5 Essential E-commerce Security Features Your Website Needs

Imagine finally buying the car of your dreams. You worked extremely hard for it, and it cost you a great deal of money. You park it on the street, leave the keys on the seat and walk away. Is it still there when you come back? Not a chance.

Now imagine finishing the website you have spent months and a serious budget building. It is the version you wanted, and it represents your business to every customer who finds it. Cyber crime is a global problem, and businesses that take payments online are among its favourite targets, wherever they happen to be.

Security is usually the last thing anyone wants to think about while a site is being built, and it is the thing that decides whether everything else you have invested in survives its first bad week. The five features below are the ones worth getting right, and none of them is difficult to understand.

What e-commerce security means

E-commerce security is the set of practices that protect the transactions a website handles. It exists to protect customers and businesses alike from threats such as card fraud, scams and malware.

Your customers want to know they can trust your site

Online customers are more aware of online threats than they used to be, and careful buyers look for signs that a site takes security seriously before they hand over their details. If your website is not safe and secure, the money you have spent on marketing goes out of the window. Nobody wants their card details stolen, and nobody wants to be scammed.

Here are five security features that matter for a business website that takes payments or handles personal information.

1. Serve every page over HTTPS

This one is easy to check. Look at the address bar: you will see either http or https in front of your domain, and most browsers now mark a plain http address as not secure.

HTTPS is the encrypted version, and the certificate behind it is what makes the encryption possible. The underlying protocol is now properly called TLS, though the certificate is still almost always described as an SSL certificate. With plain HTTP, information is not encrypted at all: it travels as plain text, which means anyone able to intercept it can read what was sent.

That is why browsers and customers alike treat an http address with suspicion, and why it is worth having on every page rather than only the ones that collect details.

What it does not do: HTTPS protects information while it travels between the visitor and the site. It says nothing about whether the software behind the site is up to date, or whether the people running it are careful with their passwords. The certificate is the start, not the finish.

2. Handle card payments through a provider built for it

If your site takes card details, the safest arrangement is one where the card numbers never pass through your own server. Hosted payment pages and payment fields supplied by a payment provider keep that data inside systems designed for it, and tokenisation means a repeat payment can be taken without storing the card number at all.

Every business that accepts card payments works under the card industry's own data security standard, known as PCI DSS, which sets out how card details are to be handled, transmitted and stored. Your payment provider will expect you to meet it, and it is far easier to satisfy when the card data was never sitting in your database in the first place.

The card verification value is part of the same picture: the three or four digit code printed on the card, which a criminal who has the number but not the card itself will not be able to supply. The extra verification step that sends an online customer to their own bank's app or page does a similar job, by confirming that the person paying is the person the card belongs to.

What it does not do: handing card payments to a provider takes the card numbers off your site. It does not take away the need to keep the rest of the site secure, and a compromised login is still a compromised login.

3. Keep the site's software maintained, and watch what changes

Websites run on software: a platform, plugins or modules, themes and libraries. Out-of-date software is one of the most common ways in, because once a vulnerability is publicly known, anyone with the tools and the inclination can go looking for the sites that have not applied the fix.

The practical version of this is dull and effective. Apply security updates promptly, remove anything you are no longer using, and keep a list of what the site depends on so you know what needs watching. Scanning for malware is the companion habit: a scan looks for code that should not be there, and monitoring notices when something about the site changes without your involvement.

What it does not do: patching closes the holes somebody else has already found and published. It will not protect you from a flaw nobody knows about yet, or from a mistake in custom code, and monitoring only helps if somebody is watching and able to act on what it reports.

4. Control who can get in

Most websites have more ways in than their owner remembers: an administrator login, hosting and domain accounts, email accounts, a database, and perhaps a former contractor's account that was never removed.

Limit the accounts that can change the site to the people who genuinely need that access, remove accounts when people leave, use long unique passwords held in a password manager rather than reused across services, and turn on two-factor authentication wherever it is offered. If your website, your hosting and your email all sit behind one password that is also used elsewhere, one leak becomes three problems.

What it does not do: good access control keeps the front door shut. It is far less useful if somebody can be talked into opening it, which is exactly what the extra step on the accounts that can change a site is for.

5. Back up, and know how you would recover

A backup is only worth having if it can be restored. Backups taken automatically and regularly, stored somewhere other than the site itself, and tested by restoring one now and then, turn a disaster into an inconvenience.

Your hosting or platform may well provide backups already. It is worth knowing exactly what they cover, how far back they go, and how long a restore takes. A backup that has never been opened is a hope rather than a plan.

What it does not do: backups do not stop anything from happening. They decide how the story ends, and the ending is a great deal worse if the copy you are relying on was taken three months ago.

None of these is a guarantee

Each of the five is a layer, and none of them is a guarantee on its own. Encryption in transit does not patch your software, patched software does not protect a careless password, careful passwords do not help if nobody notices that something has changed, and monitoring is only worth paying for when somebody acts on it.

The reason to do all five is that they cover for each other. A site that does them consistently is a much harder target than one that does not, and it is also a site that can show a customer it takes their details seriously.

Which brings us back to the car. Locking the door is sensible, and locking the door is not the whole of the protection: the alarm, the immobiliser, the insurance and where you choose to park all do their part, and none of them is much use on its own. That is the same idea as the five above, in a different form.

You have just pulled up to work in your beautiful Lamborghini in Giallo Corona yellow. You lock the door and glance back to admire the craftsmanship as you walk into the office. Your prized possession is waiting for you when you finish work.

You worked hard on your website, and you should protect what is yours. The same thinking applies to how it was built in the first place, which is what our website design and development work covers. If you would like to talk through how your own site handles any of the five, get in touch.