An online store holds customer identities, addresses, order history and payment flows, which attracts attackers. A breach costs money in fines and refunds, and it costs trust that takes years to rebuild. These practices cover the controls we apply on e-commerce projects.
Keep card data out of your systems
The PCI DSS standard applies to anyone who accepts card payments. The simplest way to reduce scope is to never touch card numbers. Use a hosted payment page or fields from a provider such as Razorpay, Stripe, PayU or PayPal, where the card data goes straight from the customer's browser to the processor. Your server receives a token. Never store the card verification code, and never write full card numbers to logs or a database. Complete the PCI self-assessment questionnaire that matches your setup.
Encrypt everything in transit
- Serve the whole site over HTTPS, not only checkout, and redirect all HTTP requests.
- Enable HSTS so browsers refuse insecure connections.
- Use TLS 1.2 or newer and renew certificates automatically.
- Encrypt database backups and disks at rest.
Defend against the common web attacks
The OWASP Top 10 lists the most frequent web flaws. Stores meet these most often:
- SQL injection: use parameterized queries or an ORM and never build SQL from user input.
- Cross-site scripting (XSS): escape output by default, sanitize rich text, and add a Content-Security-Policy header.
- Cross-site request forgery: use anti-CSRF tokens and
SameSitecookies on state-changing requests. - Broken access control: check on the server that the logged-in user owns the order, address or invoice they request. Changing an ID in a URL should never reveal another customer's data.
- Price tampering: calculate prices, discounts and totals on the server. Never trust values sent from the browser.
Harden accounts and authentication
Hash passwords with Argon2id or bcrypt, never with plain SHA or MD5. Enforce a minimum length of 12 characters, check new passwords against breached lists, and offer multi-factor authentication. Rate-limit login, password reset and OTP endpoints, and lock or challenge after repeated failures. Require MFA for every admin account without exception. Expire sessions, regenerate session IDs at login and set cookies as HttpOnly and Secure.
Lock down the admin area
Move admin panels off default URLs, restrict them by IP or VPN where possible, and apply the principle of least privilege so support staff cannot change payment settings. Keep audit logs of who changed products, prices and permissions.
Control fraud
- Use address and card verification (AVS and CVV checks) and 3-D Secure, which also shifts liability in many cases.
- Add rules for velocity, mismatched billing and shipping countries, and large orders.
- Use bot protection or reCAPTCHA on login, signup and checkout to stop card testing, where criminals run many small charges to find valid cards.
- Review high-risk orders manually before shipping.
Update dependencies and platforms
Outdated plugins and libraries cause many store compromises. Enable automatic security updates for your CMS and platform, run npm audit or Dependabot on a schedule, and remove plugins you do not use. Pin versions and test updates in staging first. For Magento, WooCommerce and Shopify apps, vet each extension's reputation and update history before installing.
Protect the infrastructure
Put a web application firewall and DDoS protection, such as Cloudflare or AWS WAF, in front of the site. Close all ports except the ones you need, keep the database off the public internet, and store secrets in a manager instead of source code. Run regular vulnerability scans and an annual penetration test.
Back up and rehearse recovery
Keep automated, encrypted backups in a separate account or region, and restore one on a test server every quarter. A backup you have never restored is a guess.
Respect privacy law
Collect only the data you need, state what you collect in a clear privacy policy, and honor access and deletion requests. India's Digital Personal Data Protection Act, GDPR and similar laws carry penalties for mishandling personal data.
Prepare an incident plan
- Name who leads the response and who talks to customers.
- Know how to isolate a compromised system and rotate keys.
- Keep logs long enough to investigate.
- Know your legal duty to notify authorities and affected users.
A quarterly security routine
- Review admin and staff accounts. Remove people who left and check that MFA is on for everyone.
- Apply platform, plugin and dependency updates in staging, then production.
- Restore a backup to a test environment and confirm orders and customers load.
- Scan the site with a tool such as OWASP ZAP or your hosting provider's scanner and fix high-severity findings.
- Check payment provider and email logs for unusual refunds, chargebacks or login activity.
- Rotate API keys and review which third-party scripts load on checkout pages.
Common questions
Do I need PCI compliance if I use Razorpay or Stripe?
Yes, but at a much smaller scope. Using a hosted checkout lets you complete the shortest self-assessment questionnaire. You must still keep your site secure, use HTTPS and protect the pages that embed the payment form.
What should I do if I suspect a breach?
Take affected systems offline, preserve logs, change all passwords and keys, contact your payment provider and hosting company, and ask a security specialist to investigate. Notify customers and authorities as the law requires.
We build and audit stores with these controls in place. Request a security review of your shop, or see our e-commerce development services.