A free, prioritized security checklist built from real vulnerabilities found in WooCommerce plugins — payment tampering, unauthenticated admin actions, order-data leaks. Tick the boxes, get a live score, fix what matters first. Nothing is uploaded; everything runs in your browser.
The checklist above tells you what to harden. This guide shows you how attackers actually break WooCommerce stores through their plugins — the exact vulnerability classes I find while auditing them, with detection and remediation steps you can hand to a developer.
permission_callback and nonce mistakes that let anyone trigger admin-only actions (integration hijack, config overwrite).How do I secure a WooCommerce store?
Prioritize where money and data move: verify your payment callback reconciles the amount actually paid against the real order total, keep every plugin updated and delete abandoned ones, require 2FA on all admin and shop-manager accounts, and run tested off-site backups. The checklist above scores each of these.
What's the most common way WooCommerce stores get hacked?
Vulnerable and abandoned plugins. Each plugin runs with your store's privileges, and disclosed plugin bugs are exploited by automated scanners within days. The highest-impact classes are checkout add-ons that trust client-supplied amounts and plugins that expose unauthenticated REST or AJAX actions.
Is the checklist free, and is my data safe?
Yes — it's free and runs entirely in your browser. Nothing about your site is uploaded, connected to, or stored. The optional $19 field guide goes deeper into detection and remediation for each vulnerability class.
Longer, plain-language reads from the same researcher — no signup:
7 signs your WooCommerce store has been hacked (and how to check each one)
How attackers pay $1 for a full-price WooCommerce order (payment-amount tampering)