Before the holidays, check your checkout page
Card skimmers hide in online shops’ checkout code. A short list to make sure yours only runs what you expect.
The busiest shopping weeks of the year are also the busiest for card skimming. Groups known as Magecart inject JavaScript into checkout pages, often through a hacked plugin or a third-party script, and copy card details as customers type them.
The shop keeps working. Customers find out weeks later from their bank.
For anyone running an online shop:
- Update the platform and plugins, and remove plugins you don’t use.
- MFA on the shop admin and hosting accounts.
- Keep the checkout page lean: fewer third-party scripts means fewer ways in.
- Use a Content-Security-Policy that limits where scripts load from and where data can be sent.
- Use the payment provider’s hosted fields or redirect, so card data never touches your page.
- Monitor the checkout page for changes to its scripts.