SSL and Security for Online Stores: A Practical Hosting Checklist

SSL is the baseline for any store, not the finish line. Every host in our field includes a free SSL certificate, and HTTPS is required by WooCommerce, browsers and payment gateways — so it's table stakes. Real store security is a stack: TLS done right, automated backups, timely updates, a firewall, DDoS protection, and above all keeping card data off your server. Here's what to expect a host to handle, and what stays your job.

SSL/TLS: have it everywhere, keep it current

Serve your entire store over HTTPS, not just the checkout — mixed content (some pages or assets on HTTP) triggers browser warnings and undermines trust. A free Let's Encrypt certificate is fine for most stores; it auto-renews on good hosts, so check that renewal is automatic to avoid an expired-certificate outage. Make sure the host supports current TLS versions. SSL protects data in transit between the shopper and your server, but it does nothing about the security of the server itself or your store software — those are separate layers.

Backups: automated, off-site, and tested

A store's database changes constantly, so backups matter more than for a static site — a lost day of orders is lost revenue and lost customer trust. Look for automated daily backups stored off-site (not just on the same server), easy one-click restore, and ideally on-demand backups before you make changes. Managed store hosts include this; on shared hosting you may need a backup plugin or add-on. Whatever the setup, test a restore once so you know it works before you need it in an emergency.

Updates and malware scanning

Most store breaches come through outdated software — an unpatched plugin, theme or core version. Keep WordPress/WooCommerce, plugins and PHP current; managed hosts help by testing updates on staging before applying them, so a fix doesn't break checkout. Malware scanning and file-integrity monitoring catch problems early, and some hosts include automatic malware removal. Run as few plugins as you can, install only from reputable sources, and remove anything you don't use — every extra plugin is extra attack surface on a site that handles money.

Firewall, DDoS and access control

A web application firewall (WAF) filters malicious requests before they reach your store, and DDoS protection keeps a flood of junk traffic from knocking you offline — valuable for a store, where downtime is lost sales. Many hosts include a WAF and basic DDoS mitigation, or you can add a service like Cloudflare in front. On the access side: use strong, unique admin passwords, enable two-factor authentication, limit login attempts, and give staff the minimum access they need. Most of this is your responsibility regardless of host.

The biggest win: keep card data off your server

The single most effective security decision a store owner makes is to never store or process card data on their own server — use a hosted payment page or iframe from a PCI-compliant gateway (Stripe, PayPal and similar). If card data never touches your server, a breach of your site can't expose it, and your PCI scope stays in the lightest SAQ A tier. This matters more than any single host feature. The full compliance picture is in PCI compliance and hosting.

What to look for in a host

Prioritise free auto-renewing SSL, automated off-site backups with easy restore, staged updates or update testing, a WAF and DDoS mitigation, malware scanning, and a PCI-capable environment (with an AOC if you need one). Our best ecommerce hosting ranking notes which hosts bundle these versus leaving them to you. But remember the split: a host secures the infrastructure; you secure your store software, your logins and your payment setup.

Harden admin access and logins

A large share of store compromises come not through exotic exploits but through weak or reused admin credentials, so login hardening is some of the highest-value security work you can do, and most of it is free. Enforce strong, unique passwords for every admin and staff account, and turn on two-factor authentication so a stolen password alone isn't enough. Give each staff member the minimum role they need rather than blanket administrator access, and remove accounts promptly when people leave. Limit login attempts to slow brute-force attacks, and consider moving or protecting the login URL to cut automated probing. Keep an eye on user sessions and revoke anything suspicious. These measures cost nothing but attention, and they close the door that attackers most often walk through on a store that handles money and customer data. No host feature substitutes for disciplined access control, because the host can't stop an attacker who simply logs in with a password you left weak.

Have an incident plan before you need one

Assume that one day something will go wrong, and decide now how you'll respond, because the middle of an incident is the worst time to improvise. The foundation is recoverability: automated, off-site, tested backups mean that even a serious compromise or a botched update is a restore-and-move-on event rather than a catastrophe. Know where your logs are and how to read them, so you can see what happened and when. Keep a short list of who to contact — your host's security or priority support, your developer, your payment provider — and how to reach them fast. If a breach involves customer or payment data, understand your notification obligations in advance. Practising a restore once, while everything is calm, is worth more than any amount of theory, because it turns "I think we have backups" into "I know I can be back online in an hour." Security isn't only prevention; it's how quickly and cleanly you recover when prevention fails.