Website Security Basics for Shopify and WordPress: Who Protects What, and What You Must Do

This is general information, not legal, tax, financial, medical or security advice. Rules and prices change, so confirm details with the official sources linked below or a qualified professional.

Website security on Shopify and WordPress comes down to one question: who is responsible for what. Shopify hosts, patches and secures the platform itself, so your job is protecting accounts, staff permissions, apps and theme code. With self-hosted WordPress, you (or your host) are responsible for almost everything: core, plugins, themes, server, backups and logins. On both, most real-world compromises start with a stolen login or a risky add-on, not an exotic platform flaw.

This guide covers the shared basics first, then the platform-specific settings that matter most.

This is general information, not professional security advice. If you handle card data directly, PCI DSS obligations may apply.

Key takeaways

• Shopify secures the platform; you secure the accounts and apps. Shopify states it is certified Level 1 PCI DSS compliant and holds SOC 2 Type II and SOC 3 reports.
• WordPress security is mostly maintenance. Keep core, plugins and themes updated, delete what you don't use, and only install from trusted sources.
• Every person gets their own login with MFA and the least access they need.
• Apps and plugins are your biggest add-on risk. Review permissions and remove anything abandoned.
• Back up and test restores, especially on WordPress, where you own the data and files.

Shared responsibility at a glance

Security basics that apply to both

1. Unique logins for every person. Shopify's help center says the store owner shouldn't share login credentials with anyone, including staff, and that each user should have a unique staff account with specific permissions. The same principle applies to WordPress user accounts and roles.
2. Strong MFA on every admin account. Prefer passkeys or an authenticator app. See how to set up 2FA and a password manager for a team.
3. Least privilege. Give editors, marketers and freelancers only the permissions they need, and remove access the day a project ends.
4. Protect the domain and DNS. Your registrar account controls where your site and email point. Use MFA and a registrar lock.
5. Vet add-ons. Every Shopify app and WordPress plugin is code or access you didn't write. Check the developer, update history, reviews and the permissions requested.
6. Use secure connections for admin work. WordPress's guide recommends SFTP rather than FTP and HTTPS for administration.
7. Watch for phishing aimed at merchants. Shopify notes its support will only request sensitive documents through a secure upload page on a shopify.com domain. Treat anything else as suspect.

Shopify-specific security settings

Accounts and staff

• Turn on two-step authentication or passkeys for the owner and every staff account. Shopify requires two-step authentication to use Shopify Payments and warns that payouts may be held without it.
• Create a staff account for each person and grant only the sections they need (for example, orders but not payments or apps).
• Review staff and collaborator access quarterly, including agency and developer collaborator accounts, and remove anyone inactive.
• Don't store sensitive files in Content > Files. Shopify warns that files there are intended for public access, so never upload confidential documents.

Apps and integrations

• Audit installed apps every quarter. Uninstall apps you no longer use; their access scopes may include customer and order data.
• Read requested permissions before installing. A countdown timer shouldn't need access to customer data.
• Treat custom app tokens like passwords. Store them in a secrets manager, never in theme code or shared documents. Our guide to API keys and secrets management covers this.

Theme and code

• Keep a copy of your published theme before every change, and use unpublished themes for edits.
• Review third-party scripts added to your theme or through tracking tools. Remove ones you can't identify.
• Limit who can edit code to trusted developers.

WordPress-specific hardening

The official WordPress hardening guide is the best single reference. The highest-impact actions:

Keep everything updated

• Update WordPress core promptly; use automatic updates. The guide warns that older versions are not maintained with security updates.
• Update plugins and themes, and delete any you don't use, including inactive ones.
• Only install from trusted sources: the WordPress.org repository or well-known companies. Never download WordPress itself from anywhere other than wordpress.org.

Lock down access

• Enable two-step authentication for all administrators.
• Avoid obvious usernames like "admin" or "webmaster," which are attacked first.
• Disable file editing in the dashboard by adding define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php. The guide notes the built-in editor is often the first tool an attacker uses after logging in.
• Consider extra protection for wp-admin, such as server-level authentication, while checking it doesn't break admin-ajax.php.

