WooCommerce security: protect customer and staff sign-ins
WooCommerce security starts with the accounts, not the checkout: a store has customer accounts that anyone can try to sign in to, and staff accounts that reach orders and customer details. BetterShield protects both kinds of sign-in and adds no bot check or form field to the cart or checkout. This guide covers what to set for each kind of account, what to leave alone and how to check it works.
Two earlier guides go deeper on the pieces. Limit login attempts in WordPress without locking yourself out covers the pause that applies to every sign-in, and WordPress two-factor authentication and passkeys: a setup guide covers the second step. This post puts them together for a store.
Quick summary
- A store has two kinds of account to protect: customers, who use My Account, and staff, who use the dashboard.
- The hidden bot check and the sign-in pause cover the WooCommerce My Account forms as well as the WordPress sign-in page. Both are on by default.
- Customers set up two-factor and passkeys themselves on My Account › Sign-in security. Staff can be required to, with Require two-factor of a role.
- BetterShield adds no bot check or form field to the cart or checkout, and it does not count accounts created at checkout against the sign-up limit.
- It has no firewall and does not scan for malware, so it is one part of a store’s security rather than all of it.
Why a store has two sign-in problems
A WordPress site has one sign-in page. A store with customer accounts has two: the WordPress sign-in page and the My Account page, with its own sign-in and registration forms, open to anyone. Scripts that guess passwords, or create throwaway accounts, find the second one as easily as the first. This is a long-known pattern: the OWASP description of credential stuffing explains how reused passwords are tried against one site after another.
The people who run the store are a different group. Staff sign in to the same dashboard as you, where orders, customer details and settings live. Unless you add a second step, a password is all that stands in front of them.
So the work splits in two. For customers, keep the forms quiet and let people strengthen their own sign-in if they want to. For staff, ask for more.
What BetterShield does not touch: the cart and checkout
This comes first because it is the usual worry. BetterShield adds no bot check and no form field to the WooCommerce cart or checkout pages. On those pages it also skips its sampling, checks and housekeeping, and only records security events. The hidden bot check does not check accounts created at checkout, and the sign-up limit never counts them, so a first-time buyer is not slowed down.
What it protects instead is the accounts and code behind the store: the sign-in and sign-up forms on My Account, the dashboard, and the files your plugins ship.
Customers: keep the forms quiet
Three protections cover the customer-facing forms, and all three are already on. You are checking them, not building anything.
- Open BetterShield › Protection › Login & Access.
- Under Sign-in protection, check that Refuse obviously automated submissions and Sign-in attempt limits are on.
- Under Request protection, check that Slow repeated sign-ups is on.
| Protection | What it does on a store | Default |
|---|---|---|
| Refuse obviously automated submissions | An invisible field and a clock on the My Account sign-in and registration forms. A submission that fills the hidden field, or arrives within two seconds of the form, is refused. People see nothing and solve nothing. | On |
| Sign-in attempt limits | After 5 failed sign-ins in 15 minutes from one connection, sign-in from that connection pauses for 15 minutes. The account itself is not locked. | On |
| Slow repeated sign-ups | Refuses a connection’s sign-ups once it reaches 8 within 60 minutes. Covers the My Account registration form where registration is open. | On |
A few details are worth knowing before a customer asks. The pause belongs to a connection, not to a person, so a customer who mistypes five times can still sign in from another network. An automatic lockout notice is sent only for a network the account used within the last 30 days, or when its correct password was used. On a new connection, choose Email Me an Unlock Link on the sign-in screen for an eligible lockout. The hidden bot check cuts bot noise and does not stop a determined, targeted attempt, which is why it sits beside the pause rather than replacing it. The docs for the hidden bot check and sign-in lockouts list every option.
Let customers choose a stronger sign-in
BetterShield adds a Sign-in security tab to My Account, just before Log out. A customer can set up two-factor with any authenticator app, add passkeys and see Where you are signed in, with Sign out everywhere except this device. There is nothing for you to switch on. Two-factor for WooCommerce customers: passkeys and codes walks through what a customer sees and where the passkey button is.
Two limits are worth stating plainly. You cannot require two-factor of every customer: Require two-factor of a role is enforced inside the dashboard, and WooCommerce sends customers to My Account instead, so it never asks them. And passkeys need HTTPS; a customer signs in with one on the site’s own sign-in page, which shows the Sign in with a passkey button. Two-factor and passkeys explains the screen.
Staff: put a second step in front of the dashboard
Staff are where a requirement belongs. Under BetterShield › Protection › Two-Factor, Require two-factor of a role asks every account in the roles you tick to set up an authenticator app.
- Set up two-factor and add a passkey for your own account first.
- Open BetterShield › Protection › Two-Factor and tick the roles under Require two-factor of a role.
