WordPress Security Plugins for WooCommerce Stores
Since 31 March 2025, two PCI DSS requirements have applied to ecommerce sites that previously did not have to think about them. Requirement 6.4.3 obliges you to inventory every script loaded on a payment page, document why it is there, have it explicitly authorised, and verify its integrity on an ongoing basis. Requirement 11.6.1 obliges you to detect and alert on unauthorised changes to payment page content and HTTP headers.
Both exist because of card skimming, where malicious JavaScript is injected into a checkout and quietly copies card details as they are typed. It is the specific attack aimed at stores, it produces no visible symptom, and it is why a store’s threat model differs from a blog’s rather than merely being more serious. This article covers what actually protects a WooCommerce checkout.
Verified August 2026. Practical guidance, not compliance advice; confirm your obligations with your acquirer.
Why a store is a different target
A compromised blog is used to host spam or serve malware to visitors. A compromised store is used to take money, and the two attacks want different things from the intrusion. Skimmers want persistence and silence, not traffic, so they avoid every symptom that would prompt you to investigate.
What WooCommerce actually stores matters here. Card numbers are not kept in your database when you use a modern gateway, which is the entire reason redirect and iframe integrations exist. What you do hold is names, addresses, phone numbers, email addresses, order histories, and account credentials, which is a serious data protection exposure even though it is not cardholder data. Your PCI scope and your privacy exposure are two separate problems and both are real.
One widely believed exemption is worth correcting. Merchants validating with SAQ A using a redirect or an iframe are not automatically outside these script requirements, because the parent page still loads the scripts around the payment element. If you validate with SAQ A-EP or SAQ D, 6.4.3 and 11.6.1 apply in full. Check which applies to you before assuming your gateway handles it.
The 6 options compared
1. Sucuri
The strongest fit for a store, for one reason above all: file integrity monitoring plus a defined cleanup response time is the closest thing in this comparison to what 11.6.1 describes, and downtime on a store has a calculable cost.
Platform plans run $229 a year with a 30-hour cleanup SLA, $339 with 12 hours, and $549 with 6 hours, all including unlimited manual cleanups. Work out your hourly revenue and the tier chooses itself: a store taking £500 a day is losing roughly £150 in the difference between a six-hour and a thirty-hour response, so the $320 gap pays for itself in a single incident. The firewall is separate, at $9.99 or $19.98 a month, and for a store it is not optional, because an edge firewall is what stops injection attempts reaching the checkout in the first place.
- Price: $229 to $549/yr, plus $9.99 to $19.98/mo for the firewall
- Store fit: Integrity monitoring plus cleanup SLAs
- Best for: Stores where hours of downtime have a price
- Watch out for: Budget for both products, not just the platform
2. MalCare Fortify
The tier built for exactly this case: $499 a year for one site or $1,499 for five, with hourly malware scans, a real-time firewall, unlimited manual security fixes, host suspension recovery, a six-hour expert response and 60-day activity logs.
Hourly scanning is the feature that matters against skimming. A daily scan means a skimmer can harvest a full day of card details before anyone knows, and on a store that is measured in customers rather than files. Sixty-day activity logs are the second reason: reconstructing who changed what, and when, is how you establish the scope of a breach, and a store has a genuine obligation to be able to answer that. Repair at $299 is the cheaper option with twice-daily scans and a 24-hour response, and Protect at $99 does not include cleanup at all, which for a store is the wrong economy.
- Price: Fortify $499/yr, or $1,499 for five sites
- Store fit: Hourly scans, 6-hour response, 60-day logs
- Best for: Stores wanting the shortest detection window
- Watch out for: Protect at $99 detects only; not enough here
3. Patchstack
The vulnerability-intelligence layer, at $69 a month for the Developer plan or $828 a year, with additional sites at $12.50 a month per five. Relevant to stores because of what a store’s plugin list looks like.
Plugins accounted for 91% of the 11,334 WordPress vulnerabilities disclosed in 2025, and a WooCommerce store runs more plugins than any other kind of WordPress site: payment gateways, shipping calculators, tax handlers, subscriptions, reviews, abandoned cart, marketing integrations. That is a broad attack surface maintained by many different vendors. With a five-hour median time to first exploitation and protection claimed up to 48 hours ahead of competitors across 12,000 mitigation rules, the value is that a newly disclosed flaw in your shipping plugin is blocked before you have read about it.
- Price: $69/mo Developer; +$12.50/mo per 5 sites
- Store fit: Covers the wide plugin surface a store accumulates
- Best for: Stores with many extensions from many vendors
- Watch out for: No cleanup; pair with a remediation product
4. Wordfence Premium
$149 a year per site for real-time firewall rules, malware signatures, an IP blocklist covering more than 40,000 known threat actors, country blocking, and a security audit log. The most cost-effective single purchase for a store that is not currently compromised.
Two features earn their keep specifically here. The security audit log supports the change-detection habit 11.6.1 is asking for, giving you a record of who did what. And country blocking is bluntly effective on a store selling into a defined market: if you ship only within one country, blocking administrative access from everywhere else removes an enormous share of hostile traffic. Remember that free Wordfence receives new rules and signatures 30 days later, which on a checkout page is not a defensible position.
- Price: $149 a year per site
- Store fit: Audit log, country blocking, real-time rules
- Best for: Stores wanting one well-supported paid plugin
- Watch out for: The free version’s 30-day lag is unacceptable here
5. Real-time backup
Not a security plugin, and the control most stores are missing. A nightly backup on a store means that recovering from any incident discards every order placed since, which is not a recovery, it is a different kind of loss.
