iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Protect an online store by holding less customer data, locking down every privileged account, keeping its software current, checking how vendors handle security, and preparing to detect and respond to incidents. Payment processing through a third party can reduce what your store handles, but it does not automatically remove your PCI DSS responsibilities.
Start by reducing the customer data you keep
Every customer detail your store collects creates a reason to protect it for as long as you retain it. The Federal Trade Commission (FTC) puts the principle simply: “No one can steal what you don’t have.”
Review each place your store asks for information, including account creation, checkout, customer support, and marketing forms. For every field, ask whether the business needs it for a specific purpose. Remove fields that do not serve one. Limit access to customer records to staff and contractors who need it, and set retention periods so that unneeded information is securely deleted.
Recommended Free Tools
The FTC’s Start with Security: A Guide for Business discusses risks illustrated by cases involving unnecessary collection, broad access, unencrypted storage, and weak vendor oversight. Those examples are reasons to check your own practices, not evidence that every store has the same exposure.
#1 Best Overall
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
Secure accounts and the systems behind your store
Storefront logins are only part of the picture. An attacker with access to your hosting account, payment dashboard, domain email, source-code repository, or remote-access tools may be able to affect the store even without a storefront login.
Protect privileged logins
- Use a unique password for each account, especially administrator and vendor accounts.
- Enable multi-factor authentication (MFA) wherever it is available for store administration, hosting, payment services, email, repositories, and remote access.
- Restrict administrator privileges to people who need them, and remove access when a staff member or contractor no longer needs it.
- Use login protections such as limits on failed attempts where your platform supports them.
- If considering a hardware security token as an additional factor, first confirm that your platform or identity provider supports it. A token is one possible MFA method, not a substitute for other account controls.
Patch, back up, and test recovery
Keep the commerce platform, plugins, themes, operating systems, and security tools current. Automate updates when appropriate, while checking that updates do not disrupt essential store functions. MFA does not replace patching or access control.
Rank #2
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- This BookFactory log book is for security guards in any sector or business. You can report location, circumstances and report number.
- There are spaces to log the individual's names address, description and other identifying information. There are also spaces to note others involved, notes, and vehicle information if one was involved
- Wire-O, 100 Pages, Dimensions 3.5" x 5.25"
- Reorder SKU: LOG-100-M3CW-PP(Security-Report)
Back up important files and information, and make sure you know how to restore them. A backup is most useful when the business can access it and has a workable recovery process. The FTC’s Cybersecurity for Small Business guidance covers MFA, updates, backups, staff training, and incident planning.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choose and manage hosting, email, and other vendors carefully
A provider’s assurances are not a guarantee that your store is secure. Use a consistent set of questions when choosing a host, commerce platform, payment provider, or other vendor, and revisit the answers when responsibilities or services change.
| What to check | Questions to ask |
|---|---|
| TLS | Does the service support TLS to protect connections to the store? |
| Updates | Who updates the platform, plugins, themes, operating systems, and security tools? What is the process for applying fixes? |
| Privileged access | Can administrative accounts use MFA, and how is vendor access limited and removed? |
| Customer data | Where is data stored, who can access it, and what protections such as encryption are in place? |
| Backups and recovery | What backup and recovery options are provided, and who is responsible for using them? |
| Incident support | Whom should you contact about suspicious activity, and what incident support does the agreement provide? |
| Written commitments | What security requirements are documented in the contract, and how will you verify that the agreed safeguards are in place? |
Put security requirements in vendor agreements, give vendors only the data and access they need, and check that promised safeguards are actually being followed. If your business uses domain email, ask the provider about SPF, DKIM, and DMARC authentication to reduce domain impersonation. Keep public or guest wireless access separate from the business network.
Understand how checkout design affects PCI DSS scope
Using a third-party payment processor does not by itself make every merchant system irrelevant to PCI DSS. The payment flow, the systems that handle or can affect payment data, and the applicable eligibility criteria all matter. In particular, a merchant-managed page that embeds a payment form can raise different requirements from a flow that sends the customer to a processor.
| Payment flow | What the cited PCI guidance says | What to verify |
|---|---|---|
| Embedded third-party payment form | PCI SSC’s February 2025 FAQ on PCI DSS v4.0.1 SAQ A r1 says the script criterion applies to e-commerce pages with an embedded third-party payment form. It describes techniques associated with Requirements 6.4.3 and 11.6.1, or confirmation from the compliant payment provider, as ways to address that criterion. | Confirm how the criterion applies to your page and which current SAQ eligibility requirements your environment must meet. |
| Redirect or fully outsourced payment flow | The same FAQ says that specific SAQ A script criterion does not apply to redirect or fully outsourced payment flows. That does not waive the other applicable SAQ A eligibility criteria. | Check which systems you manage that could affect the flow, and confirm the applicable SAQ with the entity that accepts your compliance assessment. |
PCI Security Standards Council (PCI SSC) distinguishes these configurations in its February 2025 FAQ on SAQ A eligibility for scripts. Its May 2019 FAQ on Requirements 2, 6, and 8 for SAQ A merchants also explains that a merchant-managed redirect mechanism and systems affecting its integrity may remain relevant, including applicable password, authentication, and patching controls. Because that FAQ is older and standards can change, verify current requirements rather than relying on it as a current assessment.
Free tools Windows power users keep installed
One-click scans. No signup required.
Ask your acquirer, payment brands, or other compliance-accepting entity which SAQ applies to your specific environment. Do not assume that a hosted checkout makes a merchant “PCI exempt.”
Best Value
- Used Book in Good Condition
Monitor for problems and prepare to respond
Security needs ongoing attention after launch. Monitor systems for unauthorized access and unusual activity, and train staff regularly so they know how to handle information and raise concerns. Include vendor access and the systems that support checkout in your monitoring and review routine.
Make an incident plan that covers how the business will preserve relevant data, continue operations, and notify affected customers if a breach occurs. Notification duties depend on the facts and the applicable jurisdiction. For an actual incident, consult relevant regulators and qualified legal counsel about what the business must do.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
