Ecommerce security best practices for small stores

"Urgent: your store will be suspended in 24 hours." It arrives at 11pm, it uses your store's name, it has a button, and the button goes to a login page that looks exactly right apart from one character in the address. That email is the realistic threat to a small online store — not a hooded figure breaking encryption.

Which is why most ecommerce security best practices advice is aimed at the wrong target. It talks about firewalls and certificates, which your platform largely handles, and skims past the two things that actually lose people their stores: someone getting into an account, and someone storing data they should never have had. This checklist is ordered by how likely each item is to matter to you.

1. Know which half of security is yours

Security on a hosted platform is split, and the split is not a detail — it decides where your effort goes.

mAutomate runs on Google Cloud behind Cloudflare, with DDoS protection and daily backups. That covers the top half of the table. It does nothing whatsoever about the bottom half, and the bottom half is where small stores are actually lost. Any platform that lets you believe otherwise is doing you harm.

2. Get HTTPS right, and understand what it is not

The padlock means traffic between the browser and the server is encrypted, so the café wi-fi cannot read a customer's card details or your admin password. That is important and it is also the floor, not the ceiling.

What to check: every page loads over HTTPS, not just checkout; HTTP requests redirect rather than quietly working; your custom domain has its own valid certificate — the domain checklist covers the order of operations; and no page mixes in an image or script over plain HTTP, which breaks the padlock on an otherwise fine page.

What it does not mean: that the site is honest, that the business is real, or that your data is safe once it arrives. Scam stores have padlocks too. Certificates are free and automatic now, which is good for the web and bad for using the padlock as a trust signal.

3. Fix the password problem properly

A reused password is the most common way a store changes hands. The mechanics are dull: a service you joined in 2019 was breached, your email and that password are now in a list, and software tries the list against every platform in existence. No cleverness required.

The fix is a password manager and a unique password for every account that touches the business — store admin, email, domain registrar, payment gateway, ad accounts, social logins. Long and unique beats clever and memorable. Stop rotating on a schedule; it produces Spring2026! then Summer2026!, which is worse than one strong password left alone.

Pay particular attention to the email address your store admin uses, because every password reset in your business ends up there. It should have a unique password and the strongest 2FA available, and it should not be an address at a domain whose registrar login shares a password with anything.

4. Turn on two-factor authentication, choosing the method deliberately

2FA is the single highest-value thing on this list, because it breaks the attack in step 3 even when the password is already known.

Not all second factors are equal. A hardware security key is strongest. An authenticator app on your phone is strong and free. SMS codes are better than nothing and genuinely weaker, because phone numbers can be taken over by someone persuading a mobile provider to move them. Use an app over SMS where you have the choice.

Save the backup codes somewhere that is not the device running the authenticator. Losing your phone and your only second factor at once is an unglamorous way to lose access to your own business.

5. Treat staff access as a list you prune

Every additional login is another way in, and the accounts that cause trouble are the ones nobody remembers creating: the freelancer from the redesign, the agency that ran ads last spring, the friend who fixed one thing.

• Give each person their own account. Never share one login — shared logins cannot have 2FA that works properly, and they make the audit trail useless.
• Give the lowest access that lets them do the job.
• Remove access the day someone stops working with you, not the next time you think of it.
• Review the whole list on a calendar reminder, quarterly. It takes four minutes and it is always wrong.
• Revoke old API keys and connected apps in the same sweep. An integration you trialled once still has whatever permissions you granted it.

6. Never store payment data yourself

This is the shortest item and the most absolute. Card numbers, expiry dates and CVV codes should never touch your systems, your email inbox, a spreadsheet, a notebook by the till, or a support transcript.

Use a payment gateway that collects card details itself and hands your store a token — a reference that lets you charge, refund and look up a transaction without ever holding the number. Then your store holds a token, a last four digits and a transaction ID, which are unpleasant to lose but not catastrophic.

Two real-world versions of this to refuse outright: a customer who wants to read their card number over the phone or send it by email, and a "quick" spreadsheet of card details for manual orders. Say no and send a payment link instead. The moment you hold card data, your obligations and your exposure change category — this is the one area where the easy shortcut is genuinely the dangerous one.

7. Learn the phishing patterns aimed at store owners

Store owners get targeted specifically, and the lures are consistent enough to recognise.

• Suspension and policy threats. "Your store violates our terms", with a deadline and a login link.
• Domain renewal notices. Official-looking invoices for a domain you do not need to renew, from a company that is not your registrar.
• Fake order or chargeback alerts. An attachment claiming to be a dispute. The attachment is the payload.
• Brand collaboration DMs. A file to open, a contract to download, a "media kit" to install.
• Support impersonation. Someone contacting you first, claiming to be your platform, asking you to confirm a code. Real support does not ask for your 2FA code — ever, for any reason.
• Supplier bank-detail changes. An invoice from a known supplier with new account details. Phone them on a number you already had.

The habit that defeats all of them: never act from a link in a message. Open a new tab, type the address you know, and log in there. If the warning was real, it will be waiting for you in the dashboard.

8. Make the boring layers boring

Keep your devices updated and locked, and do not log into the store admin on a shared computer. Keep your own export of products, customers and orders even where the platform backs up daily — platform backups protect against platform failure, not against you deleting a collection in a hurry. And open one of those exports at least once to confirm it contains what you assume. An untested backup is a belief, not a plan.

What none of this prevents

Security practice reduces the likelihood of an incident. It does not reach zero, and pretending otherwise is how people stop maintaining it.

You cannot protect yourself against a breach at a vendor you depend on — if your email tool or your analytics provider is compromised, your customer list may be exposed by a decision you had no part in. You cannot prevent fraudulent orders with stolen cards; that is a fraud-screening and chargeback problem, not an access-control one. You cannot stop a customer's own account being taken over because they reused a password. And no configuration survives a determined attempt to trick a tired human at 11pm, which is why the "new tab, type the address" habit matters more than any setting.

What you can do is make yourself a bad target, keep the recovery path intact, and know which half of the table above you own. If you are choosing a platform, ask specifically about 2FA, staff roles, backup frequency and export options — our pricing page lists what each plan includes, and the questions are worth asking of everyone you compare.