Harden the server and files

• Use sensible file permissions. The guide gives one common scheme: directories at 755 and files at 644, with wp-config.php restricted further.
• Restrict database privileges where practical, keeping in mind that some updates need schema changes.
• Add a web application firewall, either a plugin, a server WAF like ModSecurity, or a reverse-proxy service that filters traffic before it reaches your host.

Monitor and back up

• Keep regular backups of files and the database, encrypted and ideally in a trusted separate location. The guide suggests regular snapshots so you can restore to a point before a compromise.
• Monitor logs and file changes to detect unexpected modifications.

Step-by-step: a one-hour security baseline

1. List every person with admin, staff or collaborator access; remove or downgrade anyone who doesn't need it.
2. Turn on MFA or passkeys for every remaining admin account.
3. Uninstall unused Shopify apps or delete unused WordPress plugins and themes.
4. Run all pending WordPress updates (after taking a backup).
5. Add DISALLOW_FILE_EDIT on WordPress; restrict code editing on Shopify.
6. Lock your domain at the registrar and turn on MFA there.
7. Confirm backups exist and that you know how to restore them.
8. Set a monthly calendar reminder for the checklist below.

From experience. Working daily as a Shopify Plus developer and with WordPress and Webflow builds, I treat the app and plugin list as the real attack surface. A quarterly "do we still need this?" review is one of the simplest security habits a store or site can adopt.

Signs your site or store may be compromised

• Admin or staff accounts you don't recognize, or permission changes nobody made
• New apps, plugins, themes or files that nobody on the team installed
• Unexpected redirects, pop-ups or spam pages, often visible only to visitors from search engines
• Payment, payout or bank details changed in settings
• Unusual orders, refunds or discount codes
• Warnings from your browser, search engine or hosting provider
• Customers reporting strange emails that appear to come from you

If your site is hacked: first moves

1. Secure the accounts first. Change passwords from a clean device, sign out all sessions and check MFA settings for the owner and admins.
2. Remove unknown users and apps or plugins, and note what you removed for later investigation.
3. On Shopify, contact Shopify Support immediately; Shopify's help center says to do this if you think your account has been compromised.
4. On WordPress, take a snapshot before cleaning so evidence isn't lost, then restore from a known-clean backup or work with your host or a specialist to remove malware.
5. Rotate API keys and tokens used by apps and integrations.
6. Check whether customer data was exposed and follow what to do after a data breach.

Monthly website security checklist

• [ ] All admin and staff accounts reviewed; leavers removed
• [ ] MFA or passkeys on every admin account
• [ ] Shopify apps / WordPress plugins reviewed; unused ones removed
• [ ] WordPress core, plugins and themes updated
• [ ] Theme or code changes reviewed and backed up
• [ ] Third-party scripts reviewed
• [ ] Domain registrar locked, MFA enabled
• [ ] Backups verified and a test restore done this quarter
• [ ] Firewall or security service active (WordPress)
• [ ] Unusual orders, logins or file changes investigated

Next steps

• Do the one-hour baseline this week, starting with MFA and access cleanup.
• Set up off-site backups using the 3-2-1 backup strategy.
• Move any API tokens out of code and documents with our secrets management guide.
• Cover the rest of your business with the small business cybersecurity checklist.
• For Shopify Plus builds, app audits and secure integrations, see our Shopify Plus developer service.

Sources

• Shopify, Security (PCI DSS Level 1, SOC reports): https://www.shopify.com/security
• Shopify Help Center, Account security: https://help.shopify.com/en/manual/privacy-and-security/account-security/two-step-authentication
• WordPress Developer Resources, Hardening WordPress: https://developer.wordpress.org/advanced-administration/security/hardening/
• CISA, Require Multifactor Authentication: https://www.cisa.gov/secure-our-world/require-multifactor-authentication
• CISA, #StopRansomware Guide: https://www.cisa.gov/stopransomware/ransomware-guide

Keep reading