# WooCommerce security: protect customer and staff sign-ins

WooCommerce security for the accounts behind your store: what to set for customers and for staff, and why BetterShield leaves the cart and checkout alone.

By M Asif Rahman, Oct 21, 2026. Updated Nov 8, 2026.

WooCommerce security starts with the accounts, not the checkout: a store has customer accounts that anyone can try to sign in to, and staff accounts that reach orders and customer details. **BetterShield** protects both kinds of sign-in and adds no bot check or form field to the cart or checkout. This guide covers what to set for each kind of account, what to leave alone and how to check it works.

Two earlier guides go deeper on the pieces. [Limit login attempts in WordPress without locking yourself out](/blog/limit-login-attempts-wordpress/) covers the pause that applies to every sign-in, and [WordPress two-factor authentication and passkeys: a setup guide](/blog/wordpress-two-factor-authentication/) covers the second step. This post puts them together for a store.

## Quick summary

- A store has two kinds of account to protect: customers, who use **My Account**, and staff, who use the dashboard.
- The hidden bot check and the sign-in pause cover the WooCommerce **My Account** forms as well as the WordPress sign-in page. Both are on by default.
- Customers set up two-factor and passkeys themselves on **My Account › Sign-in security**. Staff can be required to, with **Require two-factor of a role**.
- BetterShield adds no bot check or form field to the cart or checkout, and it does not count accounts created at checkout against the sign-up limit.
- It has no firewall and does not scan for malware, so it is one part of a store’s security rather than all of it.

## Why a store has two sign-in problems

A WordPress site has one sign-in page. A store with customer accounts has two: the WordPress sign-in page and the **My Account** page, with its own sign-in and registration forms, open to anyone. Scripts that guess passwords, or create throwaway accounts, find the second one as easily as the first. This is a long-known pattern: the [OWASP description of credential stuffing](https://owasp.org/www-community/attacks/Credential_stuffing) explains how reused passwords are tried against one site after another.

The people who run the store are a different group. Staff sign in to the same dashboard as you, where orders, customer details and settings live. Unless you add a second step, a password is all that stands in front of them.

So the work splits in two. For customers, keep the forms quiet and let people strengthen their own sign-in if they want to. For staff, ask for more.

## What BetterShield does not touch: the cart and checkout

This comes first because it is the usual worry. BetterShield adds no bot check and no form field to the WooCommerce cart or checkout pages. On those pages it also skips its sampling, checks and housekeeping, and only records security events. The hidden bot check does not check accounts created at checkout, and the sign-up limit never counts them, so a first-time buyer is not slowed down.

What it protects instead is the accounts and code behind the store: the sign-in and sign-up forms on **My Account**, the dashboard, and the files your plugins ship.

## Customers: keep the forms quiet

Three protections cover the customer-facing forms, and all three are already on. You are checking them, not building anything.

1. Open **BetterShield › Protection › Login & Access**.
2. Under **Sign-in protection**, check that **Refuse obviously automated submissions** and **Sign-in attempt limits** are on.
3. Under **Request protection**, check that **Slow repeated sign-ups** is on.

| Protection | What it does on a store | Default |
|---|---|---|
| **Refuse obviously automated submissions** | An invisible field and a clock on the **My Account** sign-in and registration forms. A submission that fills the hidden field, or arrives within two seconds of the form, is refused. People see nothing and solve nothing. | On |
| **Sign-in attempt limits** | After 5 failed sign-ins in 15 minutes from one connection, sign-in from that connection pauses for 15 minutes. The account itself is not locked. | On |
| **Slow repeated sign-ups** | Refuses a connection’s sign-ups once it reaches 8 within 60 minutes. Covers the **My Account** registration form where registration is open. | On |

A few details are worth knowing before a customer asks. The pause belongs to a connection, not to a person, so a customer who mistypes five times can still sign in from another network. An automatic lockout notice is sent only for a network the account used within the last 30 days, or when its correct password was used. On a new connection, choose **Email Me an Unlock Link** on the sign-in screen for an eligible lockout. The hidden bot check cuts bot noise and does not stop a determined, targeted attempt, which is why it sits beside the pause rather than replacing it. The docs for the [hidden bot check](/docs/bot-check/) and [sign-in lockouts](/docs/sign-in-lockouts/) list every option.

### Let customers choose a stronger sign-in

BetterShield adds a **Sign-in security** tab to **My Account**, just before **Log out**. A customer can set up two-factor with any authenticator app, add passkeys and see **Where you are signed in**, with **Sign out everywhere except this device**. There is nothing for you to switch on. [Two-factor for WooCommerce customers: passkeys and codes](/blog/woocommerce-customer-two-factor/) walks through what a customer sees and where the passkey button is.

Two limits are worth stating plainly. You cannot require two-factor of every customer: **Require two-factor of a role** is enforced inside the dashboard, and WooCommerce sends customers to **My Account** instead, so it never asks them. And passkeys need HTTPS; a customer signs in with one on the site’s own sign-in page, which shows the **Sign in with a passkey** button. [Two-factor and passkeys](/docs/two-factor-and-passkeys/) explains the screen.

## Staff: put a second step in front of the dashboard

Staff are where a requirement belongs. Under **BetterShield › Protection › Two-Factor**, **Require two-factor of a role** asks every account in the roles you tick to set up an authenticator app.

