Security
Protecting the admin, screening fraudulent orders, and the content security policy.
Three separate protections, for three different risks.
Protecting the Admin
Staff accounts are the first line. One account per person, the narrowest role that lets them work, and deactivated the day somebody leaves. See Staff and Roles.
Two factor authentication is worth requiring for anybody who can move money or change where it goes, which means super admins and admins.
Settings, IP Allowlist restricts admin access to named addresses. That is strong protection and a good way to lock yourself out, so add your own address first, confirm it works from a second device, and keep a route back.
An allowlist is only safe if your address is stable
Home broadband addresses change. If yours does, you will be locked out at some point, usually at the least convenient moment. Make sure at least one other person can get in, or do not use it.
Fraud Screening
Settings, Fraud Screening scores orders on signals such as mismatched billing and delivery addresses, unusual order values, and repeated failed payments from the same source.
A flagged order is not blocked, it is marked for you to look at. That is deliberate: automatic blocking refuses real customers, and a false refusal costs more than a review.
The signals worth paying attention to are a delivery address far from the billing one, several failed attempts followed by a success, and an unusually large first order from a new account.
Content Security Policy
Settings, CSP controls which external scripts your shop is allowed to load.
The point is that a script you did not add cannot run. The cost is that a script you did add will not run either until it is allowed.
If an analytics tag or chat widget is not working, look here first
A blocked script fails silently on the page and reports an error only in the browser console. This is the usual cause of a tag that is correctly installed and still not firing.
Add the domains your tools need, rather than relaxing the policy wholesale.
Customer Accounts
Passwords are stored in a form that cannot be read back, by you or by the platform. Customers reset their own.
Nobody should ever be asked for their password by you, and your staff should know that, because the most effective attack on a small shop is somebody telephoning and asking.
Payment Details
Card numbers never reach your shop. They go to the processor, and what the shop keeps is a token that is useless anywhere else.
That is why nobody can read a card back, including for a refund, and why a customer with an expired card has to supply a new one themselves.
Backups
Utilities, Database Backup takes a copy of your shop's data.
Take one before anything large: an import, a bulk edit, a migration, a theme change you cannot easily reverse. Those are the moments when something goes wrong quickly and quietly.
A Sensible Baseline
Individual staff accounts with narrow roles. Two factor on the accounts that matter. A backup before anything bulk. Fraud screening on and actually reviewed. And the CSP left in place rather than disabled the first time something is blocked.