How to Use This Checklist
This checklist covers 7 key cybersecurity areas in e-commerce. Each item is classified by priority:
- Critical — implement immediately, absence = direct risk of customer data loss or revenue impact
- Important — implement within 3 months
- Recommended — implement within 6-12 months
The checklist aligns with PCI DSS v4.0, GDPR, and OWASP recommendations for e-commerce.
Payment and Card Data Protection
Critical:
- Payment tokenization — card data processed by a certified provider (Stripe, Adyen)
- TLS 1.2+ on all pages (not just checkout)
- Content Security Policy (CSP) on payment pages
- JavaScript script integrity monitoring on checkout pages (PCI DSS 6.4.3)
- Unauthorized change detection on payment pages (PCI DSS 11.6.1)
Important:
- Subresource Integrity (SRI) for all external scripts
- Regular scanning for web skimmers/Magecart
- Third-party vendor audit for payment page access
Recommended:
- Payment form in an isolated iframe from the provider
- Transaction monitoring for anomalies (velocity checks)
Access Control and Authentication
Critical:
- MFA on all administrative accounts
- Strong password policy (min. 12 characters)
- Account lockout after 5 failed login attempts
- Change default admin panel paths (/admin, /wp-admin)
Important:
- Role-Based Access Control (RBAC) in the admin panel
- Regular permission reviews (quarterly)
- Logging of all administrative operations
- Admin panel access restricted by IP/VPN
Recommended:
- Risk-based MFA for customers (suspicious logins)
- Have I Been Pwned integration (proactive compromised password changes)
- Session management with idle timeout (15 min admin, 30 min customers)
Web Application Firewall and Network Protection
Critical:
- Active WAF with OWASP Top 10 rules
- DDoS protection (Cloud WAF or dedicated solution)
- Network firewall with port whitelisting
Important:
- Platform-specific WAF rules (WooCommerce, Magento, etc.)
- Rate limiting on login and API endpoints
- Bot management — malicious bot detection and blocking
- IP whitelisting for payment gateways and integrations
Recommended:
- Behavioral analysis for credential stuffing detection
- Geo-blocking for unsupported regions
- API Gateway with schema validation
API Security
Critical:
- Authentication on every API endpoint
- Object-level authorization (BOLA protection)
- Input data validation (schema validation)
Important:
- Rate limiting per endpoint and per user
- JWT tokens with short lifespans (15-30 min)
- No excessive data exposure in API responses
- Logging of all API requests with metadata
Recommended:
- API versioning with deprecation policy
- Mass assignment protection
- GraphQL: query depth and complexity limits
Platform and Code Management
Critical:
- Regular platform, plugin, and library updates
- Automated vulnerability scanning (weekly)
- Environment separation: dev/staging/production (separate data, keys, access)
Important:
- Code review before production deployment
- Penetration testing (at least annually + after major changes)
- Automated backup with recovery testing (monthly)
- Production data anonymization on staging
Recommended:
- CI/CD pipeline with security scanning (SAST/DAST)
- Dependency scanning (Snyk, Dependabot)
- Infrastructure as Code with security hardening
Monitoring and Incident Response
Critical:
- Centralized logging (SIEM or log management)
- Security monitoring with critical event alerts
- Incident response procedure (who, what, when)
- Customer and supervisory authority notification plan (72h GDPR)
Important:
- File Integrity Monitoring (FIM) on the server
- Alerts for: 4xx/5xx spikes, unusual logins, checkout file changes
- Regular log reviews (weekly)
- Escalation contacts (hosting, CDN, payment provider, CERT)
Recommended:
- 24/7 SOC (internal or external)
- E-commerce threat intelligence feed
- Tabletop exercises (incident simulation every 6 months)
Compliance and Documentation
Critical:
- PCI DSS SAQ completed and current
- GDPR-compliant privacy policy
- Cookie consent mechanism with reject option
- Record of data processing activities
Important:
- Data processing agreements with vendors (hosting, analytics, marketing)
- DPIA (Data Protection Impact Assessment) for profiling
- Data subject rights procedure (access, erasure, portability)
Recommended:
- Quarterly ASV scan
- Annual security audit
- Security training for the team (every 6 months)
- Cyber insurance
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
