Ecommerce Security Audit: How to Review Your Store Before Professional Testing

An internal ecommerce security review checks that the basics are in place before professional testing. Define scope, build an inventory of domains, platforms, apps, scripts, integrations, accounts and data stores, then review controls: MFA and access, app permissions, scripts on payment-adjacent pages, payment setup, secrets, data handling, configuration, monitoring and incident readiness. Prioritize findings by likelihood and impact, fix them with owners and dates, and commission qualified specialists for testing. An internal review doesn't replace professional assessment.

This is a defensive review of your own store's controls, carried out by your team or partners. It checks configuration, access and processes. It doesn't involve attacking systems, and it doesn't prove the store is secure. Professional penetration testing and security assessments, carried out by qualified specialists with authorization, go further and should follow, especially for custom code, headless storefronts and integrations.

Doing the internal review first is still valuable: it fixes obvious gaps cheaply, gives testers an accurate inventory and scope, and makes their time count. For the underlying controls, see ecommerce security.

List what's included: storefronts (theme or headless), admin, checkout configuration, apps and plugins, custom apps and code, integrations (ERP, CRM, marketing, fulfilment), domains and DNS, email, hosting, payment providers, analytics and marketing tags, and systems that hold customer data (warehouse, support desk, email platform). Note what's managed by third parties and what you control.

Access is where many incidents start. For every system in scope, confirm MFA is enforced, each person has their own account, permissions match roles, former staff and agencies are removed, and API credentials are scoped and owned. Pay special attention to email and domain accounts: control of them often means control of everything else through password resets.

For each app or plugin, confirm it's still needed, comes from a reputable developer, requests only necessary access and is up to date. Remove unused ones. For scripts and tags, confirm each has an owner and purpose, is loaded only where needed, and is reviewed before being added to payment-adjacent pages. For custom code, check dependency updates, secrets management, code review practices and whether security testing has been done.

Confirm how card data flows: hosted checkout, embedded payment fields or direct handling. Check which PCI DSS validation applies with your payment provider, and whether you meet current requirements, including script management on payment pages where relevant (PCI Security Standards Council). Review fraud tool settings, chargeback rates and who can issue refunds or change payout details.

Map where customer data goes: platform, email and CRM tools, support desk, warehouse, spreadsheets, agencies. Check access, retention, encryption and deletion processes. Look for exports stored in shared drives or email. This overlaps with privacy work; see ecommerce privacy and customer data.

Check HTTPS everywhere, security headers where you control them, secure configuration of storage and hosting, and email authentication (SPF, DKIM, DMARC) to reduce spoofing of your domain. Confirm alerts exist for admin changes, new apps, theme or script changes and unusual activity. Check backups and restores. Review the incident response plan and whether it's been practised.

Rate each finding by likelihood and impact, assign an owner and a date. Findings that could lead to takeover of admin, email or domain accounts, exposure of payment or large volumes of customer data, or unauthorized scripts on payment-adjacent pages are critical.

After fixing critical and high findings, commission professional testing where warranted: penetration testing of custom code, headless storefronts, APIs and integrations; reviews of cloud configuration; and assessments required by your payment or compliance obligations. Provide testers with your inventory and scope, confirm authorization (including from platform providers where their terms require it) and plan remediation time. Don't run intrusive tests against live systems or third-party platforms yourself.

Security reviews work best as routine: quarterly access and app reviews, an annual full review, and targeted reviews after major changes (replatforming, headless builds, new integrations, agency changes). Keep the inventory current and track findings to closure. See ecommerce replatforming.

When engaging testers, agree scope, methods, timing and rules of engagement in writing, confirm authorization for every system tested (including checking platform provider terms), and provide a test environment where possible. Ask for a report with findings, severity, evidence and remediation guidance, and plan a re-test after fixes. Treat findings as confidential and share them only with those who need them.

Track findings to closure, re-check critical fixes, update the inventory and document decisions where risks are accepted, with a reason and an owner. Share a short summary with leadership so security investment decisions are informed. See ecommerce privacy and customer data for the data side.

An internal security review inventories the store, checks access, apps, scripts, payments, data, configuration and readiness, prioritizes fixes and prepares for professional testing, which it doesn't replace. Related: website security checklist and ecommerce compliance.