Is Your Online Store Ready for Black Friday?

Yes, you can check the basics of your store's security in about 10 minutes with free tools: confirm your HTTPS certificate is healthy, your browser security headers are set, your email is protected by SPF and DMARC, and no forgotten subdomains are exposed.

This guide is for owners of small online stores (WooCommerce, Shopify, custom builds) who want a quick "is my online store secure?" answer before a big sale. You will get a timed checklist, copy-pasteable commands, and the exact values to look for. You do not need to be technical. If a step does not apply to your platform, skip it and move on.

Why run a store security check before a sale

Sales bring more visitors, more orders and more emails. That is the worst time to find an expired certificate, a broken checkout page or a spoofed email pretending to be you.

Fixing small problems now also means you are not changing settings in the middle of your busiest week. A website security check before a sale is cheap insurance for your launch.

The 10 minute checklist at a glance

Minutes 0 to 2: run the free scan

Start with the free website security check. It is a passive check, which means it only looks at what your site already shows the public. It does not attack anything, and it needs no card or login.

Keep the results open in a tab. You will use them as a to-do list as you work through the next steps.

Minutes 2 to 4: check HTTPS and your certificate

HTTPS is the padlock in the address bar. It encrypts the traffic between your customer and your store. It relies on a certificate (a digital ID for your domain) that expires on a set date. If it expires during your sale, browsers show a scary warning page and most shoppers leave.

Do this:

1. Open your store in a private browser window. Click the padlock and view the certificate. Note the expiry date.
2. Type http://yourstore.com (without the s). It should jump to https:// automatically.
3. Check the expiry from a terminal if you like:

echo | openssl s_client -connect yourstore.com:443 -servername yourstore.com 2>/dev/null | openssl x509 -noout -dates

Look at the notAfter line. If it is less than 30 days away and auto-renew is not clearly on, renew now. If auto-renew is on, a date that close can be normal, because some certificates, such as Let's Encrypt, are usually renewed automatically about 30 days before expiry. Just confirm the last renewal actually worked. Shopify manages certificates for you. On WordPress hosting, check your host's SSL panel and confirm auto-renew is on.

Also browse your product, cart and checkout pages. A "mixed content" warning means a page on HTTPS still loads an image or script over plain HTTP. Fix those links so they use https://.

Minutes 4 to 6: check your security headers

Security headers are short instructions your server sends to the browser, such as "only load this site over HTTPS" or "do not let other sites put my page in a frame." They are a cheap layer of protection against common browser-side attacks.

Paste your domain into our security headers tool, or look yourself:

curl -I https://yourstore.com

Here are the headers worth knowing:

Two cautions. First, add includeSubDomains to the HSTS header only if every subdomain supports HTTPS, or you can lock yourself out of some. Second, do not copy a Content-Security-Policy from the internet into a live store. A strict one can break your checkout, payment widgets and analytics. Test it first using the Content-Security-Policy-Report-Only header, which reports problems without blocking anything.

On WordPress, your host or a plugin such as Really Simple Security can set several of these. On Shopify you cannot change most response headers, so focus your time on the other steps. For the reasoning behind each header, see the OWASP Secure Headers Project and the MDN guide to HSTS.

Minutes 6 to 8: check SPF and DMARC for your store email

Your store sends order confirmations, shipping updates and promos. Attackers can try to send fake emails that look like they come from your domain, for example a fake "problem with your order" message. Two DNS records (settings for your domain) help receiving mail servers spot the fakes:

• SPF lists which servers are allowed to send email for your domain. It is defined in RFC 7208.
• DMARC tells receivers what to do when a message fails the checks, and sends you reports. It was first defined in RFC 7489. That page shows whether a newer RFC has updated or replaced it.

Run our email spoofing tool, or check by hand:

dig +short TXT yourstore.com
dig +short TXT _dmarc.yourstore.com

What you want to see:

• Exactly one record starting with v=spf1. Two SPF records break SPF. An example for a store using Google Workspace looks like this: v=spf1 include:_spf.google.com ~all. Your email and marketing tools (Google Workspace, Microsoft 365, Klaviyo, Mailchimp, Shopify) each need their own SPF or DKIM records. Check each tool's docs for the exact SPF/DKIM records it needs. Use theirs, not a guess.
• A DMARC record at _dmarc.yourstore.com. A safe starting point is a TXT record with this value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourstore.com.

The p=none policy only monitors. It blocks nothing, so it is safe to publish today. Read the reports for a few weeks, fix any legitimate sender that fails, then move to p=quarantine and later p=reject. Jumping straight to reject can send your own order emails to spam if one sender is set up wrong.

This is also good practice for deliverability. Google's email sender guidelines require authentication such as SPF, DKIM and DMARC for bulk senders, and promo-heavy weeks are when you want your emails to land in inboxes.

Minutes 8 to 10: look for forgotten subdomains

A subdomain is a prefix on your domain, like staging.yourstore.com or old.yourstore.com. Stores often create test copies and then forget them. Old test sites can run outdated software, use weak passwords or hold real customer data, and nobody is watching them.

You can list subdomains that have ever had a public certificate using certificate transparency logs (public records of issued certificates). Open this in your browser, replacing the domain:

https://crt.sh/?q=%25.yourstore.com

crt.sh only shows subdomains that have had a public certificate. Sites that use a wildcard certificate or only a plain HTTP/self-signed setup may not appear, so also review the DNS records in your domain registrar or DNS host.

Scan the list for names like dev, test, staging, old, beta, admin or backup. For each one you find, ask:

1. Do I still use this?
2. If no, delete the site and remove its DNS record.
3. If yes, is it updated and behind a login or an IP allow-list?

Even a subdomain you recognize needs the three questions above, because a known but neglected site can be just as exposed. For any name you do not recognize, ask your developer or host about it.

Quick store extras that take a few more minutes

These are outside the 10 minutes but matter before a sale:

• Turn on two-step login (MFA) for every admin and staff account. CISA explains why it blocks most simple account takeovers.
• Update WordPress, WooCommerce, your theme and plugins. Outdated plugins are a common way into small stores. Take a backup first, and test checkout after updating.
• Remove old admin accounts for former staff, freelancers and agencies.
• Use a hosted payment page (Stripe Checkout, PayPal, Shopify Payments) so card numbers never touch your server. The PCI Security Standards Council publishes the card data rules.
• Do a test restore of your latest backup, or at least confirm one exists.

What a 10 minute check cannot tell you

Be honest with yourself about the limits. These checks look at the outside of your store and its settings. They cannot tell you whether someone can change another customer's order by editing a URL, skip a payment step, abuse a discount code, or exploit a flaw in a specific plugin.

Finding those problems takes a person who tests the way an attacker would. If you want to understand where that line sits, read is my website hackable. No checklist can make a store "100% secure," but fixing the basics removes the easy wins.

Key takeaways

• Run the free website security check first, then work through certificate, headers, email and subdomains in about 10 minutes.
• Make sure your certificate is not close to expiring and that auto-renew is clearly on. If it is not, renew it by hand.
• Publish one SPF record and a DMARC record starting at p=none, then tighten over time.
• Delete forgotten staging and test subdomains, and turn on MFA for every admin.
• Do this a week or two before your sale so you have time to fix what you find.

Next step: have a person look at your checkout

If the checklist turns up questions, or you want to know whether your checkout and admin area hold up, a human audit is the honest next step. Our Circuit audit is $49 one-time: a real security engineer manually tests your site and sends a written report with severity, evidence and exact fixes. It is a focused small-site audit, not a multi-week enterprise pentest or a compliance certificate. See the pricing page for details.