WooCommerce Maintenance & Security

A fault on a website gets reported by somebody sooner or later. In a shop the orders stop arriving instead, and that often only shows up days later. We keep WooCommerce shops current and protected, with an update path that does not leave the order flow to chance.

Get expert advice

Why a shop has to be maintained differently

The basics are the same as for any WordPress installation, and we have a separate page on WordPress maintenance & security. What differs in a shop is the cost of a fault. A broken contact form costs you one enquiry. A broken checkout costs every order until somebody notices.

The places where it gets expensive in a shop

The checkout: it hangs on the theme, the payment extension, the shipping rules and the tax logic at the same time. Any update can hit it.
Payment integrations: payment providers change their interfaces regularly, and outdated extensions eventually fail without a sound.
Order completion in the background: once the scheduled tasks stop running, orders sit between statuses and nobody gets a confirmation.
Personal data: a shop holds names, addresses and order histories. A data leak here is a reportable incident.
Payment pages as a target: manipulated scripts in the checkout collect payment data as it is typed, while nothing about the shop looks different from outside.

Updates that run somewhere else first

We do not push updates straight into the live shop. WooCommerce itself, the theme and the payment and shipping extensions run first on a staging environment that is a copy of production. What gets checked there is not only whether the page loads, but the whole order path down to the confirmation email.

Security patches are a separate matter. When a vulnerability is being actively exploited, we close it promptly and document afterwards what was changed. Waiting for the next regular maintenance window would be the worse call in that situation.

What maintenance covers

Core, theme and extension updates, tested on staging instead of applied blindly in production
A check of the order path after every update, test order included
Prompt security patches, outside the regular maintenance windows as well
Regular backups with a tested restore, matched to the order volume
Database care, so session and order tables do not quietly grow out of hand
Documentation of the changes, so it stays traceable what happened and when

Protecting a shop

A shop is a more rewarding target than a company website, because payment transactions and customer data come together in one place. The quiet intrusion does more damage than a defaced home page. An extra script in the checkout reads the payment data along with the visitor, while the shop carries on running normally to the outside world.

Where we start

Tidying up accounts and roles, so not every login carries administrator rights
Two factor authentication for every account with access to orders
Detection of changed files, so injected code stands out
Sorting out abandoned extensions that have had no update for years
Consistent HTTPS and current certificates on every path through the shop
A check of the third party scripts loaded in the checkout, where only what is strictly necessary belongs

Monitoring the order path

A plain availability check does not go far enough for a shop. The home page can be served flawlessly while the payment route has been failing for hours. So we keep an eye on the points the revenue hangs on, and we watch the loading times automatically with our free tool SiteSentry. A slow checkout costs orders just like a broken one does.

What we monitor

Availability and response times of the pages that carry revenue, not only of the home page
Processing of the background tasks, so orders do not get stuck between statuses
Error rates on the payment integration
Validity of SSL certificates and domains before they expire
Loading times over time, so a gradual decline stands out

When something does go wrong

In an emergency the shop gets stabilised first and the order path brought back into service. Then we look for the cause, then the hole gets closed, and cosmetics come last. We clean up compromised shops even when we did not look after them before, and we put the findings in writing. If personal data was involved, your company needs that basis for the data protection assessment.

Support that goes beyond maintenance and includes further development runs through a model of its own here. More on Continuous Support.

Frequent questions about maintenance and security

How often are updates applied?

On a fixed rhythm that we set to suit the shop, and immediately for security critical holes. The path matters more than the frequency: staging first, then a test order, then production. In case of doubt we would sooner apply an update a little later than have an order path fail silently.

What happens if an update breaks the checkout?

That is what the staging environment is for, the fault turns up there and not in the live shop. If a problem shows itself, we hold the update back, clarify the cause with the vendor or solve it ourselves, and only then apply it. If something does slip through into production, we fall back on the tested backup.

Do you also look after shops that somebody else built?

Yes, that is more or less the normal case. Before taking one on we look at the state of the code, the extensions, known vulnerabilities, the backup situation and the hosting. After that we tell you what has to be done first and what can wait.

My shop has been hacked, can you help?

Yes, at short notice and without an existing contract. We stabilise operations first, then look for the cause, close the hole and check afterwards whether order or payment data was affected. We document the findings so you have a solid basis for the further assessment.

Do I need maintenance if my shop has hardly any orders?

Automated attacks look for vulnerable installations, not for rewarding ones, so yes. With a low order volume the scope can be leaner: less frequent backups, longer maintenance intervals, but consistent security patches.

Ready for your WooCommerce project?

Tell us about your project. We'll get back to you promptly with an honest assessment.