Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To reduce cyberattack risk for an online store, secure every account that can change it, keep exposed software updated, restrict unnecessary internet access, protect checkout scripts, monitor activity, and maintain backups and an incident plan. Start by mapping your store’s systems and payment flow; then work through the controls below. No single measure guarantees security, and your PCI DSS obligations depend on how payments are handled and on the compliance program that applies to your business.
Map the store’s systems and access first
Make a short inventory before changing settings. It gives you a way to identify what needs protection, who is responsible, and which providers to contact if something goes wrong. This is a practical way to apply CISA’s guidance on reducing internet exposure and using logs, not a prescribed inventory format.
- Record the storefront platform and version, hosting service, domain registrar, and any server or endpoint software involved in running the store.
- List administrator accounts and other people or services able to change the site, deploy code, or access customer or payment systems.
- Document plugins, extensions, themes, integrations, analytics tags, and scripts that run on checkout pages, along with their owners and purpose.
- Describe the customer’s payment path: a merchant-hosted form, an embedded third-party form, a redirect, or a provider-hosted page.
- Note where backups are kept, how you would restore them, and how to reach your hosting provider, payment provider, acquirer, and other critical suppliers.
CISA’s Internet Exposure Reduction Guidance, published June 4, 2025, recommends assessing exposed assets and deciding which need to remain accessible. CISA’s logging guidance also makes logging and protecting log data part of a practical security baseline.
Free tools Windows power users keep installed
One-click scans. No signup required.
Secure the accounts that can change the store
Require unique passwords and multifactor authentication (MFA) for accounts that can alter the storefront or reach sensitive systems. Prioritize administrator, email, hosting, domain registrar, and payment-provider accounts: access to any one of these may let an attacker change the site, intercept recovery messages, or interfere with payments.
CISA says strong passwords alone are no longer enough and recommends phishing-resistant MFA where available. Its guidance ranks physical security keys highest among the listed methods, followed by authenticator apps with number matching, authenticator codes, biometrics, and text or email codes. CISA calls text and email codes the weakest option in that list. These are guidance rankings, not a guarantee against every type of account compromise. See CISA’s MFA guidance.
| MFA method | What to know | Practical consideration |
|---|---|---|
| Physical security key | CISA ranks this highest among the listed MFA options. | Check that each service supports the key standard and plan for a spare key or another secure recovery method. |
| Authenticator app with number matching | CISA places this next in its ordering. | Confirm which administrator accounts support it and how access can be recovered if a device is lost. |
| Authenticator code or biometrics | Both appear below the options above in CISA’s ordering. | Use the strongest method the service supports and document a safe recovery process. |
| Text or email code | CISA identifies these as the weakest listed options. | Use them when stronger supported options are unavailable, rather than treating them as equivalent to a security key. |
A key or app protects sign-in; it does not protect checkout code, replace software updates, or eliminate the need for monitoring and recovery planning.
Patch the storefront and reduce internet exposure
Keep the storefront platform, plugins, themes, server software, and endpoint software on supported versions, and apply security updates promptly. Remove unused extensions and accounts instead of leaving them available to be forgotten. Unsupported or abandoned components may not receive fixes when vulnerabilities are found.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Review which services are reachable from the internet and whether each needs to be. Restrict access to services that do not need public exposure, and protect the systems that must remain accessible. CISA’s June 4, 2025 exposure-reduction guidance describes assessing exposure, determining what needs internet access, and mitigating risk to what remains exposed. CISA also provides small-business security resources at Small and Medium Businesses and Small- and medium-sized business resources.
Rank #3
- 【Tired of constantly searching for or resetting your passwords?】 MOSA BEAR password keeper book is the perfect solution for you! This password book provides a dedicated place to securely store all your important website addresses, emails, usernames and passwords, ensuring your information is protected and easy to find. The well-designed log pages help you manage multiple accounts in a systematic way, saying goodbye to password confusion.
- 【Premium Design & Password Security】 The password book with alphabetical tabs features an anonymous cover design with no title on the cover, effectively avoiding information exposure. The password keeper design is specifically designed with password security in mind, providing space to record password hints instead of writing directly on the password itself, further protecting your important information.
- 【Simple Layout and Plenty of Space】The 160-page password logbook is designed to provide ample space to record passwords and other important information. It can store up to 414 passwords. In addition, it provides extra pages to record other information, such as email setup, card information, computer operating system information, software licenses, and more. The journal also includes 3 blank pages at the end for you to add additional notes.
- 【Palm-sized Size & Premium Quality】 This password notebook has an ideal size, 4.3" x 5.7", for carrying around, whether in a purse or pocket. Its sturdy glue binding allows the notebook to unfold smoothly and is more comfortable to use. The inner pages are made of high-quality 100GSM thick paper, which can effectively reduce ink penetration and ensure a cleaner and neater writing effect. The overall design takes into account both portability and durability, making it an ideal choice for recording important passwords.
- 【A-Z Tabs for Quick Search 】Our password book comes with alphabetical tabs to help you find the password you need quickly and easily. Alphabetically organized tabs ensure that you can quickly flip to the right section, saving you the time and hassle of searching for your password.
Protect payment pages from unauthorized scripts
Online skimming happens when malicious code on a payment page captures information as a customer enters it in the browser. A store can therefore face payment-page risk even when another company processes the transaction: the merchant’s page or its integrations may still affect what runs in the customer’s browser. PCI SSC’s explanation of online skimming describes this browser-side threat.
