Card skimming is one of the main payment risks for a WooCommerce store. Attackers add code to your checkout that copies card details while orders still go through. You lower the risk by updating plugins, using strong admin logins with two-factor, running a firewall and keeping clean backups.
Skimming is sometimes called web skimming or Magecart style attack. The cases below come from Sucuri, a security company that publishes its malware analyses. They show what this looks like on real WooCommerce stores.
How card skimming happens on WooCommerce
In a March 2023 write-up, Sucuri analyst Ben Martin described a store whose bank warned that cards used there were later used for fraud. Scans found nothing at first. The timeline pointed to files changed on one date, and those files belonged to a single payment gateway extension. The attacker had added code to a PHP file and to a front end JavaScript file. The script gathered the billing and payment form fields and sent them out through admin-ajax.php, imitating normal WordPress Heartbeat traffic. Sucuri stressed this was tampering with one extension, not a flaw in WooCommerce itself. The report is WooCommerce Credit Card Skimmer Reveals Tampered Plugin.
In a June 2022 write-up, Sucuri found a modified custom JavaScript file in a store's child theme. When a customer clicked "Place order", it sent the checkout data to a fake copy of a WordPress core file, which forwarded it to the attacker through Telegram. The page source looked normal and loaded no suspicious outside scripts. The report is WooCommerce Credit Card Skimmer Uses Telegram Bot to Exfiltrate Stolen Data.
In both cases the skimmer lived in files the store already ran: a gateway extension and a child theme. Both were found after the fact.
Why you may not notice
Orders keep processing. Checkout looks normal. In the 2022 case, customers noticed first, when they reported fraudulent charges shortly after buying from the store. In the 2023 case a bank raised the alarm.
Card skimming rarely shows in your order numbers. The first sign is often a bank, a payment processor or a customer telling you about fraud.
How to check a WooCommerce checkout for injected scripts
- List the scripts. Open your checkout in a browser, open the developer tools, and read the Network tab. Look for domains you do not recognise.
- Verify your files. A WordPress core integrity check compares core files to the official copies. Sucuri's investigator used one to narrow the 2022 case to two modified files. WP-CLI offers
wp core verify-checksumsfor core and a matchingwp plugin verify-checksumscommand for plugins listed in the WordPress.org directory. - Look at what changed recently. Sort your plugin, theme and uploads folders by modified date. A change you did not make, near a payment extension or child theme, deserves attention.
- Check the uploads folder. The 2023 skimmer hid stolen data in an image file in wp-content/uploads. PHP files and odd image files there are a warning.
On EasWrk, WrkMate reads your WordPress files and WooCommerce database, so you can ask it to show your active plugins or your error log. If you find injected code, restore from a clean backup, change every password and ask for help.
Four checks that lower the risk
Four checks lower the risk to your WooCommerce payment security: updated plugins and themes, protected admin logins, a firewall and clean backups. The WooCommerce developer documentation backs the first, the second and the fourth.
- Update plugins and themes. The WooCommerce developer documentation tells owners to review and update them regularly and remove any that are no longer maintained. The plugin guide covers how many to run.
- Protect admin logins. Use strong unique passwords and two-factor login. See how login attacks work.
- Run a firewall. It will not catch everything, but it drops some hostile requests before WordPress loads.
- Keep clean backups. The WooCommerce documentation calls backups essential for recovering from security incidents and recommends storing them off site.
What EasWrk covers, and what it does not
Every EasWrk plan includes a web application firewall, DDoS protection, free SSL and daily backups kept for 30 days, per our WooCommerce hosting page. EasWrk also takes no platform fee on orders. Your payment processor still charges its own fees.
Hosting does not replace updates and careful plugin choices. A firewall cannot promise to catch a skimmer, and no host can. The first two checks above stay with you.
Questions people ask
What is WooCommerce card skimming?
Card skimming is malicious code on your checkout that copies card details as customers type them and sends them to an attacker. Orders still complete. In the two Sucuri cases from 2022 and 2023, the store learned of it from customers reporting fraud and from a bank warning.
How do card skimmers get onto a WooCommerce checkout?
Sucuri's analyses from June 2022 and March 2023 found skimmers in files the store already ran: a modified payment gateway extension and a child theme JavaScript file. Check your payment plugins, child theme files and administrator logins first, since an attacker needs a way to change those files.
How do I check a WooCommerce checkout for injected scripts?
List the scripts your checkout loads in the browser Network tab and look for unknown domains. Then compare core and plugin files with official copies using the WP-CLI checksum commands, and review recently modified files and the uploads folder, where Sucuri's 2023 skimmer stored stolen data.