- Leave Grace period, in days at its default of 14, or set what suits your team.
- Press Save requirement.
We recommend ticking Administrator, Editor and Shop manager on a store, and leaving Customer unticked. The password still signs people in. What waits for them after the grace period is the setup screen, until they finish it. A passkey does not satisfy the requirement, only the app codes do. Before it saves, BetterShield checks your way back in, a working recovery link or an unused printed code, so the requirement cannot be the thing that locks you out. See Require two-factor and Set up recovery.
Keep customers out of wp-admin too
WooCommerce already keeps customers out of the dashboard, and Dashboard lock for customers and subscribers is the matching fix for the rest. It sends chosen roles to the front page when they ask for a dashboard screen, and it never applies to an account that can manage the site or has work in the dashboard. On a store the doc recommends Customer, and notes that WooCommerce already sends customers to its own account page, so applying both is safe but worth checking afterwards. Keep subscribers and customers out of wp-admin in WordPress covers it, with Monitor first to trial it.
What it can break, and how to undo
- A busy shared connection. If many people sign in from one office or school network, one person’s typos can pause sign-in for all of them. Add the network’s fixed address to Always allowed, or press Release now on Lockouts.
- Auto-submit tools. A password manager that fills and submits the form within two seconds is refused once, with a message to wait a second. The second try works.
- Staff who ignore the setup. After the grace period the dashboard sends them to set up two-factor until they do. Untick the role to stop asking, or an administrator can turn two-factor off for one account.
- A real customer paused. The pause ends on its own, with the unlock email, or Release now.
Every one of these can be undone from the same screen: turn the switch off and press Save. With Ask for my password before an action that removes a protection on, that asks for your password.
When something looks wrong during a sale
If you see an account or a file you do not recognize while orders are coming in, Lock the site down, under Protection › Recovery, is the emergency switch. It refuses sign-ins from every account that cannot manage the site, customers included, while the front end and the WooCommerce checkout keep working. Lift the lockdown ends it, and nothing expires on its own. Read Lock the site down before you need it, and if you do get locked out yourself, Locked out of WordPress? How to get back in without FTP is the guide.
Check it is working
- The form. View the source of your My Account page and look for “Leave this field empty”.
- The log. The activity log records “Automated submission refused”, “Sign-in failed” and “Sign-in lockout started”.
- A test. From a phone on mobile data, sign in to a test customer with a wrong password five times. Watch the row appear under Lockouts, then press Release now.
- A customer account. Sign in as a test customer and confirm Sign-in security appears on My Account.
- Checkout. Place a test order. Nothing about it should look different.
Recommended settings
We recommend leaving the three customer-side protections on at their defaults, requiring two-factor of your staff roles, and keeping the grace period short enough that it gets done.
| Account | What we recommend |
|---|---|
| Customers | Defaults for the bot check, the pause and sign-up limits. Tell them My Account › Sign-in security exists. |
| Shop managers, editors, administrators | Require two-factor of a role, with the 14-day default. |
| Your own account | Two-factor and a passkey, set up before you require anything of anyone else. |
Frequently asked questions
Does BetterShield change my WooCommerce cart or checkout?
No. It adds no bot check or form field to the cart or checkout. On those pages it adds no bot check, skips its sampling, checks and housekeeping, and only records security events.
Can WooCommerce customers use two-factor and passkeys?
Yes. Each customer can set up two-factor with any authenticator app, add passkeys and see where they are signed in from My Account › Sign-in security. Passkeys need HTTPS.
Will the hidden bot check get in a real customer’s way?
People see nothing and solve nothing. It refuses only submissions that fill the hidden field or arrive within two seconds of the form. It is on by default, and you can turn it off under Protection › Login & Access.
What happens when a customer gets their password wrong too many times?
By default, 5 failed sign-ins in 15 minutes from one connection pause sign-in from that connection for 15 minutes. The account is not locked, and an automatic lockout notice is sent only for a network the account used within the last 30 days, or when its correct password was used. Otherwise the sign-in screen offers Email Me an Unlock Link for eligible lockouts.
Does BetterShield scan the store for malware or vulnerable plugins?
It does not scan for or remove malware. Vulnerability checks are optional. With consent in Settings, BetterShield asks BetterShield Hub for published advisories using Wordfence Intelligence data and matches versions on your site. No Hub account or paid license is required. A failed refresh is shown as unavailable or stale, never as a clean result.
Conclusion
A store’s security is mostly its accounts: customers who can strengthen their own sign-in, and staff who should have a second step. Leave the three customer-side protections on, require two-factor of your staff roles and check each change with a test account.
BetterShield is free on WordPress.org. The docs cover each part: Hidden bot check, Sign-in lockouts and Keep subscribers and customers out of the dashboard. The WooCommerce use case shows the whole picture for a store.