Shopify is the ecommerce platform of choice if you want to create an optimized, high-performing, and scalable ecommerce website. Shopify invests significant time and money to ensure its platform is compliant and secure. All stores powered by Shopify are PCI compliant by default so you can keep payment info and business data safe. However, as with any SaaS website or online store, there are no guarantees when it comes to cybercrime and business continuity.
Your Shopify data could be lost, compromised, or rendered unavailable in multiple ways. Human error, a buggy third-party app, or a corrupt CSV file could trigger a data loss disaster, causing unwelcome and protracted downtime for your Shopify store.
Relying on Shopify to protect your data and business continuity can only go so far. Like many SaaS platforms, Shopify operates under the Shared Responsibility Model, which means while it’s conscientious about attending to any platform-related issues speedily, the onus is on customers to back up and restore their account-level data via a third party. Shopify cannot restore individual store data and doesn’t guarantee 24/7/365 uptime for its platform. It states it has “maintained a 99.99% uptime as a platform, calculated for all major Shopify services, in all geographic regions, for the past 90 days,” but that doesn’t constitute a binding SLA.
Moreover, in the Limitation of Liability and Indemnification section of its terms of service, Shopify states: “You expressly understand and agree that, to the extent permitted by applicable laws, Shopify and its suppliers will not be liable for any direct, indirect, incidental, special, consequential or exemplary damages, including but not limited to, damages for loss of profits, goodwill, use, data or other intangible losses arising out of or relating to the use of or inability to use the Service or these Terms of Service (however arising, including negligence).”
This article will consider the steps for building a comprehensive, proactive security and business continuity strategy for your Shopify store.
Audit who has access and what they have access to
Shopify allows you to grant your employees specific permissions. You can assign different access levels and be precise about which parts of your store each staff member can view and or/modify.
Keep your team members’ access rights as limited as possible. Follow the “least privilege” principle, granting employees access only to what they need to do their job. For example, a marketing manager or designer shouldn’t have access to your IT team’s dev environments, and your devs shouldn’t have access to marketing spaces such as email campaigns. Other best practices to consider include:
- Only granting sensitive permissions (such as access privileges to private store and customer data) to a few trusted team members.
- Removing departing employees’ access as soon as they leave your company or their contract ends.
- Regularly auditing your permissions to ensure they align with the least privilege principle. Regularly audit your apps too! Remember, it’s not just people who have access to your store; apps can also execute commands. Check what apps have what permissions. Why do they need those permissions?
Implement two-factor authentication
If you use Shopify Payments to accept customer payments, activate two-step authentication on your account. Two-step authentication provides a double layer of security and helps prevent breaches that can lead to misdirected payouts and other financial losses. Be sure to set up two-factor authentication for all accounts with access to your store’s login credentials, including connected third-party apps.
Failing to implement two-step authentication will render your account less secure, and your payouts could be placed on hold. To further bolster the security of your Shopify account, select the Authenticator App rather than the less secure SMS messaging option.
Always test theme updates on a staging environment
Mistakes can happen when it comes to development and site upgrades – and they can be costly and time-consuming to unravel. Shopify Plus users get nine additional stores; other users can set up a separate Shopify store entirely. This option lets you keep access to your live theme even more restricted, limiting your exposure to bad actors.
Staging environments are even better, essentially offering your devs a secure “sandbox” environment to innovate at will. As these environments are entirely self-contained, any experiments they make that don’t turn out as planned won’t impact your production store. However, once you’re confident that it’s good to go, you can auto-sync updates from the staging environment to your live store. Staging stores allow you to:
- Quickly and easily create a copy of your store to act as a staging environment.
- From product images to metadata, all aspects of your store will be copied.
- Easily preview changes and give feedback.
- Deploy changes to live store quickly and easily.
Set up proactive store monitoring
All too often, Shopify store owners only find out about site performance issues when significant damage has been done (think frustrated customers and countless abandoned carts!)
Fortunately, proactive store monitoring software such as Rewind Monitor can work behind the scenes 24/7, verifying that everything is running smoothly and customers can check out. (Rewind Alerts is part of Rewind’s “all in one” store security suite, known as Protection Suite.) The alert system will flag both “soft downtime,” which affects only certain parts of your store, and “hard downtime,” which is when your entire store’s functionalities are compromised. It notifies you of service disruptions via email and Slack and then again once the issues are resolved. By catching service impacts quickly, you can:
- Avoid customer frustration and revenue loss by finding a fix or alternative quickly, such as restoring product pages from a backup, temporarily hiding a third-party app that’s having issues, or offering alternative payment methods (in the case of a payment type or Shopify POS outage).
- Prevent wasted ad dollars, email, and SMS sends by pausing campaigns to a non-functioning store or checkout.
- Communicate with customers proactively about service impacts.
- Prepare customer-facing teams when there are issues with functionality.
Check the security practices of your apps
Most ecommerce owners deploy multiple third-party apps to enhance their website’s user experience and functionality. But a word of caution: all apps aren’t created equal from a security perspective, so be careful about which ones you leverage. Look for apps that:
- Display registered support numbers.
- Operate well-maintained websites.
- Offer extensive help/knowledge/documentation resources.
- Can prove that they’re verified apps.
- Is up to date with security compliance audits like SOC 2.
- Have numerous positive reviews on app stores.
- Don’t ask for permissions they don’t need.
- Clearly explain why they need specific permissions.
- Have a verified team/company behind them; anonymity with respect to company ownership and location could indicate potential security risks.
Be on the alert for suspicious changes
Keep on the lookout for any unauthorized or fraudulent changes made to your site. These changes could include unauthorized user activity, a CSV upload with errors, the installation of a buggy or incompatible third-party app, or even a cybersecurity incident.
Automated alert software can act as your eyes and ears in this respect. Rewind Alerts, for example, will notify you if it detects a suspicious amount of product updates on your store, and you can decide what constitutes “suspicious” for you. For example, if you rarely make product changes in your store, you might want to set a low alert threshold.
Rewind Alerts:
- Notifies you via email or SMS of bulk product changes that took place over 24 hours.
- Shares logs of product changes so you can investigate and verify that the changes were intentional.
- Allows you to mark alerts as “resolved” so your team knows all is well.
Monitor your site’s performance
Ideally, you should also deploy software (such as Rewind Monitor) that helps you catch downtime or broken functionalities before they become lost revenue. These tools actively monitor any impacts on your store’s performance, so you can act swiftly and keep your checkouts flowing.
Deploy a third-party backup solution
Ensure you have a reliable backup running to protect you in the unfortunate event of data loss resulting from malware, third-party apps, bad CSV uploads, or human error.
A solution like Rewind Backups can prevent data loss or corruption from leading to extensive downtime. It also gives you diverse backup options. You can perform incremental backups to fix smaller errors and a full recovery backup if your disaster is store-wide or all your store data has been lost or corrupted.
Securing your Shopify data
Facing unexpected data loss or downtime can be a Shopify store owner’s worst nightmare. By taking the steps outlined above, you can ensure your valuable data is safe and your store remains operational.
Larissa Hildebrandt">