BlogVault’s WooCommerce plan at $499 a year provides real-time backups at one-hour intervals with 365-day retention and 100GB, and Jetpack VaultPress Backup captures changes as they happen with restores that work when the site is entirely unreachable. Retention is the underrated half: a skimmer discovered in week six cannot be rolled back from a 30-day archive, and a year of history means you can always reach a point before the compromise. Calculate what a day of orders is worth to you and the price stops looking like a security expense.
- Price: BlogVault WooCommerce $499/yr; Jetpack varies
- Store fit: Hourly capture, 365-day retention
- Best for: Any store taking orders daily
- Watch out for: Nightly backups silently discard a day of orders
6. A script inventory for your checkout
Free, and the thing 6.4.3 literally asks for. A list of every script that loads on your payment page, why it is there, and who authorised it.
Build it in twenty minutes. Open your checkout with developer tools on the Network tab and list every JavaScript file and every third-party domain contacted. Then write a line for each: what it is, which plugin loads it, and what business reason justifies it on a payment page. The exercise is uncomfortable in a useful way, because almost every store finds a chat widget, a heatmap tool, or an advertising pixel running on the checkout for no reason anyone can now recall. Remove those, and both your compliance position and your checkout performance improve at once. Then repeat it after any plugin change, which is what “ongoing” means in the requirement.
- Price: Free
- Store fit: Directly addresses requirement 6.4.3
- Best for: Every store, before buying anything else
- Watch out for: It must be repeated, not done once
Comparison table
| Option | Price | Detection window | Cleanup | Change detection |
|---|---|---|---|---|
| Sucuri | $229 to $549/yr plus firewall | Continuous | Unlimited, 6 to 30 hour SLA | Yes, file integrity |
| MalCare Fortify | $499/yr | Hourly scans | Unlimited, 6-hour response | 60-day activity logs |
| Patchstack | $69/mo | Pre-emptive, 48h ahead | No | No |
| Wordfence Premium | $149/yr per site | Scheduled scans | Higher tiers only | Security audit log |
| Real-time backup | From $499/yr | Not applicable | Restore, not clean | No |
| Script inventory | Free | Manual, on change | No | The requirement itself |
A store’s actual checklist
Six measures, ordered by how much they reduce risk per pound spent.
- Inventory your checkout scripts and delete the ones with no business reason. Free, addresses 6.4.3 directly, and usually speeds up your checkout as a side effect.
- Enforce two-factor on every account that can reach orders or settings. A stolen administrator password is the shortest route to a skimmer, and no firewall detects a valid login.
- Move to real-time or hourly backups with long retention. Nightly backups on a store discard a day of orders, and short retention cannot reach back past a slow-discovered compromise.
- Put a firewall in front of the site, not only inside it. Edge filtering stops injection attempts before they reach the checkout and absorbs the traffic spikes that accompany campaigns.
- Buy a cleanup response time that matches your revenue. Work out hourly revenue, then decide whether six hours against thirty is worth the difference. Usually it is.
- Restrict administrative access by country if you sell in one market. Crude, free with most firewalls, and removes an enormous share of hostile login traffic.
Add one habit: after every plugin installation or update that touches the checkout, reload the payment page with developer tools open and confirm nothing new is loading. That is the ongoing verification 6.4.3 asks for, and it takes two minutes.
Related guides
Frequently asked questions
Does WooCommerce store card numbers?
Not with a modern gateway, which is the point of redirect and iframe integrations. You do store names, addresses and order history, which is a serious privacy exposure even though it is not cardholder data.
Do 6.4.3 and 11.6.1 apply to me?
They became mandatory on 31 March 2025 and apply in full under SAQ A-EP and SAQ D. SAQ A merchants using redirects or iframes are not automatically exempt, because the parent page loads the scripts. Confirm with your acquirer.
How would I know if a skimmer was running?
Usually you would not, which is the problem. It produces no visible symptom by design. Change detection on the payment page and frequent scanning are the controls, which is exactly why the requirements specify them.
Is a security plugin enough for PCI compliance?
No. Compliance is a process covering people and documentation as well as software. Plugins support specific requirements; they do not deliver compliance, and any vendor implying otherwise is overselling.
Should I block countries I do not ship to?
Block administrative access, certainly. Blocking front-end access entirely also blocks travelling customers and some search crawlers, so restrict wp-admin and the login page rather than the whole site.
How many security plugins should I run?
One firewall, not two, since overlapping firewalls conflict and slow the site. Layering an edge firewall with vulnerability intelligence and a separate backup product is sensible; running three plugins that each want to filter requests is not.
The verdict
For most stores: Sucuri, choosing the tier by what an hour of downtime costs you, and budgeting for the separate firewall at $9.99 or $19.98 a month. Unlimited cleanups with a defined SLA is the right shape of protection for a business that loses money while broken.
If the detection window is what worries you: MalCare Fortify at $499 a year, for hourly scans, a six-hour response and 60-day activity logs.
On a smaller budget: Wordfence Premium at $149 a year, using the audit log and country blocking deliberately, paired with real-time backups because nightly ones discard a day of orders.
And do the free thing this afternoon. Open your checkout with developer tools and list every script loading on it. Most stores find something on their payment page that has no business being there, and removing it improves compliance and conversion at the same time.
