Your store is running. But is it secure?
An ecommerce website can continue processing orders and serving customers while security weaknesses remain hidden in its code, configuration or server environment.
A working checkout, valid SSL certificate and successful external security scan do not tell the whole story. Attackers can combine automated scanning, application fingerprinting and AI-assisted analysis to identify weaknesses in specific software versions and configurations.
There is another risk. An attacker does not always need to break into your website directly. If an administrator's computer or another device with privileged access is compromised, stolen credentials can provide a route into the hosting account or administration panel. From there, malicious files and persistent access may remain even after the original entry point is closed.
Security requires more than checking whether your website is online and responding correctly.
Check your ecommerce platform
Select a supported platform to run a public security assessment of your own website.
Public checks use non-invasive requests. Additional verification requires proof of website ownership or explicit authorization.
osCommerce Security Audit
Check TrueLoaded/Holbi-based and compatible osCommerce installations for known application-level security weaknesses.
- Path traversal and file access
- API authentication weaknesses
- Upload directory execution risks
- Configurator file handling
- Administration vulnerabilities
WordPress & WooCommerce Security Audit
Examine public WordPress endpoints, version disclosure, REST API exposure and common security configuration issues.
- WordPress version disclosure
- Login and administration exposure
- XML-RPC availability
- REST API user enumeration signals
- Upload directory listing
How the security audit works
1. Public security fingerprint
Enter your website domain. The scanner examines publicly accessible pages, HTTP headers and application signals to identify the platform and relevant endpoints.
2. Platform-specific checks
The collected information is compared against our security check registry. Each check has a defined target, evaluation rule, severity and remediation guidance.
3. Authorized verification
Some application-level vulnerabilities cannot be confirmed from public information. Extended verification is designed for website owners who can prove control of the domain.
4. Remediation
If a security issue is confirmed, Re{code} Commerce can investigate the affected components, implement patches and help secure your ecommerce environment.
Why standard security scans are not enough
Traditional vulnerability scanners identify many known issues. However, their results depend on the checks they perform and the application behaviour they can observe.
An ecommerce application may contain an unsafe image-processing endpoint, a hardcoded API key, an executable upload directory or an administration function that processes attacker-controlled input. These weaknesses can exist inside application-specific code and require more targeted investigation.
Our work on legacy ecommerce systems has involved precisely these kinds of problems. We use verified findings from real security investigations to expand the checks available in this tool.
Security is an ongoing process
Closing an external vulnerability does not automatically establish that an incident is over. If an attacker previously obtained privileged access, modified application files or installed a backdoor, those changes may remain.
A deeper security investigation may need to examine:
- Unexpected changes to application files.
- Unknown or recently created administrator accounts.
- Suspicious database modifications.
- Unexpected scheduled tasks and server processes.
- Exposed credentials and reused API keys.
- Access through compromised administrator devices.
These activities require access to the application, server or relevant administrative systems. They are outside the scope of a public passive scan.
Frequently asked questions
Can I scan any ecommerce website?
The public checker can examine publicly available signals on supported platforms. It is intended for owners assessing their own stores. More intrusive verification requires ownership confirmation or explicit authorization.
Does a clean report mean my store has not been hacked?
No. It means the scanner did not identify the issues covered by its current public checks. It cannot establish that the server is malware-free or that no backdoor exists.
Can the scanner find backdoors?
The public version does not perform filesystem malware analysis. Detecting backdoors requires access to application files, comparison against trusted code and investigation of suspicious changes.
Are the checks updated?
The check registry is designed to grow as new vulnerability patterns are investigated and verified. New checks can be added without changing the scanner's execution engine.
Can Re{code} Commerce fix identified vulnerabilities?
Yes. We provide application-level security remediation, code hardening and technical investigation for ecommerce platforms.
Contact us to discuss your findings.
Need help securing your ecommerce store?
A vulnerability report is a starting point. If your store has already been targeted, you may need a deeper investigation to establish how access was obtained and whether the attacker left persistent access behind.