1. Set up two-factor and add a passkey for your own account first.
2. Open **BetterShield › Protection › Two-Factor** and tick the roles under **Require two-factor of a role**.
3. Leave **Grace period, in days** at its default of 14, or set what suits your team.
4. Press **Save requirement**.

We recommend ticking Administrator, Editor and Shop manager on a store, and leaving Customer unticked. The password still signs people in. What waits for them after the grace period is the setup screen, until they finish it. A passkey does not satisfy the requirement, only the app codes do. Before it saves, BetterShield checks your way back in, a working recovery link or an unused printed code, so the requirement cannot be the thing that locks you out. See [Require two-factor](/docs/require-two-factor/) and [Set up recovery](/docs/set-up-recovery/).

### Keep customers out of wp-admin too

WooCommerce already keeps customers out of the dashboard, and **Dashboard lock for customers and subscribers** is the matching fix for the rest. It sends chosen roles to the front page when they ask for a dashboard screen, and it never applies to an account that can manage the site or has work in the dashboard. On a store the doc recommends Customer, and notes that WooCommerce already sends customers to its own account page, so applying both is safe but worth checking afterwards. [Keep subscribers and customers out of wp-admin in WordPress](/blog/keep-users-out-of-wp-admin/) covers it, with **Monitor first** to trial it.

## What it can break, and how to undo

- **A busy shared connection.** If many people sign in from one office or school network, one person’s typos can pause sign-in for all of them. Add the network’s fixed address to **Always allowed**, or press **Release now** on **Lockouts**.
- **Auto-submit tools.** A password manager that fills and submits the form within two seconds is refused once, with a message to wait a second. The second try works.
- **Staff who ignore the setup.** After the grace period the dashboard sends them to set up two-factor until they do. Untick the role to stop asking, or an administrator can turn two-factor off for one account.
- **A real customer paused.** The pause ends on its own, with the unlock email, or **Release now**.

Every one of these can be undone from the same screen: turn the switch off and press **Save**. With **Ask for my password before an action that removes a protection** on, that asks for your password.

## When something looks wrong during a sale

If you see an account or a file you do not recognize while orders are coming in, **Lock the site down**, under **Protection › Recovery**, is the emergency switch. It refuses sign-ins from every account that cannot manage the site, customers included, while the front end and the WooCommerce checkout keep working. **Lift the lockdown** ends it, and nothing expires on its own. Read [Lock the site down](/docs/site-lockdown/) before you need it, and if you do get locked out yourself, [Locked out of WordPress? How to get back in without FTP](/blog/locked-out-of-wordpress/) is the guide.

## Check it is working

- **The form.** View the source of your **My Account** page and look for “Leave this field empty”.
- **The log.** The activity log records “Automated submission refused”, “Sign-in failed” and “Sign-in lockout started”.
- **A test.** From a phone on mobile data, sign in to a test customer with a wrong password five times. Watch the row appear under **Lockouts**, then press **Release now**.
- **A customer account.** Sign in as a test customer and confirm **Sign-in security** appears on **My Account**.
- **Checkout.** Place a test order. Nothing about it should look different.

## Recommended settings

We recommend leaving the three customer-side protections on at their defaults, requiring two-factor of your staff roles, and keeping the grace period short enough that it gets done.

| Account | What we recommend |
|---|---|
| Customers | Defaults for the bot check, the pause and sign-up limits. Tell them **My Account › Sign-in security** exists. |
| Shop managers, editors, administrators | **Require two-factor of a role**, with the 14-day default. |
| Your own account | Two-factor and a passkey, set up before you require anything of anyone else. |

## Frequently asked questions

### Does BetterShield change my WooCommerce cart or checkout?

No. It adds no bot check or form field to the cart or checkout. On those pages it adds no bot check, skips its sampling, checks and housekeeping, and only records security events.

### Can WooCommerce customers use two-factor and passkeys?

Yes. Each customer can set up two-factor with any authenticator app, add passkeys and see where they are signed in from **My Account › Sign-in security**. Passkeys need HTTPS.

### Will the hidden bot check get in a real customer’s way?

People see nothing and solve nothing. It refuses only submissions that fill the hidden field or arrive within two seconds of the form. It is on by default, and you can turn it off under **Protection › Login & Access**.

### What happens when a customer gets their password wrong too many times?

By default, 5 failed sign-ins in 15 minutes from one connection pause sign-in from that connection for 15 minutes. The account is not locked, and an automatic lockout notice is sent only for a network the account used within the last 30 days, or when its correct password was used. Otherwise the sign-in screen offers **Email Me an Unlock Link** for eligible lockouts.

### Does BetterShield scan the store for malware or vulnerable plugins?

It does not scan for or remove malware. Vulnerability checks are optional. With consent in Settings, BetterShield asks BetterShield Hub for published advisories using Wordfence Intelligence data and matches versions on your site. No Hub account or paid license is required. A failed refresh is shown as unavailable or stale, never as a clean result.

## Conclusion

A store’s security is mostly its accounts: customers who can strengthen their own sign-in, and staff who should have a second step. Leave the three customer-side protections on, require two-factor of your staff roles and check each change with a test account.

BetterShield is free on [WordPress.org](https://wordpress.org/plugins/bettershield/). The docs cover each part: [Hidden bot check](/docs/bot-check/), [Sign-in lockouts](/docs/sign-in-lockouts/) and [Keep subscribers and customers out of the dashboard](/docs/low-privilege-dashboard/). The [WooCommerce use case](/use-cases/woocommerce/) shows the whole picture for a store.