Keep a current list of scripts that run on payment pages and why each is present. Remove unnecessary ones, control who can add or change them, and monitor for unauthorized changes to scripts and security-impacting HTTP headers. PCI SSC’s Payment Page Security and Preventing E-Skimming supplement, published March 10, 2025, addresses authorization, integrity checks, and tamper monitoring under PCI DSS Requirements 6.4.3 and 11.6.1. Follow the applicable requirements and your provider’s instructions; merely having a script list is not proof that a page meets them.
Rank #4
- Bookbound planner helps you keep track of passwords and favorite websites
- Room for over 200 entries; 3.5 x 6 inch page sizes
- User name and security questions field
- Tips for what makes a strong password; web resources; notes pages
- Printed on quality paper containing 30% post-consumer waste; black simulated leather cover; 3.63 x 6.13 x .21 inches
Understand how payment flow changes the PCI questions
The payment form’s location affects what the merchant controls and which PCI DSS questions apply. The table summarizes the payment-flow distinctions relevant to PCI SSC FAQ 1588; it is not a determination of your full assessment or validation scope.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11| Payment flow | What the merchant’s site controls | PCI SSC FAQ 1588 clarification | Operational trade-off |
|---|---|---|---|
| Merchant-hosted payment form | The merchant page and its payment-form code are on the merchant’s site. | FAQ 1588’s specific SAQ A script-attack clarification concerns embedded third-party forms, redirects, and fully outsourced payment; it does not establish the requirements for every merchant-hosted arrangement. | More control over the form can mean more payment-page code and configuration for the merchant to secure. |
| Embedded third-party form, such as an iframe | The merchant controls the surrounding page and the scripts it loads; the payment form is embedded from the provider. | For this flow, the FAQ says the merchant confirms its site is not susceptible to relevant script attacks, using suitable techniques or confirmation from a compliant provider when implemented according to the provider’s instructions. | The form is supplied by a provider, but the merchant still needs to consider scripts and changes on the surrounding page. |
| Redirect to a payment provider | The merchant controls the page or link that sends the customer to the provider. | The FAQ says its specific SAQ A script-attack eligibility criterion does not apply to a page that redirects to the provider. | The provider handles the payment page after the redirect, while the merchant still has its own site and account security to manage. |
| Fully provider-hosted payment page | The provider hosts the payment page; the merchant site directs the customer to the provider’s payment experience. | The FAQ says its specific SAQ A script-attack eligibility criterion does not apply when payment is fully outsourced through a provider-hosted page. | Less payment-page code may be under the merchant’s direct control, but outsourcing does not remove every merchant security responsibility. |
FAQ 1588 clarifies one SAQ A eligibility criterion; it does not say that merchants using a redirect or hosted page are exempt from PCI DSS or all validation. PCI SSC says the organizations that manage compliance programs, such as payment brands or acquirers, determine whether an entity must comply with or validate against a PCI SSC standard. Confirm your current payment flow, applicable SAQ, and validation requirements with your acquirer or payment brand. See PCI SSC FAQ 1588 and the PCI DSS standards page. The 2025 supplement announcement described PCI DSS v4.0.1 as current at the time of publication; check the standards page for current information rather than treating that dated statement as a live version check.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Monitor activity and keep recoverable backups
Logging helps you notice suspicious activity and investigate changes. Enable and protect relevant logs for the storefront, hosting environment, administrator access, and payment-page changes where those records are available. Assign someone to review alerts and investigate unexpected account, configuration, or script changes; collecting logs without protecting or reviewing them is not a complete monitoring process.
Maintain backups that you can restore, and establish how to recover the store and its data if systems are damaged or unavailable. Decide who can access backups and how the team will confirm a restore has worked. Keep response instructions and contact details somewhere reachable if the storefront or company email accounts are unavailable.
Prepare a response plan and review suppliers
Write down who leads an incident and who handles technical response, communications, legal questions, and business continuity. Identify who will contact the hosting company, payment provider, acquirer, legal counsel, customers, and relevant authorities when appropriate. CISA’s small-business logging and security resources support assigning crisis-response responsibilities rather than leaving decisions to be improvised during an incident.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Keep an inventory of providers and integrations that can access the store or its data. For each important supplier, ask questions suited to the service and your contract:
- Does the service support MFA and role-based access for your account?
- How are vulnerabilities and security updates handled?
- What backups are available, and what recovery assistance is included?
- How and when will the provider notify you about a security incident that may affect your store or data?
- Who is responsible for the security of payment-page scripts and related configuration?
CISA’s Reducing ICT Supply Chain Risk in Small and Medium-Sized Businesses Fact Sheet, published May 23, 2023, emphasizes supplier visibility and risk management. Treat provider access and incident responsibilities as part of the store’s security planning, not as details that can be assumed from the service name.
Quick Recap
Prioritize the work
- Today: Turn on the strongest available MFA for administrator, email, hosting, registrar, and payment-provider accounts; remove access no one needs.
- Next: Inventory the storefront, exposed services, extensions, checkout scripts, payment flow, suppliers, and backup locations.
- Then: Update supported software, remove unused components, and restrict internet access that is not needed for the business.
- Before the next change to checkout: Review the scripts and headers that affect payment pages, and confirm the applicable PCI requirements with your acquirer or payment provider.
- On an ongoing basis: Review logs and alerts, verify that backups can be restored, check supplier access, and keep the incident contact plan current.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
