Contents
Short answer
Most attacks on websites exploit outdated shop systems, plugins or weak admin access. Updates, MFA for all admins, tested backups and secured domain access are therefore the baseline. WAF and DDoS protection become relevant mainly for online shops where downtime directly costs revenue.
Why does this matter for small businesses?
A compromised shop can expose customer data, manipulate payment pages or spread malware. For online shops every outage means lost revenue and trust – and website, email and shop often depend on the same domain.
What does it include?
CMS, shop and plugin updates
Apply promptly; remove unused plugins and themes.
Basic
Admin accounts and MFA
Personal admin accounts with MFA for shop, hosting, domain registrar and payment provider.
Basic
Hosting and backups
Reputable hosting with server updates; your own tested backups of files and database.
Basic
Domain and DNS security
Registrar account with MFA, auto-renewal, transfer lock, DNS changes by few people only.
Basic
TLS
An encrypted connection (HTTPS) with an automatically renewed certificate is standard today.
Basic
Payment providers
Avoid processing payment data yourself; use established providers and follow their requirements.
Basic
Monitoring
Monitor availability, file changes and unusual admin sign-ins.
Useful as IT grows
WAF
A web application firewall filters typical attacks on web applications. It does not replace updates.
Relevant with higher risk
DDoS protection
Protection against deliberate overload, often part of hosting or CDN offers.
Relevant with higher risk
What does it protect against?
- Exploitation of known flaws in shop system and plugins
- Takeover of admin and registrar accounts
- Long outages, if backups are tested
What does it not protect against?
- Flaws in unpatched software despite a WAF
- Customers deceived via look-alike domains
- Mistakes at external providers beyond your control
Which basic measures are often enough?
- 01Updates for shop, plugins and themes
- 02MFA for all admin, hosting and registrar accounts
- 03Your own tested backups
- 04Domain with auto-renewal and transfer lock
- 05Payments through an established provider
When does a more advanced solution make sense?
WAF, DDoS protection and extended monitoring are worth it when the shop generates a significant share of revenue, stores much customer data or has already been attacked. Hosting or CDN providers often offer these as add-ons.
Common mistakes
- Postponing plugin updates for fear of breaking things
- One shared admin account for everyone
- Domain expiring unnoticed
- Backups only at the host and never tested
Checklist
- Shop and plugins up to date
- Unused plugins removed
- MFA for all admins, hosting and registrar
- Backup tested
- Domain expiry and transfer lock checked
- Responsibility for updates clarified
Frequently asked questions
Does every shop need a WAF?
No. For small shops, updates, MFA and backups matter more. A WAF is an additional layer at higher risk.
Who is responsible for updates?
This should be agreed in writing – with agency, host or internally. Unclear responsibility is a common cause of outdated shops.
Sensible next step
Agree in writing who installs shop and plugin updates, and how often.
Sources
- Bundesamt für Sicherheit in der Informationstechnik (BSI)
- CISA – Cybersecurity and Infrastructure Security Agency
- ENISA – European Union Agency for Cybersecurity
Checked on 6 Oct 2026.
General orientation – does not replace an individual security review, legal or data-protection advice.