Authorised no-login checklist

WooCommerce Security Snapshot checklist

A practical checklist for preparing public WooCommerce, Stripe webhook, checkout-adjacent and API surfaces for a fixed-scope Security Snapshot.

Built for systems using WooCommerce, Stripe, webhooks, WordPress, public checkout paths and API integrations. It helps you prepare evidence and boundaries; it is not a live scan or a full pentest.

View Sample Report Request Scope Approval — £99

Use before launch or handoff

Prepare approved route hints

Keep scope written and bounded

Route into evidence-backed review

Review preparation

Check the surfaces that usually create public WooCommerce risk.

This checklist is built to prepare a Security Snapshot. It does not ask you to run attacks, handle credentials or change checkout state.

Public store exposure

Confirm the obvious public store risks are either controlled or ready for review evidence.

Public backup, export, archive and database-like files are not accessible
Directory listing is disabled on upload, cache, backup and plugin-adjacent paths
Debug files, logs, readme files and version banners are not exposing unnecessary context
Admin, login, XML-RPC and REST routes are understood before testing starts

Checkout and payment surface

Check the public checkout-adjacent surface without changing orders, payments or customer state.

Checkout, cart, account and payment pages are in the approved public scope
Public parameter and response behaviour can be observed safely
Redirect, cache and error handling signals are documented for review
Any production testing boundaries are written down before work starts

Stripe and webhook boundary

Make webhook routes easier to review without pretending the checklist is a live security test.

Stripe webhook paths and WooCommerce payment webhook routes are identified
Invalid-signature behaviour can be reviewed using safe dummy requests only when authorised
Webhook error messages avoid leaking secrets, stack traces or implementation details
Payment Rescue Review is separated from broader Security Snapshot scope when order-state evidence is the main issue

API, docs and source evidence

Bring route hints and public documentation into the review instead of leaving coverage vague.

OpenAPI, Swagger, GraphQL or public API documentation exposure is known
Source maps and client-side config files are reviewed for public exposure signals
Security headers, TLS posture, CORS and cookie signals are visible for the approved hostnames
Route hints, staging notes and known exclusions are prepared for the reviewer

Report and retest readiness

Prepare for a useful evidence-backed report and a clean before/after fix verification pass.

Owner, agency or technical contact is ready to approve written scope
Known sensitive areas and excluded paths are documented before testing
Recommended fixes can be handed to the developer or agency responsible for the store
Retest proof can compare fixed, still-present and limited-by-coverage findings

This checklist is preparation, not proof.

Security Snapshot evidence comes from the authorised review window. The checklist helps you collect routes, boundaries and context so findings, limitations and retest proof are clearer.

Example finding — sample evidence format

How checklist items turn into report evidence

The report separates evidence from recommendation. This sample shows the format only; it is not a claim about your store or a previous customer.

Issue

Public backup file exposure

A backup-like archive appears reachable from a public upload path.

Sample proof format

GET /wp-content/uploads/backup-example.zip
HTTP/1.1 200 OK
Content-Type: application/zip
Content-Length: 1250452

Risk

Sensitive files may be recoverable from public storage paths.

Fix path

Remove public access, review storage rules and retest the URL.

Guardrails

Keep the review safe and bounded.

These boundaries protect your store, your customers and the quality of the evidence.

Authorised public scope only

No credential attacks by default

No destructive testing

No data exfiltration

No hidden changes

Written approval before any credentialed testing

Next step

Turn the checklist into evidence-backed review.

Start Launch Snapshot if the scope is clear, view the sample report if you want to see the output, or use Scope Approval first if you want the target checked before committing.

View Sample Report Request Scope Approval — £99

WooCommerce Security Review Stripe webhook security review Security Snapshot

Security Snapshot is an authorised external security review. It is not a penetration test, Cyber Essentials assessment, PCI ASV scan, legal opinion or certification. Findings reflect the agreed scope and test window only.