Security

Shops process payment and customer data and are permanently exposed on the internet — they are scanned automatically for known weaknesses. This category covers day-to-day protection: applying security updates promptly, hardening server and application, access protection with strong methods and two-factor authentication, permissions for editors and service providers, protection against bot attacks on login and checkout, and detection of malicious code. Added to this is preparation and procedure in an emergency: verifying backups, documenting incidents, knowing reporting duties, resetting credentials. We describe measures that can be sustained with reasonable effort and deliberately avoid promises of absolute security. We additionally cover which traces an attack leaves and how to tell whether an incident is closed or merely paused.