on your mind, see our Klaviyo vs Omnisend deliverability comparison.
7. Write A One-Page Incident Plan
The FTC recommends having an incident response plan before a breach. Keep it short: who can lock accounts, who contacts Shopify or the host, who contacts the payment processor, who preserves logs, who pauses ads, who handles customer communication, and who calls outside help.
Store the plan somewhere accessible if email is compromised. Print one copy. It feels old-fashioned until the login screen says no.
Sources
- FTC: Cybersecurity for Small Business.
- CISA: Small and Medium-Sized Business Resources.
- CISA: Require Multifactor Authentication.
- NIST: Cybersecurity Framework 2.0 Small Business Quick-Start Guide.
- Shopify Help Center: Securing your account with two-step authentication.
- Shopify Compliance Reports.
- PCI Security Standards Council: PCI DSS.
Last Reviewed
Last reviewed: July 20, 2026.
Affiliate Disclosure
This site may earn commissions from links at no extra cost to the reader.
