Security checks for Shopify, WooCommerce, and small online stores.
Recurring external security monitoring on the public surface of your store. Card-skimmer indicators, theme and CSP issues, abandoned subdomains, and email authentication gaps. Plain-English findings, written for your web developer or theme developer. No exploitation, no test orders, no replacement for a code review.
Where the risk concentrates for an online store.
Four pressure points specific to selling online: the checkout, the theme, the subdomains, and the sending domain.
Magecart-style attacks inject malicious JavaScript into the checkout page and silently exfiltrate card details. Small Shopify and WooCommerce stores get hit because attackers compromise a third-party theme, app, or supply-chain script. We look for known indicators of skimmer activity on your public pages.
Custom Shopify themes, WooCommerce templates, and BigCommerce stencil edits often ship with reflected-XSS bugs in product reviews, search, or customer-input fields. The attacker uses them to steal session cookies or pivot into the admin. We flag the conditions that make these attacks possible.
Old staging stores (staging.shop.example.com), retired campaign sites, or test storefronts that still resolve in DNS are a real risk. Some still hold real customer email lists or order data. We continuously discover subdomains and flag what should not still be live.
Without SPF, DKIM, and DMARC on the sending domain, order confirmations from your store land in spam, and worse, scammers spoof "your order from acme.com.au" with a fake tracking link. Both kill trust. Email authentication is one of the cheapest fixes and the easiest to verify externally.
The checks that matter for an online store.
We focus on the public surface of your store: the storefront, the checkout page, the domain, email authentication, TLS, and any subdomains or staging copies that still resolve.
Where the line sits.
Honesty about scope is part of the product.
AttackEdge observes the public surface of your store. We do not exploit, brute-force, place test orders, or interfere with the checkout. Nothing we do affects your customers, your orders, or your payment processor.
AttackEdge never asks for Shopify, WooCommerce, or hosting credentials, never reads your orders or customer database, and does not test iOS or Android apps. We only check what your store exposes on the public internet.
A custom Shopify theme or a WooCommerce plugin can have logic bugs we cannot see from outside. If you ship custom code on the checkout, you still need a code review. AttackEdge runs alongside, not instead.
Automated external scanning is not the same as a human-led pen test. If a payment partner or large customer requires a pen test, you still need one. AttackEdge runs in between, weekly or monthly.
Plain-English report, same shape every cycle.
Owner summary first, then prioritised findings, then technical detail and remediation steps a developer can action.
Most ecommerce stores pick SMB.
SMB Monitor at A$99 per month (A$990 per year, two months free) gives you 50 scan units a month, enough to cover the shop, blog, admin and CDN subdomains each month, with headroom for retests and ad-hoc checks. PDF reports on every scan. The Snapshot at A$149 is a one-off baseline if you only need a single PDF before a peak shopping period or a payment-partner audit.
From other online stores.
Does AttackEdge scan our Shopify or WooCommerce admin?
No. AttackEdge is an external scanner. We only check what your store exposes on the public internet (the storefront, DNS, TLS, email authentication, and any subdomains). We do not connect to your Shopify admin, your WooCommerce database, or your hosting console. Your admin credentials are never asked for and never stored.
Will it interfere with our checkout or our customers?
No. We do not place test orders, brute-force forms, or send payloads. The scanner is passive: it requests public pages and reads what is already visible. Customer browsing, checkout, and payment processing are unaffected.
Can I get a report for our PCI assessor or payment partner?
Yes. AttackEdge produces a dated PDF report with the methodology, the findings, and the evidence log on every paid plan. Many payment partners and assessors accept it as evidence of recurring external vulnerability scanning, which is one of the items they ask about. It is evidence, not a PCI ASV scan, and we are not an accredited PCI scanning vendor.
What about our mobile app?
AttackEdge does not test mobile apps. We scan websites, DNS, TLS, and email authentication only. If you ship an iOS or Android app, you need a separate mobile security review for that surface.
We have five brand domains under one parent company. Does that fit?
Probably the SMB plan. Five storefronts plus their typical subdomains (shop, blog, admin, staging, CDN, mail) usually land near fifteen sites scanned monthly, which is the SMB shape at 50 scan units. Add the root domains as workspace assets and let the scanner discover the rest. If your monthly scan volume runs past SMB, the next step is MSP / Agency pricing. Email partners@attackedge.io.
Will this catch a Magecart card skimmer on our checkout?
Sometimes. We compare third-party scripts loaded on your public pages against known-malicious indicators and flag suspicious patterns. If the skimmer uses a known infrastructure or obfuscation pattern, we catch it. If it is novel or hidden behind conditional loading, we may not. AttackEdge is not a substitute for a code review of your theme and apps. The pragmatic answer: it catches the loud cases and gives you a fighting chance against the broad-based campaigns. Treat it as one layer, not the only layer.
Ready to see what your store looks like from the outside?
The free check covers the headline issues on your domain in about a minute. A paid plan adds the full methodology, the evidence log, and recurring scans you can show a payment partner or a PCI assessor.