WooCommerce has published guidance arguing that most store compromises are caught late because nobody is watching for them, and that the earliest signs show up in ordinary shop data rather than dramatic outages. For a UK small business running an online store, that reframes online store security as a weekly habit you can build, not a specialist tool you buy once and forget.
The practical upshot: if attackers used stolen customer logins or ran a card-testing attack against your checkout tonight, your first warning would probably be a small shift in orders, refunds or user accounts, not an alarm. Knowing what “normal” looks like is what lets you spot the abnormal.
What WooCommerce actually said
In a post by solutions architect Christopher Jones, WooCommerce sets out how to keep a store safe by catching problems early. The core argument is that a card-testing run or an account breach looks like background noise to each team member individually: support sees a few odd tickets, operations sees a bump in failed payments, your agency sees uptime holding steady. It only reads as an attack when someone connects all three.
WooCommerce recommends starting with a baseline: document your average daily order volume, typical refund rate, failed orders and average order value, and record which plugins and admin-level accounts already exist. It then points to specific dashboard signals. In Analytics and order history, watch for unexplained order spikes or clusters of small orders (a hallmark of card testing), sudden drops in completed orders, and unusual refund activity. In the Users section, watch for administrator accounts your team did not create, rapid spikes in registrations, and accounts with suspiciously similar names or emails.
The post is clear that these signs rarely mean an attack on their own; they matter in context. It also flags plugins, themes, pages, posts and comments as places where unauthorised changes surface, and recommends monitoring tools such as Jetpack Security for real-time alerts and an activity log, alongside anti-fraud tooling that goes beyond your payment gateway’s built-in checks.
What this changes, and who it affects
This is not a product launch or a rule change. It is a shift in emphasis, and it applies to anyone running a self-hosted store where you own the security stack rather than renting a fully managed one. That is the trade-off behind the platform choice many owners make, which we cover in our comparison of Shopify, WooCommerce and Squarespace for UK online stores: WooCommerce gives you control, and control means responsibility for admin accounts, plugins and updates.
The advice replaces a common but flawed assumption, that a security plugin or your host will simply tell you when something is wrong. WooCommerce’s point is that alerts often arrive after the damage, or not at all, and that the human step of noticing a pattern is what buys you time. It sits alongside the wider security baseline every small firm should hold, which is exactly what Cyber Essentials certification is designed to formalise: patching, access control and configuration.
What this means for your business
A breach on a small store rarely announces itself. Card testing, where criminals run thousands of tiny transactions to check stolen card numbers, can quietly rack up gateway fees, trigger chargebacks and get your merchant account flagged. A compromised admin account can inject malicious code into your checkout that skims card details from real customers. In both cases, the cost is money and trust, and under UK GDPR a personal data breach can carry a reporting duty to the Information Commissioner’s Office within 72 hours of you becoming aware.
The reassuring part is that the monitoring WooCommerce describes uses data you already have. You do not need a security operations team. You need one person who checks the same handful of numbers on a schedule and knows roughly what they should be. That is the same discipline behind measuring whether any new tool is earning its keep, which we set out in our guide to the numbers that tell you automation has paid off.
It is also worth remembering that the threat is not only your storefront. Malicious documents and prompt-injection attacks aimed at office tools, as we explained in the piece on the Copilot “AI worm” hidden in Word files, show that the same principle applies across your systems: assume the first sign will be subtle, and give someone the job of watching for it.
Four steps to build the routine this week
- Set your baseline and put it in writing. Record your normal daily order count, average order value, refund rate and failed-order rate. Note every administrator account and every active plugin. Without this reference, no alert means anything, because you cannot say whether a spike is a sale or an attack.
- Tighten admin access and turn on two-factor authentication. Remove users who no longer need access, including former staff and contractors, and give each remaining account the lowest permission level that lets them do their job. Require two-factor authentication for administrators, following the practical advice in the National Cyber Security Centre’s small business guide. WooCommerce singles this out as an immediate risk reduction.
- Audit the plumbing behind your store. In your dashboard, review WooCommerce REST API keys under Settings, Advanced, and delete any that are unused or hold read/write access you cannot account for. Check the logs under Status, Logs for services still pulling data that you have stopped using. If the logs read as technical, get your developer to look them over rather than guessing.
- Make sure your backups actually restore, and write a first-hour plan. A backup you have never tested is a guess. Restore one to a staging site and confirm it works. Then write down what happens in the first hour if you suspect a breach: change admin passwords, take payments offline if needed, preserve logs, contact your host, and check whether the incident is a reportable personal data breach under the ICO’s guidance. Bring the same monitoring rhythm to the rest of your systems, as covered in our rundown of the operations stack for a sub-£1m business.
Security alerts matter, but they do not always fire first, and they do not always fire at all. The habit WooCommerce is really recommending is cheap: know your numbers, watch them on a schedule, and act the moment they drift.
