Securing Shopify: 5 Ways to Enhance Your Store’s Security
PARTNER SERIES
Our partner blog series features articles from many industry authorities, and posts range in topics discussing best practices and learned lessons within our partner’s fields.
This month’s Partner Post (by Ross Beyeler, Founder of Growth Spark and new COO of Trellis) discusses best practices for Shopify store security and recommends some tools to get the job done.
When it comes to security and e-commerce, Shopify hits almost every ‘best practice’ out of the park without any customizations. They meet all six categories of PCI Standards, have GDPR-compliant features built directly into the platform, support two-step authentication, allow you to manage staff permissions and enforces that latest in TLS encryption protocols. Needless to say, they check quite a few boxes. However, there are a few additional practices that are worth considering to ensure you’ve covered all of your basis as a Shopify merchant when it comes to security.
Activate SSL Certificate
What used to require an annual licenses through a domain provider, Shopify includes support for an SSL certificate as part of their platform. Although it’s technically enabled by default, or at least should be, it’s worth double-checking to ensure your store is actively enforcing SSL. At its core, an SSL certificate routes all traffic through HTTPS instead of HTTP, a more secure way for customers to access your website.
Schedule Regular Backups
Shopify has a tremendously well-architectured hosting infrastructure that ensures various levels of data redundancy. This, however, does not prevent your intern from accidentally deleting all of your website’s content or overwriting your theme. As a means of recovering from any ‘oops’ situation that might occur internally, it’s recommended to have a backup solution. This allows you to schedule and automate a backup of almost every item within your Shopify store including products, inventory, customers, blog posts, pages and more.
Enforce Code Management Standards
Shopify provides a range of tutorials on using the theme editor and some ‘getting started recommendations‘ that are worth reviewing for any merchant considering modifying their theme code directly. However, merchants planning to ‘get serious’ about modifying their theme’s code should consider employing some code management standards. Most importantly, you’ll want to explore the use of a version control system such as Git and possibly a local command line tool such as Theme Kit. At the very least, creating regular backups of your theme and restricting access to who actually touches any theme code is a good foundation for preventing issues with your theme.
Protect Against Fraud
Shopify has robust built-in fraud analysis for all merchants and offers additional solutions such as Shopify Flow and Fraud Protect to Shopify Plus merchants as well. Beyond what’s included with Shopify, you’ll want to consider a more advanced fraud detection tool such as NS8. NS8 helps with order fraud, advertising fraud and protection against overall poor performance. It requires no modification to your theme’s code and provides a robust set of functionality out-of-the-box.
Lock Restricted Content
Depending on your business, you could likely have the need to prevent access to certain products, content or sections of your website. Whether it’s to differentiate customers, appeal to investors or provide member-only access, a tool like Locksmith can help in tackling all of these. The app allows you to customize a variety of ‘lockdown rules’ to help you control the overall access and security of your store.
Taking the recommended steps above will ensure your Shopify store is as secure as possible. In addition, these extra security protocols can help provide a better, more trustworthy experience for your customers, which ultimately means more sales. For further reference, here are a few other relevant resources on security:
Our Partner
Until recently Ross Beyeler was CEO of Growth Spark, a Shopify design, development, and consulting agency. To read more posts like this please see the Growth Spark blog and follow them on Twitter, Facebook, or Instagram.
Ross is now the COO of Trellis, an agency that provides strategy, design, development and marketing services to e-commerce companies
GrowthSpark
phone:
(877) 851-5286
email address:
info@growthspark.com
