UK online retailers face GDPR fines, PCI DSS obligations, and increasingly sophisticated skimming attacks. Here's how to protect your customers and your business.
Online shops are among the most attractive targets for cybercriminals because they process payment card data, hold customer personal information, and often run on widely-deployed platforms (WooCommerce, Shopify, Magento) whose vulnerabilities are publicly documented.
The UK's National Cyber Security Centre (NCSC) reported that e-commerce skimming — where malicious JavaScript silently steals card details at checkout — remains one of the most prevalent threats to UK businesses. A single compromised plugin can expose thousands of customer card numbers before the attack is even detected.
Running an online shop in the UK means you are subject to multiple overlapping legal frameworks:
| Regulation | Enforced By | Key Requirement | Maximum Penalty |
|---|---|---|---|
| UK GDPR / DPA 2018 | ICO | Protect personal data with appropriate technical measures | £17.5m or 4% global turnover |
| PCI DSS | Card brands / acquirers | Secure cardholder data environment | Fines + card processing suspension |
| Consumer Rights Act 2015 | Trading Standards | Accurate product descriptions, refund rights | Civil liability |
| NIS Regulations 2018 | NCSC / sector regulators | Incident reporting for essential services | £17m |
For most small UK online shops, UK GDPR and PCI DSS are the two frameworks that directly drive security requirements.
Payment Card Industry Data Security Standard (PCI DSS) applies to any business that accepts, processes, stores, or transmits cardholder data. The current version, PCI DSS v4.0, came into effect in 2024.
For small merchants using hosted payment pages (Stripe, PayPal, Worldpay), your scope is significantly reduced — you never touch raw card data. However, you are still responsible for:
A properly configured CSP header is one of the most effective defences against Magecart-style skimming attacks. It tells browsers which scripts are authorised to run on your pages, blocking any injected malicious code.
Content-Security-Policy: default-src 'self'; script-src 'self' https://js.stripe.com; frame-src https://js.stripe.com
Content-Security-Policy: default-src 'self'; script-src 'self' https://js.stripe.com; frame-src https://js.stripe.com
When loading third-party scripts (analytics, payment widgets), use SRI hashes to ensure the script has not been tampered with:
<script src="https://cdn.example.com/script.js"
integrity="sha384-..."
crossorigin="anonymous"></script>
<script src="https://cdn.example.com/script.js"
integrity="sha384-..."
crossorigin="anonymous"></script>
The majority of WooCommerce and Magento breaches originate from outdated or abandoned plugins. Audit your installed extensions quarterly:
Set up real-time alerts for new admin user creation, file changes in core directories, failed login spikes, and unexpected outbound connections.
Have a written incident response plan. Under UK GDPR, you must report certain personal data breaches to the ICO within 72 hours of becoming aware of them.
WebGuard's security scanner checks over 100 security controls relevant to e-commerce sites, including CSP header presence and configuration, TLS strength, exposed admin panels, sensitive file exposure, and security header completeness. Run a free scan on your shop's domain to get a prioritised list of issues with AI-powered fix instructions.
Free scan, no account required. See exactly which issues affect your site.
Start Free ScanFrom missing security headers to exposed configuration files, these are the vulnerabilities WebGuard finds most frequently — and they're all fixable in under an hour.
WordPress powers 43% of the web and is the most targeted CMS by attackers. This practical guide covers the essential steps to harden your WordPress site against the most common attack vectors.
Passwords alone are no longer sufficient protection. 2FA blocks over 99% of automated account takeover attacks. Here's how to implement it across your website and admin tools.