There’s a lot that goes into the operation of a modern ecommerce store. You need to produce an exceptional user experience, pick the right products (which inevitably requires a lot of dedicated research), nail your pricing, devise a smart marketing strategy, support your customers well enough to earn their loyalty and keep improving to stay with the curve.

But that’s not all. There’s another factor we’ve yet to consider, and it’s one that’s grown hugely in importance in recent years (particularly since 2018): data security. Quite understandably, online shoppers have become very wary when it comes to providing websites with their private information, and they’re even more skittish. Let them down once and they’ll abandon you.

Now, let’s say that you’ve built an ecommerce website using WordPress (most likely extended through WooCommerce, though not necessarily), and you’re looking to optimize it. While you’re shaping the layout and working on the speed, you also need to be taking steps to safeguard customer data — and in this post, we’re going to offer up some tips to help you. Let’s begin.

Use a trustworthy hosting service

The hosting service you use will heavily dictate the speed and reliability of your website, but it’ll also govern how vulnerable it is to outside threats. Using a hosted ecommerce service is so popular partially because it provides suitable security safeguards: WordPress users have access to many more options, but not all of them were designed for online retail.

Due to this, you should ensure that your hosting service is up to the task. Read reviews and comparisons to see how it fares against its competitors. Ask for details about the steps being taken to keep your store safe, and what guarantees are in place to reassure you. Check that you’re on a hosting tier intended for ecommerce use — this will have major consequences both for website performance and for the extent and nature of the active security processes.

Pay particular attention to the updating process of your chosen host. It’s vitally important for security that your site runs on the latest version of WordPress, and hosting geared towards ecommerce often takes the control of this process away from you. If you’re going to be relying on your host for something so fundamental, be absolutely certain that you can trust them.

The WooCommerce plugin has official hosting partners such as SiteGround and GoDaddy, and choosing one of those will always be a good move. The enterprise-level investment brings enterprise-level security, too, so you can move up the tiers as you scale. For the economy, though, it’s tough to beat WordPress hosting from Cloudways following its addition of a free Cloudflare integration. Now, migrating between platforms isn’t easy, but it shouldn’t be too bad for WordPress as it has native import/export tools. Find a suitable theme and start rebuilding.

Follow best practices for your admin login

All the security measures in the world won’t help you if you make it easy for someone to gain unauthorized access to your admin dashboard. You’re no doubt already aware of the importance of using strong passwords (and changing them semi-regularly), but the ubiquity of that awareness actually works against it.

Why? Because it makes it so obvious that people forget to actually do anything about it. They lose track of when they last changed their login details and rationalize when reminded that it’s fairly unlikely that anything will go wrong. After all, since everyone knows that they need to follow best password practices, scammers might as well not bother trying to access systems.

The result is widespread insecurity that flies under the radar — and if you don’t want to fall victim to it, you need to make a commitment to taking action. Stop thinking about how you should treat your passwords in principle, and start securing them in reality. This will make a huge difference in the long term, and it isn’t even very difficult.

Now, it’s easy to find advice pertaining to passwords (like this Mental Floss piece), and most of those tips are worth following — but one alternative you should consider if you don’t want to use a password manager is creating word sequences. One regular word can be brute-forced easily enough, but string a few together and you end up with something secure. For instance, “rabbit” would be a weak password, but “rabbit-guacamole-bilge” would be perfectly solid (and so much easier to remember than a garbled string of characters).

Offer advice to help customers protect themselves

Securing customer data isn’t solely about the systems you put in place: it’s also about the actions your customers take. This is because of the danger of social engineering. Users can choose weak passwords for their store accounts, or they can leave hints to their security questions on their public social media profiles, leading to major problems.

And while it won’t be your fault if a customer sees their data stolen because of their weak password, you’ll still be viewed as responsible — so the onus is on you to do what you can to prevent it from happening. You can’t do that much, but you can offer advice to help your customers protect their data.

Notably, you should aim to help them do this both on your site and elsewhere because this will help your brand image. Write blog posts about how to cloak activity with a proxy server, how to choose a solid password, how to use a password manager, how to set good security questions, how to use multi-factor authentication wherever possible, and other issues that spring to mind.

You should also reach out via social media to ask your followers how confident they feel about protecting their data, and to identify their main concerns about how it’s being used. This will have the added bonus of demonstrating that you’re invested in keeping them safe. The more you care about security, the more they’ll feel confident that you’re on top of things.

Carefully vet your chosen array of plugins

Lastly, you must take into account the extent to which WordPress relies on plugins (in addition to themes, of course) for its immense customizability. Online sellers often need to implement complex features, and they generally turn to the massive range of WordPress plugins — most of which are compatible with WooCommerce — to get them done cheaply and easily.

Now, there’s nothing inherently wrong with this. Most highly-rated plugins are entirely reliable and introduce little in the way of added risk. But note the word “little” there: the risk is never zero because every plugin you add needs permissions to run, and those permissions could plausibly be exploited by hackers.

The first thing you should focus on is WordPress version compatibility. An outdated plugin tested only with an old version of WordPress can fail to function correctly and lead to problems. Using a plugin like Better Plugin Compatibility Control will help you with this. You should also keep an eye on user reviews and WordPress-related sites so you’ll hear about it if a significant vulnerability is identified (and can take appropriate action).

What’s more, running myriad plugins with overlapping purposes can lead to compatibility issues. Two plugins trying to access the same file can produce compounding problems. Due to this, it’s best to cut any plugins you don’t truly need. Once you’re certain that you have a minimal selection of top-notch plugins, you can proceed with greater confidence.

Wrapping up

Despite its lack of cost and range of features, WordPress is a fairly secure system, so you don’t need to worry unduly about the security of your WordPress store — but that doesn’t mean you don’t need to take action to minimize risk. By following the suggestions we’ve looked at here, you can achieve a level of security that should be more than adequate for your customers.